mod-security-users — General discussion about mod_security

Re: [mod-security-users] OWASP ModSecurity Core Rule Set vs. OWASP ModSecurity Core Rule Set V 3.0

[Christian F. <chr...@ne...>]

Hi there,

On Mon, Mar 26, 2018 at 11:18:20PM -0400, Chip wrote:
> Any idea if the suggestions on this page are up-to-date?  No timestamp
> on the technical details just an interesting how-to.

It looks like the author knows ModSecurity given the advanced rule set
he / she proposes. But it's hard to tell if this works without testing
it by heart.

Alternatively, the ModSecurity Handbook has similar rules with the same
goal and I guarantee that those really work.

But ModSecurity is not the best tool to prevent BruteForce and Automation
anyways.  At least not when it gets closer to a DoS. Mod_qos and friends are
usually better suited.

Depends on the rules. The example you linked should apparently be put
in Location context. But you can also work in server context which brings
advantages as it can be ran in phase 1. But honestly, this is really advanced
stuff and pros and cons are all very complicated and take a lot of experience.

Ahoj,

Christian


-- 
Investors should be aware of the overall dangers the legal profession 
present to companies, and how its current and generalized naiveté can 
sink fortunes overnight.
--- John Dvorak on the digg.com story in May 2007

Re: [mod-security-users] OWASP ModSecurity Core Rule Set vs. OWASP ModSecurity Core Rule Set V 3.0

[Chip <jef...@gm...>]

Great!  Just what I was looking for.

Any idea if the suggestions on this page are up-to-date?  No timestamp
on the technical details just an interesting how-to.

By the way, where does one actually PUT those stanzas of code?  Or does
mod_security already have a brute force module that needs to be likewise
uncommented?

Thank you.

https://snippets.aktagon.com/snippets/563-brute-force-authentication-protection-with-modsecurity

On 03/26/2018 11:03 PM, Osama Elnaggar wrote:
> Check out the Anti-Automation / DoS Protection option in
> crs-setup.conf.  By default it is not enabled but you can enable the
> rule which will in turn trigger the rules in
> REQUEST-912-DOS-PROTECTION.conf
>
> -- 
> Osama Elnaggar
>
> On March 27, 2018 at 11:33:11 AM, Chip (jef...@gm...
> <mailto:jef...@gm...>) wrote:
>
>> Thank you for that.
>>
>> I ask because I read this post:
>>
>> https://security.stackexchange.com/questions/31556/securing-a-simple-webservice-against-brute-force-with-mod-security
>>
>> in which the author states a rate-limiting rule exsists in the
>> ruleset but  I can't find it.  So I'm confused.  If V3 has it where
>> is it, how to I activate a brute force mitigation rule?
>>
>> Here is a snippet from that discussion:
>>
>> There are rate-limiting rule set in ModSecurity CRS that does not
>> directly correlate whether the authentication attempt was successful
>> or not. Following is one of the Rule
>>
>> |SecRule IP:BRUTE_FORCE_COUNTER "@gt
>> %{tx.brute_force_counter_threshold}"
>> "phase:5,id:'981042',t:none,nolog,pass,t:none,
>> setvar:ip.brute_force_burst_counter=+1,
>> expirevar:ip.brute_force_burst_counter=%{tx.brute_force_burst_time_slice},
>> setvar:!ip.brute_force_counter" |
>>
>>
>>
>> On 03/26/2018 08:23 PM, Osama Elnaggar wrote:
>>> v3 contains everything you need.  I’d suggest removing the older
>>> ruleset if possible so you don’t accidentally enable it
>>>
>>> -- 
>>> Osama Elnaggar
>>>
>>> On March 27, 2018 at 11:10:48 AM, Chip (jef...@gm...
>>> <mailto:jef...@gm...>) wrote:
>>>
>>>> WHM/Cpanel server running on CENTOS 6.9 with OWASP ModSecurity Core
>>>> Rule Set and OWASP ModSecurity Core Rule Set V 3.0 available.
>>>>
>>>> Only ModSecurity Core Rule Set V 3.0 has been activated.
>>>>
>>>> I can see from information that V 3.0 is an enhancement to OWASP
>>>> ModSecurity Core Rule Set but I am at a loss in the following way:
>>>> must BOTH rule sets be activated for total coverage or does the V
>>>> 3.0 contain everything in the
>>>> OWASP ModSecurity Core Rule Set but with enhancements?
>>>>
>>>> This is not clear at least to me, anyway.
>>>>
>>>> Thanks.
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Check out the vibrant tech community on one of the world's most
>>>> engaging tech sites, Slashdot.org!
>>>> http://sdm.link/slashdot_______________________________________________
>>>> mod-security-users mailing list
>>>> mod...@li...
>>>> <mailto:mod...@li...>
>>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>>> http://www.modsecurity.org/projects/commercial/rules/
>>>> http://www.modsecurity.org/projects/commercial/support/
>>

Re: [mod-security-users] OWASP ModSecurity Core Rule Set vs. OWASP ModSecurity Core Rule Set V 3.0

[Osama E. <oel...@gm...>]

Check out the Anti-Automation / DoS Protection option in crs-setup.conf.
By default it is not enabled but you can enable the rule which will in turn
trigger the rules in REQUEST-912-DOS-PROTECTION.conf

-- 
Osama Elnaggar

On March 27, 2018 at 11:33:11 AM, Chip (jef...@gm...) wrote:

Thank you for that.

I ask because I read this post:

https://security.stackexchange.com/questions/31556/securing-a-simple-webservice-against-brute-force-with-mod-security

in which the author states a rate-limiting rule exsists in the ruleset but
I can't find it.  So I'm confused.  If V3 has it where is it, how to I
activate a brute force mitigation rule?

Here is a snippet from that discussion:

There are rate-limiting rule set in ModSecurity CRS that does not directly
correlate whether the authentication attempt was successful or not.
Following is one of the Rule

SecRule IP:BRUTE_FORCE_COUNTER "@gt %{tx.brute_force_counter_threshold}"
"phase:5,id:'981042',t:none,nolog,pass,t:none,
setvar:ip.brute_force_burst_counter=+1,
expirevar:ip.brute_force_burst_counter=%{tx.brute_force_burst_time_slice},
setvar:!ip.brute_force_counter"




On 03/26/2018 08:23 PM, Osama Elnaggar wrote:

v3 contains everything you need.  I’d suggest removing the older ruleset if
possible so you don’t accidentally enable it

-- 
Osama Elnaggar

On March 27, 2018 at 11:10:48 AM, Chip (jef...@gm...) wrote:

WHM/Cpanel server running on CENTOS 6.9 with OWASP ModSecurity Core Rule
Set and OWASP ModSecurity Core Rule Set V 3.0 available.

