Web Application Defender's Cookbook

Recipe 2-1: Passive Vulnerability Identification

This recipe shows you how to use ModSecurity to monitor live application traffic to identify flaws, misconfigurations, and attacks against vulnerable resources.

Ingredients

• OSVDB
  • OSVDB account
  • Download CSV database
• Apache header directive
• ModSecurity Reference Manual1
  • Lua API support
  • SecRuleScript directive
  • initcol action
  • RESOURCE persistent storage
• ModSecurity OWASP Core Rule Set2
  • modsecurity_crs_56_pvi_checks.conf
  • osvdb.lua

Passive Vulnerability Identification (PVI)

One of the most underappreciated capabilities of web application firewalls (WAFs) is traffic monitoring and analysis. Because WAFs have access to the full inbound request and outbound response payloads, they can gain valuable insight into vulnerabilities and configuration issues such as missing HttpOnly or Secure cookie flags. The main benefit of using a WAF to supplement Dynamic Application Security Testing (DAST) is that the identification happens in real time by monitoring real clients interacting with the web application—hence the term Passive Vulnerability Identification (PVI).

PVI is a much different operating model than the standard WAF “blocking inbound attacks” mentality. First, you often need to correlate both inbound and outbound data to accurately identify an application flaw or vulnerable resource. Second, you don’t want to take any disruptive actions against the live transaction. Remember, these transactions are not active attack-focused ...