NetScaler Web App Firewall uses a pattern match approach for detecting command injection attacks in HTML payloads. The approach uses a set of pre-defined keywords and (or) special characters to detect an attack and flag it as a violation. Although this approach is effective, it can result in many false positives that lead to adding one or more relaxation rules. Especially, when a commonly used word such as “Exit” is used in an HTTP request. We can reduce false positives by implementing the command injection grammar-based protection check for the HTML payload.

In the pattern-match approach, a command injection attack is identified if a pre-defined keyword and (or) a special character is present in an HTTP request. In this case, the statement need not be a valid command injection statement. But in the grammar-based approach, a command injection attack is detected only if a keyword or a special character is present in a command injection statement. Therefore, false-positive scenarios are reduced.