Recipe 1-1: Real-time Application Profiling
This recipe shows you how to use ModSecurity’s Lua API to analyze HTTP transactions to develop a learned profile of expected request characteristics.
Ingredients
  • ModSecurity Reference Manual1
    • Lua API support
    • SecRuleScript directive
    • initcol action
    • RESOURCE persistent storage
  • OWASP ModSecurity Core Rule Set2
    • modsecurity_crs_40_appsensor_detection_point_2.0_setup.conf
    • modsecurity_crs_40_appsensor_detection_point_2.1_request_exception.conf
    • modsecurity_crs_40_appsensor_detection_point_3.0_end.conf
    • appsensor_request_exception_profile.lua
Learning about Expected Request Attributes
The concepts in this section demonstrate how to dynamically create a positive security model or whitelisting input validation envelope around your application. After it is created, this external security layer will enforce rules for the critical elements of an application and allow you to identify abnormal requests that violate this policy. This recipe shows how to profile real web user transactions to identify the following request attributes for each application resource:
  • Request method(s)
  • Number of parameters (minimum/maximum range)
  • Parameter names
  • Parameter lengths (minimum/maximum range)
  • Parameter types
    • Flag (such as /path/to/foo.php?param)
    • Digits (such as /path/to/foo.php?param=1234)
    • Alpha (such as /path/to/foo.php?param=abcd)
    • Alphanumeric (such as /path/to/foo.php?param=abcd1234)
    • E-mail (such as /path/to/foo.php?param=foo@bar.com)
    • Path (such as ...

Get Web Application Defender's Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.