mod-security-users — General discussion about mod_security

Re: [mod-security-users] web app discovery

[Ivan R. <iva...@gm...>]

On 5/25/06, kiran k <kir...@ya...> wrote:
>
> Ok, with positive security there are no rules and it is based on usage
> pattern, anomalies would be flagged ?

Yes, there are rules.


> How you determine this behavioural model.

By observing the real-life traffic.


>  It is counter-intuitive to acquire
> scanning tool to write the policies.

The scanning tools cannot provide you with the real-life data. They
can possibly enumerate the scripts and the parameters but not the data
types.


> How do you write positive security
> using the rules you mentioned manually. Can you show examples in the
> downloads ?

I don't have any examples handy but the idea is to write a group of
rules for each individual resource. These rules would examine every
parameter, how many parameters there are with the same name, are there
any extra parameters, for every parameter check the content, the
length, etc. You can see that this can quickly turn into a very
tedious job.

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

Re: [mod-security-users] web app discovery

[kiran k <kir...@ya...>]

 
  Ok, with positive security there are no rules and it is based on usage pattern, anomalies would be flagged ?
   
  How you determine this behavioural model. It is counter-intuitive to acquire scanning tool to write the policies. How do you write positive security using the rules you mentioned manually. Can you show examples in the downloads ?
   
  -Kiran 

Ivan Ristic <iva...@gm...> wrote:
  On 5/21/06, kiran k wrote:
>
> Are there any tools which discovers web application from an input URL.
>
> I am looking for a tool which crawls recursively and finds the forms, form
> fields, server scripts, cookies and hidden fileds. Based on this information
> I would like to develop policies. If I have this data in xml it would be
> even better.
>
> Any quick starting point would be greatly appreciated, if no tools exists.
> How about any commercial libraries ?

Your best bet might be the commercial tools (web application
vulnerability scanners). But, IMHO, none of the tools I have seen are
smart enough to work in a general case. For example, if the web site
uses JavaScript or Flash for navigation the tool is not going to help
you much.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users


				
---------------------------------
Do you Yahoo!?
 Next-gen email? Have it all with the  all-new Yahoo! Mail Beta.

Re: [mod-security-users] Positive Security Model

[Ivan R. <iva...@gm...>]

On 5/25/06, Edy <em...@ed...> wrote:
> How is the performance of the Mod Security right now?

Under 1 msec per request running the Certified Rule Set (similar to
what's available for free) on modest hardware. On the same modest
hardware but installed on a reverse proxy it can achieve 1500 request
per second with latency under 1 msec. You can achieve many times
better performance with more powerful hardware (e.g. T1000/T2000). I
hope to do a test with T1000 in the next couple of months.


> From the way i
> look at it right now it is based on rules which essentially is negative
> security.

It supports both models. But positive security rules sets are
difficult to write manually.


> I believe the chances of false positive is fairly high with
> this approach and performance could be a hit if we have a long list of
> rules.

Depends on the application...


> Also on the website, it stated that the modsecurity can be configured as
> stand alone WAF but i did not see any package/document which describe
> this process.

Just configure Apache to work as a reverse proxy and you're done.

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

Re: [mod-security-users] Positive Security Model

[Ivan R. <iva...@gm...>]

On 5/25/06, Alexx Alexx <zm...@ya...> wrote:
> My question is addressed to the author of the
> mod_security. Some time ago I read in your blog, that
> your are intrested in idea of including positive
> security model ito your mod_security module. Are you
> going to implement this somewhen?

I am, but the feature didn't make it to v2.0 due to time constraints.
But it's now on the top of the list. I decided to leave positive
security out because it needs interactivity in order to work properly
and the management GUI is not going to be ready for a couple of more
months.


> OR, perhaps, it's
> already implemented?
> I'm rather intrested of positive security model and
> I'd like to clarify wheter it's possible to include
> into your application!

It's possible to manually write the rules but that's somewhat
hard/boring/time consuming to do.

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

[mod-security-users] Fwd: errors while trying to load mod_security2 beta3

[<ste...@gm...>]

Okay. Got it fixed. But the changes in 2.0.0 are to much for me to handle now. The included RTF document is okay, but in now way verbose enought for me to understand how and wich of my 2.0.0-dev1 rules I need to change.

