is it possible to detect and block for the XSS Referer and X-Forwarded-For Header vulnerability on WAF module?

Yes, you can configure to block cross-site scripting and SQL injection.

Cheers - Bob

Hello BAlfson, 

Thank you for your answer. 

XSS is one of my question. but SQL injection is not my question.

SQL injection is just example for the x-forwarded-for and i just explained as an example that attacker is able to attack a SQL injection using x-forwarded-for vulnerability.

Can SG detect and block the XSS that injected the malicious script in the Referer HTTP Header if i enable the XSS attack in Common Threat Filter Category?

What should i do on SG if i want to detect and block a x-forwarded-for vulnerability?

Thanks, 

That information isn't explicitly stated in the documentation.  I would expect that that's covered, but you really need to ask Sophos Sales to get such information from their pre-sales engineer.

Please post their response here so that we all can learn.

Cheers - Bob