Only ModSecurity Core Rule Set V 3.0 has been activated.

I can see from information that V 3.0 is an enhancement to OWASP
ModSecurity Core Rule Set but I am at a loss in the following way: must
BOTH rule sets be activated for total coverage or does the V 3.0 contain
everything in the
OWASP ModSecurity Core Rule Set but with enhancements?

This is not clear at least to me, anyway.

Thanks.


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org!
http://sdm.link/slashdot_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] OWASP ModSecurity Core Rule Set vs. OWASP ModSecurity Core Rule Set V 3.0

[Chip <jef...@gm...>]

Thank you for that.

I ask because I read this post:

https://security.stackexchange.com/questions/31556/securing-a-simple-webservice-against-brute-force-with-mod-security

in which the author states a rate-limiting rule exsists in the ruleset
but  I can't find it.  So I'm confused.  If V3 has it where is it, how
to I activate a brute force mitigation rule?

Here is a snippet from that discussion:

There are rate-limiting rule set in ModSecurity CRS that does not
directly correlate whether the authentication attempt was successful or
not. Following is one of the Rule

|SecRule IP:BRUTE_FORCE_COUNTER "@gt %{tx.brute_force_counter_threshold}"
"phase:5,id:'981042',t:none,nolog,pass,t:none,
setvar:ip.brute_force_burst_counter=+1,
expirevar:ip.brute_force_burst_counter=%{tx.brute_force_burst_time_slice},
setvar:!ip.brute_force_counter" |




On 03/26/2018 08:23 PM, Osama Elnaggar wrote:
> v3 contains everything you need.  I’d suggest removing the older
> ruleset if possible so you don’t accidentally enable it
>
> -- 
> Osama Elnaggar
>
> On March 27, 2018 at 11:10:48 AM, Chip (jef...@gm...
> <mailto:jef...@gm...>) wrote:
>
>> WHM/Cpanel server running on CENTOS 6.9 with OWASP ModSecurity Core
>> Rule Set and OWASP ModSecurity Core Rule Set V 3.0 available.
>>
>> Only ModSecurity Core Rule Set V 3.0 has been activated.
>>
>> I can see from information that V 3.0 is an enhancement to OWASP
>> ModSecurity Core Rule Set but I am at a loss in the following way:
>> must BOTH rule sets be activated for total coverage or does the V 3.0
>> contain everything in the
>> OWASP ModSecurity Core Rule Set but with enhancements?
>>
>> This is not clear at least to me, anyway.
>>
>> Thanks.
>>
>>
>> ------------------------------------------------------------------------------
>>
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org!
>> http://sdm.link/slashdot_______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> <mailto:mod...@li...>
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] OWASP ModSecurity Core Rule Set vs. OWASP ModSecurity Core Rule Set V 3.0

[Osama E. <oel...@gm...>]

v3 contains everything you need.  I’d suggest removing the older ruleset if
possible so you don’t accidentally enable it

-- 
Osama Elnaggar

On March 27, 2018 at 11:10:48 AM, Chip (jef...@gm...) wrote:

WHM/Cpanel server running on CENTOS 6.9 with OWASP ModSecurity Core Rule
Set and OWASP ModSecurity Core Rule Set V 3.0 available.

Only ModSecurity Core Rule Set V 3.0 has been activated.

I can see from information that V 3.0 is an enhancement to OWASP
ModSecurity Core Rule Set but I am at a loss in the following way: must
BOTH rule sets be activated for total coverage or does the V 3.0 contain
everything in the
OWASP ModSecurity Core Rule Set but with enhancements?

This is not clear at least to me, anyway.

Thanks.


------------------------------------------------------------------------------

Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org!
http://sdm.link/slashdot_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] OWASP ModSecurity Core Rule Set vs. OWASP ModSecurity Core Rule Set V 3.0

[Chip <jef...@gm...>]

WHM/Cpanel server running on CENTOS 6.9 with OWASP ModSecurity Core Rule
Set and OWASP ModSecurity Core Rule Set V 3.0 available.

Only ModSecurity Core Rule Set V 3.0 has been activated.

I can see from information that V 3.0 is an enhancement to OWASP
ModSecurity Core Rule Set but I am at a loss in the following way: must
BOTH rule sets be activated for total coverage or does the V 3.0 contain
everything in the
OWASP ModSecurity Core Rule Set but with enhancements?

This is not clear at least to me, anyway.

Thanks.

Re: [mod-security-users] Best Way to Whitelist strings in input fields that are similar to commands.

[Felipe R. <fel...@gm...>]

*SecRule ARGS "@contains alter" \*
* "phase:request,\*
* rev:'2',\*
* ver:'OWASP_CRS/3.0.0',\*
* maturity:'9',\*
* accuracy:'8',\*
* capture,\*
* t:none,t:urlDecodeUni,\*
* block,\*
* msg:'Detects concatenated basic SQL injection and SQLLFI attempts',\*
* id:CHANGEHERE,\*
* tag:'application-multi',\*
* tag:'language-multi',\*
* tag:'platform-multi',\*
* tag:'attack-sqli',\*
* tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\*
* tag:'WASCTC/WASC-19',\*
* tag:'OWASP_TOP_10/A1',\*
* tag:'OWASP_AppSensor/CIE1',\*
* tag:'PCI/6.5.2',\*
* logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}:
%{MATCHED_VAR}',\*
* severity:'CRITICAL',\*
* setvar:'tx.msg=%{rule.msg}',\*
* setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score},\*
* setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\*
* setvar:'tx.%{rule.id
<http://rule.id>}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"*
* SecRule
REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|!ARGS|XML:/*
"(?i:(?:[\d\W]\s+as\s*?[\"'`\w]+\s*?from)|(?:^[\W\d]+\s*?(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc)\b)|(?:(?:select|create|rename|truncate|load|delete|update|insert|desc)\s+(?:(?:group_)concat|char|load_file)\s?\(?)|(?:end\s*?\);)|([\"'`]\s+regexp\W)|(?:[\s(]load_file\s*?\())"
\*
* ctl:ruleRemoveTargetById=981260*

*I'm not sure, but I think this chain rule could work. *

On Mon, Mar 26, 2018 at 4:36 PM Christian Folini <
chr...@ne...> wrote:

