Web Application Profiles - Mixed Models

There are several approaches which address the elevation of web-application security. In contrast to the positive security model which is inherent to the proposed profile approach, the core rules or PHP-IDS try to detect attacks be matching the requests against a pattern-database of known attacks.

As the strict positive approach is a lot more efficient when it comes to simple parameters like product IDs, date-field and the like, it will fail for validating free-text fields for instance. Thus, a strict positive model will not be sufficient to detect all attacks. The profiles therefore allow for the "selected" inclusion of pattern-based approaches into the profiles.

The editor for instance can import the filter-rules provided by the PHP-IDS project and allows to apply filters to a parameter. The PHP-IDS rules are tagged by specific tags which can be used to select the "attack type" to check for. A simple example is the following:

   ...
   <Parameter name="comment">
      <IncludeFilter tags="sqli" />
   </Parameter>
   ...