Everybody welcome the final video of the fireballs module.
Now in this video we're going to very very briefly go over a Web application firewalls.
Now what does a web application firewall.
It's also known as a laugh.
That's how you're gonna normally hear it when speaking about it with other colleagues.
Now this is used between the browser and the web application itself.
Sometimes this resides on the same system and sometimes this is something as simple as when it when
when all the proximate when all the requests come to the proxies or the high availability services it
will have a web application firewall on it.
So it uses its ruleset which is looking for like sequin Jackson cross-eyed scripting local file inclusion
of all of the fun stuff it's looking for that type of request or anything that could be deemed malicious
before it even hits the web server and then blocks it right then and there.
So for example if it sees something like ATC pass WD in the URL string that's not something common that's
normally has some intent of being malicious about it whether it's expected in that application or not.
So it will block stuff like that.
Now this is again this is a similar concept to the firewall but the rule sets are different you're looking
at more of a rule set than an access control list.
So this just keep this in mind the Web Application Firewalls are there.
Most of the time you don't even notice it but there are a lot of ways to bypass it when you go to do
bypassing or to be looking more along the lines of filtering or you to be looking at more filters than
anything else.
So what you're sending is there a way to send it in another way.
So the web application can still interpret it but the laugh can not.
So if you want take a little bit of a deeper stride into Web Application Firewalls it is good stuff
to know.
Normally the firewalls in this particular case or the Web Application Firewalls are going to be vendor
specific.
So bypassing them is going to be more along the lines of a specific vendor rather than a numeric concept
does all.