Protect your web applications with the firewall
Thousands of websites get hacked every day due to misconfiguration or vulnerable code. Web Application Firewall (WAF) is one of the best ways to protect your website from online threats.
If your website is available on the Internet, then you can use online tools to scan a website for vulnerability to get an idea of how secure your website is. Don’t worry if it’s an intranet website; you can use Nikto web scanner open source.
Commercial WAF can be expensive, and if you are looking for a free solution to protect your website using WAF, then the following open-source Web Application Firewall can be helpful.
ModSecurity free rules will be helpful if you are looking for the following protection.
- Cross-site scripting
- Information leakage
- SQL injection
- Common web attacks
- Malicious activity
ModSecurity doesn’t have a graphical interface, and if you are looking for the one, then you may consider using WAF-FLE. It let you store, search, and view the event in a console.
NAXSI is Nginx Anti-XSS & SQL Injection. So as you can guess, this is only for the Nginx web server and mainly target to protect from cross-site scripting & SQL injection attacks.
NAXSI filter only GET and PUT request, and default configuration will act as a DROP-by-default firewall, so you got to add the ACCEPT rule to work correctly.
WebKnight WAF is for Microsoft IIS. It’s an ISAPI filter that secures your web server by blocking bad requests. WebKnight is useful for securing the following.
- Buffer overflow
- Directory transversal
- Character encoding
- SQL injection
- Blocking bad robots
- Brute force
- And much more…
In a default configuration, all blocked requests are logged, and you can customize based on your needs. WebKnight 3.0 got an admin web interface where you can customize the rules and perform administration tasks, including statistics.
Shadow Daemon detect, record, and prevent web attacks by filtering request from malicious parameters. It comes with an own interface where you can perform administration and manage this WAF. It supports PHP, Perl & Python language framework.
It can detect the following attacks.
- SQL injection
- XML injection
- Code injection
- Command injection
- Backdoor access
- Local/remote file inclusion
Open source is free, but you don’t get support means you need to rely on your expertise and community support. So if you are looking for the commercial WAF, then you may refer the following one.
- Cloudflare (cloud-based)
- Incapsula (cloud-based)
- F5 ASM
- TrustWave ModSecurity commercial rules
- SUCURI (cloud-based)
I hope this helps you with an idea about open source web application firewalls for the various platform.
- Tagged in:
- Open Source
More great readings on Security
Protect Your Web Applications and APIs with G-Core Labs WAFAmrita Pathak on June 10, 2022
Create an Incident Report in Minutes With These TemplatesSatish Shethi on June 6, 2022
Software Composition Analysis (SCA): Everything You Need to Know in 2022Amrita Pathak on May 26, 2022
Best On-premise Password Manager for Your Business – PassworkHitesh Sant on June 1, 2022
How to Scan and Fix Log4j Vulnerability?Amrita Pathak on May 10, 2022
How to Protect Your WordPress Site with iThemes Security ProHitesh Sant on May 7, 2022
Join Geekflare Newsletter
Every week we share trending articles and tools in our newsletter. More than 10,000 people enjoy reading, and you will love it too.