Web Application Defender's Cookbook

Recipe 5-8: Detecting Request Header Anomalies

This recipe shows various methods of identifying request header anomalies.

Ingredients

• OWASP AppSensor9
  • Data Missing from Request
• ModSecurity
  • @rx operator
  • @eq operator
  • @endsWith operator

A number of different request header anomalies can be analyzed, and we will discuss them in the following recipes.

Missing Request Headers

Normal web browsers send the following request headers:

• Host
• User-Agent
• Accept

When attackers create automated attack scripts or programs, they often do not include these standard web browser headers. The OWASP ModSecurity Core Rule Set includes the following checks for these headers within the modsecurity_crs_21_protocol_anomalies.conf file:

# # Some common HTTP usage patterns are indicative of attacks but may # also be used by non-browsers for legitimate uses. # # Do not accept requests without common headers. # All normal web browsers include Host, User-Agent and Accept # headers. # # Implies either an attacker or a legitimate automation client. # # # Missing/Empty Host Header # # -=[ Rule Logic ]=- # These rules will first check to see if a Host header is present. # The second check is to see if a Host header exists but is empty. # SecMarker BEGIN_HOST_CHECK SecRule &REQUEST_HEADERS:Host "@eq 0" \ "skipAfter:END_HOST_CHECK,phase:2,rev:'2.2.3',t:none, block,msg:'Request Missing a Host Header',id:'960008', tag:'PROTOCOL_VIOLATION/MISSING_HEADER_HOST',tag:'WASCTC/WASC-21', tag:'OWASP_TOP_10/A7',tag:'PCI/6.5.10',severity:'5', ...