mod-security-users Mailing List for ModSecurity (Page 25)
Brought to you by:
victorhora,
zimmerletw
Menu
▾
▴
mod-security-users — General discussion about mod_security
You can subscribe to this list here.
| 2003 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(2) |
Jul
(17) |
Aug
(7) |
Sep
(8) |
Oct
(11) |
Nov
(14) |
Dec
(19) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2004 |
Jan
(46) |
Feb
(14) |
Mar
(20) |
Apr
(48) |
May
(15) |
Jun
(20) |
Jul
(36) |
Aug
(24) |
Sep
(31) |
Oct
(28) |
Nov
(23) |
Dec
(12) |
| 2005 |
Jan
(69) |
Feb
(61) |
Mar
(82) |
Apr
(53) |
May
(26) |
Jun
(71) |
Jul
(27) |
Aug
(52) |
Sep
(28) |
Oct
(49) |
Nov
(104) |
Dec
(74) |
| 2006 |
Jan
(61) |
Feb
(148) |
Mar
(82) |
Apr
(139) |
May
(65) |
Jun
(116) |
Jul
(92) |
Aug
(101) |
Sep
(84) |
Oct
(103) |
Nov
(174) |
Dec
(102) |
| 2007 |
Jan
(166) |
Feb
(161) |
Mar
(181) |
Apr
(152) |
May
(192) |
Jun
(250) |
Jul
(127) |
Aug
(165) |
Sep
(97) |
Oct
(135) |
Nov
(206) |
Dec
(56) |
| 2008 |
Jan
(160) |
Feb
(135) |
Mar
(98) |
Apr
(89) |
May
(115) |
Jun
(95) |
Jul
(188) |
Aug
(167) |
Sep
(153) |
Oct
(84) |
Nov
(82) |
Dec
(85) |
| 2009 |
Jan
(139) |
Feb
(133) |
Mar
(128) |
Apr
(105) |
May
(135) |
Jun
(79) |
Jul
(92) |
Aug
(134) |
Sep
(73) |
Oct
(112) |
Nov
(159) |
Dec
(80) |
| 2010 |
Jan
(100) |
Feb
(116) |
Mar
(130) |
Apr
(59) |
May
(88) |
Jun
(59) |
Jul
(69) |
Aug
(67) |
Sep
(82) |
Oct
(76) |
Nov
(59) |
Dec
(34) |
| 2011 |
Jan
(84) |
Feb
(74) |
Mar
(81) |
Apr
(94) |
May
(188) |
Jun
(72) |
Jul
(118) |
Aug
(109) |
Sep
(111) |
Oct
(80) |
Nov
(51) |
Dec
(44) |
| 2012 |
Jan
(80) |
Feb
(123) |
Mar
(46) |
Apr
(12) |
May
(40) |
Jun
(62) |
Jul
(95) |
Aug
(66) |
Sep
(65) |
Oct
(53) |
Nov
(42) |
Dec
(60) |
| 2013 |
Jan
(96) |
Feb
(96) |
Mar
(108) |
Apr
(72) |
May
(115) |
Jun
(111) |
Jul
(114) |
Aug
(87) |
Sep
(93) |
Oct
(97) |
Nov
(104) |
Dec
(82) |
| 2014 |
Jan
(96) |
Feb
(77) |
Mar
(71) |
Apr
(40) |
May
(48) |
Jun
(78) |
Jul
(54) |
Aug
(44) |
Sep
(58) |
Oct
(79) |
Nov
(51) |
Dec
(52) |
| 2015 |
Jan
(55) |
Feb
(59) |
Mar
(48) |
Apr
(40) |
May
(45) |
Jun
(63) |
Jul
(36) |
Aug
(49) |
Sep
(35) |
Oct
(58) |
Nov
(21) |
Dec
(47) |
| 2016 |
Jan
(35) |
Feb
(81) |
Mar
(43) |
Apr
(41) |
May
(77) |
Jun
(52) |
Jul
(39) |
Aug
(34) |
Sep
(107) |
Oct
(67) |
Nov
(54) |
Dec
(20) |
| 2017 |
Jan
(99) |
Feb
(37) |
Mar
(86) |
Apr
(47) |
May
(57) |
Jun
(55) |
Jul
(34) |
Aug
(31) |
Sep
(16) |
Oct
(49) |
Nov
(53) |
Dec
(33) |
| 2018 |
Jan
(25) |
Feb
(11) |
Mar
(79) |
Apr
(77) |
May
(5) |
Jun
(19) |
Jul
(17) |
Aug
(7) |
Sep
(13) |
Oct
(22) |
Nov
(13) |
Dec
(68) |
| 2019 |
Jan
(44) |
Feb
(17) |
Mar
(40) |
Apr
(39) |
May
(18) |
Jun
(14) |
Jul
(20) |
Aug
(31) |
Sep
(11) |
Oct
(35) |
Nov
(3) |
Dec
(10) |
| 2020 |
Jan
(32) |
Feb
(16) |
Mar
(10) |
Apr
(22) |
May
(2) |
Jun
(34) |
Jul
(1) |
Aug
(8) |
Sep
(36) |
Oct
(16) |
Nov
(13) |
Dec
(10) |
| 2021 |
Jan
(16) |
Feb
(23) |
Mar
(45) |
Apr
(28) |
May
(6) |
Jun
(17) |
Jul
(8) |
Aug
(1) |
Sep
(2) |
Oct
(35) |
Nov
|
Dec
(5) |
| 2022 |
Jan
|
Feb
(17) |
Mar
(23) |
Apr
(23) |
May
(9) |
Jun
(8) |
Jul
|
Aug
|
Sep
(7) |
Oct
(5) |
Nov
(16) |
Dec
(4) |
| 2023 |
Jan
|
Feb
|
Mar
(3) |
Apr
|
May
(1) |
Jun
(4) |
Jul
(1) |
Aug
|
Sep
(2) |
Oct
(1) |
Nov
|
Dec
|
| 2024 |
Jan
(7) |
Feb
(13) |
Mar
(18) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(2) |
Oct
(1) |
Nov
(5) |
Dec
(3) |
| 2025 |
Jan
|
Feb
|
Mar
|
Apr
(12) |
May
(12) |
Jun
(2) |
Jul
(3) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Dominik S. <Dom...@sy...> - 2019-11-20 10:36:20
|
Hi there, I can whitelist a rule (e. g., from the CRS) for a specific URL like so: SecRule REQUEST_URI "@beginsWith /fileupload/" "id:1920120,phase:1,nolog,pass,ctl:ruleRemoveById=920120" Is there a way to not remove the rule entirely, but just make it log instead of block? The only way I found was to copy and doctor the entire rule, which is hard to maintain. The use case is: Users sometimes upload files with weird names. I want to allow this, but still see it in the logs. Many thanks, Dominik -- Unsere Grundsätze zur Datenverarbeitung finden Sie unter: https://www.syracom.de/footernavi/grundsaetze-der-datenverarbeitung-bei-der-syracom-ag.html |
|
From: Cris H. <cri...@gm...> - 2019-10-28 13:49:42
|
This is from whoever's is hacking my phone . On Mon, Oct 28, 2019, 8:46 AM Chaim Sanders <cha...@gm...> wrote: > This looks to be a exceedingly broad rule. Probably the only route going > forward is to disable this rule. Failing that I think you could expect more > false positives. > > On Mon, Oct 28, 2019, 6:11 AM AbdelMonem ElMesery <abd...@tr...> > wrote: > >> Hi, >> >> We've implemented ModSecurity commercial rules on our API gateway server, >> and during a POST request that upload a PDF file, the request was blocked >> by this rule: >> >> BOTNET: "SLR: Common IRC Botnet Attack Command String Identified" >> >> The request was showing the below error: >> >> >> *ModSecurity: Access denied with code 403 (phase 2). * >> >> >> *Matched "Operator `Pm' with parameter` !tum !zero !lfi !rfi !e107 !sql >> !osco !zen !adm !op !oscoo !sqle !whmz !cmdlfi !cmde107 !cmdxml' against >> variable `REQUEST_BODY' form-data; name="bu (229583 characters omitted)' ) * >> >> *[msg "SLR: Common IRC Botnet Attack Command String Identified"] [data >> "Matched Data: !sql found within REQUEST_BODY: * >> >> *----------------------------099685253547753370295846\x0d\x0aContent-Disposition: >> form-data; name="buffer"; * >> >> *filename="1571931264160-1-test error pdf.pdf"\x0d\x0aConten (93192 >> characters omitted)"] [severity "2"] [ver "SLR"] [maturity "8"] [accuracy >> "8"] [tag "SLR/MALICIOUS_SOFTWARE/BOTNET"] [tag "WASCTC/WASC-01"] [tag >> "OWASP_TOP_10/A7"] [tag "PCI/5.1.1"] [tag "attack-botnet"] [uri >> "/onespan/packages/addDocument"] [ref "o78051,4v491,93348t:urlDecodeUni"], >> request: "POST /onespan/packages/addDocument HTTP/1.1"* >> >> >> Any advise on the root cause of this pdf being blocked. >> >> >> Regards, >> Ali >> >> _______________________________________________ >> mod-security-users mailing list >> mod...@li... >> https://lists.sourceforge.net/lists/listinfo/mod-security-users >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: >> http://www.modsecurity.org/projects/commercial/rules/ >> http://www.modsecurity.org/projects/commercial/support/ >> > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > |
|
From: Chaim S. <cha...@gm...> - 2019-10-28 13:44:46
|
This looks to be a exceedingly broad rule. Probably the only route going forward is to disable this rule. Failing that I think you could expect more false positives. On Mon, Oct 28, 2019, 6:11 AM AbdelMonem ElMesery <abd...@tr...> wrote: > Hi, > > We've implemented ModSecurity commercial rules on our API gateway server, > and during a POST request that upload a PDF file, the request was blocked > by this rule: > > BOTNET: "SLR: Common IRC Botnet Attack Command String Identified" > > The request was showing the below error: > > > *ModSecurity: Access denied with code 403 (phase 2). * > > > *Matched "Operator `Pm' with parameter` !tum !zero !lfi !rfi !e107 !sql > !osco !zen !adm !op !oscoo !sqle !whmz !cmdlfi !cmde107 !cmdxml' against > variable `REQUEST_BODY' form-data; name="bu (229583 characters omitted)' ) * > > *[msg "SLR: Common IRC Botnet Attack Command String Identified"] [data > "Matched Data: !sql found within REQUEST_BODY: * > > *----------------------------099685253547753370295846\x0d\x0aContent-Disposition: > form-data; name="buffer"; * > > *filename="1571931264160-1-test error pdf.pdf"\x0d\x0aConten (93192 > characters omitted)"] [severity "2"] [ver "SLR"] [maturity "8"] [accuracy > "8"] [tag "SLR/MALICIOUS_SOFTWARE/BOTNET"] [tag "WASCTC/WASC-01"] [tag > "OWASP_TOP_10/A7"] [tag "PCI/5.1.1"] [tag "attack-botnet"] [uri > "/onespan/packages/addDocument"] [ref "o78051,4v491,93348t:urlDecodeUni"], > request: "POST /onespan/packages/addDocument HTTP/1.1"* > > > Any advise on the root cause of this pdf being blocked. > > > Regards, > Ali > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > |
|
From: AbdelMonem E. <abd...@tr...> - 2019-10-28 13:08:20
|
Hi, We've implemented ModSecurity commercial rules on our API gateway server, and during a POST request that upload a PDF file, the request was blocked by this rule: BOTNET: "SLR: Common IRC Botnet Attack Command String Identified" The request was showing the below error: ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Pm' with parameter` !tum !zero !lfi !rfi !e107 !sql !osco !zen !adm !op !oscoo !sqle !whmz !cmdlfi !cmde107 !cmdxml' against variable `REQUEST_BODY' form-data; name="bu (229583 characters omitted)' ) [msg "SLR: Common IRC Botnet Attack Command String Identified"] [data "Matched Data: !sql found within REQUEST_BODY: ----------------------------099685253547753370295846\x0d\x0aContent-Disposition: form-data; name="buffer"; filename="1571931264160-1-test error pdf.pdf"\x0d\x0aConten (93192 characters omitted)"] [severity "2"] [ver "SLR"] [maturity "8"] [accuracy "8"] [tag "SLR/MALICIOUS_SOFTWARE/BOTNET"] [tag "WASCTC/WASC-01"] [tag "OWASP_TOP_10/A7"] [tag "PCI/5.1.1"] [tag "attack-botnet"] [uri "/onespan/packages/addDocument"] [ref "o78051,4v491,93348t:urlDecodeUni"], request: "POST /onespan/packages/addDocument HTTP/1.1" Any advise on the root cause of this pdf being blocked. Regards, Ali |
|
From: Christian F. <chr...@ne...> - 2019-10-10 09:28:54
|
You can enable the debug log and follow the rules there. Generally, the config files are executed top down in 5 iterations for all the phases. If can't get to solve this, I suggest you start to read up on my ModSec / CRS tutorials to get a decent understanding how this works. https://www.netnea.com/cms/apache-tutorials/ Good luck, Christian On Thu, Oct 10, 2019 at 09:16:00AM +0000, Madden, Joe via mod-security-users wrote: > Hi there, > > I put it in the modsecurity_crs_10_config.conf at the end of the file - I'm not sure where the crs include statement is in order to put it before or after. > > Is there anywhere that shows the excitation of the configuration files - Its hard to understand. > > Should I put this in the virtual host configuration - Is that the last place of execution? > > Thanks > > Joe. > > > -----Original Message----- > From: Christian Folini <chr...@ne...> > Sent: 10 October 2019 09:03 > To: Madden, Joe via mod-security-users <mod...@li...> > Subject: Re: [mod-security-users] Rule breaks access to website > > Joe, > > Did you put that rule 131 before the CRS include in the configuration? > > It may be that you try to sanitize after the alert has been written. > > Christian > > > On Thu, Oct 10, 2019 at 07:53:58AM +0000, Madden, Joe via mod-security-users wrote: > > Hi All, > > > > So adding pass workds but it doesn't work as expected. > > > > For example, I have a login page and I use ''''select * fromusers '''' to trigger the SQL injection rule 942190 > > > > With this in place: > > > > # Never log passwords > > SecAction "nolog,pass,phase:2,id:131,sanitiseArg:password,sanitiseArg:newPassword,sanitiseArg:oldPassword" > > > > The website is accessible, but the log entry Is not sanitised: > > > > Message: Warning. Pattern match "(?i:(?:[\"'`](?:;?\\s*?(?:having|select|union)\\b\\s*?[^\\s]|\\s*?!\\s*?[\"'`\\w])|(?:c(?:onnection_id|urrent_user)|database)\\s*?\\([^\\)]*?|u(?:nion(?:[\\w(\\s]*?select| select @)|ser\\s*?\\([^\\)]*?)|s(?:chema\\s*?\\([^\\)]*?|elect.*?\\w?user\\()|in ..." at ARGS:password. [file "/etc/httpd/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "190"] [id "942190"] [msg "Detects MSSQL code execution and information gathering attempts"] [data "Matched Data: 'select* found within ARGS:password: ''''select* fromusers''''"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] > > > > Am I missing something in order to blank out the matched data fields? > > > > Thanks > > > > Joe. > > > > -----Original Message----- > > From: Madden, Joe via mod-security-users <mod...@li...> > > Sent: 10 October 2019 08:21 > > To: mod...@li... > > Cc: Madden, Joe <Joe...@mo...> > > Subject: Re: [mod-security-users] Rule breaks access to website > > > > Thank you all - I'll give it a try today! > > > > Joe. > > > > -----Original Message----- > > From: Reindl Harald <h.r...@th...> > > Sent: 09 October 2019 15:53 > > To: mod...@li... > > Subject: Re: [mod-security-users] Rule breaks access to website > > > > > > > > Am 09.10.19 um 16:28 schrieb Madden, Joe via mod-security-users: > > > Hi there, > > > > > > I was kinda following this example here: > > > > > > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FSpiderLabs%2FModSecurity%2Fwiki%2FReference-Manual-(v2.x&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=KrWjJgm%2BHfcXNwe9X2rC2zVRmmaDIhd1wStvjPFl8Z8%3D&reserved=0) > > > > > > Where would the pass go just after nolog,? > > > > it don't matter > > > > ,phase:1,pass,nolog, > > ,phase:1,nolog,pass, > > ,pass,phase:1,nolog, > > > > it's all the same > > > > > > _______________________________________________ > > mod-security-users mailing list > > mod...@li... > > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=sve64hxQhst0nOADJ6H2d6hwwHGRgtH8rrnidhIbo%2Fo%3D&reserved=0 > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=MToW3lFKXqmX3vGc9dzAvEex4QT67ci1CiSu9GqAS2Q%3D&reserved=0 > > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=WdsnLMLiOSNZyoFenKEhKqoKNHsn7kTNfwn1j0gZAQE%3D&reserved=0 > > > > > > _______________________________________________ > > mod-security-users mailing list > > mod...@li... > > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=sve64hxQhst0nOADJ6H2d6hwwHGRgtH8rrnidhIbo%2Fo%3D&reserved=0 > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=MToW3lFKXqmX3vGc9dzAvEex4QT67ci1CiSu9GqAS2Q%3D&reserved=0 > > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=WdsnLMLiOSNZyoFenKEhKqoKNHsn7kTNfwn1j0gZAQE%3D&reserved=0 > > > > > > _______________________________________________ > > mod-security-users mailing list > > mod...@li... > > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=sve64hxQhst0nOADJ6H2d6hwwHGRgtH8rrnidhIbo%2Fo%3D&reserved=0 > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=MToW3lFKXqmX3vGc9dzAvEex4QT67ci1CiSu9GqAS2Q%3D&reserved=0 > > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=WdsnLMLiOSNZyoFenKEhKqoKNHsn7kTNfwn1j0gZAQE%3D&reserved=0 > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=sve64hxQhst0nOADJ6H2d6hwwHGRgtH8rrnidhIbo%2Fo%3D&reserved=0 > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=MToW3lFKXqmX3vGc9dzAvEex4QT67ci1CiSu9GqAS2Q%3D&reserved=0 > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca150a1ca53474126e20608d74d58759a%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=WdsnLMLiOSNZyoFenKEhKqoKNHsn7kTNfwn1j0gZAQE%3D&reserved=0 > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ |
|
From: Christian F. <chr...@ne...> - 2019-10-10 08:03:36
|
