mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-14 05:45:59 +03:00
Documentation changes
This commit is contained in:
mihaipitu
Felipe Zimmerle
parent
1b5de94f3d
commit
12d2d4abc2
@ -1,121 +1,175 @@
|
|||||||
<!DOCTYPE html>
|
<!DOCTYPE html>
|
||||||
<html>
|
<html>
|
||||||
<head>
|
<head>
|
||||||
<title>ModSecurity WAF: Help page</title>
|
<title>ModSecurity WAF: Help page</title>
|
||||||
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
||||||
<style>
|
<style>
|
||||||
.code {
|
.code {
|
||||||
font-family: Courier;
|
font-family: Courier;
|
||||||
font-size: 14px;
|
font-size: 14px;
|
||||||
}
|
}
|
||||||
.codecanvas {
|
|
||||||
background: #DDDDDD;
|
|
||||||
}
|
|
||||||
</style>
|
|
||||||
</head>
|
|
||||||
|
|
||||||
<body style="background: #333333;">
|
.codecanvas {
|
||||||
<div align="center" style="width:930px; margin:0 auto; box-shadow: 5px 5px 6px #000; background: #FFFFFF;">
|
background: #DDDDDD;
|
||||||
<div style="width: 930px;">
|
overflow-x: auto;
|
||||||
<img border="0" height="101" alt="ModSecurity: Open Source Web Application Firewall" src="http://www.modsecurity.org/g/header-top.jpg" />
|
overflow-y: hidden;
|
||||||
</div>
|
max-width: 800px;
|
||||||
<div style="width: 930px;">
|
padding: 5px;
|
||||||
<table width="90%" cellspacing="0" cellpadding="0" border="0">
|
}
|
||||||
<tr>
|
</style>
|
||||||
<td>
|
</head>
|
||||||
<h2 style="font-family: Arial;">ModSecurity for Java - Help Page</h2>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
<tr>
|
|
||||||
<td>
|
|
||||||
<p>
|
|
||||||
<b>ModSecurity</b> is an open source intrusion detection and prevention engine for web
|
|
||||||
applications. It can also be called an web application firewall. It operates embedded into
|
|
||||||
the web server, acting as a powerful umbrella, shielding applications from attacks.
|
|
||||||
</p>
|
|
||||||
<p>
|
|
||||||
ModSecurity for Java is designed as a <a href="http://www.oracle.com/technetwork/java/filters-137243.html">Java Filter</a> which makes use of ModSecurity's
|
|
||||||
<a href="https://github.com/SpiderLabs/ModSecurity">native code</a> using the <b>JNI technology</b>.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<br />
|
<body style="background: #333333;">
|
||||||
<h2 id="installation">Installation</h2>
|
<div align="center" style="width:930px; margin:0 auto; box-shadow: 5px 5px 6px #000; background: #FFFFFF;">
|
||||||
<p>
|
<div style="width: 930px;">
|
||||||
First you need to choose whether to download and compile ModSecurity from the project's version control web-site:
|
<img height="101" alt="ModSecurity: Open Source Web Application Firewall" src="http://www.modsecurity.org/g/header-top.jpg" />
|
||||||
<a href="https://github.com/SpiderLabs/ModSecurity">github.com/SpiderLabs/ModSecurity</a> or using pre-compiled binaries from
|
</div>
|
||||||
<a href="https://www.modsecurity.org/">modsecurity.org</a>.
|
<div style="width: 930px;">
|
||||||
The native libraries (.so, .dll, etc.) needed for <b>ModSecurity for Java</b> are:
|
<table width="90%" border="0">
|
||||||
</p>
|
<tr>
|
||||||
<ol>
|
<td>
|
||||||
<li>
|
<h2 style="font-family: Arial;">ModSecurity for Java - Help Page</h2>
|
||||||
zlib1 (Windows only)
|
</td>
|
||||||
</li>
|
</tr>
|
||||||
<li>
|
<tr>
|
||||||
libxml2
|
<td>
|
||||||
</li>
|
<p>
|
||||||
<li>
|
<b>ModSecurity</b> is an open source intrusion detection and prevention engine for web
|
||||||
pcre
|
applications. It can also be called an web application firewall. It operates embedded into
|
||||||
</li>
|
the web server, acting as a powerful umbrella, shielding applications from attacks.