> Hey Deanna,
>
> On Mon, Mar 26, 2018 at 11:12:20AM -0600, Deanna Stevenson wrote:
> > 8d85025e-H-- Message: Warning. Pattern match
> "(?i:(?:[\\d\\W]\\s+as\\s*?[\"
> > '`\\w]+\\s*?from)|(?:^[\\W\\d]+\\s*?(?:union|select|create|
> > rename|truncate|load|alter|delete|update|insert|desc)\\b)
> > |(?:(?:select|create|rename|truncate|load|alter|delete|
> > update|insert|desc)\\s+(?:(?:group_)concat|char|load ..." at
> ARGS:address1.
> > [file
> "/etc/modsec/sitebuyprod/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"]
> > [line "451"] [id "942360"] [rev "2"] [msg "Detects concatenated basic SQL
> > injection and SQLLFI attempts"] *[data "Matched Data: 1922 ALTER found
> > within ARGS:address1: 1922 ALTER St PHILADELPHIA, PA 19146"*] [severity
> > "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "8"] [tag
> > "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag
> > "attack-sqli"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag
> > "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"]
> [tag
> > "PCI/6.5.2"]
>
> You stumbled over this false positive here:
> https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/997
>
> You are far from the only one. It's just funny it took people almost a
> year to
> respond and since then, wherever we look, there is this FP.
>
> The 3.1/dev tree has an update to this rule merged in
> https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1013
>
> It's probably best to use this updated rule fule.
>
> Good luck and sorry for the inconvenience.
>
> Christian
>
>
> --
> Trust leaves on horseback but returns on foot.
> -- Donald Rumsfeld
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
*Nenhum Sonho é grande demais.*

Re: [mod-security-users] Best Way to Whitelist strings in input fields that are similar to commands.

[Christian F. <chr...@ne...>]

Hey Deanna,

On Mon, Mar 26, 2018 at 11:12:20AM -0600, Deanna Stevenson wrote:
> 8d85025e-H-- Message: Warning. Pattern match "(?i:(?:[\\d\\W]\\s+as\\s*?[\"
> '`\\w]+\\s*?from)|(?:^[\\W\\d]+\\s*?(?:union|select|create|
> rename|truncate|load|alter|delete|update|insert|desc)\\b)
> |(?:(?:select|create|rename|truncate|load|alter|delete|
> update|insert|desc)\\s+(?:(?:group_)concat|char|load ..." at ARGS:address1.
> [file "/etc/modsec/sitebuyprod/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"]
> [line "451"] [id "942360"] [rev "2"] [msg "Detects concatenated basic SQL
> injection and SQLLFI attempts"] *[data "Matched Data: 1922 ALTER found
> within ARGS:address1: 1922 ALTER St PHILADELPHIA, PA 19146"*] [severity
> "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "8"] [tag
> "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag
> "attack-sqli"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag
> "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag
> "PCI/6.5.2"]

You stumbled over this false positive here:
https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/997

You are far from the only one. It's just funny it took people almost a year to
respond and since then, wherever we look, there is this FP.

The 3.1/dev tree has an update to this rule merged in
https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1013

It's probably best to use this updated rule fule.

Good luck and sorry for the inconvenience.

Christian


-- 
Trust leaves on horseback but returns on foot.
-- Donald Rumsfeld

Re: [mod-security-users] ModSecurity phase timing

[Felipe Z. <fe...@zi...>]

Great, thanks!

On Mon, Mar 26, 2018 at 3:11 PM Robert Paprocki <
rpa...@fe...> wrote:

> Sounds good, I will compile some use cases and previous implementations
> and post them on GH. Thanks :)
>
> On Mon, Mar 26, 2018 at 11:05 AM, Felipe Zimmerle <fe...@zi...>
> wrote:
>
>> Lets have a discussion about that on the issue on GitHub, so we can keep
>> that info in a fashion that everybody can easily read and follow. There is
>> a bug no GitHub already for that.
>>
>> in the meanwhile you can collect this interesting data to share with us.
>> I am curious. I don't understand why you want to compute the subtraction
>> and not showing or saving anywhere, if there is no saving/storing what is
>> the point to compute in first place?
>>
>> Br.,
>> Felipe
>>
>>
>> On Mon, Mar 26, 2018 at 2:46 PM Robert Paprocki <
>> rpa...@fe...> wrote:
>>
>>> I think the point we are making is that _native_ integration of perf
>>> data is what's missing. systemtap scripts are useful, but they are
>>> definitely not a replacement. there are a multitude of environments where
>>> its simply not possible to use such tooling.
>>>
>>> And, I'm curious, why is it so expensive to generate this data? Could it
>>> not be something as simple as a delta between two timespecs?
>>>
>>> On Mon, Mar 26, 2018 at 10:08 AM, Felipe Zimmerle <fe...@zi...>
>>> wrote:
>>>
>>>>
>>>>
>>>> I have no bug report saying that DURATION is not working and a
>>>> regression test that leads me to believe that it is working. Thus, I am
>>>> assuming that it is working Ok.
>>>>
>>>> Indeed, running a shell script may be hard for a group of users, but i
>>>> don't think that it is a motivation to have poor optimization for all users.
>>>>
>>>> Br.,
>>>> Felipe.
>>>>
>>>>
>>>>
>>>>
>>>> On Mon, Mar 26, 2018 at 1:51 PM Christian Folini <
>>>> chr...@ne...> wrote:
>>>>
>>>>> Hey Felipe,
>>>>>
>>>>> On Mon, Mar 26, 2018 at 04:45:41PM +0000, Felipe Zimmerle wrote:
>>>>> > There are other means to read "timing", no need to use performance
>>>>> > variables for that.
>>>>> >
>>>>> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#DURATION
>>>>>
>>>>> Does DURATION really work in 3.0 / nginx?
>>>>>
>>>>> If that is granted, I can live with it. But digging into header-Files
>>>>> and
>>>>> running external scripts (separate process!) because I want to get a
>>>>> Performance overview is quite demanding I think.
>>>>>
>>>>> Christian
>>>>>
>>>>> --
>>>>> History allows us to see human nature in a deeper way.
>>>>> -- Ian Mortimer
>>>>>
>>>>>
>>>>> ------------------------------------------------------------------------------
>>>>> Check out the vibrant tech community on one of the world's most
>>>>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>>>> _______________________________________________
>>>>> mod-security-users mailing list
>>>>> mod...@li...
>>>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>>>> http://www.modsecurity.org/projects/commercial/rules/
>>>>> http://www.modsecurity.org/projects/commercial/support/
>>>>>
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Check out the vibrant tech community on one of the world's most
>>>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>>> _______________________________________________
>>>> mod-security-users mailing list
>>>> mod...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>>> http://www.modsecurity.org/projects/commercial/rules/
>>>> http://www.modsecurity.org/projects/commercial/support/
>>>>
>>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Check out the vibrant tech community on one of the world's most
>>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li...
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>>>
>>
>

