OWASP TOP 10
OWASP Top 10 Web Application Vulnerabilities’ Mitigation using Prophaze WAF
The OWASP Top 10 vulnerabilities provide guidance to developers and security professionals on the most critical vulnerabilities that are commonly found in web applications, which are also easy to exploit. These 10 application risks are dangerous because they may allow attackers to plant malware, steal data, or completely take over your computers or web servers.
To make sure about availability and protect against abuse, it is possible to set API usage limits.
- Prophaze WAF provides real-time website protection by using powerful cloud-based technologies to maintain protection against the latest threats.
- Prophaze will automatically scan your website for thousands of known vulnerabilities and OWASP Top 10.
- Prophaze also ensures that the web applications are protect against being used as threat vectors into the client’s network.
Prophaze WAF requires no additional configuration but it automatically updates to include protection against new vulnerabilities. It is possible to create/modify rules to match patterns of exploitation attempts in HTTP/S requests and block requests from entering your servers using Prophaze WAF.
Threats | Protection Methods |
| A1 – Injection | · Vulnerabilities filter
· Database filter · Parameters filter |
| A2 – Broken Authentication | · Brute Force Filter
· Session Filter Authentication (login enforcement and session tracking) · Reply Cookie Flag · Clickjacking Protection |
| A3 – Sensitive Data Exposure | · Safe Reply filter
· Session filter · Vulnerabilities filter (Predictable Resource Location) · Server error’s masking |
| A4 – XML External Entities (XXE) | · XML Security Filter
· JSON Parsing property · Vulnerabilities filter · DB filters · Allow List filter · Tunnel’s Message size (max request body) · Unvalidated Redirect |
| A5 – Broken Access Control | · Session filter
· Vulnerabilities patterns (XSS, detect predictable resources protection and components with known vulnerabilities) · Allow list (File type and Methods) · Role/IP/GEO based policy · Directory traversal protection · Authentication · Reply Cookie Flags |
| A6 – Security Misconfiguration | · Allow List filter
· Parameters Filter · Path Blocking filter · Vulnerabilities filter (blocks predictable resources and known backdoors) · Automatic policy generation · RFC enforcement · Native R/T Proxy · Error Masking (eg. Masking error 500s) · Directory Listing Prevention · Masquerade Server Identity · Activity Tracking (prevents foreign scanners) · Role/IP/GEO based policy · DAST (integration with web scanners) · HSTS/Clickjacking · API Security |
| A7 – Cross-Site Scripting (XSS) | · Vulnerabilities filter
· Database filter · Parameters filter · Reply Cookie Flags (HTTP-Only) |
| A8 – Insecure Deserialization | · Authentication (login enforcement and session tracking)
· Session Filter (cookies protection) · XML security filter · JSON Parsing Properties · Vulnerabilities filter · Database filters · Parameters filter |
| A9 – Using Components with Known Vulnerabilities | · Allow List filter
· Parameters Filter · Path Blocking filter · Database filter · Session filter · Vulnerabilities filter (blocks known patterns, backdoors and predictable resource) · Create custom patterns · Automatic policy generation · RFC enforcement · Error masking (eg. Masking error 500s) · Directory Listing Prevention · Masquerade Server Identity · Activity Tracking (prevents foreign scanners) · Role/IP/GEO based policy · Signature update mechanism · Source blocking feature · DAST (Integration with HP WebInspect) · Unvalidated Redirect · Reply Cookies Flags · HSTS/Clickjacking · API Security |
| A10 – Insufficient Logging and Monitoring | · Authentication (login monitoring)
· DefenseMessaging · AppWall Forensics – Request/Response logging · APSolute Vision AVR · APSolute Vision Analytic · SIEM system integration |