mod-security-users

[mod-security-users] Protection against Bash injection

[Marc S. <mar...@ap...>]

For those who remember, we (Approach Belgium) published in 2011 the 
"cmdLine" transformation that handles most Windows cmd injections (and 
some basic bash injections). The "cmdLine" transformation is now 
officially part of ModSecurity for years.

We were also using, to protect our customers for some years, an 
additional transformation blocking several other bash injections.
We decided to also give it to the community.
The source code and the explanations are available on 
https://www.approach.be/en/modsecurity.html

Enjoy


	*Marc Stern
Cyber-Security Consulting Director*
Approach Belgium <https://www.approach.be>
Axis Park - Rue Edouard Belin 7 - 1435 Mont-Saint-Guibert - Belgium
Follow us: <https://www.linkedin.com/company/16513/> 
<https://twitter.com/ApproachBe>
/*Inspiring the cyber-security community*/


This e-mail and any attachment are confidential and intended solely for 
the use of the individual to whom it is addressed. If you are not the 
intended recipient, please contact the sender and delete this message 
and any attachment from your system. Unauthorised publication, use, 
dissemination, forwarding, printing or copying of this e-mail and its 
associated attachments is strictly prohibited.

Re: [mod-security-users] Protection against Bash injection

[Christian F. <chr...@ne...>]

Hey Marc,

Wow. This is very cool. Just to be clear. You published this as an add-on
module for Apache that will integrate with ModSec 2.x on Apache.

Ideally your code contribution will be taken and integrated into the
upcoming (and final) 2.9.3 and hopefully into the libModSecurity 3.x release
line.

Am I correct?

Cheers,

Christian

On Thu, Nov 08, 2018 at 02:13:57PM +0000, Marc Stern wrote:
> For those who remember, we (Approach Belgium) published in 2011 the 
> "cmdLine" transformation that handles most Windows cmd injections (and 
> some basic bash injections). The "cmdLine" transformation is now 
> officially part of ModSecurity for years.
> 
> We were also using, to protect our customers for some years, an 
> additional transformation blocking several other bash injections.
> We decided to also give it to the community.
> The source code and the explanations are available on 
> https://www.approach.be/en/modsecurity.html
> 
> Enjoy
> 
> 
> 	*Marc Stern
> Cyber-Security Consulting Director*
> Approach Belgium <https://www.approach.be>
> Axis Park - Rue Edouard Belin 7 - 1435 Mont-Saint-Guibert - Belgium
> Follow us: <https://www.linkedin.com/company/16513/> 
> <https://twitter.com/ApproachBe>
> /*Inspiring the cyber-security community*/
> 
> 
> This e-mail and any attachment are confidential and intended solely for 
> the use of the individual to whom it is addressed. If you are not the 
> intended recipient, please contact the sender and delete this message 
> and any attachment from your system. Unauthorised publication, use, 
> dissemination, forwarding, printing or copying of this e-mail and its 
> associated attachments is strictly prohibited.
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Protection against Bash injection

[Marc S. <mar...@ap...>]

Hi Christian,

It can be compiled and used as a stand-alone module.
If you want to integrate it into 2.9.3, you're obviously welcome.

*Marc Stern
Cyber-Security Consulting Director*
Approach Belgium <https://www.approach.be>
Axis Park - Rue Edouard Belin 7 - 1435 Mont-Saint-Guibert - Belgium/*
Inspiring the cyber-security community

