What is WAF?
A filter in front of a web app that blocks requests matching known-malicious patterns. Useful defence in depth — not a substitute for fixing the bug.
WAF: A filter in front of a web app that blocks requests matching known-malicious patterns. Useful defence in depth — not a substitute for fixing the bug.
In plain language
A WAF inspects incoming traffic and blocks what looks like an attack. It buys time and stops commodity noise, but it works on patterns, so a determined attacker can often rephrase a payload past it — and a WAF does nothing about business-logic or access-control flaws, which look like normal traffic.
SuperPentest tests what reaches the application regardless of the WAF, and reports the underlying vulnerability — because "the WAF blocked one payload" is not the same as "the app is safe." No finding never means secure.
A concrete example
A WAF blocks a textbook ' OR 1=1-- payload, and a dashboard shows the attack “stopped.” But the same injection, URL-encoded and split across two parameters, sails through — and the WAF was never going to catch the IDOR beside it, which looks like normal traffic. SuperPentest tests the application behind the WAF and reports the underlying bug, not the blocked probe.
Related
Business logic → · Rate-limit abuse testing →
Want this tested on your app? Book a demo or read how findings are verified.