- About Us
- Contact Us
WebSniper is a unique product, developed by BugSec's R&D Department for the purpose of protecting organizational Web servers and the applications stored on them.
WebSniper prevents the possibility of exposure on Web servers – such as SQL Injections, Buffer Overflows, Path Traversal, Cross Site Scripting, etc. – by implementing appropriate identification and blocking mechanisms. The identification is performed via signatures of known attacks and "behavioral patterns" of unknown attacks, enabling to block them while managing alerts to the organization's Information Security Center/Manager. The product's features enable the Information Security Department to manage the definitions of the WebSniper installed on the Web servers in a controlled manner, and to determine rules in accordance with the organization's policy; rules that will enable to prevent such or other exposures according to a scale of severity, or based on procedures that have been predefined by the organization.
WebSniper identifies and monitors the requests sent by the user via the Internet, and distinguishesbetween the legitimate requests that are approved, and the illegitimate requests that are interpreted as attempted attacks, and which will be blocked before they arrive at the organization's Web server. The product's features can, of course, enable only monitoring of traffic (without blocking) – based on the organization's information security policy and the preferences of its Information Security Manager. Furthermore, WebSniper checks and modifies the responses returned from the Web server, in order to secure the client's side and prevent leakage of information.
WebSniper, which was developed as an ISAPI file, can therefore communicate more efficiently with the Web server. With the help of an administrator interface and a central database, a large number of Web servers can be protected and/or monitored, by securing the Web server farm "gate" – or by protecting each server separately using the same product.
WebSniper's advantages are manifested in its ability to identify not only known attacks, but also attacks that are unknown in advance, and to dictate their handling as defined in the configuration, for example:
For additional details, please view the WebSniper Presentation.