Will definatly wait till 2.0.0 comes out or try again when the documentation gets better.

cheers

SteveB

-------- Original-Nachricht --------
Datum: Thu, 25 May 2006 18:43:56 +0200
Von: ste...@gm...
An: mod...@li...
Betreff: errors while trying to load mod_security2 beta3

Hallo List

I compiled mod_security2 beta3 under Gentoo Linux. But when I try to use it, then I get the following error:

Cannot load /usr/lib/apache2/modules/mod_security2.so into server: /usr/lib/apache2/modules/mod_security2.so: undefined symbol: msc_alert

Does any one know how to fix that?

cheers

Steve
-- 

Bis zu 70% Ihrer Onlinekosten sparen: GMX SmartSurfer!
      Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer
    

-- 


Bis zu 70% Ihrer Onlinekosten sparen: GMX SmartSurfer!
      Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer
    

[mod-security-users] Installing modsecurity apache2

[Markus B. <cha...@ho...>]

Hello,

i try to install the modsecurity.

This steps worked succesfully:
$ cd <modsecurity-source>/apache2
$ mkdir -r <apache2-source>/modules/security
$ cp mod_security.c Makefile.in config.m4 <apache2-source>/modules/security
$ cd <apache2-source>

But when i type

./buildconf

i get this:

-bash: ./buildconf: File or folder not found.

So how can i install the modsecrutty for apache2

Thanks
marcus

_________________________________________________________________
Die neue MSN Suche Toolbar mit Windows-Desktopsuche. Suchen Sie gleichzeitig 
im Web, Ihren E-Mails und auf Ihrem PC! Jetzt neu! http://desktop.msn.de/ 
Jetzt gratis downloaden!

[mod-security-users] errors while trying to load mod_security2 beta3

[<ste...@gm...>]

Hallo List

I compiled mod_security2 beta3 under Gentoo Linux. But when I try to use it, then I get the following error:

Cannot load /usr/lib/apache2/modules/mod_security2.so into server: /usr/lib/apache2/modules/mod_security2.so: undefined symbol: msc_alert


Does any one know how to fix that?


cheers

Steve
-- 


Bis zu 70% Ihrer Onlinekosten sparen: GMX SmartSurfer!
      Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer
    

Re: [mod-security-users] Positive Security Model

[Edy <em...@ed...>]

How is the performance of the Mod Security right now? From the way i 
look at it right now it is based on rules which essentially is negative 
security. I believe the chances of false positive is fairly high with 
this approach and performance could be a hit if we have a long list of 
rules.

Also on the website, it stated that the modsecurity can be configured as 
stand alone WAF but i did not see any package/document which describe 
this process.

Cheers,
-e

Alexx Alexx wrote:
> My question is addressed to the author of the
> mod_security. Some time ago I read in your blog, that
> your are intrested in idea of including positive
> security model ito your mod_security module. Are you
> going to implement this somewhen? OR, perhaps, it's
> already implemented? 
> I'm rather intrested of positive security model and
> I'd like to clarify wheter it's possible to include
> into your application!
>
> Thanks in advance, 
> Alexander
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
>
>
> -------------------------------------------------------
> All the advantages of Linux Managed Hosting--Without the Cost and Risk!
> Fully trained technicians. The highest number of Red Hat certifications in
> the hosting industry. Fanatical Support. Click to learn more
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
>
>   

[mod-security-users] Positive Security Model

[Alexx A. <zm...@ya...>]

My question is addressed to the author of the
mod_security. Some time ago I read in your blog, that
your are intrested in idea of including positive
security model ito your mod_security module. Are you
going to implement this somewhen? OR, perhaps, it's
already implemented? 
I'm rather intrested of positive security model and
I'd like to clarify wheter it's possible to include
into your application!

Thanks in advance, 
Alexander

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

Re: [mod-security-users] mod_security blocking many PHPMyAdmin functions

[Kai S. <mai...@co...>]

Ivan Ristic wrote on Tue, 23 May 2006 10:08:08 +0100:

> > If I wanted to add an exclusion for the simple rule above I would do
> this like that: 
> > SecFilter "select.+from"
> "id:uniqueid,rev:x,severity:x,msg:'message'" 
> > is that correct?
> 
>  
> Exclusion? No, that is a way to add a new rule.

I mean I change the existing rule like the above (add a unique id (outside 
the reserved range)) and then I can exclude that id like it is done in 
exclude.conf. Other way would be to use the regexp pattern in the rule 
itself to exclude something as it is done with many rules in the set from 
gotroot. But then I had the disadvantage of managing the differences 
between my changes and any newer versions of these files to these files.

