Check what goes out too
A successful attack often shows in the response: data leak, webshell output, defaced page. ToutWAF inspects the response before it reaches the visitor.
Data protection (DLP)
What leaves your applications is checked too: a stack trace never reaches the visitor, banners are removed, bank cards, IBANs and keys leaking in a response are spotted, masked or blocked, and your logs hold no password or token.
Where to find it in the console : Protection menu: Data leak prevention; Privacy in Reports and compliance.
What it is for
Reveal nothing through an error
A stack trace or a database error is replaced by a generic page. It is on by default.
Spot sensitive data
Bank cards, IBANs, national identifiers, API keys, private keys and long lists of e-mail addresses: logged, masked or blocked as you choose.
Logs without secrets
The values of sensitive fields (password, token, card...) are replaced by *** before being recorded.
How the response is checked
Response inspection is on by default; sensitive-data detection is chosen site by site.
The origin answers first
Your server handles the request normally; ToutWAF receives its response.
Detectors read the response
Up to 1 MiB of the response by default, looking for errors, secrets, personal data and signs of a webshell or defacement.
The action you chose
Log, mask (default) or block. The visitor receives the cleaned response, or a 502 error if you block.
What is detected
Gratuito
Sensitive-data detection (DLP) is off by default; you switch it on per site and choose the types.
- Bank cards of 13 to 19 digits validated by the Luhn algorithm, and IBANs validated by their check digits.
- National identifiers of a known shape, API keys and secrets, private key blocks.
- More than 25 e-mail addresses in one response (adjustable threshold): a leaking list.
- The types detected by default are card, IBAN, national identifier, e-mail, API key and private key.
Errors and banners
Gratuito
Two protections that are on by default.
- Error masking: a stack trace, or a database error returned with a 500 to 504 code, is replaced by a generic page.
- The Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version and X-Generator banners are removed from the response.
Dangerous outputs
Gratuito
Signs of a compromise already under way.
- Webshell output (on by default), directory listings, source code and source maps.
- Defacement, from keywords you set (off by default).
- A maximum response size, if you want one (unlimited by default).
Logs without passwords
Gratuito
Events do not contain the secrets your visitors typed.
- Fields whose name is on the list (password, token, authorization, API key, card, cvv, IBAN...) are replaced by *** in the address, a form, a JSON body and a rule's excerpt.
- You add your own field names in Reports and compliance; they also apply when reading events already recorded.
- Payload capture can be switched off, and log minimisation can also drop the query string, user agent and referrer.
- Your API's responses are also classified by type of sensitive data for the API inventory, without blocking anything.
What is not done, or not proven
We prefer to say it plainly.
- Custom patterns (your own regular expressions) are not supported: the card was removed and the API refuses them. The mail gateway, under licence, does accept your own words and phrases.
- Inspection covers the first 1 MiB of a response by default; the rest is not read.
- A detection remains a detection: a false positive is possible (a number that looks like a card). Start by logging before masking or blocking.
- A field name you add also masks events already recorded when they are read, but the stored copy is not rewritten, nor are backups already made.
Use cases
An application that shows error traces
The visitor sees a generic page, your logs keep the trace so you can fix it.
An export that leaks cards
You log first, check the cases, then move to masking.
Passwords in the logs
Sensitive fields are masked before being recorded, including those you name yourself.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdizioneGratuito Incluso in tutte le offerte, comprese le due gratuite (Free e Free +)Pro e superiori Offerte a pagamento: visibile nella console, bloccata senza licenza. Da Pro, salvo indicazione Agency o Enterprise
- Mascheramento degli errori: uno stack trace o un errore di database non raggiunge mai il visitatoreGratuito
- Banner Server e X-Powered-By rimossiGratuito
- Rilevamento di fughe: carte di pagamento (Luhn), IBAN, identificativi nazionali, chiavi API, chiavi private, elenchi massivi di e-mailGratuito
- Registrare, mascherare o bloccare i dati sensibili nelle risposteGratuito
- Output di webshell, defacement, elenchi di directory e source map rilevatiGratuito
- Eventi e log: password, token e numeri di carta mascheratiGratuito
- Campi da mascherare per nome: il valore viene sostituito da *** alla ricezione dell'evento, nell'indirizzo, in un modulo o in un corpo JSONGratuito
- Limite di dimensione delle risposteGratuito
Tornare al valore predefinito di un'opzione avanzata è sempre possibile. Che cosa accade alla fine di una licenza a pagamento è descritto nelle domande frequenti sui prezzi: 48 ore di tolleranza, 48 ore di sola lettura, poi la protezione WAF viene disattivata fino al rinnovo.
Metti oggi stesso uno scudo davanti alle tue applicazioni
Installalo sul tuo server, oppure scrivici per parlare di licenze.