WAF (Web Application Firewall) and "403 Forbidden" error
Posted under » PHP » AWS on 22 July 2023
It took me a while that when I want to use php, the AWS load balancer will give out
"403 Forbidden". Aparently WAF is blocking my php files.
Pre-defined rule set includes protection against:
SQL Injection
XSS Attacks
Local and Remote File Inclusion
Size Restrictions
Command Injection
Unknown Bad Inputs
- Malicious file extensions (e.g., .php, .exe)
- Directory traversal characters (e.g., “..”)
- Command injection payloads
- Java Deserialization payloads
- Localhost in the host header
- PROPFIND HTTP method
- Shell metacharacters (e.g. |, >, <, )
- Arbitrary code execution payloads
- LDAP injection payloads
- XPath injection payloads
- XML External Entity (XXE) payloads