Re: [mod-security-users] ModSecurity phase timing

[Robert P. <rpa...@fe...>]

Sounds good, I will compile some use cases and previous implementations and
post them on GH. Thanks :)

On Mon, Mar 26, 2018 at 11:05 AM, Felipe Zimmerle <fe...@zi...>
wrote:

> Lets have a discussion about that on the issue on GitHub, so we can keep
> that info in a fashion that everybody can easily read and follow. There is
> a bug no GitHub already for that.
>
> in the meanwhile you can collect this interesting data to share with us. I
> am curious. I don't understand why you want to compute the subtraction and
> not showing or saving anywhere, if there is no saving/storing what is the
> point to compute in first place?
>
> Br.,
> Felipe
>
>
> On Mon, Mar 26, 2018 at 2:46 PM Robert Paprocki <rpaprocki@
> fearnothingproductions.net> wrote:
>
>> I think the point we are making is that _native_ integration of perf data
>> is what's missing. systemtap scripts are useful, but they are definitely
>> not a replacement. there are a multitude of environments where its simply
>> not possible to use such tooling.
>>
>> And, I'm curious, why is it so expensive to generate this data? Could it
>> not be something as simple as a delta between two timespecs?
>>
>> On Mon, Mar 26, 2018 at 10:08 AM, Felipe Zimmerle <fe...@zi...>
>> wrote:
>>
>>>
>>>
>>> I have no bug report saying that DURATION is not working and a
>>> regression test that leads me to believe that it is working. Thus, I am
>>> assuming that it is working Ok.
>>>
>>> Indeed, running a shell script may be hard for a group of users, but i
>>> don't think that it is a motivation to have poor optimization for all users.
>>>
>>> Br.,
>>> Felipe.
>>>
>>>
>>>
>>>
>>> On Mon, Mar 26, 2018 at 1:51 PM Christian Folini <
>>> chr...@ne...> wrote:
>>>
>>>> Hey Felipe,
>>>>
>>>> On Mon, Mar 26, 2018 at 04:45:41PM +0000, Felipe Zimmerle wrote:
>>>> > There are other means to read "timing", no need to use performance
>>>> > variables for that.
>>>> > https://github.com/SpiderLabs/ModSecurity/wiki/Reference-
>>>> Manual#DURATION
>>>>
>>>> Does DURATION really work in 3.0 / nginx?
>>>>
>>>> If that is granted, I can live with it. But digging into header-Files
>>>> and
>>>> running external scripts (separate process!) because I want to get a
>>>> Performance overview is quite demanding I think.
>>>>
>>>> Christian
>>>>
>>>> --
>>>> History allows us to see human nature in a deeper way.
>>>> -- Ian Mortimer
>>>>
>>>> ------------------------------------------------------------
>>>> ------------------
>>>> Check out the vibrant tech community on one of the world's most
>>>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>>> _______________________________________________
>>>> mod-security-users mailing list
>>>> mod...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>>> http://www.modsecurity.org/projects/commercial/rules/
>>>> http://www.modsecurity.org/projects/commercial/support/
>>>>
>>>
>>> ------------------------------------------------------------
>>> ------------------
>>> Check out the vibrant tech community on one of the world's most
>>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li...
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>>>
>>>
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot______
>> _________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>

Re: [mod-security-users] ModSecurity phase timing

[Felipe Z. <fe...@zi...>]

Lets have a discussion about that on the issue on GitHub, so we can keep
that info in a fashion that everybody can easily read and follow. There is
a bug no GitHub already for that.

in the meanwhile you can collect this interesting data to share with us. I
am curious. I don't understand why you want to compute the subtraction and
not showing or saving anywhere, if there is no saving/storing what is the
point to compute in first place?

Br.,
Felipe


On Mon, Mar 26, 2018 at 2:46 PM Robert Paprocki <
rpa...@fe...> wrote:

> I think the point we are making is that _native_ integration of perf data
> is what's missing. systemtap scripts are useful, but they are definitely
> not a replacement. there are a multitude of environments where its simply
> not possible to use such tooling.
>
> And, I'm curious, why is it so expensive to generate this data? Could it
> not be something as simple as a delta between two timespecs?
>
> On Mon, Mar 26, 2018 at 10:08 AM, Felipe Zimmerle <fe...@zi...>
> wrote:
>
>>
>>
>> I have no bug report saying that DURATION is not working and a regression
>> test that leads me to believe that it is working. Thus, I am assuming that
>> it is working Ok.
>>
>> Indeed, running a shell script may be hard for a group of users, but i
>> don't think that it is a motivation to have poor optimization for all users.
>>
>> Br.,
>> Felipe.
>>
>>
>>
>>
>> On Mon, Mar 26, 2018 at 1:51 PM Christian Folini <
>> chr...@ne...> wrote:
>>
>>> Hey Felipe,
>>>
>>> On Mon, Mar 26, 2018 at 04:45:41PM +0000, Felipe Zimmerle wrote:
>>> > There are other means to read "timing", no need to use performance
>>> > variables for that.
>>> >
>>> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#DURATION
>>>
>>> Does DURATION really work in 3.0 / nginx?
>>>
>>> If that is granted, I can live with it. But digging into header-Files and
>>> running external scripts (separate process!) because I want to get a
>>> Performance overview is quite demanding I think.
>>>
>>> Christian
>>>
>>> --
>>> History allows us to see human nature in a deeper way.
>>> -- Ian Mortimer
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Check out the vibrant tech community on one of the world's most
>>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li...
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>>>
>>
>>
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] ModSecurity phase timing

[Robert P. <rpa...@fe...>]

I think the point we are making is that _native_ integration of perf data
is what's missing. systemtap scripts are useful, but they are definitely
not a replacement. there are a multitude of environments where its simply
not possible to use such tooling.

And, I'm curious, why is it so expensive to generate this data? Could it
not be something as simple as a delta between two timespecs?

On Mon, Mar 26, 2018 at 10:08 AM, Felipe Zimmerle <fe...@zi...>
wrote:

>
>
> I have no bug report saying that DURATION is not working and a regression
> test that leads me to believe that it is working. Thus, I am assuming that
> it is working Ok.
>
> Indeed, running a shell script may be hard for a group of users, but i
> don't think that it is a motivation to have poor optimization for all users.
>
> Br.,
> Felipe.
>
>
>
>
> On Mon, Mar 26, 2018 at 1:51 PM Christian Folini <
> chr...@ne...> wrote:
>
>> Hey Felipe,
>>
>> On Mon, Mar 26, 2018 at 04:45:41PM +0000, Felipe Zimmerle wrote:
>> > There are other means to read "timing", no need to use performance
>> > variables for that.
>> > https://github.com/SpiderLabs/ModSecurity/wiki/Reference-
>> Manual#DURATION
>>
>> Does DURATION really work in 3.0 / nginx?
>>
>> If that is granted, I can live with it. But digging into header-Files and
>> running external scripts (separate process!) because I want to get a
>> Performance overview is quite demanding I think.
>>
>> Christian
>>
>> --
>> History allows us to see human nature in a deeper way.
>> -- Ian Mortimer
>>
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
>

Re: [mod-security-users] Best Way to Whitelist strings in input fields that are similar to commands.

