Preventing users/bots from trying to inject scripts on website

travis_tmb

Good Morning,

This morning we awoke to either a bot or a human trying to inject scripts on to one of our websites. We were able to detect this as our site was throwing error emails to us from the login page.

Can the WatchGuard not detect this type of behavior to prevent it?

Thanks

travis_tmb

I was told that the person/bot was using this:

https://github.com/LewisArdern/bXSS

Bruce_Briggs

There are many cross site scripting detections in the Intrusion Prevention detection database.

IPS detection is improved for HTTPS traffic if Inspect is being done.

From the docs:
"If you enable IPS for an HTTPS-proxy policy, you must also enable Content Inspection in the HTTPS-proxy action, in order for IPS to scan the HTTPS content."

Configure Intrusion Prevention
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/ips/ips_config_c.html

travis_tmb

Thanks for the update!