Web Application Defender's Cookbook

Recipe 1-1: Real-time Application Profiling

This recipe shows you how to use ModSecurity’s Lua API to analyze HTTP transactions to develop a learned profile of expected request characteristics.

Ingredients

• ModSecurity Reference Manual1
  • Lua API support
  • SecRuleScript directive
  • initcol action
  • RESOURCE persistent storage
• OWASP ModSecurity Core Rule Set2
  • modsecurity_crs_40_appsensor_detection_point_2.0_setup.conf
  • modsecurity_crs_40_appsensor_detection_point_2.1_request_exception.conf
  • modsecurity_crs_40_appsensor_detection_point_3.0_end.conf
  • appsensor_request_exception_profile.lua

Learning about Expected Request Attributes

The concepts in this section demonstrate how to dynamically create a positive security model or whitelisting input validation envelope around your application. After it is created, this external security layer will enforce rules for the critical elements of an application and allow you to identify abnormal requests that violate this policy. This recipe shows how to profile real web user transactions to identify the following request attributes for each application resource:

• Request method(s)
• Number of parameters (minimum/maximum range)
• Parameter names
• Parameter lengths (minimum/maximum range)
• Parameter types
  • Flag (such as /path/to/foo.php?param)
  • Digits (such as /path/to/foo.php?param=1234)
  • Alpha (such as /path/to/foo.php?param=abcd)
  • Alphanumeric (such as /path/to/foo.php?param=abcd1234)
  • E-mail (such as /path/to/foo.php?param=[e-mail])
  • Path (such as ...