Re: [Mod-security-developers] Question about ARGS Variable
Davy Gunarso via mod-security-users <[email protected]>
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
Hello,
Regarding Mod Security, I wonder if it is possible to write custom rule in mod security special for SQLIA attacked?
For example: custom rule special for SQLIA Piggy backed tailed or custom rule special for SQLIA tautologies.
Is that possible?
Thanks in advance,Davy
On Thursday, January 3, 2019, 4:43:36 AM GMT+7, Manuel Spartan <[email protected]> wrote:
The content of the request body is parsed f there is a body processor enabled, which only happens by default in two cases (https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#ctl) ```The requestBodyProcessor option allows you to configure the request body processor. By default, ModSecurity will use the URLENCODED and MULTIPART processors to process an application/x-www-form-urlencoded and a multipart/form-data body, respectively. Other two processors are also supported: JSON and XML, but they are never used implicitly. Instead, you must tell ModSecurity to use it by placing a few rules in the REQUEST_HEADERS processing phase.```This means that if your content is XML you must have a rule in phase 1 that forces the engine to parse it, same applies to JSON and any other content-type https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#REQBODY_PROCESSOR
This also means that if the content-type is something else than `application/x-www-form-urlencoded` it will not populate the ARGS collection! That is the default in most cases.
Now XML use its own collection while json will populate the same collection as urlencoded.You may also want to read https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecRequestBodyAccess
Happy new year!
El mié., 2 ene. 2019 a las 13:50, Robert Paprocki (<[email protected]>) escribió:
Hey Jai,
I believe ARGS is only filled with the request body with the request is a urlencoded. Because ARGS and friends are treated as tabular variables, ModSecurity won't attempt to parse an XML body and at it into the ARGS or ARGS_POST variables, because there's no sane way to interpolate the document into key-value paired data.
On Wed, Jan 2, 2019 at 10:21 AM Jai Harpalani via mod-security-developers <[email protected]> wrote:
User-documentation states:
"ARGS is a collection and can be used on its own (means all arguments including the POST Payload)..."
Based on my testing, it does not appear that ARGS is including the POST payload. I am sending a POST request with the body shown below. I expect it to trigger Rule 930120, but it does not.
Request Body:
<?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Body> <ns1:echo xmlns:ns1="http://example1.org/example1"> <Text>hello .bashrc</Text> </ns1:echo> </soapenv:Body></soapenv:Envelope>
_______________________________________________
mod-security-developers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-developers
ModSecurity Services from Trustwave's SpiderLabs:
https://www.trustwave.com/spiderLabs.php
_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/
_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/
_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/