Kai

-- 
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

[mod-security-users] ModSecurity 2.0.0-beta-3 now available for testing (ModSecurity Console too)

[Ivan R. <iva...@gm...>]

Hi there,

After spending several months locked up in my office working on the
next-generation version of ModSecurity, I am *very* happy to announce
that ModSecurity 2.0.0-beta-3 is now available for download and
testing.

There are so many improvements that, frankly, I don't know where to
being. You will find more information here:
http://www.modsecurity.org/blog/archives/2006/05/modsecurity_for_2.html

ModSecurity 2.x is like a friend you haven't seen in years. The face
is very familiar, the same yet different. I think your best bet is to
go through the new manual and observe the changes. There has been a
lot of tidying up.

I am planning to release 2.0.0 Final on June 15. This is the biggest
release ever. I need your help in finding the bugs that are probably
in there somewhere. I also need your thoughts on various changes.
There is still time to tweak some of them.

On a related matter, I have also released the first public beta of
ModSecurity Console (http://www.thinkingstone.com/products/console/).
It can be downloaded from Thinking Stone Network
(https://www.thinkingstone.com/tsn/). The Console is not likely to be
open source or free, but it is going to be very affordable.

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

Re: [mod-security-users] Handling different request from different server

[Ivan R. <iva...@gm...>]

On 5/23/06, Kwa Han Wee <hw...@ye...> wrote:
>
> I have some problem implementing the rules which send some requires from =
my
> application server containing "^$" in the header request.  Can I write a
> rule to allow all requests from some IP while restricting the rest from
> sending such request?

Sure, for example (use as your first rule):

SecFilterSelective REMOTE_ADDR ^127\.0\.0\.01$" nolog,allow

It's in the manual too.

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

Re: Re[5]: [mod-security-users] escape character problem - mod_security v1.9.2

[Ivan R. <iva...@gm...>]

On 5/23/06, gyo...@hi... <gyo...@hi...> wrote:
>
> When I input string \', I see the debug log is like this,
> ..
> [23/May/2006:09:47:51 +0900] [localhost/sid#2bc130][rid#7079e8][/post.htm=
l][4] Adding parameter: "username"=3D"/'"
> ...
> So, it seems character \ to be ignored.

That's because you are running on Windows. It isn't ignored but it's
converted to a forward slash. It's an implicit anti-evasion measure
that cannot be turned off (unless you change the source code, which is
a perfectly valid approach). Changing your signature to check for /"
should provide results in your case.

FYI, because this implicit anti-evasion is often very annoying (and it
isn't the right way to do things) it has been removed from ModSecurity
2.x (which is currently in beta).

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

Re: [mod-security-users] mod_security blocking many PHPMyAdmin functions

[Ivan R. <iva...@gm...>]

On 5/22/06, Kai Schaetzl <mai...@co...> wrote:
> The match is correct, it contains a "select ... from" statement. (BTW, no=
 other
> method to find the correct rule than searching for the pattern, right?)

No, unless you have assigned unique IDs to each of your rules. (Which,
for example, I did for the Certified ModSecurity Rules.)

> Ok, it's not this rule that hit. That also explains why the message wasn'=
t
> noted above. I searched all the rules files but I didn't search the main
> mod_security.conf that (I think) came with mod_security.
> There are these rules:
>     # Very crude filters to prevent SQL injection attacks
>      SecFilter "delete[[:space:]]+from"
>      SecFilter "insert[[:space:]]+into"
>      SecFilter "select.+from"
> and it's the last one that gets triggered.
> It seems all three rules are encompassed by the SQL Injection rules in
> rules.conf as quoted in my first posting. So, if I keep rules.conf I
> could probably delete those three, right?

Yes, probably.


> If I wanted to add an exclusion for the simple rule above I would do this=
 like that:
> SecFilter "select.+from" "id:uniqueid,rev:x,severity:x,msg:'message'"
> is that correct?

Exclusion? No, that is a way to add a new rule.


> BTW, while viewing over the documentation I found some links to your webk=
reator.com
> site and read some of the old PHP articles. However, the Techniques secti=
on doesn't show the single articles, there seems to be some error with the =
template.

Thanks, I'll look into that.


> I'm now trying to understand how the chaining works. Documentation doesn'=
t say anything
> about finishing it so I suppose the chaining works only for the next line=
 after the
> chain action?

Yes.


> Is it limited to one line or can I add more lines to a chain by
> adding the chain action to all of them except the last one?

There's no limit, you can chain any number of rules together.