[Deanna S. <dst...@gm...>]

Christian,

My understanding is that what Kirk responded with doesn't address the
problems I am talking about. Looks like the reply I sent on March2 had a
delivery failure. I'll try to answer point by point here again. I'd be glad
if you can correct me if my thinking is wrong.

*"First thing I'd check is whether you're running the latest Core Rule Set
- that has been tuned to have less false positives
(see https://coreruleset.org/ <https://coreruleset.org/>)"*

I am running CRS/3.0.0, which I believe is the version that reduced large
number of false positives, and modsec ver is 2.9.

*"Then if you decide that this particular rule is more trouble than it's
worth, I'd disable the rule by ID using SecRuleRemoveById."*

The rule is getting lot of hits and the traffic is malicious 99.9% of the
time, so I'd rather not disable the rule.

*Chaim has a good article on tuning linked from the Core Rule Set
blog: https://www.oreilly.com/ideas/how-to-tune-your-waf-installation-to-reduce-false-positives
<https://www.oreilly.com/ideas/how-to-tune-your-waf-installation-to-reduce-false-positives>*

This article, talks about tuning the noise in general and approach one can
take to identify what is causing most noise, and work down methodically.
Its a great post.
But, the problem I have here is very specific and don't see those concepts
covered in that article. My problem is how would I whitelist SQL command
like words in text fields, but not actually whitelist SQL commands part of
SQLI.

Here is the problem:

I have a problem where SQL injection rules like "Detects concatenated basic
SQL injection and SQLLFI" attempts are firing, when the strings in the
input fields are similar to SQL commands. Here is an example.

8d85025e-H-- Message: Warning. Pattern match "(?i:(?:[\\d\\W]\\s+as\\s*?[\"
'`\\w]+\\s*?from)|(?:^[\\W\\d]+\\s*?(?:union|select|create|
rename|truncate|load|alter|delete|update|insert|desc)\\b)
|(?:(?:select|create|rename|truncate|load|alter|delete|
update|insert|desc)\\s+(?:(?:group_)concat|char|load ..." at ARGS:address1.
[file "/etc/modsec/sitebuyprod/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"]
[line "451"] [id "942360"] [rev "2"] [msg "Detects concatenated basic SQL
injection and SQLLFI attempts"] *[data "Matched Data: 1922 ALTER found
within ARGS:address1: 1922 ALTER St PHILADELPHIA, PA 19146"*] [severity
"CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "8"] [tag
"application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag
"attack-sqli"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag
"WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag
"PCI/6.5.2"]

How do I whitelist this behavior in a way, where
1. I am not whitelisting actual SQL injection commands. Like in above case,
I can whitelist not to fire on string "alter" for args adress1, but doesn't
that eliminate detection/blocking of any alter based SQL injection?
2. Is there a way to whitelist such false positives globally for all
fields. The string could be present in address 2 next time or comments
etc., and there are multiple sites. Do I have to collect all possible
fields for all sites, or can I whitelist this false positive globally in
some way?

Hope that better explains what am looking for. If the answer is that I
won't be able to do something like that, and just have to whitelist those
words by each field per URI, and hope other SQLI attack based rules capture
the attack when they are actual SQL commands, I'll take that, but wanted to
confirm and verify with experienced user community here. Would greatly
appreciate sharing your opinion.

Sincerely,
Deanna

On Fri, Mar 16, 2018 at 9:29 AM, Christian Folini <
chr...@ne...> wrote:

> Hey Deanna,
>
> Kirk Jackson responded to your message on March 2. Is there anything wrong
> with his advice?
>
> Best,
>
> Christian
>
> On Fri, Mar 16, 2018 at 09:17:49AM -0600, Deanna Stevenson wrote:
> > Hi All,
> >
> > Any advise on possible solutions for my problem?
> >
> > Sincerely,
> > Deanna
> >
> >
> >
> > On Tue, Mar 6, 2018 at 10:22 AM, Franziska Buehler <
> > fra...@gm...> wrote:
> >
> > > Hi,
> > >
> > > Just a note about the linked blog post:
> > >
> > > https://www.oreilly.com/ideas/how-to-tune-your-waf-
> > > installation-to-reduce-false-positives
> > >
> > > It was Christian Folini who has written this blog post about how to
> > > reduce false positives.
> > > Chaim linked it on https://coreruleset.org.
> > >
> > > Best regards,
> > > Franziska
> > >
> > > ------------------------------------------------------------
> > > ------------------
> > > Check out the vibrant tech community on one of the world's most
> > > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > >
>
> > ------------------------------------------------------------
> ------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
> --
> https://www.feistyduck.com/training/modsecurity-training-course
> https://www.feistyduck.com/books/modsecurity-handbook/
> mailto:chr...@ne...
> twitter: @ChrFolini
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] ModSecurity phase timing

[Felipe Z. <fe...@zi...>]

I have no bug report saying that DURATION is not working and a regression
test that leads me to believe that it is working. Thus, I am assuming that
it is working Ok.

Indeed, running a shell script may be hard for a group of users, but i
don't think that it is a motivation to have poor optimization for all users.

Br.,
Felipe.




On Mon, Mar 26, 2018 at 1:51 PM Christian Folini <
chr...@ne...> wrote:

> Hey Felipe,
>
> On Mon, Mar 26, 2018 at 04:45:41PM +0000, Felipe Zimmerle wrote:
> > There are other means to read "timing", no need to use performance
> > variables for that.
> > https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#DURATION
>
> Does DURATION really work in 3.0 / nginx?
>
> If that is granted, I can live with it. But digging into header-Files and
> running external scripts (separate process!) because I want to get a
> Performance overview is quite demanding I think.
>
> Christian
>
> --
> History allows us to see human nature in a deeper way.
> -- Ian Mortimer
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] ModSecurity phase timing

[Christian F. <chr...@ne...>]

Hey Felipe,

On Mon, Mar 26, 2018 at 04:45:41PM +0000, Felipe Zimmerle wrote:
> There are other means to read "timing", no need to use performance
> variables for that.
> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#DURATION

Does DURATION really work in 3.0 / nginx?