|
||||||
<li>
|
</p>
|
||||||
libapr-1
|
<p>
|
||||||
</li>
|
ModSecurity for Java is designed as a <a href="http://www.oracle.com/technetwork/java/filters-137243.html">Java Filter</a> which makes use of ModSecurity's
|
||||||
<li>
|
<a href="https://github.com/SpiderLabs/ModSecurity">native code</a> using the <b>JNI technology</b>.
|
||||||
libapriconv-1 (Windows only)
|
</p>
|
||||||
</li>
|
<br />
|
||||||
<li>
|
|
||||||
libaprutil-1
|
|
||||||
</li>
|
|
||||||
<li>
|
|
||||||
ModSecurityJNI (JNI wrapper for mod_security code)
|
|
||||||
</li>
|
|
||||||
</ol>
|
|
||||||
|
|
||||||
<p>
|
<h2 id="installation">Installation steps</h2>
|
||||||
These native libraries are used by the <a class="code" href="../src/java/org/modsecurity/ModSecurityFilter.java">ModSecurityFilter</a>.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<br />
|
<h3>Step 1: Compile ModSecurity native library</h3>
|
||||||
<h3>Compile ModSecurity native library</h3>
|
<p>
|
||||||
<p>
|
Install required packages for compilation. For example, on Debian/Ubuntu like systems:
|
||||||
Install required packages for compilation. For example, on Debian/Ubuntu like systems:
|
</p>
|
||||||
</p>
|
<pre class="codecanvas">
|
||||||
<pre class="codecanvas">
|
|
||||||
sudo apt-get install g++ make automake autoconf libtool
|
sudo apt-get install g++ make automake autoconf libtool
|
||||||
</pre>
|
</pre>
|
||||||
<p>
|
<p>
|
||||||
Install required dependent packages:
|
Install required dependent packages:
|
||||||
</p>
|
</p>
|
||||||
<pre class="codecanvas">
|
<pre class="codecanvas">
|
||||||
sudo apt-get install libxml2 libxml2-dev libxml2-utils libaprutil1 libaprutil1-dev apache2-prefork-dev
|
sudo apt-get install libxml2 libxml2-dev libxml2-utils libaprutil1 libaprutil1-dev apache2-prefork-dev
|
||||||
</pre>
|
</pre>
|
||||||
<p>
|
|
||||||
Download mod_security source code from <a href="https://github.com/mihaipitu/ModSecurity">GitHub</a>, compile and install:
|
<p>
|
||||||
</p>
|
The native libraries needed for <b>ModSecurity for Java</b> are:
|
||||||
<pre class="codecanvas">
|
</p>
|
||||||
|
<ol>
|
||||||
|
<li>
|
||||||
|
zlib1 (Windows only)
|
||||||
|
</li>
|
||||||
|
<li>
|
||||||
|
libxml2
|
||||||
|
</li>
|
||||||
|
<li>
|
||||||
|
pcre
|
||||||
|
</li>
|
||||||
|
<li>
|
||||||
|
libapr-1
|
||||||
|
</li>
|
||||||
|
<li>
|
||||||
|
libapriconv-1 (Windows only)
|
||||||
|
</li>
|
||||||
|
<li>
|
||||||
|
libaprutil-1
|
||||||
|
</li>
|
||||||
|
<li>
|
||||||
|
ModSecurityJNI (JNI wrapper for mod_security code)
|
||||||
|
</li>
|
||||||
|
</ol>
|
||||||
|
|
||||||
|
<p>
|
||||||
|
These native libraries are used by the <a class="code" href="../src/java/org/modsecurity/ModSecurityFilter.java">ModSecurityFilter</a>.
