Re: [Mod-security-developers] Question about ARGS Variable

Hi Davy,
Have you reviewed the owasp modsecurity core rule set project?
https://github.com/SpiderLabs/owasp-modsecurity-crs

Cheers!
Sent from my iPhone

> On 16 Jan 2019, at 02:51, Davy Gunarso via mod-security-users <[email protected]> wrote:
> 
> 
> Hello,
> 
> Regarding Mod Security,  I wonder if it is possible to write custom rule in mod security special for SQLIA attacked?
> 
> For example: custom rule special for SQLIA Piggy backed tailed or custom rule special for SQLIA tautologies.
> 
> Is that possible?
> 
> Thanks in advance,
> Davy
> 
> On Thursday, January 3, 2019, 4:43:36 AM GMT+7, Manuel Spartan <[email protected]> wrote:
> 
> 
> The content of the request body is parsed f there is a body processor enabled, which only happens by default in two cases (https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#ctl) 
> ```
> The requestBodyProcessor option allows you to configure the request body processor. By default, ModSecurity will use the URLENCODED and MULTIPART processors to process an application/x-www-form-urlencoded and a multipart/form-data body, respectively. Other two processors are also supported: JSON and XML, but they are never used implicitly. Instead, you must tell ModSecurity to use it by placing a few rules in the REQUEST_HEADERS processing phase.
> ```
> This means that if your content is XML you must have a rule in phase 1 that forces the engine to parse it, same applies to JSON and any other content-type https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#REQBODY_PROCESSOR
> 
> This also means that if the content-type is something else than `application/x-www-form-urlencoded` it will not populate the ARGS collection!  That is the default in most cases.
> 
> Now XML use its own collection while json will populate the same collection as urlencoded.
> You may also want to read https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecRequestBodyAccess
> 
> Happy new year!
> 
> El mié., 2 ene. 2019 a las 13:50, Robert Paprocki (<[email protected]>) escribió:
> Hey Jai,
> 
> I believe ARGS is only filled with the request body with the request is a urlencoded. Because ARGS and friends are treated as tabular variables, ModSecurity won't attempt to parse an XML body and at it into the ARGS or ARGS_POST variables, because there's no sane way to interpolate the document into key-value paired data.
> 
> On Wed, Jan 2, 2019 at 10:21 AM Jai Harpalani via mod-security-developers <[email protected]> wrote:
> User-documentation states:
> 
> "ARGS is a collection and can be used on its own (means all arguments including the POST Payload)..."
> 
> Based on my testing, it does not appear that ARGS is including the POST payload. I am sending a POST request with the body shown below. I expect it to trigger Rule 930120, but it does not.
> 
> Request Body:
> 
> <?xml version='1.0' encoding='UTF-8'?>
> <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
>      <soapenv:Body>
>           <ns1:echo xmlns:ns1="http://example1.org/example1">
>                 <Text>hello .bashrc</Text>
>           </ns1:echo>
>      </soapenv:Body>
> </soapenv:Envelope>
> 
> _______________________________________________
> mod-security-developers mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-developers
> ModSecurity Services from Trustwave's SpiderLabs:
> https://www.trustwave.com/spiderLabs.php
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/