If that is granted, I can live with it. But digging into header-Files and
running external scripts (separate process!) because I want to get a 
Performance overview is quite demanding I think.

Christian

-- 
History allows us to see human nature in a deeper way.
-- Ian Mortimer

Re: [mod-security-users] ModSecurity phase timing

[Felipe Z. <fe...@zi...>]

Hi,

https://github.com/SpiderLabs/ModSecurity/blob/v3/master/headers/modsecurity/transaction.h#L481-L485

Contains the id of the transaction along all the information that you may
need to know about it.

There are other means to read "timing", no need to use performance
variables for that.
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#DURATION

Br.,
Felipe.



On Mon, Mar 26, 2018 at 1:16 PM Robert Paprocki <
rpa...@fe...> wrote:

> Yes but how do you correlate this to a specific, known request?
>
> And what is to be done with rulesets that rely on phase timing data? Are
> they unsupported forever?
>
>
> On Mar 26, 2018, at 08:52, Felipe Costa <FC...@tr...> wrote:
>
> Hi,
>
>
>
>
>
> > On 3/23/18, 5:29 PM, "Christian Folini" <chr...@ne...>
> wrote:
>
> >
>
> >     Hey Zimmerle,
>
> >
>
> >     That makes sense, but I think it does not hold up when you look
> closer.
>
> >
>
>
>
> Why do you think so?
>
>
>
>
>
> >    Correct me if I am wrong, but correlating stap with an individual
> request
>
> >    is much more difficult than saving the perf-data out of ModSec
> directly
>
> >    into the access-log (Apache / ModSec 2.9) or error-log (NGINX /
> ModSec 3.0).
>
>
> IMHO it is easy as there is no file to be parsed.
>
>
>
> (…)
>
>
>
>
>
> Br.,
>
> Felipe “Zimmerle” Costa
>
> Security Researcher, Lead Developer ModSecurity.
>
> Trustwave | SMART SECURITY ON DEMAND
>
> www.trustwave.com <http://www.trustwave.com/>
>
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] ModSecurity phase timing

[Robert P. <rpa...@fe...>]

Yes but how do you correlate this to a specific, known request?

And what is to be done with rulesets that rely on phase timing data? Are they unsupported forever?


> On Mar 26, 2018, at 08:52, Felipe Costa <FC...@tr...> wrote:
> 
> Hi,
>  
>  
> > On 3/23/18, 5:29 PM, "Christian Folini" <chr...@ne...> wrote:
> > 
> >     Hey Zimmerle,
> >    
> >     That makes sense, but I think it does not hold up when you look closer.
> >
>  
> Why do you think so?
>  
>  
> >    Correct me if I am wrong, but correlating stap with an individual request
> >    is much more difficult than saving the perf-data out of ModSec directly
> >    into the access-log (Apache / ModSec 2.9) or error-log (NGINX / ModSec 3.0).
> 
> IMHO it is easy as there is no file to be parsed.
>     
> (…)
>  
>  
> Br.,
> Felipe “Zimmerle” Costa
> Security Researcher, Lead Developer ModSecurity.
> Trustwave | SMART SECURITY ON DEMAND
> www.trustwave.com <http://www.trustwave.com/>
>  
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] ModSecurity phase timing

[Felipe C. <FC...@tr...>]

Hi,





> On 3/23/18, 5:29 PM, "Christian Folini" <chr...@ne...> wrote:

>

>     Hey Zimmerle,

>

>     That makes sense, but I think it does not hold up when you look closer.

>



Why do you think so?





>    Correct me if I am wrong, but correlating stap with an individual request

>    is much more difficult than saving the perf-data out of ModSec directly

>    into the access-log (Apache / ModSec 2.9) or error-log (NGINX / ModSec 3.0).

IMHO it is easy as there is no file to be parsed.



(…)





Br.,

Felipe “Zimmerle” Costa

Security Researcher, Lead Developer ModSecurity.

Trustwave | SMART SECURITY ON DEMAND

www.trustwave.com <http://www.trustwave.com/>

Re: [mod-security-users] ModSecurity phase timing

[Christian F. <chr...@ne...>]

Hey Zimmerle,

That makes sense, but I think it does not hold up when you look closer.

Correct me if I am wrong, but correlating stap with an individual request
is much more difficult than saving the perf-data out of ModSec directly
into the access-log (Apache / ModSec 2.9) or error-log (NGINX / ModSec 3.0).

Also, I think the DURATION variable is not yet implemented in 3.0. Or did I
make a mistake when I found it was always empty?

Best,

Christian


On Fri, Mar 23, 2018 at 01:14:04PM +0000, Felipe Costa wrote:
> Hi Gregory,
> 
> Indeed, the PERF_ related variables are not supported in v3. The reason for that is the fact that you can use linux instrumentation to measure those performance numbers with better accuracy. As the PERF generation itself was already impacting on the performance.
> 
> For further info, please have a look here: https://github.com/SpiderLabs/ModSecurity/issues/1011
> 
> Br.,
> Felipe “Zimmerle” Costa
> Security Researcher, Lead Developer ModSecurity.
> 
> Trustwave | SMART SECURITY ON DEMAND
> www.trustwave.com<http://www.trustwave.com/>
> 
> From: Gregory LeFevre <gr...@cl...>
> Reply-To: "mod...@li..." <mod...@li...>
> Date: Wednesday, March 21, 2018 at 12:21 AM
> To: "mod...@li..." <mod...@li...>
> Subject: [mod-security-users] ModSecurity phase timing
> 
> 
> Hello,
> 
> Is access to phase timing known to work in ModSecurity 3.x with Nginx?
> 
> For example, should I be able to write a SecAction in phase:5 to log PERF_PHASE2, or PERF_ALL, etc.?
> 
> I'm using an earlier version of Nginx, and I have such rules, and lines for them do, in fact, show up in the log, but without the performance information. For example, this (which I include in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf):
> 
> SecAction "id:90110, phase:5, pass, t:none, log, noauditlog, msg:'PERF_ALL: %{PERF_ALL}'"
> 
> shows up in the log as:
> 
> ... [id "90110"] [rev ""] [msg "PERF_ALL: "] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] ...
> 
> Just curious whether this should be considered possible now or whether anyone already may have had success doing so.
> 
> Thank you,
> 
> Gregory
> 

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

Re: [mod-security-users] ModSecurity phase timing

[Felipe C. <FC...@tr...>]

Hi Gregory,

Indeed, the PERF_ related variables are not supported in v3. The reason for that is the fact that you can use linux instrumentation to measure those performance numbers with better accuracy. As the PERF generation itself was already impacting on the performance.