|
||||||
|
</p>
|
||||||
|
<br />
|
||||||
|
<p>
|
||||||
|
Download mod_security source code from <a href="https://github.com/mihaipitu/ModSecurity">GitHub</a>, compile and install:
|
||||||
|
</p>
|
||||||
|
<pre class="codecanvas">
|
||||||
|
git clone https://github.com/mihaipitu/ModSecurity.git
|
||||||
cd mod_security/
|
cd mod_security/
|
||||||
./autogen.sh
|
./autogen.sh
|
||||||
./configure --enable-standalone-module --enable-java-module
|
./configure --enable-standalone-module --enable-java-module
|
||||||
make
|
make
|
||||||
</pre>
|
</pre>
|
||||||
<p>
|
<p>
|
||||||
Copy compiled library in a convenient folder:
|
Copy compiled library in a convenient folder:
|
||||||
</p>
|
</p>
|
||||||
<pre class="codecanvas">
|
<pre class="codecanvas">
|
||||||
sudo cp ./java/.libs/libModSecurityJNI.so /usr/lib/
|
sudo cp ./java/.libs/libModSecurityJNI.so /usr/lib/
|
||||||
</pre>
|
</pre>
|
||||||
|
<p>
|
||||||
|
The libModSecurityJNI.so file is the connector that plugs the "standalone" ModSecurity code into the Java application as a Filter.
|
||||||
|
</p>
|
||||||
|
<br />
|
||||||
|
|
||||||
|
<h3>Step 2: Java Web Applications with ModSecurity Filter</h3>
|
||||||
|
<p>
|
||||||
|
ModSecurity for Java uses <a href="http://www.oracle.com/technetwork/java/filters-137243.html">Java Filters</a> in order to
|
||||||
|
intercept Http requests and responses. <b>ModsecurityTestApp</b> is an example of Java EE Web application using the ModSecurity
|
||||||
|
Filter. To use the ModSecurity filter in your Java web application, you will need to copy either the source .java files or
|
||||||
|
the compiled .class files into your application.
|
||||||
|
</p>
|
||||||
|
<ul>
|
||||||
|
<li>
|
||||||
|
<h4>Scenario 1: Add ModSecurity source java files to application and create WAR</h4>
|
||||||
|
<p>
|
||||||
|
Copy the source files from <span class="code">mod_security/java/ModSecurityTestApp/src/</span>
|
||||||
|
into your application. By using this option, the ModSecurity Java source code files are compiled
|
||||||
|
with the source files from your web application.
|
||||||
|
</p>
|
||||||
|
<pre class="codecanvas">
|
||||||
|
# pwd
|
||||||
|
/tmp/ModSecurity/java/ModSecurityTestApp/src/java/org
|
||||||
|
# ls -R
|
||||||
|
.:
|
||||||
|
apache modsecurity
|
||||||
|
./apache:
|
||||||
|
commons
|
||||||
|
./apache/commons:
|
||||||
|
fileupload
|
||||||
|
./apache/commons/fileupload:
|
||||||
|
DefaultFileItemFactory.java DiskFileUpload.java FileUploadBase.java MultipartStream.java
|
||||||
|
DefaultFileItem.java FileItemFactory.java FileUploadException.java package.html
|
||||||
|
DeferredFileOutputStream.java FileItem.java FileUpload.java ThresholdingOutputStream.java
|
||||||
|
./modsecurity:
|
||||||
|
ModSecurityFilter.java MsHttpServletRequest.java MsHttpServletResponse.java MsOutputStream.java
|
||||||
|
ModSecurity.java MSHttpServletRequestWrapper.java MsHttpTransaction.java MsWriter.java
|
||||||
|
[root@localhost org]#
|
||||||
|
</pre>
|
||||||
|
</li>
|
||||||
|
|
||||||
<br />
|
<li>
|
||||||
<h3>Java Web Applications with ModSecurity Filter</h3>
|
<h4>Scenario 2: Add ModSecurity compiled class files to an already compiled app</h4>
|
||||||
<p>
|
<p>
|
||||||
ModSecurity for Java uses <a href="http://www.oracle.com/technetwork/java/filters-137243.html">Java Filters</a> in order to
|
If you already have a compiled app and you would like to add in ModSecurity filtering
|
||||||
intercept Http requests and responses. <b>ModsecurityTestApp</b> is an example of Java EE Web application using the ModSecurity
|
without recompiling a new WAR file, you can instead use the compiled .class files.
