coreX.app - Web Application Firewall & Runtime Application Self-Protection

CORE is an evolution of the Web Application Firewall (WAF) technology called Runtime Application Self-Protection (RASP). Traditional RASP technologies are required to be integrated as a framework or module that runs in conjunction with a program's codes, libraries, and system calls. This requirement limits the type of applications traditional RASP technologies can be deployed with. CORE does not have any framework requirements and can be deployed with any web application requiring no modification to existing code bases.

As the name CORE suggests, it works by correcting the request and response data as it ingresses and egresses the application. This unique and novel method allows for additional protections over other RASP technologies.

Protections

Attacks

Clickjacking

HTTP Response Splitting

HTTP Method Tampering

Large Requests

Malformed Content-Types

Path Traversal

Unvalidated Redirects

Injections

Command Injection

Cross-Site Scripting

Crose-Site Request Forgery

CSS & HTML Injection

JSON & XML Injection

OGNL Injection

SQL Injection

Database Access Violation

Weaknesses

Insecure Cookies

Logging Sensitive Information

Unauthenticated Network Activity

Uncaught Exceptions

Vulnerable Dependencies

Weak Authentication

Weak Browser Caching

Weak Cryptography

Mask Confidential Text

Confidential Field Inputs

History

CORE started off as the open source Stronghenge Web Application Firewall offered as an installable package in the SUSE Linux distribution until May of 2014. The current WAF/RASP technology is now closed source and privately licensed with multiple patents in the works.

The first large scale deployment of the current CORE RASP technology was deployed in at the end of 2010 for the United States Federal Government to protect an agency's vulnerable legacy application for which the original un-compiled source code was lost and rewriting the application would ultimately take 5 years. During the time it took to rewrite the application, CORE was successfully able to mitigate all the vulnerabilities discovered with the application.

Information Request