For further info, please have a look here: https://github.com/SpiderLabs/ModSecurity/issues/1011

Br.,
Felipe “Zimmerle” Costa
Security Researcher, Lead Developer ModSecurity.

Trustwave | SMART SECURITY ON DEMAND
www.trustwave.com<http://www.trustwave.com/>

From: Gregory LeFevre <gr...@cl...>
Reply-To: "mod...@li..." <mod...@li...>
Date: Wednesday, March 21, 2018 at 12:21 AM
To: "mod...@li..." <mod...@li...>
Subject: [mod-security-users] ModSecurity phase timing


Hello,

Is access to phase timing known to work in ModSecurity 3.x with Nginx?

For example, should I be able to write a SecAction in phase:5 to log PERF_PHASE2, or PERF_ALL, etc.?

I'm using an earlier version of Nginx, and I have such rules, and lines for them do, in fact, show up in the log, but without the performance information. For example, this (which I include in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf):

SecAction "id:90110, phase:5, pass, t:none, log, noauditlog, msg:'PERF_ALL: %{PERF_ALL}'"

shows up in the log as:

... [id "90110"] [rev ""] [msg "PERF_ALL: "] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] ...

Just curious whether this should be considered possible now or whether anyone already may have had success doing so.

Thank you,

Gregory

Re: [mod-security-users] Active specifics rules with SecRuleEngine DetectionOnly

[Christian F. <chr...@ne...>]

Hello,

That looks good already. But you have a very peculiar setup in your mind.

Maybe it works if you put CRS from scoring into direct-blocking mode.
This is done in crs-setup.conf.

Good luck,

Christian

On Wed, Mar 21, 2018 at 05:15:31PM -0300, Cristiano Galdino wrote:
> Hi
> 
> I write this rule ans this works fine:
> 
> SecRule REQUEST_HEADERS:Host "^[\d.:]+$" \
>   "id:200,\
>    msg:'Host header is a numeric IP address - Block Request',\
>    phase:1,\
>    t:none,\
>    deny,\
>    ctl:ruleEngine=On"
> 
> But what I need is to change rule 920350 to ctl:ruleEngine=On and deny.
> 
> I do not know the syntax for this.
> 
> Cristiano Galdino
> cri...@ga...
> 
> On 21 Mar 2018 16:29 -0300, Reindl Harald <h.r...@th...>, wrote:
> >
> > Am 21.03.2018 um 20:19 schrieb Cristiano Galdino:
> > > But, how to do this in my rules and not in CRS?
> >
> > by just it to the rule like whitelist file extension in the sample below
> >
> > SecRule REQUEST_BASENAME
> > "\.(avi|css|csv|doc|docx|eot|flv|gif|htm|html|ico|jpeg|jpg|m4v|mp3|mp4|mpeg|mpg|otf|pdf|png|svg|svgz|ttf|txt|wma|wmv|woff|xls|xlsx)$"
> > "id:'90',phase:1,nolog,allow,ctl:ruleEngine=off"
> >
> > > On 21 Mar 2018 16:13 -0300, Christian Folini
> > > <chr...@ne...>, wrote:
> > > > Hello Cristiano,
> > > >
> > > > Did you try ctl:ruleEngine=On?
> > > >
> > > > Christian
> > > >
> > > > On Wed, Mar 21, 2018 at 01:47:54PM -0300, Cristiano Galdino wrote:
> > > > > Hi!
> > > > >
> > > > > My platform:
> > > > >
> > > > > - Modsecurity: 2.9.0-1 (from Ubuntu repository)
> > > > > - CRS 3.0
> > > > > - Apache 2.4.18-2ubuntu3.5
> > > > >
> > > > > Modsecurity is configured with SecRuleEngine DetectionOnly but I want
> > > > > to activate some rules to block requests.
> > > > >
> > > > > This is my configuration:
> > > > >
> > > > > IncludeOptional /etc/modsecurity/modsecurity.conf (set SecRuleEngine
> > > > > DetectionOnly)
> > > > > IncludeOptional /usr/share/modsecurity-crs/owasp-crs.load
> > > > > └──> Load all CRS 3
> > > > > IncludeOptional /usr/share/modsecurity-crs/my-rules.load
> > > > > └──> Load my specifics Rules.
> > > > >
> > > > > I want to include in my rules something that activates CRS rules. For
> > > > > example, change rule 920350 to engine=on to block accesses by IP.
> > > > >
> > > > > How to do this?
> >
> > ------------------------------------------------------------------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

Re: [mod-security-users] Active specifics rules with SecRuleEngine DetectionOnly

[Cristiano G. <cri...@ga...>]

Hi

I write this rule ans this works fine:

SecRule REQUEST_HEADERS:Host "^[\d.:]+$" \
  "id:200,\
   msg:'Host header is a numeric IP address - Block Request',\
   phase:1,\
   t:none,\
   deny,\
   ctl:ruleEngine=On"

But what I need is to change rule 920350 to ctl:ruleEngine=On and deny.

I do not know the syntax for this.

Cristiano Galdino
cri...@ga...

On 21 Mar 2018 16:29 -0300, Reindl Harald <h.r...@th...>, wrote:
>
> Am 21.03.2018 um 20:19 schrieb Cristiano Galdino:
> > But, how to do this in my rules and not in CRS?
>
> by just it to the rule like whitelist file extension in the sample below
>
> SecRule REQUEST_BASENAME
> "\.(avi|css|csv|doc|docx|eot|flv|gif|htm|html|ico|jpeg|jpg|m4v|mp3|mp4|mpeg|mpg|otf|pdf|png|svg|svgz|ttf|txt|wma|wmv|woff|xls|xlsx)$"
> "id:'90',phase:1,nolog,allow,ctl:ruleEngine=off"
>
> > On 21 Mar 2018 16:13 -0300, Christian Folini
> > <chr...@ne...>, wrote:
> > > Hello Cristiano,
> > >
> > > Did you try ctl:ruleEngine=On?
> > >
> > > Christian
> > >
> > > On Wed, Mar 21, 2018 at 01:47:54PM -0300, Cristiano Galdino wrote:
> > > > Hi!
> > > >
> > > > My platform:
> > > >
> > > > - Modsecurity: 2.9.0-1 (from Ubuntu repository)
> > > > - CRS 3.0
> > > > - Apache 2.4.18-2ubuntu3.5
> > > >
> > > > Modsecurity is configured with SecRuleEngine DetectionOnly but I want
> > > > to activate some rules to block requests.
> > > >
> > > > This is my configuration:
> > > >
> > > > IncludeOptional /etc/modsecurity/modsecurity.conf (set SecRuleEngine
> > > > DetectionOnly)
> > > > IncludeOptional /usr/share/modsecurity-crs/owasp-crs.load
> > > > └──> Load all CRS 3
> > > > IncludeOptional /usr/share/modsecurity-crs/my-rules.load
> > > > └──> Load my specifics Rules.
> > > >
> > > > I want to include in my rules something that activates CRS rules. For
> > > > example, change rule 920350 to engine=on to block accesses by IP.
> > > >
> > > > How to do this?
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Active specifics rules with SecRuleEngine DetectionOnly

