mod-security-rules — Discuss rule ideas, problems and false positives

[Mod-security-rules] about crs2.2.5 issues

[ro c. <chr...@gm...>]

Hi,

There are two issues about Mod-security-rules.

1.Rules of modsecurity_crs_20_protocol_violations.conf and
modsecurity_crs_21_protocol_anomalies.conf,modsecurity_crs_60_correlation.conf,those
three rules will block google chrome,Internet explorer,firefox to download
PDF files when those three rules are enabled.Can you fix this issue to
download PDF files when rules are enabled?

2.Some automatic robots such as telport pro,httrack can't be blocked by
Mod-security-rules.Is there any rule can stop that kind of rude site copier
robots?Or you can create rule to stop it?

best regards.

Re: [Mod-security-rules] Bad robot addition

[Ryan B. <RBa...@tr...>]

I just updated the 35 scanners.data file for the CRS v2.2.2 in SVN to include Arachni and a bunch of other User-Agent strings -
http://mod-security.svn.sourceforge.net/viewvc/mod-security/crs/trunk/base_rules/modsecurity_35_scanners.data?revision=1829&view=markup

--
Ryan Barnett
Senior Security Researcher
Trustwave – SpiderLabs

From: Benjamin Flament <ben...@ya...<mailto:ben...@ya...>>
Reply-To: Benjamin Flament <ben...@ya...<mailto:ben...@ya...>>
Date: Tue, 23 Aug 2011 12:12:57 -0500
To: "mod...@li...<mailto:mod...@li...>" <mod...@li...<mailto:mod...@li...>>
Subject: [Mod-security-rules] Bad robot addition

Hi

Would it be possible to add arachni to the bad_robots/scanners list? I noticed it hasn't been added yet.

Regards
Benjamin

________________________________
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.

[Mod-security-rules] Bad robot addition

[Benjamin F. <ben...@ya...>]

Hi

Would it be possible to add arachni to the bad_robots/scanners list? I noticed it hasn't been added yet.


Regards
Benjamin

Re: [Mod-security-rules] Rule 950901 needs to be more specific

[Ryan B. <RBa...@tr...>]

Benjamin,
You will be happy to know that we just released CRS v2.2.1 and we have
updated this SQL Injection Tautaology rule 950901 to be more accurate both
from a false positive and negative perspective.

Please test out the new CRS and let me know if it is working better for
you.

-Ryan



On 7/2/11 8:14 PM, "Benjamin Flament" <ben...@ya...> wrote:

>Hi
>
>I've been having some trouble with rule 950901, because it essentialy
>matches any single sentence that includes an "and" or "or". The rule's
>regex is currently as follows:
>
>\b(\d+) ?(?:=|<>|<=>|<|>|!=) ?\1\b|[\'\"\`\´\¹\Œ](\d+)[\'\"\`\´\¹\Œ]
>?(?:=|<>|<=>|<|>|!=) ?[\'\"\`\´\¹\Œ]\2\b|[\'\"\`\´\Œ](\w+)[\'\"\`\´\¹\Œ]
>?(?:=|<>|<=>|<|>|!=)
>?[\'\"\`\´\¹\Œ]\3\b|([\'\"\;\`\´\¹\Œ]*)?\s+(and|or)\s+([\s\'\"\`\´\¹\Œ]*)?
>\w+([\s\'\"\`\´\¹\Œ]*)?[=<>!]+([\s\'\"\`\´\¹\Œ]*)?\w+([\s\'\"\`\´\¹\Œ]*)?
>
>
>I suggest changing the rule to:
>
>\b(\d+) ?(?:=|<>|<=>|<|>|!=)
>?\1\b|[\'\"\`\´\¹\Œ](\d+)[\'\"\`\´\¹\Œ]
>?(?:=|<>|<=>|<|>|!=)
>?[\'\"\`\´\¹\Œ]\2\b|[\'\"\`\´\Œ](\w+)[\'\"\`\´\¹\Œ]
>?(?:=|<>|<=>|<|>|!=)
>?[\'\"\`\´\¹\Œ]\3\b|([\'\"\;\`\´\¹\Œ]*)?\s+(and|or)\s+([\s\'\"\`\´\¹\Œ]*)?
>\w+([\s\'\"\`\´\¹\Œ]*)?(?:=|<>|<=>|<|>|!=)([\s\'\"\`\´\¹\Œ]*)?\w+([\s\'\"\
>`\´\¹\Œ]*)?
>
>As the operator list is not specific enough and matches any "and|or"
>preceded with a space and followed by anything.
>
>Regards
>Benjamin
>
>
>--------------------------------------------------------------------------
>----
>All of the data generated in your IT infrastructure is seriously valuable.
>Why? It contains a definitive record of application performance, security
>threats, fraudulent activity, and more. Splunk takes this data and makes
>sense of it. IT sense. And common sense.
>http://p.sf.net/sfu/splunk-d2d-c2
>_______________________________________________
>Mod-security-rules mailing list
>Mod...@li...
>https://lists.sourceforge.net/lists/listinfo/mod-security-rules


This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.

