Web Application Defender's Cookbook

Recipe 2-4: Automated Scan Result Conversion

This recipe shows you how to use a Perl script to automatically convert Arachni XML scan report data into ModSecurity virtual patches to mitigate identified vulnerabilities.

Ingredients

• Arachni
• Arachni2modsec.pl Perl script
• Perl
  • Simple::XML module
• ModSecurity Reference Manual6
  • SecRule directive
  • chain action

As shown in Recipe 2-3, it is certainly possible to review the Arachni scan results report data and manually create virtual patches. The main disadvantage of this approach is that it is difficult to scale the process if you have a large number of web applications to protect. You would need to considerably increase your security staff if you used the manual approach. In addition, there are also issues with inconsistent rule constructions when different people are creating rules. Ideally, we should be able to automate this virtual patch creation of scan result data.

Let’s take a quick look at the Arachni XML report data format. Here is a section of the XML report for the same SQL Injection vulnerability we looked at in Recipe 2-3:

<issue> <_hash>686da018303c5831ae4c99474bc55412</_hash> <cvssv2>9.0</cvssv2> <cwe>89</cwe> <cwe_url>http://cwe.mitre.org/data/definitions/89.html</cwe_url> <description>SQL code can be injected into the web application. </description> <elem>link</elem> <internal_modname>SQLInjection</internal_modname> <method>GET</method> <mod_name>SQLInjection</mod_name> <name>SQL Injection</name> <remedy_code></remedy_code> ...