The testing environment included three vulnerable applications: OWASP Juice Shop v20.2.0, Damn Vulnerable Web Application (DVWA), and File Browser 2.63.23. These applications do not support HTTPS or traffic encryption and allow file uploads to the server disk.
The protection architecture consists of a proxy server based on Kaspersky Web Traffic Security (KWTS) and a Squid server version 6.13 with OpenSSL support. In this setup, KWTS acts as an ICAP server providing policy management, while Squid handles HTTP/HTTPS traffic as a TLS front-end for the backend applications.
KWTS can be installed as a virtual appliance or as separate components. The tested configuration used Ubuntu 24.04.3 LTS with separate components. The system requires Nginx for installation and integrates with Microsoft Active Directory for multi-user administration and role-based access control.
The solution's licensing is based on the number of users, although the software lacks built-in tools to visualize or calculate current license consumption. The manufacturer recommends calculating licenses based on the number of employees using the proxy, but no clear algorithm exists for reverse-proxy or ICAP server scenarios.
Tests showed that KWTS successfully blocks the upload of malicious files, including those uploaded via vulnerability exploitation. However, the system does not act as a Web Application Firewall (WAF) and does not block most vulnerability scanning requests, as its primary function is file and URL analysis.