[Mod-security-rules] Rule 950901 needs to be more specific

[Benjamin F. <ben...@ya...>]

Hi

I've been having some trouble with rule 950901, because it essentialy matches any single sentence that includes an "and" or "or". The rule's regex is currently as follows:

\b(\d+) ?(?:=|<>|<=>|<|>|!=) ?\1\b|[\'\"\`\´\’\‘](\d+)[\'\"\`\´\’\‘] ?(?:=|<>|<=>|<|>|!=) ?[\'\"\`\´\’\‘]\2\b|[\'\"\`\´\‘](\w+)[\'\"\`\´\’\‘] ?(?:=|<>|<=>|<|>|!=) ?[\'\"\`\´\’\‘]\3\b|([\'\"\;\`\´\’\‘]*)?\s+(and|or)\s+([\s\'\"\`\´\’\‘]*)?\w+([\s\'\"\`\´\’\‘]*)?[=<>!]+([\s\'\"\`\´\’\‘]*)?\w+([\s\'\"\`\´\’\‘]*)?


I suggest changing the rule to:

\b(\d+) ?(?:=|<>|<=>|<|>|!=) 
?\1\b|[\'\"\`\´\’\‘](\d+)[\'\"\`\´\’\‘] 
?(?:=|<>|<=>|<|>|!=) 
?[\'\"\`\´\’\‘]\2\b|[\'\"\`\´\‘](\w+)[\'\"\`\´\’\‘] 
?(?:=|<>|<=>|<|>|!=) 
?[\'\"\`\´\’\‘]\3\b|([\'\"\;\`\´\’\‘]*)?\s+(and|or)\s+([\s\'\"\`\´\’\‘]*)?\w+([\s\'\"\`\´\’\‘]*)?(?:=|<>|<=>|<|>|!=)([\s\'\"\`\´\’\‘]*)?\w+([\s\'\"\`\´\’\‘]*)?

As the operator list is not specific enough and matches any "and|or" preceded with a space and followed by anything.

Regards
Benjamin

[Mod-security-rules] error : Failed to execute

[Serkan <du...@gm...>]

--23bf125d-B--
GET /test.php HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg,
application/x-ms-application, application/x-ms-xbap,
application/vnd.ms-xpsdocument, application/xaml+xml,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: tr
User-Agent: Mozilla/4.0 (compatible; )
Host: example.net
Connection: Keep-Alive

--23bf125d-F--
HTTP/1.1 404 Not Found
Last-Modified: Thu, 19 May 2011 09:28:26 GMT
ETag: "22c034-3bf-4a39da092a280"
Accept-Ranges: bytes
Content-Length: 959
Vary: Accept-Encoding
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html

--23bf125d-H--
Message: Exec: Execution failed while reading output: /tmp/test.sh (End of
file found)
Message: Failed to execute: /tmp/test.sh
Message: Warning. Pattern match "/test\.php" at REQUEST_URI. [file
"/etc/apache2/test/mod-security.conf"] [line "24"]
Stopwatch: 1305987060640023 3860 (218 3512 -)
Producer: ModSecurity for Apache/2.5.12 (http://www.modsecurity.org/).
Server: Apache

--23bf125d-Z--

---
mod-security.conf line "24"


SecRule REQUEST_URI "/test\.php"
"phase:2,t:none,t:lowercase,t:normalisePath,log,exec:/tmp/test.sh"

--


root@example:/tmp# ls -lah /tmp/test.sh
-rwxrwxrwx 1 www-data www-data 38 May 21 17:10 /tmp/test.sh

--

root@example:/tmp# cat test.sh
#!/bin/sh
echo "test" > /tmp/test.txt


--

root@example:/tmp# apache2 -v
Server version: Apache/2.2.16 (Debian)
Server built:   Mar 22 2011 20:56:31

--

root@example:/tmp# uname -a
Linux example 2.6.32-5-686 #1 SMP Tue Mar 8 21:36:00 UTC 2011 i686 GNU/Linux


What should I do for solution?

[Mod-security-rules] hello there

[Ranjit J. <ran...@gm...>]

Is there any link available were I can get in depth meaning of mod-security
rules.

and

detail explaination how it works

[Mod-security-rules] rules

[ranjeet j. <ran...@gm...>]

Kindly provide me list of rules that can be used in mod security to secure
php application

Thanks