Look Who it Was Random video

DEF CON 16 - Wendel Guglielmetti Henrique: Playing with Web Application Firewalls

413 views · Published 26 November 2013 · 34:58 · Indexed 6 November 2026

Channel: DEFCONConference · 2013 · Science & Technology

Watch on YouTube

DEF CON 16 - Wendel Guglielmetti Henrique: Playing with Web Application Firewalls
WAF (Web Application Firewalls) are often called 'Deep Packet Inspection Firewalls' because they look at every request and response within the HTTP/HTTPS/SOAP/XML-RPC/Web Service layers. Some WAFs look for certain 'attack signatures' to try to identify a specific attack that an intruder may be sending, while others look for abnormal behavior that doesn't fit the websites normal traffic patterns. Web Application Firewalls can be either software, or hardware appliance based and are installed in front of a webserver in an effort to try and shield it from incoming attacks.

Today WAF systems are considered the next generation product to protect websites against web hacking attacks, this presentation will show some techniques to detect, fingerprint and evade them. Affiliated to Hackaholic team (https://hackaholic.org/) and working as penetration tester to a Brazilian company called SecurityLabs in the Intruders Tiger Team division - One of leaders company of segment in Brazil, among our clients are government, credit card industry, etc.

Wendel Guglielmetti Henrique has worked with IT since 1997, during the last 7 years he has worked in the computer security field. He found vulnerabilities in many softwares like webmails, Access Points, Citrix Metaframe, etc. Some tools he wrote already were used as examples in articles in national magazines like PCWorld Brazil and international ones like Hakin9 Magazine. During the last 3 years he has worked as Pen-tester. 

For copies of the slides and additional materials please see the DEF CON 16 Archive here: https://defcon.org/html/links/dc-archives/dc-16-archive.html

More from this channel