Check what goes out too
A successful attack often shows in the response: data leak, webshell output, defaced page. ToutWAF inspects the response before it reaches the visitor.
Data protection (DLP)
What leaves your applications is checked too: a stack trace never reaches the visitor, banners are removed, bank cards, IBANs and keys leaking in a response are spotted, masked or blocked, and your logs hold no password or token.
Where to find it in the console : Protection menu: Data leak prevention; Privacy in Reports and compliance.
What it is for
Reveal nothing through an error
A stack trace or a database error is replaced by a generic page. It is on by default.
Spot sensitive data
Bank cards, IBANs, national identifiers, API keys, private keys and long lists of e-mail addresses: logged, masked or blocked as you choose.
Logs without secrets
The values of sensitive fields (password, token, card...) are replaced by *** before being recorded.
How the response is checked
Response inspection is on by default; sensitive-data detection is chosen site by site.
The origin answers first
Your server handles the request normally; ToutWAF receives its response.
Detectors read the response
Up to 1 MiB of the response by default, looking for errors, secrets, personal data and signs of a webshell or defacement.
The action you chose
Log, mask (default) or block. The visitor receives the cleaned response, or a 502 error if you block.
What is detected
Бесплатно
Sensitive-data detection (DLP) is off by default; you switch it on per site and choose the types.
- Bank cards of 13 to 19 digits validated by the Luhn algorithm, and IBANs validated by their check digits.
- National identifiers of a known shape, API keys and secrets, private key blocks.
- More than 25 e-mail addresses in one response (adjustable threshold): a leaking list.
- The types detected by default are card, IBAN, national identifier, e-mail, API key and private key.
Errors and banners
Бесплатно
Two protections that are on by default.
- Error masking: a stack trace, or a database error returned with a 500 to 504 code, is replaced by a generic page.
- The Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version and X-Generator banners are removed from the response.
Dangerous outputs
Бесплатно
Signs of a compromise already under way.
- Webshell output (on by default), directory listings, source code and source maps.
- Defacement, from keywords you set (off by default).
- A maximum response size, if you want one (unlimited by default).
Logs without passwords
Бесплатно
Events do not contain the secrets your visitors typed.
- Fields whose name is on the list (password, token, authorization, API key, card, cvv, IBAN...) are replaced by *** in the address, a form, a JSON body and a rule's excerpt.
- You add your own field names in Reports and compliance; they also apply when reading events already recorded.
- Payload capture can be switched off, and log minimisation can also drop the query string, user agent and referrer.
- Your API's responses are also classified by type of sensitive data for the API inventory, without blocking anything.
What is not done, or not proven
We prefer to say it plainly.
- Custom patterns (your own regular expressions) are not supported: the card was removed and the API refuses them. The mail gateway, under licence, does accept your own words and phrases.
- Inspection covers the first 1 MiB of a response by default; the rest is not read.
- A detection remains a detection: a false positive is possible (a number that looks like a card). Start by logging before masking or blocking.
- A field name you add also masks events already recorded when they are read, but the stored copy is not rewritten, nor are backups already made.
Use cases
An application that shows error traces
The visitor sees a generic page, your logs keep the trace so you can fix it.
An export that leaks cards
You log first, check the cases, then move to masking.
Passwords in the logs
Sensitive fields are masked before being recorded, including those you name yourself.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
РедакцияБесплатно Входит во все предложения, включая оба бесплатных (Free и Free +)Pro и выше Платные предложения: видна в консоли, без лицензии заблокирована. Начиная с Pro, если не указано Agency или Enterprise
- Маскирование ошибок: трассировка стека или ошибка базы данных никогда не доходит до посетителяБесплатно
- Баннеры Server и X-Powered-By удаляютсяБесплатно
- Обнаружение утечек: платёжные карты (Luhn), IBAN, национальные идентификаторы, ключи API, закрытые ключи, массовые списки адресовБесплатно
- Записывать, маскировать или блокировать чувствительные данные в ответахБесплатно
- Обнаруживаются вывод веб-шеллов, дефейс, листинги каталогов и карты исходного кодаБесплатно
- События и журналы: пароли, токены и номера карт маскируютсяБесплатно
- Поля для маскирования по имени: значение заменяется на *** при получении события — в адресе, форме или теле JSONБесплатно
- Ограничение размера ответовБесплатно
Вернуться к значению по умолчанию для расширенной опции можно всегда. Что происходит по окончании платной лицензии, описано в вопросах и ответах о тарифах: 48 часов льготного периода, 48 часов только для чтения, затем защита WAF отключается до продления.
Поставьте щит перед вашими приложениями уже сегодня
Установите его на собственный сервер или напишите нам, чтобы обсудить лицензии.