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

[mod-security-users] Handling different request from different server

[Kwa H. W. <hw...@ye...>]

Hey gurus,

=20

I'm a newbie here using mod_security for my apache version 1.3. =20

=20

I have some problem implementing the rules which send some requires from
my application server containing "^$" in the header request.  Can I
write a rule to allow all requests from some IP while restricting the
rest from sending such request?

=20

Thanks amillion.

wannabe

=20

Re[5]: [mod-security-users] escape character problem - mod_security v1.9.2

[<gyo...@hi...>]

Ivan, thanks.
Here is debug log,
...
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][4] Adding parameter: "username"="/\""
...
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][2] Checking signature "username=" at POST_PAYLOAD
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][4] Checking against "bbsID=feedback&MsgID=12329&threadcode=00006051!&sticky=0&username=/\"&password=1&title=\x82\xa0\x82\xa0\x82\xa0\x82\xa0\x82\xa0\x82\xa0\x82\xa0\x82\xa0&msgbody=&img=&file=&dig=1&120=&Submit=submit"
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][9] Check took 0 usec
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][3] Warning (chained rule). Pattern match "username=" at POST_PAYLOAD
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][9] Signature check returned 403
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][9] Chained rule with match, continue in the loop
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][2] Checking signature "username=\\\\\"&" at ARG("username")
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][4] Checking against "/\""
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][9] Check took 0 usec
[23/May/2006:09:42:33 +0900] [localhost/sid#2bc130][rid#6f1768][/post.html][9] Signature check returned 0
...
It doesn't work yet :(
I also wonder why post form parameter value \" changed to /\". 

When I input string \', I see the debug log is like this,
..
[23/May/2006:09:47:51 +0900] [localhost/sid#2bc130][rid#7079e8][/post.html][4] Adding parameter: "username"="/'"
...
So, it seems character \ to be ignored.

Conan,

>> Thank Ivan.
>>
>> I tested this rule.
>> ###
>> SecFilterSelective ARG_parameter1 "\\\""
>> ###
>>
>> It filters all messages which includes character ",
>
>Ah, sorry, my mistake. We want to use:
>
>SecFilterSelective ARG_parameter1 "\\\\\""
>
>After Apache is done with the parameter (regex pattern) it will
>convert "\\\\\"" to \\", which is what you want (since \ is used to
>escape characters in regex patterns too).
>
>-- 
>Ivan Ristic, Technical Director
>Thinking Stone, http://www.thinkingstone.com
>ModSecurity: Open source Web Application Firewall
>

Re: [mod-security-users] Working with Reverse Proxy

[Kai S. <mai...@co...>]

Ivan Ristic wrote on Mon, 22 May 2006 21:58:34 +0100:

> You can either respond with a very simple message:

Actually, if need be you can span that over several lines and thus 
transmit a "complete" error page. It's a bit difficult to handle, of 
course.

Kai

-- 
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

Re: [mod-security-users] mod_security blocking many PHPMyAdmin functions

[Kai S. <mai...@co...>]

Ivan Ristic wrote on Mon, 22 May 2006 09:56:32 +0100:

Thanks for your answer!

> Surely you mean to say your ModSecurity *configuration* blocks the 
> PHPMyAdmin pages? :) 

Well, ultimately it is mod_security, but you are right, it's of course,
how it is configured ;-) I took the rules from 
http://www.gotroot.com/mod_security+rules, but don't use all of them.
I removed the blacklist ones and similar stuff, since they took too 
much memory for my taste. I also commented out one or two rules from 
the other files. I didn't change anything else or added my own rules.

> Rule IDs are applied either to rules (single line) or rule chains 
> (multiple lines). Rule 300016 is a chained rule thus exclusion applies 
> to the second line too. 

That's what I thought, too. But since it didn't seem to do this in this 
case I wasn't sure and I'm very new to mod_security. Maybe it's just a 
different rule that gets triggered and I'm looking at the wrong one. 
(yes, see below)

>  
> BTW, you should exclude all rules related to SQL Injection in order to 
> get PHPMyAdmin to work properly. 

Yes, I understand that. I had hoped that's already been done in the rules 
from gotroot. At least it's got started by excluding tbl_change.php.

> What is the error message that you get?

I can't reproduce the problem with "tbl_change.php" at the moment, but 
I get it with sql.php from PHPMyAdmin. I tried to add that page to the 
exclusions (exclude.conf), but this did't work. So, here we go:

> mod_security-message: Access denied with code 406. Pattern match
> "select.+from" at REQUEST_URI [severity "EMERGENCY"]
> mod_security-action: 406

The match is correct, it contains a "select ... from" statement. (BTW, no other
method to find the correct rule than searching for the pattern, right?)

