Recently, I noticed that SafeLine WAF had released version 7.0, adding a lot of new features. And I decided to give it a try.
Introduction to SafeLine WAF
SafeLine WAF, produced by Chaitin Technology, is a Web Application Firewall that protects web services from hacker attacks. It has been well-known in the security industry for its "intelligent semantic analysis technology" since its early days.
SafeLine is an open source web application firewall (WAF). It is designed to be simple and easy to use. According to the official website, it has been installed on over 250,000 servers and has 12.4K stars on GitHub, making it the world's top-ranked open-source WAF on GitHub.
SafeLine Official Website:
Next, configure the websites that need protection. I set up a DVWA target behind SafeLine and ran an AWVS scan. It blocked everything it should. (PS: If it couldn’t, it wouldn’t be a WAF.)
The protection features against SQL injection, XSS, and similar attacks are fundamental for any WAF, and Chaitin’s semantic analysis technology already has a significant advantage in this area.
It provides a performance indicator table for the WAF, comparing it to ModSecurity, Coraza, etc. Although the data isn’t perfect, it’s impressive.
Additionally, the official website thoughtfully provides test samples and tools. If you don’t trust the results, you can conduct your own tests.
SafeLine’s main anti-bot capabilities include human-machine verification, dynamic protection, and request replay prevention:
Human-Machine Verification
There is traffic from real users on the internet, but more often, it comes from automated programs like crawlers, vulnerability scanners, worms, and exploitation tools. Enabling SafeLine’s human-machine verification allows real users to pass through while blocking malicious bots.
Dynamic Protection
Without changing the content users see on the web pages, it adds dynamic features to the page by dynamically encrypting HTML and JavaScript code. This ensures that these codes appear random and unique each time they are accessed.
Request Replay Prevention
Automated tools often record HTTP requests using packet capture and replay techniques, then modify and resend these requests to perform attacks like ID traversal and unauthorized scanning. SafeLine’s request replay prevention effectively counters such attacks.
Conclusion
This protection method is indeed effective against scanners and bots. Human-machine verification forces clients to rely on browsers, significantly reducing the efficiency of automated requests. Dynamic encryption of HTML makes it impossible for scanners to recognize the actual content of the page, thus unable to identify vulnerability signatures. Finally, request replay prevention ensures that cookies recorded by scanners and bots cannot be used.
SOCIAL SHARE CARD GENERATOR