Service Overview
The WAF Assessment evaluates the effectiveness, and detection capabilities of the Web Application Firewall by simulating realistic, OWASP‑aligned attack scenarios. During the engagement, Cye executes controlled offensive techniques—mirroring common adversarial behaviors—to determine how well the WAF identifies and blocks, malicious traffic. The outcome provides clear visibility into your WAF’s overall readiness to defend against modern web‑based threats.
Testing is performed using a black-box approach and does not assess the application(s) behind the WAF. The testing is solely intended to evaluate the effectiveness of the current Web Application Firewall configuration.
Methodology
Cye assessment follows a structured, repeatable approach based on the OWASP Top 10 standard. The team simulates selected 10 distinct attack categories, each executed through multiple variations to evaluate the WAF’s ability to detect and block different payload encodings, bypass techniques, and evasion strategies. These attacks include, but are not limited to, SQL Injection, Cross‑Site Scripting (XSS), Command Injection, Insecure Deserialization, and other relevant vectors.
Each attack type is performed using multiple request formats—modifying headers, encodings, parameters, payload structures, and transport techniques—to surface detection gaps and observe WAF behavior under realistic offensive pressure. The WAF’s reactions are measured to calculate a blocking success rate, identify unblocked malicious requests, and highlight blind spots where tuning or additional controls may be required.
Deliverables
Executive Summary outlining overall security posture and key findings
Detailed Attack Matrix covering:
Simulated OWASP Top 10 techniques
Payload variations used
Calculated block rate per attack type
Samples of Successful Requests (safely redacted) that were not blocked by the WAF
Prerequisites
To conduct the assessment effectively, the following are required:
A WAF deployed in front of the tested application(s)
At least one web-facing application behind the WAF
Target environment accessible for testing (public or allowed via IP whitelisting)
Customer Engagement
The client is expected to:
Assign a designated point of contact for coordination
Provide relevant documentation e.g., architecture diagrams, WAF hardening guide used to configure the WAF, etc.
Relevant Standards
This service aligns with the OWASP Top 10 methodology as the testing baseline.
Security Domains Covered
Application-level security
Threat Detection and Prevention
Security Control Validation/Effectiveness Testing