The only match for this is in rules.conf:

> SecFilterSelective REQUEST_URI "!(/forum/posting\.php)"
> "chain,id:300016,rev:1,severity:2,msg:'Generic SQL injection
> protection'"
> SecFilterSelective ARGS
> "(insert[[:space:]]+into.+values|select.+from|bulk[[:space:]]+insert|union.+select)"

(I don't see that "msg" anywhere, though. It's not in the audit.log and 
not in the HTTP error page. Shouldn't it get logged instead of or in 
addition to the message quoted above at least to the audit log?)

Ok, it's not this rule that hit. That also explains why the message wasn't
noted above. I searched all the rules files but I didn't search the main 
mod_security.conf that (I think) came with mod_security. 
There are these rules:
    # Very crude filters to prevent SQL injection attacks
     SecFilter "delete[[:space:]]+from"
     SecFilter "insert[[:space:]]+into"
     SecFilter "select.+from"
and it's the last one that gets triggered.
It seems all three rules are encompassed by the SQL Injection rules in 
rules.conf as quoted in my first posting. So, if I keep rules.conf I
could probably delete those three, right?

I added an exclusion for sql.php now and that seems to work.
If I wanted to add an exclusion for the simple rule above I would do this like that:
SecFilter "select.+from" "id:uniqueid,rev:x,severity:x,msg:'message'"
is that correct?

BTW, while viewing over the documentation I found some links to your webkreator.com
site and read some of the old PHP articles. However, the Techniques section doesn't show
the single articles, there seems to be some error with the template.

I'm now trying to understand how the chaining works. Documentation doesn't say anything
about finishing it so I suppose the chaining works only for the next line after the 
chain action? Is it limited to one line or can I add more lines to a chain by
adding the chain action to all of them except the last one? A brief look over the
gotroot rules doesn't reveal any chains over more than two lines, so more lines are 
either not supported or not necessary in most cases.

Kai

-- 
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

Re: [mod-security-users] Working with Reverse Proxy

[Ivan R. <iva...@gm...>]

On 5/22/06, Chris Scott <chr...@ex...> wrote:
> Hey Guys,
>
> I'm trying to setup a reverse proxy that does some filtering as well.  I'=
ve
> got mod_security and mod_proxy loaded and configured.  mod_security is
> matching its filters (the deny message shows up in the log), but the prox=
y
> still passes the connection to the end server.  Is there any way to deny =
the
> proxying based off of what mod_security allows or denies?
>
> ...
>
> GET /error/HTTP_INTERNAL_SERVER_ERROR.html.var

  You have ErrorDocument configured on the same domain name.
  The original request is cancelled (and does not go through). In order
  to respond as configured Apache creates a new request but that
  request is proxied to the backend server.

  You can either respond with a very simple message:

  ErrorDocument 403 "Sorry can't allow you access today"

  or respond with an error document on a different domain (one that
  is not proxied:

  ErrorDocument 500 http://foo.example.com/cgi-bin/tester

  or create a proxy exclusion for a part of domain (e.g. /error/) and
  place your error documents there.

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

[mod-security-users] Working with Reverse Proxy

[Chris S. <chr...@ex...>]

Hey Guys,

I'm trying to setup a reverse proxy that does some filtering as well.  I've 
got mod_security and mod_proxy loaded and configured.  mod_security is 
matching its filters (the deny message shows up in the log), but the proxy 
still passes the connection to the end server.  Is there any way to deny the 
proxying based off of what mod_security allows or denies?

We are using this setup in the DMZ, with a proxy going inbound, we'd prefer 
to deny the connection at the DMZ and not let it get any further.  Any help 
in this would be greatly appreciated.

--C 

Re: [mod-security-users] web app discovery

[Tom A. <tan...@oa...>]

kiran k wrote:
> Are there any tools which discovers web application from an input URL.
>  
> I am looking for a tool which crawls recursively and finds the forms, 
> form fields, server scripts, cookies and hidden fileds. Based on this 
> information I would like to develop policies. If I have this data in xml 
> it would be even better.
>  
>  Any quick starting point would be greatly appreciated, if no tools 
> exists. How about any commercial libraries ?

You could look at Firefox's "DOM Inspector".  I think it will handle 
Javascript and such.  I don't think it will recursively crawl a site, 
but it's open-source, so you could just pull the parser and write your 
own crawler portion or lift it from a robot.

