Web Application Defender's Cookbook

Recipe 7-7: Correlating Usernames with SessionIDs

This recipe shows you how to correlate an application username with the active SessionID.

Ingredients

• OWASP ModSecurity Core Rule Set (CRS)
  • modsecurity_crs_16_username_tracking.conf
• ModSecurity
  • RESPONSE_HEADERS:Set-Cookie variable
  • ARGS:username variable
  • setsid action
  • setuid action
  • setvar action

When security-related events are generated, can you identify the actual application user within the alert data? You will have an IP address, but that does not directly correlate to a specific application user. What about a SessionID? SessionIDs are too transient, because they are valid for only a short time. What you need to be able to do is correlate the username that was submitted during successful authentication with the active SessionID. This allows tracking, because the SessionID is resubmitted to the application on subsequent requests within the Cookie request headers.

Creating Session Collections

To track data from request to request related to a particular SessionID, you must use the ModSecurity setsid action when the application either issues or receives a SessionID. In the former case, when an application issues a Set-Cookie response header, that is the time to create a persistent session collection. For instance, here is how it looks when Joomla hands out a SessionID when a client first arrives at the site:

HTTP/1.1 200 OK P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 01 Jan 2001 00:00:00 GMT ...