Web Application Defender's Cookbook

Recipe 4-3: Utilizing Real-time Blacklist Lookups (RBL)

This recipe demonstrates how to use remote RBLs to gather intelligence about the current client IP address.

Ingredients

• Spamhaus Block List (SBL) and Spamhaus Exploit Block List (XBL)3
• ModSecurity
  • SecHttpBlKey
  • @rbl action

Using the Spamhaus Blacklists

RBLs use the DNS protocol to share information. The RBL client sends a DNS request to the RBL server with the client’s IP address reversed in the lookup name. For example, if the client’s IP address is 92.43.98.115, the RBL DNS request name is 115.98.43.92.sbl-xbl.spamhaus.org. If the RBL DNS server has an entry for 115.98.43.92.sbl-xbl.spamhaus.org, it returns a positive result. With this information, you may decide how you want to treat the client differently.

Caution

Be careful when choosing which RBL service you will use. It is important to verify the accuracy of the RBL server. What processes does it use to identify malicious IP addresses? How often is its data updated? Some RBLs are also more reputable than others with regard to listing specific known malicious sources. Many different types of RBL lists also target specific types of malicious behavior, such as open proxies, spam sources, and malware hosts. You should choose the appropriate RBL for your use case.

Here is a sample ModSecurity ruleset for running RBL checks using the @rbl operator:

SecRule IP:PREVIOUS_RBL_CHECK "@eq 1" "phase:1,id:'981137',t:none,pass, nolog,skipAfter:END_RBL_LOOKUP" SecRule ...