mod-security-users

[mod-security-users] THE_REQUEST vs. REQUEST_URI vs. REQUEST_FILE

[Sander H. - O. X. <in...@or...>]

I'm trying to implement some custom rules for mod_security, but I'm slightly
confused on what the best and most efficient way is to implement rules.

Looking at existent rules, there seems to be no real definitive way to match
requests. Is there any? How do the internals work of mod_security in this
regard? Are all KEYWORDS generated in one pass, or are some keywords
initiated and filtered before others?

An example for the same rule:

# Exploit phpBB Highlighting Code Execution Attempt (v1)
SecFilterSelective REQUEST_FILENAME "/viewtopic\.php$" chain
SecFilterSelective ARG_highlight "(\'\.|\x2527\x252E)"

# Exploit phpBB Highlighting Code Execution Attempt (v2)
SecFilterSelective REQUEST_URI
"/viewtopic\.php\?.*highlight=(\'\.|\x2527\x252E)"

# Exploit phpBB Highlighting Code Execution Attempt (v3)
SecFilterSelective THE_REQUEST
"/viewtopic\.php\?.*highlight=(\'\.|\x2527\x252E)"

Kind Regards,
Sander Holthaus - Orange XL

Re: [mod-security-users] THE_REQUEST vs. REQUEST_URI vs. REQUEST_FILE

[Ivan R. <iv...@we...>]

Sander Holthaus - Orange XL wrote:
> I'm trying to implement some custom rules for mod_security, but I'm slightly
> confused on what the best and most efficient way is to implement rules.
> 
> Looking at existent rules, there seems to be no real definitive way to match
> requests. Is there any?

   Yes, there can be many solutions to the same problem. In general
   they can all be equal, provided they work properly.


> How do the internals work of mod_security in this
> regard? Are all KEYWORDS generated in one pass, or are some keywords
> initiated and filtered before others?

   Keywords are "generated" on demand. Rules are processed
   in the order they appear in the configuration file.


> An example for the same rule:
> 
> # Exploit phpBB Highlighting Code Execution Attempt (v1)
> SecFilterSelective REQUEST_FILENAME "/viewtopic\.php$" chain
> SecFilterSelective ARG_highlight "(\'\.|\x2527\x252E)"
> 
> # Exploit phpBB Highlighting Code Execution Attempt (v2)
> SecFilterSelective REQUEST_URI
> "/viewtopic\.php\?.*highlight=(\'\.|\x2527\x252E)"
> 
> # Exploit phpBB Highlighting Code Execution Attempt (v3)
> SecFilterSelective THE_REQUEST
> "/viewtopic\.php\?.*highlight=(\'\.|\x2527\x252E)"

   I wouldn't worry too much about it. If you really want
   you can measure the performance to see if any of the
   approaches is faster than the others.

   Personally I don't like to use THE_REQUEST much. I prefer
   REQUEST_URI, or REQUEST_FILENAME.

   As an reminder, here's what these variables contain:

   THE_REQUEST - GET /index.php?x=y
   REQUEST_URI /index.php?x=y
   REQUEST_FILENAME - /var/www/htdocs/index.php
   SCRIPT_FILENAME - /var/www/htdocs/index.php

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] THE_REQUEST vs. REQUEST_URI vs. REQUEST_FILE

[Ivan R. <iv...@we...>]

> As an reminder, here's what these variables contain:
> 
> THE_REQUEST - GET /index.php?x=y

   Oops, this should actually be something like:

   THE_REQUEST - GET /index.php?x=y HTTP/1.0

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] THE_REQUEST vs. REQUEST_URI vs. REQUEST_FILE

[Ryan B. <rcb...@gm...>]

On 8/5/05, Ivan Ristic <iv...@we...> wrote:
>   As an reminder, here's what these variables contain:
>=20
>   THE_REQUEST - GET /index.php?x=3Dy
>   REQUEST_URI /index.php?x=3Dy
>   REQUEST_FILENAME - /var/www/htdocs/index.php
>   SCRIPT_FILENAME - /var/www/htdocs/index.php
>=20

My understanding is that the THE_REQUEST directive also includes the
HTTP version data.  For example -

THE_REQUEST - GET /index.php?x=3Dy HTTP/1.1

This is what is documented in Mod_Rewrite for this variable.

--=20
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GSNA, GCUX, GSEC