[Reindl H. <h.r...@th...>]

Am 21.03.2018 um 20:19 schrieb Cristiano Galdino:
> But, how to do this in my rules and not in CRS?

by just it to the rule like whitelist file extension in the sample below

SecRule REQUEST_BASENAME 
"\.(avi|css|csv|doc|docx|eot|flv|gif|htm|html|ico|jpeg|jpg|m4v|mp3|mp4|mpeg|mpg|otf|pdf|png|svg|svgz|ttf|txt|wma|wmv|woff|xls|xlsx)$" 
"id:'90',phase:1,nolog,allow,ctl:ruleEngine=off"

> On 21 Mar 2018 16:13 -0300, Christian Folini 
> <chr...@ne...>, wrote:
>> Hello Cristiano,
>>
>> Did you try ctl:ruleEngine=On?
>>
>> Christian
>>
>> On Wed, Mar 21, 2018 at 01:47:54PM -0300, Cristiano Galdino wrote:
>>> Hi!
>>>
>>> My platform:
>>>
>>> - Modsecurity: 2.9.0-1 (from Ubuntu repository)
>>> - CRS 3.0
>>> - Apache 2.4.18-2ubuntu3.5
>>>
>>> Modsecurity is configured with SecRuleEngine DetectionOnly but I want 
>>> to activate some rules to block requests.
>>>
>>> This is my configuration:
>>>
>>> IncludeOptional /etc/modsecurity/modsecurity.conf (set SecRuleEngine 
>>> DetectionOnly)
>>> IncludeOptional /usr/share/modsecurity-crs/owasp-crs.load
>>> └──> Load all CRS 3
>>> IncludeOptional /usr/share/modsecurity-crs/my-rules.load
>>> └──> Load my specifics Rules.
>>>
>>> I want to include in my rules something that activates CRS rules. For 
>>> example, change rule 920350 to engine=on to block accesses by IP.
>>>
>>> How to do this?

Re: [mod-security-users] Active specifics rules with SecRuleEngine DetectionOnly

[Christian F. <chr...@ne...>]

On Wed, Mar 21, 2018 at 04:19:16PM -0300, Cristiano Galdino wrote:
> Hi Christian!
> 
> But, how to do this in my rules and not in CRS?

You write a rule in phase 1 and place it before the CRS include.
That rule should contain the ctl statement and enable that based on a
condition with @ipMatch.

Good luck,

Christian

> 
> Regards,
> 
> Cristiano Galdino
> cri...@ga...
> 
> On 21 Mar 2018 16:13 -0300, Christian Folini <chr...@ne...>, wrote:
> > Hello Cristiano,
> >
> > Did you try ctl:ruleEngine=On?
> >
> > Christian
> >
> > On Wed, Mar 21, 2018 at 01:47:54PM -0300, Cristiano Galdino wrote:
> > > Hi!
> > >
> > > My platform:
> > >
> > > - Modsecurity: 2.9.0-1 (from Ubuntu repository)
> > > - CRS 3.0
> > > - Apache 2.4.18-2ubuntu3.5
> > >
> > > Modsecurity is configured with SecRuleEngine DetectionOnly but I want to activate some rules to block requests.
> > >
> > > This is my configuration:
> > >
> > > IncludeOptional /etc/modsecurity/modsecurity.conf (set SecRuleEngine DetectionOnly)
> > > IncludeOptional /usr/share/modsecurity-crs/owasp-crs.load
> > > └──> Load all CRS 3
> > > IncludeOptional /usr/share/modsecurity-crs/my-rules.load
> > > └──> Load my specifics Rules.
> > >
> > > I want to include in my rules something that activates CRS rules. For example, change rule 920350 to engine=on to block accesses by IP.
> > >
> > > How to do this?
> > >
> > > Best regards,
> > >
> > >
> > > Cristiano Galdino
> > > cri...@ga...
> >
> > > ------------------------------------------------------------------------------
> > > Check out the vibrant tech community on one of the world's most
> > > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> >
> >
> > --
> > https://www.feistyduck.com/training/modsecurity-training-course
> > https://www.feistyduck.com/books/modsecurity-handbook/
> > mailto:chr...@ne...
> > twitter: @ChrFolini
> >
> > ------------------------------------------------------------------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

Re: [mod-security-users] Active specifics rules with SecRuleEngine DetectionOnly

[Cristiano G. <cri...@ga...>]

Hi Christian!

But, how to do this in my rules and not in CRS?

Regards,

Cristiano Galdino
cri...@ga...

On 21 Mar 2018 16:13 -0300, Christian Folini <chr...@ne...>, wrote:
> Hello Cristiano,
>
> Did you try ctl:ruleEngine=On?
>
> Christian
>
> On Wed, Mar 21, 2018 at 01:47:54PM -0300, Cristiano Galdino wrote:
> > Hi!
> >
> > My platform:
> >
> > - Modsecurity: 2.9.0-1 (from Ubuntu repository)
> > - CRS 3.0
> > - Apache 2.4.18-2ubuntu3.5
> >
> > Modsecurity is configured with SecRuleEngine DetectionOnly but I want to activate some rules to block requests.
> >
> > This is my configuration:
> >
> > IncludeOptional /etc/modsecurity/modsecurity.conf (set SecRuleEngine DetectionOnly)
> > IncludeOptional /usr/share/modsecurity-crs/owasp-crs.load
> > └──> Load all CRS 3
> > IncludeOptional /usr/share/modsecurity-crs/my-rules.load
> > └──> Load my specifics Rules.
> >
> > I want to include in my rules something that activates CRS rules. For example, change rule 920350 to engine=on to block accesses by IP.
> >
> > How to do this?
> >
> > Best regards,
> >
> >
> > Cristiano Galdino
> > cri...@ga...
>
> > ------------------------------------------------------------------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
> --
> https://www.feistyduck.com/training/modsecurity-training-course
> https://www.feistyduck.com/books/modsecurity-handbook/
> mailto:chr...@ne...
> twitter: @ChrFolini
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/