Joe, Did you put that rule 131 before the CRS include in the configuration? It may be that you try to sanitize after the alert has been written. Christian On Thu, Oct 10, 2019 at 07:53:58AM +0000, Madden, Joe via mod-security-users wrote: > Hi All, > > So adding pass workds but it doesn't work as expected. > > For example, I have a login page and I use ''''select * fromusers '''' to trigger the SQL injection rule 942190 > > With this in place: > > # Never log passwords > SecAction "nolog,pass,phase:2,id:131,sanitiseArg:password,sanitiseArg:newPassword,sanitiseArg:oldPassword" > > The website is accessible, but the log entry Is not sanitised: > > Message: Warning. Pattern match "(?i:(?:[\"'`](?:;?\\s*?(?:having|select|union)\\b\\s*?[^\\s]|\\s*?!\\s*?[\"'`\\w])|(?:c(?:onnection_id|urrent_user)|database)\\s*?\\([^\\)]*?|u(?:nion(?:[\\w(\\s]*?select| select @)|ser\\s*?\\([^\\)]*?)|s(?:chema\\s*?\\([^\\)]*?|elect.*?\\w?user\\()|in ..." at ARGS:password. [file "/etc/httpd/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "190"] [id "942190"] [msg "Detects MSSQL code execution and information gathering attempts"] [data "Matched Data: 'select* found within ARGS:password: ''''select* fromusers''''"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] > > Am I missing something in order to blank out the matched data fields? > > Thanks > > Joe. > > -----Original Message----- > From: Madden, Joe via mod-security-users <mod...@li...> > Sent: 10 October 2019 08:21 > To: mod...@li... > Cc: Madden, Joe <Joe...@mo...> > Subject: Re: [mod-security-users] Rule breaks access to website > > Thank you all - I'll give it a try today! > > Joe. > > -----Original Message----- > From: Reindl Harald <h.r...@th...> > Sent: 09 October 2019 15:53 > To: mod...@li... > Subject: Re: [mod-security-users] Rule breaks access to website > > > > Am 09.10.19 um 16:28 schrieb Madden, Joe via mod-security-users: > > Hi there, > > > > I was kinda following this example here: > > > > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FSpiderLabs%2FModSecurity%2Fwiki%2FReference-Manual-(v2.x&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=eAKku%2FES4qBTsxoMbh7Gjj6cGfdD6TxWOuqi5YsZtb0%3D&reserved=0) > > > > Where would the pass go just after nolog,? > > it don't matter > > ,phase:1,pass,nolog, > ,phase:1,nolog,pass, > ,pass,phase:1,nolog, > > it's all the same > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=PmFMFalMqGYPt5fbg%2FP1%2B7JzuPrb7fyQyriU8NkKtjY%3D&reserved=0 > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=7f654dDQwtspGxvh7FlJnORKrY4tBe%2FjdT5okic5dhg%3D&reserved=0 > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=1yn8Q3vNZ11lPxUWsDcCtB6utZbUKEe4%2FwpOu6zHkns%3D&reserved=0 > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=PmFMFalMqGYPt5fbg%2FP1%2B7JzuPrb7fyQyriU8NkKtjY%3D&reserved=0 > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=7f654dDQwtspGxvh7FlJnORKrY4tBe%2FjdT5okic5dhg%3D&reserved=0 > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=1yn8Q3vNZ11lPxUWsDcCtB6utZbUKEe4%2FwpOu6zHkns%3D&reserved=0 > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ |
|
From: Madden, J. <Joe...@mo...> - 2019-10-10 07:54:10
|
Hi All, So adding pass workds but it doesn't work as expected. For example, I have a login page and I use ''''select * fromusers '''' to trigger the SQL injection rule 942190 With this in place: # Never log passwords SecAction "nolog,pass,phase:2,id:131,sanitiseArg:password,sanitiseArg:newPassword,sanitiseArg:oldPassword" The website is accessible, but the log entry Is not sanitised: Message: Warning. Pattern match "(?i:(?:[\"'`](?:;?\\s*?(?:having|select|union)\\b\\s*?[^\\s]|\\s*?!\\s*?[\"'`\\w])|(?:c(?:onnection_id|urrent_user)|database)\\s*?\\([^\\)]*?|u(?:nion(?:[\\w(\\s]*?select| select @)|ser\\s*?\\([^\\)]*?)|s(?:chema\\s*?\\([^\\)]*?|elect.*?\\w?user\\()|in ..." at ARGS:password. [file "/etc/httpd/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "190"] [id "942190"] [msg "Detects MSSQL code execution and information gathering attempts"] [data "Matched Data: 'select* found within ARGS:password: ''''select* fromusers''''"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] Am I missing something in order to blank out the matched data fields? Thanks Joe. -----Original Message----- From: Madden, Joe via mod-security-users <mod...@li...> Sent: 10 October 2019 08:21 To: mod...@li... Cc: Madden, Joe <Joe...@mo...> Subject: Re: [mod-security-users] Rule breaks access to website Thank you all - I'll give it a try today! Joe. -----Original Message----- From: Reindl Harald <h.r...@th...> Sent: 09 October 2019 15:53 To: mod...@li... Subject: Re: [mod-security-users] Rule breaks access to website Am 09.10.19 um 16:28 schrieb Madden, Joe via mod-security-users: > Hi there, > > I was kinda following this example here: > > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FSpiderLabs%2FModSecurity%2Fwiki%2FReference-Manual-(v2.x&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=eAKku%2FES4qBTsxoMbh7Gjj6cGfdD6TxWOuqi5YsZtb0%3D&reserved=0) > > Where would the pass go just after nolog,? it don't matter ,phase:1,pass,nolog, ,phase:1,nolog,pass, ,pass,phase:1,nolog, it's all the same _______________________________________________ mod-security-users mailing list mod...@li... https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=PmFMFalMqGYPt5fbg%2FP1%2B7JzuPrb7fyQyriU8NkKtjY%3D&reserved=0 Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=7f654dDQwtspGxvh7FlJnORKrY4tBe%2FjdT5okic5dhg%3D&reserved=0 https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=1yn8Q3vNZ11lPxUWsDcCtB6utZbUKEe4%2FwpOu6zHkns%3D&reserved=0 _______________________________________________ mod-security-users mailing list mod...@li... https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=PmFMFalMqGYPt5fbg%2FP1%2B7JzuPrb7fyQyriU8NkKtjY%3D&reserved=0 Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=7f654dDQwtspGxvh7FlJnORKrY4tBe%2FjdT5okic5dhg%3D&reserved=0 https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ca061d2cc4db8481a7d2408d74d52861e%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=1yn8Q3vNZ11lPxUWsDcCtB6utZbUKEe4%2FwpOu6zHkns%3D&reserved=0 |
|
From: Paul B. <pau...@ou...> - 2019-10-10 06:26:25
|
Manuel, Sorry, it's been a couple of years since I looked at the log sanitisation behaviour: In mod-security 2.9.x the audit log can be sanitised, but the error log isn't (can't remember whether the full audit report is sanitised). This is described in: https://github.com/SpiderLabs/ModSecurity/issues/1447 Looks like it's been/going to be addressed in v3 but not v2. Cheers, Paul ________________________________ From: Manuel Spartan <spa...@gm...> Sent: Wednesday, October 9, 2019 5:06:36 PM To: mod...@li... <mod...@li...> Subject: Re: [mod-security-users] ingesting mod-security audit log to elasticsearch (or other system) Absolutely, you can use logstash to overwrite the original message with a sanitized version, there may be leaks in elasticsearch or logstash logs under some error conditions. Modsecurity can sanitize the auditlog, I would advice to use the sanitization actions. * sanitiseArg<https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseArg> * sanitiseMatched<https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseMatched> * sanitiseMatchedBytes<https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseMatchedBytes> * sanitiseRequestHeader<https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseRequestHeader> * sanitiseResponseHeader<https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseResponseHeader> El mié., 9 oct. 2019 a las 11:59, Paul Beckett (<pau...@ou...<mailto:pau...@ou...>>) escribió: Thanks for the great info/ideas, I really appreciate this. Sorry, I'd missed the JSON log format contribution, that should indeed parsing/mapping the data much easier. I'm fortunately not affected by PCI, but GDPR is a potential issue. As I understand it sanitisation only applies to the error log, and not the audit report, which for me, (and I presume others) creates some challenges. One thought I'd had was to pipe the serialised audit log through elastics beats (or similar) via logstash to elastic search. I think this would give me the opportunity to sanitise or encrypt any sensitive fields before they were stored/touched the disk. Best Regards, Paul ________________________________ From: Manuel Spartan <spa...@gm...<mailto:spa...@gm...>> Sent: Wednesday, October 9, 2019 2:51:36 PM To: mod...@li...<mailto:mod...@li...> <mod...@li...<mailto:mod...@li...