Stopping Malicious File Uploads: SHA-256 Verification at the Edge
Upload forms are a favourite malware delivery path. Learn how hash-based verification screens files on the WAF agent before your application ever receives them.
That innocent-looking "upload your avatar" box is one of the friendliest things you've ever built for an attacker. Profile pictures, document imports, support attachments — every one of them is a door into a place your app will happily store a file and, now and then, run it.
The reflex is to check the extension or the MIME type. Don't rely on it. Both are trivial to fake; a .jpg that's really a PHP shell takes about ten seconds to produce. If you want a real first line of defence, stop trusting what the file claims to be and start checking what it is.
Fingerprints beat labels
A SHA-256 hash is a fingerprint of a file's exact bytes. If a file's hash matches a known-malware fingerprint, it isn't "probably" malware — it's that sample, full stop. No heuristics, no maybe. WAFio checks uploaded files right on the WAF agent, before your application ever touches them, and compares their SHA-256 against known-bad signatures.
Screen fast, then confirm
Obviously you can't diff every upload against millions of hashes on every request and keep your latency budget. So WAFio does it in two moves. First, a Bloom filter quickly throws out anything that definitely isn't in the set — it never misses a true match, and only occasionally flags something that needs a second look. Then, for those candidates, an exact SHA-256 lookup makes the call. A block requires an exact match, which means no innocent file ever gets convicted on a hunch.
Where the known-bad list comes from
WAFio can sync hash lists from threat-intel feeds like MalwareBazaar. Two things worth knowing: your provider key is encrypted on the control plane and never shipped to agents, and your uploaded files never leave your boundary — only hashes get compared, locally. If you've got files specific to your own environment, you can keep custom SHA-256 allowlists and blocklists alongside the feed.
Where this stops, and why that's fine
Let's be straight about the limits. Hash matching nails known malware exactly, and by design it won't catch a brand-new sample or one an attacker tweaked a single byte of — different bytes, different hash. It doesn't crack open archives, either. That's not a flaw; it's why upload inspection is one layer, not the whole wall. Pair it with your app's own validation, size limits and content checks.
In practice, roll it out the careful way: start in Log only and watch what matches on real traffic, set a sane scan budget (WAFio hashes complete files up to a shared size limit), decide up front how to treat an incomplete scan — forward and log, or block — and only turn on blocking once the policy has earned your trust.
A quiet layer that pulls its weight
The nice part is that none of this involves a round-trip to someone's cloud scanner. It happens on the agent, and nothing you receive leaves the building. Read the Malicious Uploads feature, follow the setup guide, or watch it catch something in the demo.