Proxies Add a Protective Shield: Page 14 of 22

Various form validity tampering: We used a test form containing various select, checkbox and radio input values to determine if the security proxy would ensure the values we submitted were legal, allowed values; for example, when given a select menu with choices "A," "B" and "C," we attempted to submit nonexistent value "D." We used both static and dynamically generated form values. Partial failure means the product can handle static values via hard-coded rule definitions but cannot handle dynamic values.

CVE IDs were included for attacks that exploit specific vulnerabilities; however, many of the attacks are more general in nature. Below are a few URLs explaining some of the general vulnerabilities we tried to exploit.

• Cross-site scripting

• SQL injection

• Cookie manipulation