>> Subject: Re: [mod-security-users] ingesting mod-security audit log to elasticsearch (or other system) Hi Paul, other than the full payloads the info is already in the error log which is a many times smaller and easier to process, depending on the size of your implementation and the kind of transactions you handle processing the audit log even in json format, it is at least a factor of magnitude heavier than the error log. I prefer to generate links to the auditlog based on the transaction id in the error log on my monitoring console as I only had to check the audit log for forensics or when payloads are too big. There is one little detail that may bite you hard PII and financial data on audit logs, be careful in some cases it may be better to just drop the request body or response body parts from the audit log. GDPR and PCI won’t like the audit log. Regards, Manuel Sent from my iPhone On Oct 9, 2019, at 5:39 AM, Robert Paprocki <rpa...@fe...<mailto:rpa...@fe...>> wrote: We had this exact problem, which is why we wrote JSON audit logging for 2.x releases. It should still be available in the 2.9.x series of releases. https://www.dreamhost.com/blog/making-sense-of-modsecurity-json-audit-logs/ https://www.feistyduck.com/library/modsecurity-handbook-2ed-free/online/ch04-logging.html https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecAuditLogFormat On Oct 9, 2019, at 00:27, Paul Beckett <pau...@ou...<mailto:pau...@ou...>> wrote: I'm interested in ingesting the mod-security audit log (generated by modsecurity 2.9.x) into elasticsearch or other system. However, parsing the audit log format looks like it will require a substantial amount of work. I was hoping that someone might have solved this problem, and that I could reuse an existing solution. I've spent a while googling, trying to find what existing solutions exist. The only thing I've managed to find are a couple of blog posts with github links from several years ago: https://github.com/bitsofinfo/logstash-modsecurity<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbitsofinfo%2Flogstash-modsecurity&data=02%7C01%7CP.Beckett%40uea.ac.uk%7C2373f6ec44b248380f8508d74c84b3c7%7Cc65f8795ba3d43518a070865e5d8f090%7C0%7C0%7C637062005146617288&sdata=ECTTZfGFdDHiwMzps20ss9i%2FEX1m7DD3LF5is0LI4%2BM%3D&reserved=0> https://github.com/bitsofinfo/fluentd-modsecurity Before I dive to far down this rabbit hole, I was wondering if anyone else out there in the community had a solution for this, and if so whether they would be willing to share their high level approach, and/or any implementation details. Thanks, Paul _______________________________________________ mod-security-users mailing list mod...@li...<mailto:mod...@li...> https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ _______________________________________________ mod-security-users mailing list mod...@li...<mailto:mod...@li...> https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ _______________________________________________ mod-security-users mailing list mod...@li...<mailto:mod...@li...> https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ |
|
From: Manuel S. <spa...@gm...> - 2019-10-09 16:06:56
|
Absolutely, you can use logstash to overwrite the original message with a sanitized version, there may be leaks in elasticsearch or logstash logs under some error conditions. Modsecurity can sanitize the auditlog, I would advice to use the sanitization actions. - sanitiseArg <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseArg> - sanitiseMatched <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseMatched> - sanitiseMatchedBytes <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseMatchedBytes> - sanitiseRequestHeader <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseRequestHeader> - sanitiseResponseHeader <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#sanitiseResponseHeader> El mié., 9 oct. 2019 a las 11:59, Paul Beckett (<pau...@ou...>) escribió: > Thanks for the great info/ideas, I really appreciate this. > > Sorry, I'd missed the JSON log format contribution, that should indeed > parsing/mapping the data much easier. > > I'm fortunately not affected by PCI, but GDPR is a potential issue. As I > understand it sanitisation only applies to the error log, and not the audit > report, which for me, (and I presume others) creates some challenges. One > thought I'd had was to pipe the serialised audit log through elastics beats > (or similar) via logstash to elastic search. I think this would give me the > opportunity to sanitise or encrypt any sensitive fields before they were > stored/touched the disk. > > Best Regards, > Paul > > ------------------------------ > *From:* Manuel Spartan <spa...@gm...> > *Sent:* Wednesday, October 9, 2019 2:51:36 PM > *To:* mod...@li... < > mod...@li...> > *Subject:* Re: [mod-security-users] ingesting mod-security audit log to > elasticsearch (or other system) > > Hi Paul, other than the full payloads the info is already in the error log > which is a many times smaller and easier to process, depending on the size > of your implementation and the kind of transactions you handle processing > the audit log even in json format, it is at least a factor of magnitude > heavier than the error log. > I prefer to generate links to the auditlog based on the transaction id in > the error log on my monitoring console as I only had to check the audit log > for forensics or when payloads are too big. > There is one little detail that may bite you hard PII and financial data > on audit logs, be careful in some cases it may be better to just drop the > request body or response body parts from the audit log. GDPR and PCI won’t > like the audit log. > Regards, > Manuel > > Sent from my iPhone > > On Oct 9, 2019, at 5:39 AM, Robert Paprocki < > rpa...@fe...> wrote: > > We had this exact problem, which is why we wrote JSON audit logging for > 2.x releases. It should still be available in the 2.9.x series of > releases. > > https://www.dreamhost.com/blog/making-sense-of-modsecurity-json-audit-logs/ > > > https://www.feistyduck.com/library/modsecurity-handbook-2ed-free/online/ch04-logging.html > > > https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecAuditLogFormat > > On Oct 9, 2019, at 00:27, Paul Beckett <pau...@ou...> wrote: > > > I'm interested in ingesting the mod-security audit log (generated by > modsecurity 2.9.x) into elasticsearch or other system. However, parsing the > audit log format looks like it will require a substantial amount of work. I > was hoping that someone might have solved this problem, and that I could > reuse an existing solution. > > I've spent a while googling, trying to find what existing solutions exist. > The only thing I've managed to find are a couple of blog posts with github > links from several years ago: > https://github.com/bitsofinfo/logstash-modsecurity > <https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbitsofinfo%2Flogstash-modsecurity&data=02%7C01%7CP.Beckett%40uea.ac.uk%7C2373f6ec44b248380f8508d74c84b3c7%7Cc65f8795ba3d43518a070865e5d8f090%7C0%7C0%7C637062005146617288&sdata=ECTTZfGFdDHiwMzps20ss9i%2FEX1m7DD3LF5is0LI4%2BM%3D&reserved=0> > https://github.com/bitsofinfo/fluentd-modsecurity > > Before I dive to far down this rabbit hole, I was wondering if anyone else > out there in the community had a solution for this, and if so whether they > would be willing to share their high level approach, and/or any > implementation details. > > Thanks, > Paul > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > |
|
From: Paul B. <pau...@ou...> - 2019-10-09 15:57:40
|
Thanks for the great info/ideas, I really appreciate this. Sorry, I'd missed the JSON log format contribution, that should indeed parsing/mapping the data much easier. I'm fortunately not affected by PCI, but GDPR is a potential issue. As I understand it sanitisation only applies to the error log, and not the audit report, which for me, (and I presume others) creates some challenges. One thought I'd had was to pipe the serialised audit log through elastics beats (or similar) via logstash to elastic search. I think this would give me the opportunity to sanitise or encrypt any sensitive fields before they were stored/touched the disk. Best Regards, Paul ________________________________ From: Manuel Spartan <spa...@gm...> Sent: Wednesday, October 9, 2019 2:51:36 PM To: mod...@li... <mod...@li...> Subject: Re: [mod-security-users] ingesting mod-security audit log to elasticsearch (or other system) Hi Paul, other than the full payloads the info is already in the error log which is a many times smaller and easier to process, depending on the size of your implementation and the kind of transactions you handle processing the audit log even in json format, it is at least a factor of magnitude heavier than the error log. I prefer to generate links to the auditlog based on the transaction id in the error log on my monitoring console as I only had to check the audit log for forensics or when payloads are too big. There is one little detail that may bite you hard PII and financial data on audit logs, be careful in some cases it may be better to just drop the request body or response body parts from the audit log. GDPR and PCI won’t like the audit log. Regards, Manuel Sent from my iPhone On Oct 9, 2019, at 5:39 AM, Robert Paprocki <rpa...@fe...<mailto:rpa...@fe...>> wrote: We had this exact problem, which is why we wrote JSON audit logging for 2.x releases. It should still be available in the 2.9.x series of releases. https://www.dreamhost.com/blog/making-sense-of-modsecurity-json-audit-logs/ https://www.feistyduck.com/library/modsecurity-handbook-2ed-free/online/ch04-logging.html https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecAuditLogFormat On Oct 9, 2019, at 00:27, Paul Beckett <pau...@ou...<mailto:pau...@ou...>> wrote: I'm interested in ingesting the mod-security audit log (generated by modsecurity 2.9.x) into elasticsearch or other system. However, parsing the audit log format looks like it will require a substantial amount of work. I was hoping that someone might have solved this problem, and that I could reuse an existing solution. I've spent a while googling, trying to find what existing solutions exist. The only thing I've managed to find are a couple of blog posts with github links from several years ago: https://github.com/bitsofinfo/logstash-modsecurity<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbitsofinfo%2Flogstash-modsecurity&data=02%7C01%7CP.Beckett%40uea.ac.uk%7C2373f6ec44b248380f8508d74c84b3c7%7Cc65f8795ba3d43518a070865e5d8f090%7C0%7C0%7C637062005146617288&sdata=ECTTZfGFdDHiwMzps20ss9i%2FEX1m7DD3LF5is0LI4%2BM%3D&reserved=0> https://github.com/bitsofinfo/fluentd-modsecurity Before I dive to far down this rabbit hole, I was wondering if anyone else out there in the community had a solution for this, and if so whether they would be willing to share their high level approach, and/or any implementation details. Thanks, Paul _______________________________________________ mod-security-users mailing list mod...@li...<mailto:mod...@li...> https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ _______________________________________________ mod-security-users mailing list mod...@li...<mailto:mod...@li...> https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ |
|
From: Reindl H. <h.r...@th...> - 2019-10-09 15:11:18
|
Am 09.10.19 um 16:28 schrieb Madden, Joe via mod-security-users: > Hi there, > > I was kinda following this example here: > > https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x) > > Where would the pass go just after nolog,? it don't matter ,phase:1,pass,nolog, ,phase:1,nolog,pass, ,pass,phase:1,nolog, it's all the same |
|
From: Ervin H. <ai...@gm...> - 2019-10-09 14:54:19
|
Hi Joe, On Wed, Oct 09, 2019 at 02:28:41PM +0000, Madden, Joe via mod-security-users wrote: > Hi there, > > I was kinda following this example here: > > https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x) > > Where would the pass go just after nolog,? you can place at everywhere, there isn't any restriction. Note, that there is a recommended but not mandatory order: https://github.com/SpiderLabs/owasp-modsecurity-crs/wiki/Order-of-ModSecurity-Actions-in-CRS-rules a. |
|
From: Christian F. <chr...@ne...> - 2019-10-09 14:53:16
|
The order of the actions does not matter. For the book, I followed the order we also use in CRS: https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.3/dev/CONTRIBUTING.md the proposed order for actions is: id phase allow | block | deny | drop | pass | proxy | redirect status capture t:xxx log nolog auditlog noauditlog msg logdata tag sanitiseArg sanitiseRequestHeader sanitiseMatched sanitiseMatchedBytes ctl ver severity multiMatch initcol setenv setvar expirevar chain skip skipAfter Ahoj, Christian On Wed, Oct 09, 2019 at 02:28:41PM +0000, Madden, Joe via mod-security-users wrote: > Hi there, > > I was kinda following this example here: > > https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x) > > Where would the pass go just after nolog,? > > Thanks, > > Joe. > > > -----Original Message----- > From: Christian Folini <chr...@ne...> > Sent: 09 October 2019 14:59 > To: Madden, Joe via mod-security-users <mod...@li...> > Subject: Re: [mod-security-users] Rule breaks access to website > > Hey Joe, > > You do not state "pass" in your rule. So maybe your SecDefaultAction applies. > > Ahoj, > > Christian > > On Wed, Oct 09, 2019 at 01:53:56PM +0000, Madden, Joe via mod-security-users wrote: > > Hi there, > > > > I'm trying to hide passwords for being audited to the modsec_audit.log therefor I put this rule into modsecurity_crs_10_config.conf for apache: > > > > # Never log passwords > > #SecAction "nolog,phase:2,id:131,sanitiseArg:password,sanitiseArg:newPassword,sanitiseArg:oldPassword" > > > > The website returns constant 403 when this rule is enabled, I can't seem to figure out why. > > > > Is this the right way to achieve what I am trying to do? Am I putting it in the correct place? > > > > Thanks > > > > Joe. > > > > _______________________________________________ > > mod-security-users mailing list > > mod...@li... > > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7C4525123b50ff437f622508d74cc10895%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=lKjSvxmEijV9FRZKA%2FTjOb1fBdLtA1E%2FcBXim%2F7LbKY%3D&reserved=0 > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7C4525123b50ff437f622508d74cc10895%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=LQuLxppCuS%2B3IcfVNDXberT7M3KFZGHllTI5sIb5BFU%3D&reserved=0 > > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7C4525123b50ff437f622508d74cc10895%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=p2ByPA4dpkrIIYWsjr5RrJ2xi4KcUuM9QLr3sazBTQs%3D&reserved=0 > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&data=01%7C01%7Cjoe.madden%40mottmac.com%7C4525123b50ff437f622508d74cc10895%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=lKjSvxmEijV9FRZKA%2FTjOb1fBdLtA1E%2FcBXim%2F7LbKY%3D&reserved=0 > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7C4525123b50ff437f622508d74cc10895%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=LQuLxppCuS%2B3IcfVNDXberT7M3KFZGHllTI5sIb5BFU%3D&reserved=0 > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&data=01%7C01%7Cjoe.madden%40mottmac.com%7C4525123b50ff437f622508d74cc10895%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=p2ByPA4dpkrIIYWsjr5RrJ2xi4KcUuM9QLr3sazBTQs%3D&reserved=0 > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ |
|
From: Christian F. <chr...@ne...> - 2019-10-09 13:59:31
|
Hey Joe, You do not state "pass" in your rule. So maybe your SecDefaultAction applies. Ahoj, Christian On Wed, Oct 09, 2019 at 01:53:56PM +0000, Madden, Joe via mod-security-users wrote: > Hi there, > > I'm trying to hide passwords for being audited to the modsec_audit.log therefor I put this rule into modsecurity_crs_10_config.conf for apache: > > # Never log passwords > #SecAction "nolog,phase:2,id:131,sanitiseArg:password,sanitiseArg:newPassword,sanitiseArg:oldPassword" > > The website returns constant 403 when this rule is enabled, I can't seem to figure out why. > > Is this the right way to achieve what I am trying to do? Am I putting it in the correct place? > > Thanks > > Joe. > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ |
|
From: Madden, J. <Joe...@mo...> - 2019-10-09 13:54:06
|
Hi there, I'm trying to hide passwords for being audited to the modsec_audit.log therefor I put this rule into modsecurity_crs_10_config.conf for apache: # Never log passwords #SecAction "nolog,phase:2,id:131,sanitiseArg:password,sanitiseArg:newPassword,sanitiseArg:oldPassword" The website returns constant 403 when this rule is enabled, I can't seem to figure out why. Is this the right way to achieve what I am trying to do? Am I putting it in the correct place? Thanks Joe. |
|
From: Manuel S. <spa...@gm...> - 2019-10-09 13:51:49
|
Hi Paul, other than the full payloads the info is already in the error log which is a many times smaller and easier to process, depending on the size of your implementation and the kind of transactions you handle processing the audit log even in json format, it is at least a factor of magnitude heavier than the error log. I prefer to generate links to the auditlog based on the transaction id in the error log on my monitoring console as I only had to check the audit log for forensics or when payloads are too big. There is one little detail that may bite you hard PII and financial data on audit logs, be careful in some cases it may be better to just drop the request body or response body parts from the audit log. GDPR and PCI won’t like the audit log. Regards, Manuel Sent from my iPhone > On Oct 9, 2019, at 5:39 AM, Robert Paprocki <rpa...@fe...> wrote: > > We had this exact problem, which is why we wrote JSON audit logging for 2.x releases. It should still be available in the 2.9.x series of releases. > > https://www.dreamhost.com/blog/making-sense-of-modsecurity-json-audit-logs/ > > https://www.feistyduck.com/library/modsecurity-handbook-2ed-free/online/ch04-logging.html > > https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecAuditLogFormat > >> On Oct 9, 2019, at 00:27, Paul Beckett <pau...@ou...> wrote: >> >> >> I'm interested in ingesting the mod-security audit log (generated by modsecurity 2.9.x) into elasticsearch or other system. However, parsing the audit log format looks like it will require a substantial amount of work. I was hoping that someone might have solved this problem, and that I could reuse an existing solution. >> >> I've spent a while googling, trying to find what existing solutions exist. >> The only thing I've managed to find are a couple of blog posts with github links from several years ago: >> https://github.com/bitsofinfo/logstash-modsecurity >> https://github.com/bitsofinfo/fluentd-modsecurity >> >> Before I dive to far down this rabbit hole, I was wondering if anyone else out there in the community had a solution for this, and if so whether they would be willing to share their high level approach, and/or any implementation details. >> >> Thanks, >> Paul >> _______________________________________________ >> mod-security-users mailing list >> mod...@li... >> https://lists.sourceforge.net/lists/listinfo/mod-security-users >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: >> http://www.modsecurity.org/projects/commercial/rules/ >> http://www.modsecurity.org/projects/commercial/support/ > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ |
|
From: Christian F. <chr...@ne...> - 2019-10-09 13:24:13
|
Homesh, This is a very old recipe and I doubt it will work out of the box. But you can always try. If I was to setup a similar thing, I would easily spend a day or more on tweaking and debugging. Good luck! ... and please report back with your experience. We're all curious to learn about real world uses of the more advanced ModSec features. Cheers, Christian On Wed, Oct 09, 2019 at 06:42:44PM +0530, homesh joshi wrote: > Hi Christian, > > Thanks for the quick reply. > > I am trying to implement rules mentioned here > <https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-advanced-topic-of-the-week-detecting-browser-fingerprint-changes-during-sessions/> > > Here are the all the rules. > > #Step1 > ## This rule will identify the outbound Set-Cookie SessionID data and > capture it in a setsid# > SecRule RESPONSE_HEADERS:/Set-Cookie2?/ > "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)" > "chain,phase:3,id:'881062',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar: > tx.ua=%{request_headers.user-agent}" > SecRule UNIQUE_ID "(.*)" > "t:none,t:sha1,t:hexEncode,capture,setvar:session.csrf_token=%{TX.1}" > > #Step 2 > SecContentInjection On > SecStreamOutBodyInspection On > SecResponseBodyAccess On > SecRule RESPONSE_STATUS "200" "chain,id:'881802',t:none,pass" > SecRule RESPONSE_HEADERS:Content-Type "@beginsWith text/html" > "chain,t:none,nolog" > SecRule &SESSION:KEY "@eq 1" "chain" > SecRule STREAM_OUTPUT_BODY "@rsub s/<\/body>/<script > type=\"text\/javascript\" > src=\"https\:\/\/www.abc123.com\/client.min.js\"><\/script>|0A|<\/body>/" > "capture,setvar:session.fingerprint_code_sent=1" > #Step 3 > ## -=[ Save the initial Browser Fingerprint Hash in the Session Collection > ]=-# > SecRule &SESSION:BROWSER_HASH "@eq 0" > "chain,id:'881803',phase:1,t:none,nolog,pass" > SecRule REQUEST_COOKIES:BROWSER_HASH ".*" > "setvar:session.browser_hash=%{matched_var}" > > #Step 4 > ## -=[ If Browser Fingerprint JS was sent previously, then enforce the # > existence of the browser_hash Cookie field. ]=-# > SecRule SESSION:FINGERPRINT_CODE_SENT "@eq 1" > "chain,id:'881804',phase:1,t:none,block,msg:'Warning: Browser Fingering > Cookie Missing.'" > SecRule &REQUEST_COOKIES:BROWSER_HASH "@eq 0" > SecRule SESSION:FINGERPRINT_CODE_SENT "@eq 1" > "chain,id:'881805',phase:1,t:none,block,msg:'Warning: Browser Fingering > Cookie Mismatch.',logdata:'Expected Browser Fingerprint: > %{session.browser_hash}. Browser Fingerprint Received: > %{request_cookies.browser_hash}'" > SecRule &REQUEST_COOKIES:BROWSER_HASH "@eq 1" "chain" > SecRule REQUEST_COOKIES:BROWSER_HASH "!@streq %{session.browser_hash}" > > Thanks, > Homesh > > > On Wed, Oct 9, 2019 at 5:46 PM Christian Folini <chr...@ne...> > wrote: > > > Hello Homesh, > > > > You do not have the code to inject the JS into the response. At least not > > in > > the rule snippet you provided. > > > > The last time I checked the whole CSRF injection and testing stuff, it was > > broken. But that was like 2 years ago. > > > > If the rule snippet you listed has a problem, then I would enable the > > DebugLog > > and follow the execution of this rule closely. It's a very complex rule an > > a > > lot can go wrong here. > > > > Cheers, > > > > Christian > > > > > > On Wed, Oct 09, 2019 at 05:35:16PM +0530, homesh joshi wrote: > > > Hi, > > > Now when I am testing the rule against the website I think the first rule > > > is not getting triggered. > > > > > > SecRule RESPONSE_HEADERS:/Set-Cookie2?/ > > > > > "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)" > > > > > "chain,phase:3,id:'881064',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar:' > > > tx.ua=%{request_headers.user-agent}' " > > > SecRule UNIQUE_ID "(.