[WEB SECURITY] Re: Comparisons of Web ApplicationFirewalls

["Colin Watson" <colin@xxxxxxxxxxxxxx>]

Regarding WAF fingerprinting:

> > The same could be said for web servers, but even with customized 
> > configuration you still can usually determine the distribution/
> > version despite the best attempts to mask it. A lot of testing
> > required, but my gut says there will always be some identifiable
> > mark. Just gotta find it.
>
> ...
>
> Just a few ideas. The tough part is getting a test-bed.

I suppose it would be possible to look at the websites of WAF vendors... but perhaps they don't use their own WAFs?  If they don't, I wonder why not.

Colin

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives:
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS:
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA