From b6414bbdf249761a2fbc2cd2348cfa7e5b0453ae Mon Sep 17 00:00:00 2001 From: brenosilva Date: Wed, 6 Jun 2012 12:26:06 +0000 Subject: [PATCH] Update reference manual --- doc/Reference_Manual.html | 808 ++++++++++++++++++++++++++++---------- 1 file changed, 610 insertions(+), 198 deletions(-) diff --git a/doc/Reference_Manual.html b/doc/Reference_Manual.html index 905d7872..98c1948e 100644 --- a/doc/Reference_Manual.html +++ b/doc/Reference_Manual.html @@ -55,7 +55,7 @@ type="text/css"> var wgUserLanguage = "en"; var wgContentLanguage = "en"; var wgBreakFrames = false; - var wgCurRevisionId = 444; + var wgCurRevisionId = 500; var wgVersion = "1.15.1"; var wgEnableAPI = true; var wgEnableWriteAPI = true; @@ -94,9 +94,9 @@ href="javascript:toggleToc()" class="internal" id="togglelink">hide]< class="tocnumber">1 ModSecurity® Reference Manual @@ -628,91 +650,99 @@ class="tocnumber">9.25 removeCommentsChar10 Actions @@ -739,43 +769,49 @@ class="tocnumber">10.32 sanitiseResponseHeaderinspectFile
  • 11.10 ipMatch
    • -
  • 11.11 +
  • 11.11 + ipMatchF
    • +
  • 11.12 ipMatchFromFile
    • +
  • 11.13 le
    • -
  • 11.12 +
  • 11.14 lt
    • -
  • 11.13 +
  • 11.15 pm
    • -
  • 11.14 +
  • 11.16 pmf
    • -
  • 11.15 +
  • 11.17 pmFromFile
    • -
  • 11.16 +
  • 11.18 rbl
    • -
  • 11.17 +
  • 11.19 rsub
    • -
  • 11.18 +
  • 11.20 rx
    • -
  • 11.19 +
  • 11.21 streq
    • -
  • 11.20 +
  • 11.22 strmatch
  • 11.21 validateByteRange
    • -
  • 11.22 +class="tocnumber">11.23 validateByteRange
    • +
  • 11.24 validateDTD
    • -
  • 11.23 +
  • 11.25 validateEncryption
    • +
  • 11.26 validateSchema
  • 11.24 validateUrlEncoding
    • +class="tocnumber">11.27 validateUrlEncoding
  • 11.25 validateUtf8Encoding
    • -
  • 11.26 +class="tocnumber">11.28 validateUtf8Encoding
    • +
  • 11.29 verifyCC
    • -
  • 11.27 +
  • 11.30 verifyCPF
    • -
  • 11.28 +
  • 11.31 verifySSN
    • -
  • 11.29 +
  • 11.32 within
    • @@ -804,9 +840,9 @@ Configuration

    ModSecurity® Reference Manual

    -

    -Current as of v2.5.13 and v2.6

    +

    Current as of v2.5.13 v2.6 and v2.7

    Copyright © 2004-2011 http://www.modsecurity.org/documentation/ModSecurity-Migration-Matrix.pdf +
    Starting with ModSecurity 2.7.0 there are a few important +configuration options +
    +
    1. --enable-pcre-jit - Enables JIT support from pcre >= +8.20 that can improve regex performance. +
    2. --enable-cache-lua - Enables lua vm caching that can +improve lua script performance. Difference just appears if ModSecurity +must run more than one script per transaction. +
    3. --enable-request-early - On ModSecuricy 2.6 phase one +has been moved to phase 2 hook, if you want to play around it use this +option. +

    Configuration Directives

    The following section outlines all of the ModSecurity directives. @@ -1245,7 +1293,7 @@ class="mw-headline"> SecArgumentSeparator

    for application/x-www-form- urlencoded content.

    Syntax: SecArgumentSeparator character

    Default: & -

    Scope: Main +

    Scope: Main(< 2.7.0), Any(2.7.0)

    Version: 2.0.0

    This directive is needed if a backend web application is using a nonstandard argument separator. Applications are sometimes (very rarely) @@ -1672,7 +1720,7 @@ title="http://blog.spiderlabs.com/2008/07/three-modsecurity-rule-language-annoya frontend compression enabled.