*)" > > > "t:none,t:sha1,t:hexEncode,capture,setvar:session.csrf_token=%{TX.1}" > > > > > > This should trigger as the response header set-cookie is present in the > > > response with PHPSESSID > > > e.g > > > A: homesh$ curl -k -i https://somesite.abcd.in 2>&1 | grep Set-Cookie > > > Set-Cookie: PHPSESSID=f26b72756916f074ab798270327d2c99; path=/ > > > > > > Not sure why it is not working. I don't see second rule injecting the JS > > > and I think it is because first rule is not getting triggered which > > should > > > capture "setsid" > > > > > > Please help. > > > > > > Thanks, > > > Homesh > > > > > > On Tue, Oct 1, 2019 at 8:13 PM Ervin Hegedüs <ai...@gm...> wrote: > > > > > > > Hi Homesh, > > > > > > > > > > > > On Tue, Oct 01, 2019 at 07:29:53PM +0530, homesh joshi wrote: > > > > > > > > > > here is is the final thing that worked for me. Now I am testing the > > rule > > > > > for various conditions. > > > > > > > > good to see, > > > > > > > > > #Step1 > > > > > ## This rule will identify the outbound Set-Cookie SessionID data and > > > > capture it in a setsid# > > > > > SecRule RESPONSE_HEADERS:/Set-Cookie2?/ > > > > > > > "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)" > > > > > > "chain,phase:3,id:'881062',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar: > > > > tx.ua=%{request_headers.user-agent}" > > > > > > > > just my 2 cents: you would better to use the actions that you > > > > quote its arguments, eg: > > > > > > > > setvar:'tx.ua=%{request_headers.user-agent}' > > > > > > > > It's not mandatory, but more clear. > > > > > > > > > > > > > > > > a. > > > > > > > > > > > > > > > > _______________________________________________ > > > > mod-security-users mailing list > > > > mod...@li... > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > _______________________________________________ > > > mod-security-users mailing list > > > mod...@li... > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > > http://www.modsecurity.org/projects/commercial/rules/ > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > _______________________________________________ > > mod-security-users mailing list > > mod...@li... > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > http://www.modsecurity.org/projects/commercial/rules/ > > http://www.modsecurity.org/projects/commercial/support/ > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ |
|
From: homesh j. <ho...@gm...> - 2019-10-09 13:13:04
|
Hi Christian, Thanks for the quick reply. I am trying to implement rules mentioned here <https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-advanced-topic-of-the-week-detecting-browser-fingerprint-changes-during-sessions/> Here are the all the rules. #Step1 ## This rule will identify the outbound Set-Cookie SessionID data and capture it in a setsid# SecRule RESPONSE_HEADERS:/Set-Cookie2?/ "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)" "chain,phase:3,id:'881062',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar: tx.ua=%{request_headers.user-agent}" SecRule UNIQUE_ID "(.*)" "t:none,t:sha1,t:hexEncode,capture,setvar:session.csrf_token=%{TX.1}" #Step 2 SecContentInjection On SecStreamOutBodyInspection On SecResponseBodyAccess On SecRule RESPONSE_STATUS "200" "chain,id:'881802',t:none,pass" SecRule RESPONSE_HEADERS:Content-Type "@beginsWith text/html" "chain,t:none,nolog" SecRule &SESSION:KEY "@eq 1" "chain" SecRule STREAM_OUTPUT_BODY "@rsub s/<\/body>/<script type=\"text\/javascript\" src=\"https\:\/\/www.abc123.com\/client.min.js\"><\/script>|0A|<\/body>/" "capture,setvar:session.fingerprint_code_sent=1" #Step 3 ## -=[ Save the initial Browser Fingerprint Hash in the Session Collection ]=-# SecRule &SESSION:BROWSER_HASH "@eq 0" "chain,id:'881803',phase:1,t:none,nolog,pass" SecRule REQUEST_COOKIES:BROWSER_HASH ".*" "setvar:session.browser_hash=%{matched_var}" #Step 4 ## -=[ If Browser Fingerprint JS was sent previously, then enforce the # existence of the browser_hash Cookie field. ]=-# SecRule SESSION:FINGERPRINT_CODE_SENT "@eq 1" "chain,id:'881804',phase:1,t:none,block,msg:'Warning: Browser Fingering Cookie Missing.'" SecRule &REQUEST_COOKIES:BROWSER_HASH "@eq 0" SecRule SESSION:FINGERPRINT_CODE_SENT "@eq 1" "chain,id:'881805',phase:1,t:none,block,msg:'Warning: Browser Fingering Cookie Mismatch.',logdata:'Expected Browser Fingerprint: %{session.browser_hash}. Browser Fingerprint Received: %{request_cookies.browser_hash}'" SecRule &REQUEST_COOKIES:BROWSER_HASH "@eq 1" "chain" SecRule REQUEST_COOKIES:BROWSER_HASH "!@streq %{session.browser_hash}" Thanks, Homesh On Wed, Oct 9, 2019 at 5:46 PM Christian Folini <chr...@ne...> wrote: > Hello Homesh, > > You do not have the code to inject the JS into the response. At least not > in > the rule snippet you provided. > > The last time I checked the whole CSRF injection and testing stuff, it was > broken. But that was like 2 years ago. > > If the rule snippet you listed has a problem, then I would enable the > DebugLog > and follow the execution of this rule closely. It's a very complex rule an > a > lot can go wrong here. > > Cheers, > > Christian > > > On Wed, Oct 09, 2019 at 05:35:16PM +0530, homesh joshi wrote: > > Hi, > > Now when I am testing the rule against the website I think the first rule > > is not getting triggered. > > > > SecRule RESPONSE_HEADERS:/Set-Cookie2?/ > > > "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)" > > > "chain,phase:3,id:'881064',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar:' > > tx.ua=%{request_headers.user-agent}' " > > SecRule UNIQUE_ID "(.*)" > > "t:none,t:sha1,t:hexEncode,capture,setvar:session.csrf_token=%{TX.1}" > > > > This should trigger as the response header set-cookie is present in the > > response with PHPSESSID > > e.g > > A: homesh$ curl -k -i https://somesite.abcd.in 2>&1 | grep Set-Cookie > > Set-Cookie: PHPSESSID=f26b72756916f074ab798270327d2c99; path=/ > > > > Not sure why it is not working. I don't see second rule injecting the JS > > and I think it is because first rule is not getting triggered which > should > > capture "setsid" > > > > Please help. > > > > Thanks, > > Homesh > > > > On Tue, Oct 1, 2019 at 8:13 PM Ervin Hegedüs <ai...@gm...> wrote: > > > > > Hi Homesh, > > > > > > > > > On Tue, Oct 01, 2019 at 07:29:53PM +0530, homesh joshi wrote: > > > > > > > > here is is the final thing that worked for me. Now I am testing the > rule > > > > for various conditions. > > > > > > good to see, > > > > > > > #Step1 > > > > ## This rule will identify the outbound Set-Cookie SessionID data and > > > capture it in a setsid# > > > > SecRule RESPONSE_HEADERS:/Set-Cookie2?/ > > > > > "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)" > > > > "chain,phase:3,id:'881062',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar: > > > tx.ua=%{request_headers.user-agent}" > > > > > > just my 2 cents: you would better to use the actions that you > > > quote its arguments, eg: > > > > > > setvar:'tx.ua=%{request_headers.user-agent}' > > > > > > It's not mandatory, but more clear. > > > > > > > > > > > > a. > > > > > > > > > > > > _______________________________________________ > > > mod-security-users mailing list > > > mod...@li... > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > > http://www.modsecurity.org/projects/commercial/rules/ > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > _______________________________________________ > > mod-security-users mailing list > > mod...@li... > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > http://www.modsecurity.org/projects/commercial/rules/ > > http://www.modsecurity.org/projects/commercial/support/ > > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > |
|
From: Christian F. <chr...@ne...> - 2019-10-09 12:13:27
|
Hello Homesh,
You do not have the code to inject the JS into the response. At least not in
the rule snippet you provided.
