mod-security-users

[mod-security-users] How to add/remove multiple targets with ctl:ruleUpdateTargetById

[rm4dillo D <rm4...@gm...>]

Hi,

With the "SecRuleUpdateTargetById" directive, it's possible to add/remove
multiple targets using the following syntax:

    SecRuleUpdateTargetById 999999 !ARG:param1,!ARGS:param2

but if I try to write the same rule using the "ctl" action combined with
the "ruleUpdateTargetById" option, I'm stuck because I can't use the comma
as a separator.

Any ideas?

Rm4dillo

Re: [mod-security-users] How to add/remove multiple targets with ctl:ruleUpdateTargetById

[Breno S. <bre...@gm...>]

Hey,

Can you try :

SecRule ARGS "@rx test"
"phase:1,id:1111,ctl:'ruleUpdateTargetById=222;REQUEST_FILENAME,RESPONSE_BODY'"

Thanks

Breno

On Mon, Jan 30, 2012 at 11:41 AM, rm4dillo D <rm4...@gm...> wrote:

> Hi,
>
> With the "SecRuleUpdateTargetById" directive, it's possible to add/remove
> multiple targets using the following syntax:
>
>     SecRuleUpdateTargetById 999999 !ARG:param1,!ARGS:param2
>
> but if I try to write the same rule using the "ctl" action combined with
> the "ruleUpdateTargetById" option, I'm stuck because I can't use the comma
> as a separator.
>
> Any ideas?
>
> Rm4dillo
>
>
> ------------------------------------------------------------------------------
> Try before you buy = See our experts in action!
> The most comprehensive online learning library for Microsoft developers
> is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
> Metro Style Apps, more. Free future releases when you subscribe now!
> http://p.sf.net/sfu/learndevnow-dev2
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
>

Re: [mod-security-users] How to add/remove multiple targets with ctl:ruleUpdateTargetById

[Ryan B. <RBa...@tr...>]

You should be able to do it with something like this -

SecRule TARGET OPERATOR "phase:1,t:none,nolog,pass,ctl:'ruleUpdateTargetById=999999;ARGS:param1|!ARGS:param2'"

-Ryan

From: rm4dillo D <rm4...@gm...<mailto:rm4...@gm...>>
Date: Mon, 30 Jan 2012 11:41:43 -0600
To: "mod...@li...<mailto:mod...@li...>" <mod...@li...<mailto:mod...@li...>>
Subject: [mod-security-users] How to add/remove multiple targets with ctl:ruleUpdateTargetById

Hi,

With the "SecRuleUpdateTargetById" directive, it's possible to add/remove multiple targets using the following syntax:

    SecRuleUpdateTargetById 999999 !ARG:param1,!ARGS:param2

but if I try to write the same rule using the "ctl" action combined with the "ruleUpdateTargetById" option, I'm stuck because I can't use the comma as a separator.

Any ideas?

Rm4dillo

________________________________
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.

Re: [mod-security-users] How to add/remove multiple targets with ctl:ruleUpdateTargetById

[rm4dillo D <rm4...@gm...>]

I tried both and it seems that Breno's solution is the only one that works.

Thank you both for your fast answers.

On Mon, Jan 30, 2012 at 7:01 PM, Ryan Barnett <RBa...@tr...> wrote:
> You should be able to do it with something like this -
>
> SecRule TARGET OPERATOR "phase:1,t:none,nolog,pass,ctl:'ruleUpdateTargetById=999999;ARGS:param1|!ARGS:param2'"
>
> -Ryan
>
> From: rm4dillo D <rm4...@gm...<mailto:rm4...@gm...>>
> Date: Mon, 30 Jan 2012 11:41:43 -0600
> To: "mod...@li...<mailto:mod...@li...>" <mod...@li...<mailto:mod...@li...>>
> Subject: [mod-security-users] How to add/remove multiple targets with ctl:ruleUpdateTargetById
>
> Hi,
>
> With the "SecRuleUpdateTargetById" directive, it's possible to add/remove multiple targets using the following syntax:
>
>    SecRuleUpdateTargetById 999999 !ARG:param1,!ARGS:param2
>
> but if I try to write the same rule using the "ctl" action combined with the "ruleUpdateTargetById" option, I'm stuck because I can't use the comma as a separator.
>
> Any ideas?
>
> Rm4dillo
>
> ________________________________
> This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.
>