    Syntax: SecDisableBackendCompression On|Off

    Scope: Any -

    Version: Development trunk +

    Version: 2.6.0

    Default: Off

    This directive is necessary in reverse proxy mode when the backend servers support response compression, but you wish to inspect @@ -1681,6 +1729,100 @@ will only see compressed content, which is not very useful. This directive is not necessary in embedded mode, because ModSecurity performs inspection before response compression takes place.

    +

    SecEncryptionEngine

    +

    Description: Configures the encryption engine. +

    Syntax: SecEncryptionEngine On|Off +

    Example Usage: SecEncryptionEngine On +

    Scope: Any +

    Version: 2.7 +

    Default: Off +

    The possible values are: +

    + +
    Note 
    Users must enable stream output variables +and content injection. +
    +

    SecEncryptionKey

    +

    Description: Define the key that will be used by HMAC. +

    Syntax: SecEncryptionKey rand|TEXT +KeyOnly|SessionID|RemoteIP +

    Example Usage: SecEncryptionKey "this_is_my_key" +KeyOnly +

    Scope: Any +

    Version: 2.7 +

    ModSecurity encryption engine will append, if specified, the +user's session id or remote ip to the key before the MAC operation. If +the first parameter is "rand" then a random key will be generated and +used by the engine. +


    +

    +

    SecEncryptionParam

    +

    Description: Define the parameter name that will receive the +MAC hash. +

    Syntax: SecEncryptionParam TEXT +

    Example Usage: SecEncryptionKey "hmac" +

    Scope: Any +

    Version: 2.7 +

    ModSecurity encryption engine will add a new parameter to +protected HTML elements containing the MAC hash. +

    +

    SecEncryptionMethodRx

    +

    Description: Configures what kind of HTML data the encryption +engine should sign based on regular expression. +

    Syntax: SecEncryptionMethodRx TYPE REGEX +

    Example Usage: SecEncryptionMethodRx HashHref +"product_info|list_product" +

    Scope: Any +

    Version: 2.7.0 +

    As a initial support is possible to protect HREF, FRAME, IFRAME +and FORM ACTION html elements as well response Location header when http + redirect code are sent. +

    The possible values for TYPE are: +

    + +
    Note 
    This directive is used to sign the elements + however user must use the @validateEncryption operator to enforce data +integrity. +
    +


    +

    +

    SecEncryptionMethodPm

    +

    Description: Configures what kind of HTML data the encryption +engine should sign based on string search algoritm. +

    Syntax: SecEncryptionMethodRx TYPE "string1 string2 +string3..." +

    Example Usage: SecEncryptionMethodRx HashHref +"product_info list_product" +

    Scope: Any +

    Version: 2.7.0 +

    As a initial support is possible to protect HREF, FRAME, IFRAME +and FORM ACTION html elements as well response Location header when http + redirect code are sent. +

    The possible values for TYPE are: +

    + +
    Note 
    This directive is used to sign the elements + however user must use the @validateEncryption operator to enforce data +integrity. +

    SecGeoLookupDb

    Description: Defines the path to the database that will be @@ -1710,9 +1852,11 @@ href="http://code.google.com/apis/safebrowsing/" class="external autonumber" title="http://code.google.com/apis/safebrowsing/" rel="nofollow">[3].

    -
    Note 
    After registering and obtaining a Safe -Browsing API key, you can automatically download the GSB using a tool -like wget (where KEY is your own API key): +
    Note 
    Deprecated in 2.7.0 after Google dev team +decided to not allow the database download anymore. After registering +and obtaining a Safe Browsing API key, you can automatically download +the GSB using a tool like wget (where KEY is your own API +key):

    wget http://blog.spiderlabs.com/2010/11/advanced-topic-of-the-week-mitigating-slow-http-dos-attacks.html

    +

    SecSensorId

    +

    Description: Define a sensor ID that will be present into log +part H. +

    Syntax: SecSensorId TEXT +

    Example Usage: SecSensorId WAFSensor01 +

    Scope: Main +

    Version: 2.7.0 +

    SecWriteStateLimit

    Description: Establishes a per-IP address limit of how many @@ -2187,6 +2340,16 @@ class="mw-headline"> SecRuleEngine

  • DetectionOnly: process rules but never executes any disruptive actions (block, deny, drop, allow, proxy and redirect)
    • +

    SecRulePerfTime

    +

    Description: Set a performance threshold for rules. Rules that + spends too much time will be logged into audit log Part H in the format + id=usec. +

    Syntax: SecRulePerfTime USECS +

    Example Usage: SecRulePerfTime 1000 +

    Scope: Any +

    Version: 2.7 +

    SecRuleRemoveById

    Description: Removes the matching rules from the current @@ -2390,7 +2553,7 @@ TARGET1[,TARGET2,TARGET3] REPLACED_TARGET

    Version: 2.6

    This directive will append (or replace) variables to the current target list of the specified rule with the targets provided in the -second parameter. +second parameter. Starting with 2.7.0 this feature supports id range.

    Explicitly Appending Targets

    This is useful for implementing exceptions where you want to externally update a target list to exclude inspection of specific @@ -2439,6 +2602,128 @@ example, lets say you want to only inspect ARGS for a particular URL: 

    SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetById=958895;REQUEST_URI;REQUEST_FILENAME"
    +

    + SecRuleUpdateTargetByMsg

    +

    Description: Updates the target (variable) list of the +specified rule by rule message. +

    Syntax: SecRuleUpdateTargetByMsg TEXT +TARGET1[,TARGET2,TARGET3] REPLACED_TARGET +

    Example Usage: SecRuleUpdateTargetByMsg "Cross-site +Scripting (XSS) Attack" "!ARGS:foo" +

    Scope: Any +

    Version: 2.7 +

    This directive will append (or replace) variables to the current +target list of the specified rule with the targets provided in the +second parameter. +

    Explicitly Appending Targets +

    This is useful for implementing exceptions where you want to +externally update a target list to exclude inspection of specific +variable(s). +

    +
    SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+     "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}"
+
+SecRuleUpdateTargetByMsg "System Command Injection" !ARGS:email
+
    +

    The effective resulting rule in the previous example will append the +target to the end of the variable list as follows: +

    +
    SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|!ARGS:email "[\;\|\`]\W*?\bmail\b" \
+     "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}""
+
    +

    Explicitly Replacing Targets +

    You can also entirely replace the target list to something more +appropriate for your environment. For example, lets say you want to +inspect REQUEST_URI instead of REQUEST_FILENAME, you could do this: +

    +
    SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+     "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}"
+
+SecRuleUpdateTargetByMsg "System Command Injection" REQUEST_URI REQUEST_FILENAME
+
    +

    The effective resulting rule in the previous example will append the +target to the end of the variable list as follows: +

    +
    SecRule REQUEST_URI|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+     "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}""
+
    +

    Conditionally Appending Targets +

    You could also do the same by using the ctl action. This is +useful if you want to only update the targets for a particular URL +

    +
    SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='System Command Injection';!ARGS:email"
+
    +

    Conditionally Replacing Targets +

    You could also replace targets using the ctl action. For +example, lets say you want to only inspect ARGS for a particular URL: +

    +
    SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='System Command Injection';REQUEST_URI;REQUEST_FILENAME"
+
    +

    + SecRuleUpdateTargetByTag

    +

    Description: Updates the target (variable) list of the +specified rule by rule tag. +

    Syntax: SecRuleUpdateTargetByTag TEXT +TARGET1[,TARGET2,TARGET3] REPLACED_TARGET +

    Example Usage: SecRuleUpdateTargetByTag +"WEB_ATTACK/XSS" "!ARGS:foo" +

    Scope: Any +

    Version: 2.7 +

    This directive will append (or replace) variables to the current +target list of the specified rule with the targets provided in the +second parameter. +

    Explicitly Appending Targets +

    This is useful for implementing exceptions where you want to +externally update a target list to exclude inspection of specific +variable(s). +

    +
    SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+     "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}"
+
+SecRuleUpdateTargetByTag "WASCTC/WASC-31" !ARGS:email
+
    +

    The effective resulting rule in the previous example will append the +target to the end of the variable list as follows: +

    +
    SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|!ARGS:email "[\;\|\`]\W*?\bmail\b" \
+     "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}""
+
    +

    Explicitly Replacing Targets +

    You can also entirely replace the target list to something more +appropriate for your environment. For example, lets say you want to +inspect REQUEST_URI instead of REQUEST_FILENAME, you could do this: +

    +
    SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+     "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}"
+
+SecRuleUpdateTargetByTag "WASCTC/WASC-31" REQUEST_URI REQUEST_FILENAME
+
    +

    The effective resulting rule in the previous example will append the +target to the end of the variable list as follows: +

    +
    SecRule REQUEST_URI|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+     "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}""
+
    +

    Conditionally Appending Targets +

    You could also do the same by using the ctl action. This is +useful if you want to only update the targets for a particular URL +

    +
    SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='WASCTC/WASC-31';!ARGS:email"
+
    +

    Conditionally Replacing Targets +

    You could also replace targets using the ctl action. For +example, lets say you want to only inspect ARGS for a particular URL: +

    +
    SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='WASCTC/WASC-31';REQUEST_URI;REQUEST_FILENAME"
+

    SecServerSignature

    Description: Instructs ModSecurity to change the data @@ -2836,6 +3121,9 @@ DURATION

    Contains the number of milliseconds elapsed since the beginning of the current transaction. Available starting with 2.6.0.

    +
    Note 
    Starting with ModSecurity 2.7.0 the time is + microseconds. +

    ENV

    Collection that provides access to environment variables set by ModSecurity. Requires a single parameter to specify the name of the @@ -3110,6 +3398,12 @@ class="mw-headline"> PERF_PHASE5

    Contains the time, in microseconds, spent processing phase 5. Available starting with 2.6.

    +

    + PERF_RULES

    +

    Contains the time of rules, in microseconds. Available starting with +2.7. +

    SecRule PERF_RULES "@gt 1000" "id:12345,phase:5" +

    PERF_SREAD

    Contains the time, in microseconds, spent reading from persistent @@ -3617,6 +3911,12 @@ SecAction "nolog,pass,setuid:%{REMOTE_USER}" # Is the current user the administrator? SecRule USERID "admin" +

    USERAGENT_IP

    +

    This variable is created when running modsecurity with apache2.4 and +will contains the client ip address set by mod_remoteip in proxied +connections. +

    WEBAPPID

    This variable contains the current application name, which is set in @@ -3983,7 +4283,7 @@ chain, a disruptive action can only appear in the first rule).

    Note 
    Disruptive actions will NOT be executed if the SecRuleEngine is set to DetectionOnly. If you are creating exception/whitelisting rules that use the allow action, you should also -add the ctl:ruleEngine=DetectionOnly action to execute the action. +add the ctl:ruleEngine=On action to execute the action.
    • Non-disruptive actions - Do something, but that something does not and cannot affect the rule processing flow. Setting a @@ -4000,6 +4300,20 @@ containers that hold data used by other actions. For example, the status action holds the status that will be used for blocking (if it takes place).
    +

    +accuracy

    +

    Description: Specifies the relative accuracy level of the rule + related to false positives/negatives. The value is a string based on a + numeric scale (1-9 where 9 is very strong and 1 has many false +positives). +

    Action Group: Meta-data +

    Version: 2.7 +

    Example: +

    +
    SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bgetparentfolder\b" \
+	"phase:2,ver:'CRS/2.2.4,accuracy:'9',maturity:'9',capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,msg:'Cross-site Scripting (XSS) Attack',id:'958016',tag:'WEB_ATTACK/XSS',tag:'WASCTC/WASC-8',tag:'WASCTC/WASC-22',tag:'OWASP_TOP_10/A2',tag:'OWASP_AppSensor/IE1',tag:'PCI/6.5.1',logdata:'% \
+{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.xss_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}"
+

    allow

    Description: Stops rule processing on a successful match and allows the transaction to proceed. @@ -4196,6 +4510,11 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml "nolog,pass,ctl:requestBodyProcessor=XML" time, it should be specified before the rule in which it is disabling.

  • ruleUpdateTargetById +
  • ruleUpdateTargetByMsg +
  • ruleUpdateTargetByTag +
  • ruleRemoveByMsg +
  • encryptionEngine +
  • encryptionEnforcement

    • With the exception of the requestBodyProcessor and forceRequestBodyVariable settings, each configuration option corresponds @@ -4304,7 +4623,8 @@ time will be reset.

    id

    Description: Assigns a unique ID to the rule or chain in which - it appears. + it appears. Starting with ModSecurity 2.7 this action is mandatory and +must be numeric.

    Action Group: Meta-data

    Example:

    @@ -4324,14 +4644,22 @@ modsecurity.org href="http://projects.otaku42.de/wiki/Scally-Whack" class="external autonumber" title="http://projects.otaku42.de/wiki/Scally-Whack" rel="nofollow">[9] -
  • 430,000–699,999: unused (available for reservation) +
  • 430,000–439,999: reserved for rules published by Flameeyes [10] +
  • 440.000-599,999: unused (available for reservation) +
  • 600,000-699,999: reserved for use by Akamai [11]
  • 700,000–799,999: reserved for Ivan Ristic
  • 900,000–999,999: reserved for the OWASP ModSecurity Core Rule Set [10] project + rel="nofollow">[12] project
  • 1,000,000-1,999,999: unused (available for reservation)
  • 2,000,000-2,999,999: reserved for rules from Trustwave's SpiderLabs Research team @@ -4377,6 +4705,21 @@ Macro expansion is performed, so you may use variable names such as %{TX.0} or %{MATCHED_VAR}. The information is properly escaped for use with logging of binary data.

    +

    +maturity

    +

    Description: Specifies the relative maturity level of the rule + related to the length of time a rule has been public and the amount of +testing it has received. The value is a string based on a numeric scale + (1-9 where 9 is extensively tested and 1 is a brand new experimental +rule). +

    Action Group: Meta-data +

    Version: 2.7 +

    Example: +

    +
    SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bgetparentfolder\b" \
+	"phase:2,ver:'CRS/2.2.4,accuracy:'9',maturity:'9',capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,msg:'Cross-site Scripting (XSS) Attack',id:'958016',tag:'WEB_ATTACK/XSS',tag:'WASCTC/WASC-8',tag:'WASCTC/WASC-22',tag:'OWASP_TOP_10/A2',tag:'OWASP_AppSensor/IE1',tag:'PCI/6.5.1',logdata:'% \
+{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.xss_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}"
+

    msg

    Description: Assigns a custom message to the rule or chain in which it appears. The message will be logged along with every alert. @@ -4455,7 +4798,8 @@ SecRule ARGS "test" "phase:2,log,pass,setvar:TX.test=+1"

    pause

    Description: Pauses transaction processing for the specified -number of milliseconds. +number of milliseconds. Starting with ModSecurity 2.7 this feature also +supports macro expansion.

    Action Group: Non-disruptive

    Example:

    @@ -4478,6 +4822,17 @@ establish the rule defaults. 
    # Initialize IP address tracking in phase 1
 SecAction phase:1,nolog,pass,initcol:IP=%{REMOTE_ADDR}
    +

    Starting in ModSecurity version v2.7 there are aliases for some phase + numbers: +

    +
    • 2 - request +
    • 4 - response +
    • 5 - logging +
    +

    Example: +

    +
    SecRule REQUEST_HEADERS:User-Agent "Test" "phase:request,log,deny"
+
    Warning 
    Keep in mind that if you specify the incorrect phase, the variable used in the rule may not yet be available. This could lead to a false negative situation where your variable and @@ -4684,6 +5039,17 @@ available for use in the subsequent rules. This action understands application namespaces (configured using SecWebAppId), and will use one if it is configured.

    +

    setrsc

    +

    Description: Special-purpose action that initializes the +RESOURCE collection using a key provided as parameter. +

    Action Group: Non-disruptive +

    Example: +

    +
    SecAction "phase:1,pass,id:3,log,setrsc:'abcd1234'"
+
    +

    This action understands application namespaces (configured using +SecWebAppId), and will use one if it is configured. +

    setsid

    Description: Special-purpose action that initializes the SESSION collection using the session token provided as parameter. @@ -4830,6 +5196,16 @@ of events. Multiple tags can be specified on the same rule. Use forward slashes to create a hierarchy of categories (as in the example). Since ModSecurity 2.6.0 tag supports macro expansion.

    +

    ver

    +

    Description: Specifies the rule set version. +

    Action Group: Meta-data +

    Version: 2.7 +

    Example: +

    +
    SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bgetparentfolder\b" \
+	"phase:2,ver:'CRS/2.2.4,capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,msg:'Cross-site Scripting (XSS) Attack',id:'958016',tag:'WEB_ATTACK/XSS',tag:'WASCTC/WASC-8',tag:'WASCTC/WASC-22',tag:'OWASP_TOP_10/A2',tag:'OWASP_AppSensor/IE1',tag:'PCI/6.5.1',logdata:'% \
+{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.xss_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}"
+

    xmlns

    Description: Configures an XML namespace, which will be used in the execution of XPath expressions. @@ -4967,7 +5343,7 @@ script in the /util directory called runav.pl [11] that allows the file approval mechanism to + rel="nofollow">[13] that allows the file approval mechanism to integrate with the ClamAV virus scanner. This is especially handy to prevent viruses and exploits from entering the web server through file upload. @@ -5065,6 +5441,31 @@ ipMatch 

    SecRule REMOTE_ADDR "@ipMatch 192.168.1.100,192.168.1.50,10.10.50.0/24"
    +

    +ipMatchF

    +

    short alias for ipMatchFromFile +

    +

    ipMatchFromFile

    +

    Description: Performs a fast ipv4 or ipv6 match of REMOTE_ADDR + variable, loading data from a file. Can handle the following formats: +

    +
    • Full IPv4 Address - 192.168.1.100 +
    • Network Block/CIDR Address - 192.168.1.0/24 +
    • Full IPv6 Address - 2001:db8:85a3:8d3:1319:8a2e:370:7348 +
    • Network Block/CIDR Address - +2001:db8:85a3:8d3:1319:8a2e:370:0/24 +
    +

    Examples: +

    +
    SecRule REMOTE_ADDR "@ipMatch ips.txt"
+
    +

    The file ips.txt may contain: +

    +
    192.168.0.1
+172.16.0.0/16
+10.0.0.0/8
+

    le

    Description: Performs numerical comparison and returns true if the input value is less than or equal to the operator parameter. Macro @@ -5191,7 +5592,9 @@ specific RBL the IP was found in.

    rsub

    Description: Performs regular expression data substitution when applied to either the STREAM_INPUT_BODY or STREAM_OUTPUT_BODY -variables. This operator also supports macro expansion. +variables. This operator also supports macro expansion. Starting with +ModSecurity 2.7.0 this operator supports the syntax |hex| allowing users + to use special chars like \n \r

    Syntax: @rsub s/regex/str/[id]

    Examples: Removing HTML Comments from response bodies: @@ -5205,7 +5608,7 @@ SecContentInjection directive.

    Regular expressions are handled by the PCRE library [12]. ModSecurity +title="http://www.pcre.org" rel="nofollow">[14]. ModSecurity compiles its regular expressions with the following settings:

    1. The entire input is treated as a single line, even when there @@ -5243,7 +5646,7 @@ SecRule REQUEST_HEADERS:User-Agent "(?i)nikto"

      Regular expressions are handled by the PCRE library [13]. ModSecurity +title="http://www.pcre.org" rel="nofollow">[15]. ModSecurity compiles its regular expressions with the following settings:

      1. The entire input is treated as a single line, even when there @@ -5340,6 +5743,15 @@ SecRule REQUEST_HEADERS:Content-Type ^text/xml$ "phase:1,nolog,pass,t:lowercase, # Validate XML payload against DTD SecRule XML "@validateDTD /path/to/xml.dtd" "phase:2,deny,msg:'Failed DTD validation'" +

        validateEncryption

        +

        Description: Validates REQUEST_URI that contains data +protected by the encryption engine. +

        Example: +

        +
        # Validates requested URI that matches a regular expression.
+SecRule REQUEST_URI "@validateEncryption "product_info|product_list" "phase:1,deny,id:123456"
+

        validateSchema

        Description: Validates the XML DOM tree against the supplied @@ -5815,13 +6227,13 @@ SecCookieFormat 0 - +

        Retrieved from "http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual"
        @@ -5931,7 +6343,7 @@ pages
        2. href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual&printable=yes&printable=yes" rel="alternate" title="Printable version of this page [alt-shift-p]" accesskey="p">Printable version @@ -5943,15 +6355,15 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Referen src="Reference_Manual_files/poweredby_mediawiki_88x31.png" alt="Powered by MediaWiki">
          -
        • This page was last modified on 19 December 2011, -at 12:16.
          • -
        • This page has been accessed 77,761 times.
          • +
        • This page was last modified on 5 June 2012, at +18:32.
          • +
        • This page has been accessed 130,057 times.
        - +