CODEWITHSUNDEEP
azureazure-web-app-firewall
mnj
mnj

Reputation: 3413

How does Web App Firewall protect from SQL Injection?

I heard that Azure App Gateway's Web App Firewall is able to protect apps from SQL injection attacks. How does it actually achieve that?

Does it inspect all the incoming payload (both body and URL params)? If it does, I assume TLS termination has to be set up on the Application Gateway level, otherwise it wouldn't be able to read anything. Does it just look for some suspicious strings in the payload (like ";DROP TABLE....")? How does it know if the content in the payload is safe or not? I mean, I could be sending some payload to my web app that could look like SQL injection - how does the WAF know which request is an attack and which isn't?

Upvotes: -2

Views: 1827

Answers (1)

Ken W - Zero Networks
Ken W - Zero Networks

Reputation: 3804

Here is a list of reference material that OWASP used to create the rules for SQL injections. Essentially it is looking at the query to see if there is anything suspect in it (comments trying to obfuscate commands, backticks in the wrong place, trying to gain server/host information, etc). It is a long list, too long to describe here but the reference sites might be easier to understand than the raw rules.

References (from rule code):

Upvotes: 1

Related Questions