The last time I checked the whole CSRF injection and testing stuff, it was
broken. But that was like 2 years ago.
If the rule snippet you listed has a problem, then I would enable the DebugLog
and follow the execution of this rule closely. It's a very complex rule an a
lot can go wrong here.
Cheers,
Christian
On Wed, Oct 09, 2019 at 05:35:16PM +0530, homesh joshi wrote:
> Hi,
> Now when I am testing the rule against the website I think the first rule
> is not getting triggered.
>
> SecRule RESPONSE_HEADERS:/Set-Cookie2?/
> "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)"
> "chain,phase:3,id:'881064',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar:'
> tx.ua=%{request_headers.user-agent}' "
> SecRule UNIQUE_ID "(.*)"
> "t:none,t:sha1,t:hexEncode,capture,setvar:session.csrf_token=%{TX.1}"
>
> This should trigger as the response header set-cookie is present in the
> response with PHPSESSID
> e.g
> A: homesh$ curl -k -i https://somesite.abcd.in 2>&1 | grep Set-Cookie
> Set-Cookie: PHPSESSID=f26b72756916f074ab798270327d2c99; path=/
>
> Not sure why it is not working. I don't see second rule injecting the JS
> and I think it is because first rule is not getting triggered which should
> capture "setsid"
>
> Please help.
>
> Thanks,
> Homesh
>
> On Tue, Oct 1, 2019 at 8:13 PM Ervin Hegedüs <ai...@gm...> wrote:
>
> > Hi Homesh,
> >
> >
> > On Tue, Oct 01, 2019 at 07:29:53PM +0530, homesh joshi wrote:
> > >
> > > here is is the final thing that worked for me. Now I am testing the rule
> > > for various conditions.
> >
> > good to see,
> >
> > > #Step1
> > > ## This rule will identify the outbound Set-Cookie SessionID data and
> > capture it in a setsid#
> > > SecRule RESPONSE_HEADERS:/Set-Cookie2?/ >
> > "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)"
> > "chain,phase:3,id:'881062',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar:
> > tx.ua=%{request_headers.user-agent}"
> >
> > just my 2 cents: you would better to use the actions that you
> > quote its arguments, eg:
> >
> > setvar:'tx.ua=%{request_headers.user-agent}'
> >
> > It's not mandatory, but more clear.
> >
> >
> >
> > a.
> >
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
|
|
From: homesh j. <ho...@gm...> - 2019-10-09 12:05:37
|
Hi,
Now when I am testing the rule against the website I think the first rule
is not getting triggered.
SecRule RESPONSE_HEADERS:/Set-Cookie2?/
"(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)"
"chain,phase:3,id:'881064',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar:'
tx.ua=%{request_headers.user-agent}' "
SecRule UNIQUE_ID "(.*)"
"t:none,t:sha1,t:hexEncode,capture,setvar:session.csrf_token=%{TX.1}"
This should trigger as the response header set-cookie is present in the
response with PHPSESSID
e.g
A: homesh$ curl -k -i https://somesite.abcd.in 2>&1 | grep Set-Cookie
Set-Cookie: PHPSESSID=f26b72756916f074ab798270327d2c99; path=/
Not sure why it is not working. I don't see second rule injecting the JS
and I think it is because first rule is not getting triggered which should
capture "setsid"
Please help.
Thanks,
Homesh
On Tue, Oct 1, 2019 at 8:13 PM Ervin Hegedüs <ai...@gm...> wrote:
> Hi Homesh,
>
>
> On Tue, Oct 01, 2019 at 07:29:53PM +0530, homesh joshi wrote:
> >
> > here is is the final thing that worked for me. Now I am testing the rule
> > for various conditions.
>
> good to see,
>
> > #Step1
> > ## This rule will identify the outbound Set-Cookie SessionID data and
> capture it in a setsid#
> > SecRule RESPONSE_HEADERS:/Set-Cookie2?/ >
> "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)"
> "chain,phase:3,id:'881062',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar:
> tx.ua=%{request_headers.user-agent}"
>
> just my 2 cents: you would better to use the actions that you
> quote its arguments, eg:
>
> setvar:'tx.ua=%{request_headers.user-agent}'
>
> It's not mandatory, but more clear.
>
>
>
> a.
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
|
|
From: Robert P. <rpa...@fe...> - 2019-10-09 10:27:54
|
We had this exact problem, which is why we wrote JSON audit logging for 2.x releases. It should still be available in the 2.9.x series of releases. https://www.dreamhost.com/blog/making-sense-of-modsecurity-json-audit-logs/ https://www.feistyduck.com/library/modsecurity-handbook-2ed-free/online/ch04-logging.html https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecAuditLogFormat > On Oct 9, 2019, at 00:27, Paul Beckett <pau...@ou...> wrote: > > > I'm interested in ingesting the mod-security audit log (generated by modsecurity 2.9.x) into elasticsearch or other system. However, parsing the audit log format looks like it will require a substantial amount of work. I was hoping that someone might have solved this problem, and that I could reuse an existing solution. > > I've spent a while googling, trying to find what existing solutions exist. > The only thing I've managed to find are a couple of blog posts with github links from several years ago: > https://github.com/bitsofinfo/logstash-modsecurity > https://github.com/bitsofinfo/fluentd-modsecurity > > Before I dive to far down this rabbit hole, I was wondering if anyone else out there in the community had a solution for this, and if so whether they would be willing to share their high level approach, and/or any implementation details. > > Thanks, > Paul > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ |
|
From: Paul B. <pau...@ou...> - 2019-10-09 07:27:11
|
I'm interested in ingesting the mod-security audit log (generated by modsecurity 2.9.x) into elasticsearch or other system. However, parsing the audit log format looks like it will require a substantial amount of work. I was hoping that someone might have solved this problem, and that I could reuse an existing solution. I've spent a while googling, trying to find what existing solutions exist. The only thing I've managed to find are a couple of blog posts with github links from several years ago: https://github.com/bitsofinfo/logstash-modsecurity<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbitsofinfo%2Flogstash-modsecurity&data=02%7C01%7CP.Beckett%40uea.ac.uk%7C2373f6ec44b248380f8508d74c84b3c7%7Cc65f8795ba3d43518a070865e5d8f090%7C0%7C0%7C637062005146617288&sdata=ECTTZfGFdDHiwMzps20ss9i%2FEX1m7DD3LF5is0LI4%2BM%3D&reserved=0> https://github.com/bitsofinfo/fluentd-modsecurity Before I dive to far down this rabbit hole, I was wondering if anyone else out there in the community had a solution for this, and if so whether they would be willing to share their high level approach, and/or any implementation details. Thanks, Paul |
139 messages has been excluded from this view by a project administrator.
