Glossary
Web application firewall (WAF)
A filter in front of web applications that inspects HTTP traffic to block attacks such as injection and malicious uploads.
A web application firewall (WAF) inspects HTTP(S) requests and responses and blocks those matching attack patterns — injection, path traversal, malicious uploads and known exploit signatures. Examples include ModSecurity or Coraza with the OWASP Core Rule Set and cloud WAF services.
Against web shells, a WAF is most valuable for virtual patching of exploitable vulnerabilities and for rejecting script uploads. It does not reliably detect encrypted or custom-encoded traffic to an already-planted shell, so it complements, rather than replaces, secure upload handling, least privilege and monitoring.