*/
On 09-11-18 07:59, Christian Folini wrote:
> Hey Marc,
>
> Wow. This is very cool. Just to be clear. You published this as an add-on
> module for Apache that will integrate with ModSec 2.x on Apache.
>
> Ideally your code contribution will be taken and integrated into the
> upcoming (and final) 2.9.3 and hopefully into the libModSecurity 3.x release
> line.
>
> Am I correct?
>
> Cheers,
>
> Christian
>
> On Thu, Nov 08, 2018 at 02:13:57PM +0000, Marc Stern wrote:
>> For those who remember, we (Approach Belgium) published in 2011 the
>> "cmdLine" transformation that handles most Windows cmd injections (and
>> some basic bash injections). The "cmdLine" transformation is now
>> officially part of ModSecurity for years.
>>
>> We were also using, to protect our customers for some years, an
>> additional transformation blocking several other bash injections.
>> We decided to also give it to the community.
>> The source code and the explanations are available on
>> https://www.approach.be/en/modsecurity.html
>>
>> Enjoy
>>
>>
>> 	*Marc Stern
>> Cyber-Security Consulting Director*
>> Approach Belgium <https://www.approach.be>
>> Axis Park - Rue Edouard Belin 7 - 1435 Mont-Saint-Guibert - Belgium
>> Follow us: <https://www.linkedin.com/company/16513/>
>> <https://twitter.com/ApproachBe>
>> /*Inspiring the cyber-security community*/
>>
>>
>> This e-mail and any attachment are confidential and intended solely for
>> the use of the individual to whom it is addressed. If you are not the
>> intended recipient, please contact the sender and delete this message
>> and any attachment from your system. Unauthorised publication, use,
>> dissemination, forwarding, printing or copying of this e-mail and its
>> associated attachments is strictly prohibited.
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Protection against Bash injection

[Christian F. <chr...@ne...>]

+1

On Fri, Nov 09, 2018 at 07:27:58AM +0000, Marc Stern wrote:
> Hi Christian,
> 
> It can be compiled and used as a stand-alone module.
> If you want to integrate it into 2.9.3, you're obviously welcome.
> 
> *Marc Stern
> Cyber-Security Consulting Director*
> Approach Belgium <https://www.approach.be>
> Axis Park - Rue Edouard Belin 7 - 1435 Mont-Saint-Guibert - Belgium/*
> Inspiring the cyber-security community
> 
> */
> On 09-11-18 07:59, Christian Folini wrote:
> > Hey Marc,
> >
> > Wow. This is very cool. Just to be clear. You published this as an add-on
> > module for Apache that will integrate with ModSec 2.x on Apache.
> >
> > Ideally your code contribution will be taken and integrated into the
> > upcoming (and final) 2.9.3 and hopefully into the libModSecurity 3.x release
> > line.
> >
> > Am I correct?
> >
> > Cheers,
> >
> > Christian
> >
> > On Thu, Nov 08, 2018 at 02:13:57PM +0000, Marc Stern wrote:
> >> For those who remember, we (Approach Belgium) published in 2011 the
> >> "cmdLine" transformation that handles most Windows cmd injections (and
> >> some basic bash injections). The "cmdLine" transformation is now
> >> officially part of ModSecurity for years.
> >>
> >> We were also using, to protect our customers for some years, an
> >> additional transformation blocking several other bash injections.
> >> We decided to also give it to the community.
> >> The source code and the explanations are available on
> >> https://www.approach.be/en/modsecurity.html
> >>
> >> Enjoy
> >>
> >>
> >> 	*Marc Stern
> >> Cyber-Security Consulting Director*
> >> Approach Belgium <https://www.approach.be>
> >> Axis Park - Rue Edouard Belin 7 - 1435 Mont-Saint-Guibert - Belgium
> >> Follow us: <https://www.linkedin.com/company/16513/>
> >> <https://twitter.com/ApproachBe>
> >> /*Inspiring the cyber-security community*/
> >>
> >>
> >> This e-mail and any attachment are confidential and intended solely for
> >> the use of the individual to whom it is addressed. If you are not the
> >> intended recipient, please contact the sender and delete this message
> >> and any attachment from your system. Unauthorised publication, use,
> >> dissemination, forwarding, printing or copying of this e-mail and its
> >> associated attachments is strictly prohibited.
> >>
> >> _______________________________________________
> >> mod-security-users mailing list
> >> mod...@li...
> >> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> >> http://www.modsecurity.org/projects/commercial/rules/
> >> http://www.modsecurity.org/projects/commercial/support/
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/