Web Application Defender's Cookbook

Recipe 1-2: Preventing Data Manipulation with Cryptographic Hash Tokens

This recipe shows you how to use ModSecurity to implement additional hash tokens to outbound HTML data to prevent data manipulation attacks. When this book was written, the capabilities outlined in this recipe were available in ModSecurity version 2.7. Future versions may have different or extended functionality.

Ingredients

• ModSecurity Reference Manual3
  • Version 2.7 or higher
  • SecDisableBackendCompression directive
  • SecContentInjection directive
  • SecStreamOutBodyInspection directive
  • SecEncryptionEngine directive
  • SecEncryptionKey directive
  • SecEncryptionParam directive
  • SecEncryptionMethodRx directive

As mentioned earlier, web developers cannot rely on web browser security mechanisms to prevent data manipulation. With this being the case, how can we implement an external method of verifying that outbound data has not been manipulated when returned in a follow-up request? One technique is to parse the outbound HTML response body data and inject additional token data into select locations. The data we are injecting is called request parameter validation tokens. These are essentially cryptographic hashes of select HTML page elements. The hashes enable us to detect if the client attempts to tamper with the data. Here are some sample ModSecurity directives and rules that implement basic hashing protections:

SecDisableBackendCompression On SecContentInjection On SecStreamOutBodyInspection On SecEncryptionEngine ...