|
||||||
Filter. To use ModSecurity Filter in your Web application, copy the source files from
|
Unzip the <span class="code">mod_security/java/ModSecurityTestApp/dist/ModSecurityTestApp.war</span> file
|
||||||
<span class="code">mod_security/java/ModSecurityTestApp/src/</span>
|
and copy the <span class="code">/WEB-INF/classes/</span> directory into your own <span class="code">WEB-INF/</span>
|
||||||
in your application and add the following entry for the filter tag in your <b>web.xml</b> file:
|
directory.
|
||||||
</p>
|
</p>
|
||||||
|
<pre class="codecanvas">
|
||||||
|
cp -R ModSecurity/java/ModSecurityTestApp/dist/WEB-INF/classes/org/* /opt/tomcat/webapps/WebGoat/WEB-INF/classes/org
|
||||||
|
</pre>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
<br />
|
||||||
|
|
||||||
<pre class="codecanvas"><code >
|
<h3>Step 3: Activate the ModSecurityFilter in web.xml</h3>
|
||||||
|
<p>
|
||||||
|
Add the following entry for the filter tag in your <b>web.xml</b> file:
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<pre class="codecanvas"><code>
|
||||||
<filter>
|
<filter>
|
||||||
<filter-name>ModSecurityFilter</filter-name>
|
<filter-name>ModSecurityFilter</filter-name>
|
||||||
<filter-class>org.modsecurity.ModSecurityFilter</filter-class>
|
<filter-class>org.modsecurity.ModSecurityFilter</filter-class>
|
||||||
@ -128,7 +182,6 @@ sudo cp ./java/.libs/libModSecurityJNI.so /usr/lib/
|
|||||||
Include activated_rules\*.conf
|
Include activated_rules\*.conf
|
||||||
-->
|
-->
|
||||||
</init-param>
|
</init-param>
|
||||||
|
|
||||||
<!--
|
<!--
|
||||||
<init-param>
|
<init-param>
|
||||||
<param-name>zlib1</param-name>
|
<param-name>zlib1</param-name>
|
||||||
@ -160,7 +213,6 @@ sudo cp ./java/.libs/libModSecurityJNI.so /usr/lib/
|
|||||||
</init-param>
|
</init-param>
|
||||||
-->
|
-->
|
||||||
</filter>
|
</filter>
|
||||||
|
|
||||||
<filter-mapping>
|
<filter-mapping>
|
||||||
<filter-name>ModSecurityFilter</filter-name>
|
<filter-name>ModSecurityFilter</filter-name>
|
||||||
<url-pattern>/*</url-pattern>
|
<url-pattern>/*</url-pattern>
|
||||||
@ -168,80 +220,162 @@ sudo cp ./java/.libs/libModSecurityJNI.so /usr/lib/
|
|||||||
</filter>
|
</filter>
|
||||||
</code>
|
</code>
|
||||||
</pre>
|
</pre>
|
||||||
|
<br />
|
||||||
<p>
|
<p>
|
||||||
The ModSecurity Filter makes use of the native libraries written in C/C++ using the JNI technology.
|
The ModSecurity Filter makes use of the native libraries written in C/C++ using the JNI technology.
|
||||||
There are two ways of loading native libraries by Java Web Applications:
|
There are two ways of loading native libraries by Java Web Applications:
|
||||||
<ol>
|
</p>
|
||||||
<li>
|
<ol>
|
||||||
<h4>Loading native libraries directly in the ModSecurityFilter</h4>
|
<li>
|
||||||
<p>
|
<h4>Loading native libraries directly in the ModSecurityFilter</h4>
|
||||||
Although this is easier, it is not recommended because the JVM will raise
|
<p>
|
||||||
<span class="code">UnsatisfiedLinkError</span> if the ModSecurity Filter is used in
|
Although this is easier, it is not recommended because the JVM will raise
|
||||||
multiple applications within the same server or the application is redeployed while the server is running.
|
<span class="code">UnsatisfiedLinkError</span> if the ModSecurity Filter is used in
|
||||||
The libraries are loaded in the <a class="code" href="../src/java/org/modsecurity/ModSecurity.java">ModSecurity</a> class using
|
multiple applications within the same server or the application is redeployed while the server is running.
