Forum Discussion

pitmaster's avatar
pitmaster
Icon for Nimbostratus rankNimbostratus
Apr 23, 2015

Tools for WAF Professionals

What are the tools a WAF professional must have to properly do his/her job? I'm asking because I would like to evaluate request and give recommendation based on facts.  
ASM Advanced WAF
security
pitmaster's avatar
pitmaster
Icon for Nimbostratus rankNimbostratus

Hannes Rapp thanks for the response but I was thinking more to review web request and alike. Tools like fiddler or others.

 

Hannes_Rapp's avatar
Hannes_Rapp
Icon for Nimbostratus rankNimbostratus
Apr 23, 2015
ASM event logs include all the HTTP header and payload (parameters) data. Additionally, reponse logging can be enabled. I don't see daily use for tools like Fiddler, because it's superseded by cURL, but it could come handy if you wanted to verify that ASM profile is configured properly. Similarly to cURL, you can use Fiddler to craft your own malicious request. I just see Fiddler as the second preference if UNIX machine with cURL is not available. Regards :)