Web Application Defender's Cookbook

Recipe 6-5: Detecting Page Size Deviations

This recipe demonstrates how to identify when there are abnormalities with response body sizes.

Ingredients

• ModSecurity
  • modsecurity_crs_40_appsensor_detection_point_2.0_setup.conf
  • modsecurity_crs_40_appsensor_detection_point_2.1_response_exception.conf
  • appsensor_response_enforce.lua
  • appsensor_response_profile.lua

Two main compromise scenarios may directly impact the resulting web page size:

• Web page defacements
• Bulk extraction of back-end database information

When web defacers modify the target web page, the resulting page typically is significantly smaller than the normal web page. On the other end of the spectrum, when criminals successfully execute a SQL Injection attack and conduct bulk extractions of data, the web page is often significantly larger than normal. To catch these two scenarios, we must be able to track the normal size ranges for our response body content and generate alerts if a deviation occurs.

To identify these page size anomalies, we can use the ModSecurity Lua API to profile the normal page sizes for each resource and save that data in a persistent collection. The OWASP ModSecurity Core Rule Set includes a file called modsecurity_crs_40_appsensor_2.1_response_exception.conf, which includes the following rules that profile response data:

# # --[ Begin Profiling Phase ]-- # SecMarker BEGIN_RES_PROFILE_ANALYSIS SecRule RESPONSE_STATUS "^404$" "phase:5,id:'981099',t:none,nolog, pass,setvar:!resource.KEY,skipAfter:END_RES_PROFILE_ANALYSIS" ...