Abstract: Technology related to a network application firewall is disclosed. In one example, a method includes intercepting a response from a network application and destined for a client. The response can be associated with a user identifier. A modified response can be forwarded to the client. The modified response can include a honeytrap embedded within the intercepted response. Engagement with the honeytrap can be detected in a subsequent request to the network application. In response to detecting the engagement with the honeytrap, an indication that the user identifier is malicious can be stored.

Abstract: Technology related to a network application firewall is disclosed. In one example, a method includes intercepting a response from a network application and destined for a client. The response can be associated with a user identifier. A modified response can be forwarded to the client. The modified response can include a honeytrap embedded within the intercepted response. Engagement with the honeytrap can be detected in a subsequent request to the network application. In response to detecting the engagement with the honeytrap, an indication that the user identifier is malicious can be stored.

Abstract: Methods, non-transitory computer readable media, network traffic management apparatuses, and network traffic management systems that obtain a dictionary comprising a plurality of credentials and populate a probabilistic data structure based on the dictionary. A login request is received from a client and one or more credentials are extracted from the received login request. A determination of when the probabilistic data structure indicates that the extracted credentials are included in the dictionary is made. A mitigation action is initiated with respect to the client, when the determination indicates that the probabilistic data structure indicates that the extracted credentials are included in the dictionary. This technology more efficiently and effectively detects and mitigates brute force credential stuffing attacks advantageously using a reduced amount of resources.

Abstract: Methods, non-transitory computer readable media, application security management apparatuses, and network traffic management systems that obtain a reputation score for a client. A server is selected based on the reputation score and a session is established with the server. Interaction(s) with an application hosted by the server are monitored. The reputation score for the client is updated based on the interaction(s). A remote fingerprint database and client-side scripts and cookies can be used to obtain reputation scores generated in different domain(s). With this technology, reputations scores are used to direct sessions for relatively benign clients and relatively malicious clients to different server devices so that if the relatively malicious clients conduct a successful attack, only a subset of the servers will be unavailable, and the relatively benign clients will still have access to application(s) hosted by another subset of servers unaffected by the attack.