Re: Fwd: rules
2007-08-01 04:33:38 GMT
Alert and script are common English words and do not, by themselves, serve as a good enough signature for XSS. The rule below requires “alert” or “script” in combination with other factors. For example “<script” would be enough.
Now your test vector includes “<script” but encodes “<” as /u003c. While ModSecurity does compensate for common encoding evasion techniques, I have never encountered this one before and therefore wonder whether it is really a valid attack string. If I understood well from a previous e-mail, this attack vector was generated by Watchfire’s AppScan, so I am checking with them to see what this attack vector is all about.
Another important note is that alert seldom indicates a real XSS attack, though it is common to XSS testing. After all, I don’t know many attackers who would want to display a pop up to the attacked user.
~ Ofer
From:
mod-security-users-bounces <at> lists.sourceforge.net
[mailto:mod-security-users-bounces <at> lists.sourceforge.net] On Behalf Of love
wadhwa
Sent: Monday, July 30, 2007 10:48 PM
To: mod-security-users <at> lists.sourceforge.net
Subject: [mod-security-users] Fwd: rules
---------- Forwarded message ----------
From: love wadhwa <lovewadhwa <at> gmail.com>
Date: Jul 31, 2007 11:17 AM
Subject: Re: [mod-security-users] rules
To: Ryan Barnett <Ryan.Barnett <at> breach.com>
Hi
This is what i have in my rules file.I only have a single rule for XSS.I don't
have specified any encoding.Now specifying the following, when i do run a
scanner , it should have caught that url since that has the keyword
"alert" or "script" in it and i have specified these
keywords in my rules. But i am not getting it being caught and logged to some
other file i.e audit.log.
SecRuleEngine On
SecAuditEngine RelevantOnly
SecAuditLog logs/audit.log
SecAuditLogType serial
SecAuditLogParts ABIFHZ
SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS
"(?:\b(?:on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|script|up)|ve)|key(?:press|down|up)|c(?:hange|lick)|s(?:elec|ubmi)t|(?:un)?load|dragdrop|resize|focus|blur)\b\W*?=|abort\b)|(?:l(?:owsrc\b\W*?\b(?:(?:java|vb)script|shell)|ivescript)|(?:href|url)\b\W*?\b(?:(?:java|vb)script|shell)|background-image|mocha):|type\b\W*?\b(?:text\b(?:\W*?\b(?:j(?:ava)?|ecma)script\b|
[vbscript])|application\b\W*?\bx-(?:java|vb)script\b)|s(?:(?:tyle\b\W*=.*\bexpression\b\W*|ettimeout\b\W*?)\(|rc\b\W*?\b(?:(?:java|vb)script|shell|http):)|(?:c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder)\b|a(?:ctivexobject\b|lert\b\W*?\())|<(?:(?:body\b.*?\b(?:backgroun|onloa)d|input\b.*?\\btype\b\W*?\bimage)\b|!\[CDATA\[|script|meta)|(?:\.(?:(?:execscrip|addimpor)t|(?:fromcharcod|cooki)e|innerhtml)|\ <at> import)\b)"
On 7/30/07, Ryan Barnett < Ryan.Barnett <at> breach.com> wrote:
Are you attempting to bypass or evade this XSS rule by using Unicode encoding? It looks like this is the case however there are forward slashes instead of % signs -
http://www.example.com/cgi-bin/foo.php?p=%u003Cscript%u003Ealert%u0028%u0027XSS%u0020Test%u0020Successful%u0027%u0029%u003C%script%u003E
Another thing to keep in mind with regards to evasion tests, and this is especially true with XSS, is that while you may be able to evade the rules the malicious code still needs to be in a format that the backend web application (or in the case of XSS the client browser) will execute. I don't believe that a browser would execute the code snippet you provided.
--
Ryan C. Barnett
ModSecurity Community Manager
Breach
Security: Director of Application Security Training
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor, GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
Author: Preventing Web Attacks with Apache
From: mod-security-users-bounces <at> lists.sourceforge.net
[mailto:mod-security-users-bounces <at> lists.sourceforge.net] On
Behalf Of love wadhwa
Sent: Monday, July 30, 2007 5:34 AM
To: mod-security-users <at> lists.sourceforge.net
Subject: [mod-security-users] rules
hi
I have been using the following rules in my conf file.
SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS
"(?:\b(?:on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|script|alert|up)|ve)|key(?:press|down|up)|c(?:hange|lick)|s(?:elec|ubmi)t|(?:un)?load|dragdrop|resize|focus|blur)\b\W*?=|abort\b)|(?:l(?:owsrc\b\W*?\b(?:(?:java|vb)script|shell)|ivescript)|(?:href|url)\b\W*?\b(?:(?:java|vb)script|shell)|background-image|mocha):|type\b\W*?\b(?:text\b(?:\W*?\b(?:j(?:ava)?|ecma)script\b|
[vbscript])|application\b\W*?\bx-(?:java|vb)script\b)|s(?:(?:tyle\b\W*=.*\bexpression\b\W*|ettimeout\b\W*?)\(|rc\b\W*?\b(?:(?:java|vb)script|shell|http):)|(?:c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder)\b|a(?:ctivexobject\b|lert\b\W*?\())|<(?:(?:body\b.*?\b(?:backgroun|onloa)d|input\b.*?\\btype\b\W*?\bimage)\b|!\[CDATA\[|script|meta)|(?:\.(?:(?:execscrip|addimpor)t|(?:fromcharcod|cooki)e|innerhtml)|\ <at> import)\b)"
although i do have "script" and "alert" keyword in my rules
as a filter i am still getting the following url with status code 200
/u003Cscript/u003Ealert/u0028/u0027XSS/u0020Test/u0020Successful/u0027/u0029/u003C/script/u003E
Plz help me regardin the same and see if some changes have to be
made in rules.
--
Warm Regards
Love Wadhwa
RedHat Certified Engg
--
Warm Regards
Love Wadhwa
RedHat Certified Engg
--
Warm Regards
Love Wadhwa
RedHat Certified Engg
------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________ mod-security-users mailing list mod-security-users <at> lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/mod-security-users
RSS Feed