Web Application Defender's Cookbook

Recipe 3-3: Adding Fake HTML Comments

This recipe shows you how to add fake HTML comment data that may be flagged if ever used by a client.

Ingredients

• ModSecurity Reference Manual3
  • SecStreamOutBodyInspection directive
  • SecContentInjection directive
  • STREAM_OUTPUT_BODY variable
  • @rsub operator

HTML Comments

HTML provides syntax that allows developers to embed comment information within the HTML code. The HTML RFC states the following:

3.2.4 Comments
 
HTML comments have the following syntax:
 
<!-- this is a comment -->
<!-- and so is this one,
    which occupies more than one line -->
 
White space is not permitted between the markup declaration open 
delimiter("<!") and the comment open delimiter ("--"), but is 
permitted between the comment close delimiter ("--") and the 
markup declaration close delimiter (">"). A common error is to 
include a string of hyphens ("---") within a comment. Authors 
should avoid putting two or more adjacent hyphens inside 
comments.
 
Information that appears between comments has no special meaning 
(e.g., character references are not interpreted as such).
 
Note that comments are markup.

Although the intended purpose of this functionality is to be helpful, it often divulges sensitive data. Let’s look at an example.

During the reconnaissance phase, an attacker will most likely run an automated spidering tool against the site. Then he can review various elements of the site offline and look for pieces of sensitive information. For example, Figure 3-2 shows the ...