|
||||||
<span class="code">System.loadLibrary()</span>. In this case the server has to be started with
|
The libraries are loaded in the <a class="code" href="../src/java/org/modsecurity/ModSecurity.java">ModSecurity</a> class using
|
||||||
the following VM options:
|
<span class="code">System.loadLibrary()</span>. In this case the server has to be started with
|
||||||
</p>
|
the following VM options:
|
||||||
<pre class="codecanvas">
|
</p>
|
||||||
|
<pre class="codecanvas">
|
||||||
-Djava.library.path=/path/to/libraries/folder/
|
-Djava.library.path=/path/to/libraries/folder/
|
||||||
</pre>
|
</pre>
|
||||||
<p>
|
<p>
|
||||||
You can specify multiple folders for the <span class="code">java.library.path</span> variable by using
|
You can specify multiple folders for the <span class="code">java.library.path</span> variable by using
|
||||||
: (colon) or ; (semi-colon), depending on your environment. Also, the libraries can be loaded using
|
: (colon) or ; (semi-colon), depending on your environment. Also, the libraries can be loaded using
|
||||||
their absolute path by uncommenting the <span class="code">init-param</span> elements in the above
|
their absolute path by uncommenting the <span class="code">init-param</span> elements in the above
|
||||||
filter example.
|
filter example.
|
||||||
</p>
|
</p>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
<li>
|
<li>
|
||||||
<h4>Loading native libraries when the Web Server starts</h4>
|
<h4>Loading native libraries when the Web Server starts</h4>
|
||||||
<p>
|
<p>
|
||||||
<a class="code" href="../../ModSecurityLoader/dist/ModSecurityLoader.jar">ModSecurityLoader.jar</a> should be placed
|
<a class="code" href="../../ModSecurityLoader/dist/ModSecurityLoader.jar">ModSecurityLoader.jar</a> should be placed
|
||||||
in the Java server library loader folder (for example, in Tomcat 7: <span class="code">$CATALINA_HOME/lib</span>).
|
in the Java server library loader folder (for example, in Tomcat 7: <span class="code">$CATALINA_HOME/lib</span>).
|
||||||
The server has to be started with the VM options:
|
The server has to be started with the VM options:
|
||||||
</p>
|
</p>
|
||||||
<pre class="codecanvas">
|
<pre class="codecanvas">
|
||||||
-Djava.library.path=/path/to/libraries/folder/
|
-Djava.library.path=/path/to/libraries/folder/
|
||||||
</pre>
|
</pre>
|
||||||
<p>
|
<p>
|
||||||
or alternatively by specifying <span class="code">init-param</span> elements with absolute paths
|
or alternatively by specifying <span class="code">init-param</span> elements with absolute paths
|
||||||
in the <span class="code">ModSecurityLoaderConfig.xml</span> file.
|
in the <span class="code">ModSecurityLoaderConfig.xml</span> file.
|
||||||
</p>
|
</p>
|
||||||
</li>
|
</li>
|
||||||
</ol>
|
</ol>
|
||||||
|
|
||||||
<br/>
|
<br />
|
||||||
|
|
||||||
<h2 id="beanshell">BeanShell scripting with ModSecurity</h2>
|
<h3>Step 4: Configure ModSecurity Settings</h3>
|
||||||
<p>
|
<p>
|
||||||
You can use <a href="http://www.beanshell.org/">BeanShell</a> scripts in <span class="code">SecRule</span>
|
In the web.xml file, you added a path to the main modsecurity.conf file holding directives such as SecRuleEngine, SecAuditEngine, etc...
|
||||||
ModSecurity directives using the <span class="code">exec</span> action. First you need to put the
|
You should update this file as needed for your environment.
|
||||||
<span class="code">bsh.jar</span> file (which can be downloaded from <a href="http://www.beanshell.org/download.html">beanshell.org</a>)
|
</p>
|
||||||
into the current directory of your server (for example <span class="code">$CATALINA_HOME/bin</span> in Tomcat).
|
<pre class="codecanvas">
|
||||||
An example of an <span class="code">exec</span> can be the following:
|
# head /root/modsecurity-apache_2.7.2/modsecurity.conf
|
||||||
</p>
|
# -- Rule engine initialization ----------------------------------------------
|
||||||
|
# Enable ModSecurity, attaching it to every transaction. Use detection
|
||||||
|
# only to start with, because that minimises the chances of post-installation
|
||||||
|
# disruption.
|
||||||
|
#
|
||||||
|
SecRuleEngine DetectionOnly
|
||||||
|
</pre>
|
||||||
|
<br />
|
||||||
|
<h3>Step 5: Add in Rule Files</h3>
|
||||||
|
<p>
|
||||||
|
The ModSecurity filter knows how to handle "Apache Include" directives in the "conf" param value. This means that if you want to create your
|
||||||
|
own rule files or utilize the OWASP ModSecurity CRS, you should add appropriate Include directives to the main modsecurity.conf file:
|
||||||
|
</p>
|
||||||
|
<pre class="codecanvas">
|
||||||
|
# tail /root/modsecurity-apache_2.7.2/modsecurity.conf
|
||||||
|
# Specify your Unicode Code Point.
|
||||||
|
# This mapping is used by the t:urlDecodeUni transformation function
|
||||||
|
# to properly map encoded data to your language. Properly setting
|
||||||
|
# these directives helps to reduce false positives and negatives.
|
||||||
|
#
|
||||||
|
#SecUnicodeCodePage 20127
|
||||||
|
#SecUnicodeMapFile unicode.mapping
|
||||||
|
Include /root/owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
|
||||||
|
Include /root/owasp-modsecurity-crs/base_rules/*.conf
|
||||||
|
</pre>
|
||||||
|
<h3>Step 6: Start Java Server and Confirm ModSecurity Initialization</h3>
|
||||||
|
<pre class="codecanvas">
|
||||||
|
# /opt/apache-tomcat-7.0.42/bin/startup.sh
|
||||||
|
Using CATALINA_BASE: /opt/apache-tomcat-7.0.42
|
||||||
|
Using CATALINA_HOME: /opt/apache-tomcat-7.0.42
|
||||||
|
Using CATALINA_TMPDIR: /opt/apache-tomcat-7.0.42/temp
|
||||||
|
Using JRE_HOME: /usr/lib/jvm/java-1.6.0-openjdk
|
||||||
|
Using CLASSPATH: /opt/apache-tomcat-7.0.42/bin/bootstrap.jar:/opt/apache-tomcat-7.0.42/bin/tomcat-juli.jar
|
||||||
|
# cat /opt/apache-tomcat-7.0.42/logs/localhost*.log
|
||||||
|
Sep 27, 2013 6:35:18 PM org.apache.catalina.core.ApplicationContext log
|
||||||
|
INFO: ModSecurity for Java (STABLE)/2.7.5 (http://www.modsecurity.org/) configured.
|
||||||
|
Sep 27, 2013 6:35:18 PM org.apache.catalina.core.ApplicationContext log
|
||||||
|
INFO: ModSecurity: APR compiled version="1.3.9"; loaded version="1.3.9"
|
||||||
|
Sep 27, 2013 6:35:18 PM org.apache.catalina.core.ApplicationContext log
|
||||||
|
INFO: ModSecurity: PCRE compiled version="7.8 "; loaded version="7.8 2008-09-05"
|
||||||
|
Sep 27, 2013 6:35:18 PM org.apache.catalina.core.ApplicationContext log
|
||||||
|
INFO: ModSecurity: LUA compiled version="Lua 5.1"
|
||||||
|
Sep 27, 2013 6:35:18 PM org.apache.catalina.core.ApplicationContext log
|
||||||
|
INFO: ModSecurity: LIBXML compiled version="2.7.6"
|
||||||
|
Sep 27, 2013 6:35:18 PM org.apache.catalina.core.ApplicationContext log
|
||||||
|
INFO: ModSecurity started.
|
||||||
|
</pre>
|
||||||
|
<h3>Step 7: Test Rules</h3>
|
||||||
|
<p>
|
||||||
|
The next step is to send some example attacks to your application to ensure that the it is working properly.
|
||||||
|
If you send some XSS attacks for instance, you should see logs similar to the following in the Tomcat logs directory:
|
||||||
|
</p>
|
||||||
|
<img src="http://npercoco.typepad.com/.a/6a0133f264aa62970b019affa4378a970b-800wi" />
|
||||||
|
|
||||||
<pre class="codecanvas">
|
<h3>Step 8: Verify Audit Logging</h3>
|
||||||
|
<p>
|
||||||
|
In addition to the short, 1-line alert messages sent to the Tomcat logs, ModSecurity will also generate appropriate Audit log
|
||||||
|
entries depending on your configuration. You can review the corresponding Audit log entry for your test request(s) to see fully
|
||||||
|
request/response payloads:
|
||||||
|
</p>
|
||||||
|
<img src="http://npercoco.typepad.com/.a/6a0133f264aa62970b019affa43c2f970b-800wi" />
|
||||||
|
<img src="http://npercoco.typepad.com/.a/6a0133f264aa62970b019affa463c0970c-800wi" />
|
||||||
|
|
||||||
|
|
||||||
|
<h2 id="beanshell">Bonus Testing: BeanShell scripting with ModSecurity</h2>
|
||||||
|
<p>
|
||||||
|
You can use <a href="http://www.beanshell.org/">BeanShell</a> scripts in <span class="code">SecRule</span>
|
||||||
|
ModSecurity directives using the <span class="code">exec</span> action. First you need to put the
|
||||||
|
<span class="code">bsh.jar</span> file (which can be downloaded from <a href="http://www.beanshell.org/download.html">beanshell.org</a>)
|
||||||
|
into the current directory of your server (for example <span class="code">$CATALINA_HOME/bin</span> in Tomcat).
|
||||||
|
An example of an <span class="code">exec</span> can be the following:
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<pre class="codecanvas">
|
||||||
|
# Alert and Block based on Anomaly Scores
|
||||||
|
#
|
||||||
|
SecRule TX:ANOMALY_SCORE "@gt 0" \
|
||||||
|
"chain,phase:2,id:'981176',t:none,deny,log,msg:'Inbound Anomaly Score Exceeded (Total Score: %{TX.ANOMALY_SCORE}, SQLi=%{TX.SQL_INJECTION_SCORE}, XSS=%{TX.XSS_SCORE}): Last Matched Message: %{tx.msg}',logdata:'Last Matched Data: %{matched_var}',setvar:tx.inbound_tx_msg=%{tx.msg},setvar:tx.inbound_anomaly_score=%{tx.anomaly_score}"
|
||||||
|
SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_level}" chain
|
||||||
|
SecRule TX:ANOMALY_SCORE_BLOCKING "@streq on" chain
|
||||||
|
SecRule TX:/^\d+\-/ "(.*)" <strong>"setenv:block_session=1,exec:/usr/local/apache/conf/beanshell_script.bsh"</strong>
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
<p>
|
||||||
|
The environment variable set in the <span class="code">SecAction</span> can be accessed in BeanShell scripts
|
||||||
|
using some pseudo-code like this to instruct the app to block the current session:
|
||||||
|
</p>
|
||||||
|
<pre class="codecanvas">
|
||||||
<code>
|
<code>
|
||||||
SecAction "setenv:msg=%{rule.msg},exec:/usr/local/apache/conf/beanshell_script.bsh"
|
import org.owasp.webgoat.session.WebSession;
|
||||||
|
|
||||||
|
System.getenv("block_session");
|
||||||
|
if (block_user != null) {
|
||||||
|
session.setAttribute(BLOCKED, "true");
|
||||||
|
}
|
||||||
</code>
|
</code>
|
||||||
</pre>
|
</pre>
|
||||||
<p>
|
<br />
|
||||||
The environment variable set in the <span class="code">SecAction</span> can be accessed in BeanShell scripts
|
<br />
|
||||||
using:
|
</td>
|
||||||
</p>
|
</tr>
|
||||||
<pre class="codecanvas">
|
</table>
|
||||||
<code>
|
|
||||||
System.getenv("msg");
|
|
||||||
</code>
|
|
||||||
</pre>
|
|
||||||
<br/>
|
|
||||||
<br/>
|
|
||||||
</td>
|
|
||||||
</tr>
|
|
||||||
</table>
|
|
||||||
</div>
|
|
||||||
</div>
|
</div>
|
||||||
</body>
|
</div>
|
||||||
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user