Tom

Re: [mod-security-users] mod_security blocking many PHPMyAdmin functions

[Ivan R. <iva...@gm...>]

On 5/22/06, Kai Schaetzl <mai...@co...> wrote:
> mod_security blocks many of the PHPMyAdmin actions/pages
> (different pages on different PHPMyAdmin pages).

Surely you mean to say your ModSecurity *configuration* blocks the
PHPMyAdmin pages? :)


> There's
> already a rule that excludes some rules for applying to
> PHPMyAdmin. But it's not enough. How can I expand that?
>
> #PhpMyadmin
> <LocationMatch "/tbl_change.php">
>    SecFilterRemove 300016
> </LocationMatch>
>
> mod_security still blocks this page, probably because it doesn't
> exclude all possible matches. It seems to apply to the line below
> (from rules.conf) with "id:300016".
> It's not clear to me if it applies to the next line as well.

Rule IDs are applied either to rules (single line) or rule chains
(multiple lines). Rule 300016 is a chained rule thus exclusion applies
to the second line too.

BTW, you should exclude all rules related to SQL Injection in order to
get PHPMyAdmin to work properly.


> It's
> obviously the next line that triggers the blocking because there's a
> "select from" statement in the URL (many of the PHPMyAdmin URLs contain c=
omplete
> SQL queries).

What is the error message that you get?

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

Re: [mod-security-users] web app discovery

[Ivan R. <iva...@gm...>]

On 5/21/06, kiran k <kir...@ya...> wrote:
>
> Are there any tools which discovers web application from an input URL.
>
> I am looking for a tool which crawls recursively and finds the forms, for=
m
> fields, server scripts, cookies and hidden fileds. Based on this informat=
ion
> I would like to develop policies. If I have this data in xml it would be
> even better.
>
>  Any quick starting point would be greatly appreciated, if no tools exist=
s.
> How about any commercial libraries ?

Your best bet might be the commercial tools (web application
vulnerability scanners). But, IMHO, none of the tools I have seen are
smart enough to work in a general case. For example, if the web site
uses JavaScript or Flash for navigation the tool is not going to help
you much.

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

Re: Re[3]: [mod-security-users] escape character problem - mod_security v1.9.2

[Ivan R. <iva...@gm...>]

On 5/19/06, gyo...@hi... <gyo...@hi...> wrote:
> Thank Ivan.
>
> I tested this rule.
> ###
> SecFilterSelective ARG_parameter1 "\\\""
> ###
>
> It filters all messages which includes character ",

Ah, sorry, my mistake. We want to use:

SecFilterSelective ARG_parameter1 "\\\\\""

After Apache is done with the parameter (regex pattern) it will
convert "\\\\\"" to \\", which is what you want (since \ is used to
escape characters in regex patterns too).

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

[mod-security-users] mod_security blocking many PHPMyAdmin functions

[Kai S. <mai...@co...>]

mod_security blocks many of the PHPMyAdmin actions/pages 
(different pages on different PHPMyAdmin pages). There's
already a rule that excludes some rules for applying to 
PHPMyAdmin. But it's not enough. How can I expand that?

#PhpMyadmin
<LocationMatch "/tbl_change.php">
   SecFilterRemove 300016
</LocationMatch>

mod_security still blocks this page, probably because it doesn't
exclude all possible matches. It seems to apply to the line below
(from rules.conf) with "id:300016".
It's not clear to me if it applies to the next line as well. It's 
obviously the next line that triggers the blocking because there's a
"select from" statement in the URL (many of the PHPMyAdmin URLs contain complete
SQL queries). How can I exclude that next line for this page as well?

#Generic SQL sigs
SecFilterSelective ARGS "(or.+1[[:space:]]*=[[:space:]]1|(or 1=1|'.+)--')" "id:300014,rev:1,severity:2,msg:'Generic SQL 
injection protection'"
SecFilterSelective ARGS 
"((alter|create|drop)[[:space:]]+(column|database|procedure|table)|delete[[:space:]]+from|update.+set.+=)" 
"id:300015,rev:1,severity:2,msg:'Generic SQL injection protection'"
SecFilterSelective REQUEST_URI "!(/forum/posting\.php)" "chain,id:300016,rev:1,severity:2,msg:'Generic SQL injection 
protection'"
SecFilterSelective ARGS "(insert[[:space:]]+into.+values|select.+from|bulk[[:space:]]+insert|union.+select)"


Kai