Web Application Defender's Cookbook

Recipe 8-4: Detecting Client Source Location Changes During Session Lifetime

This recipe shows you how to determine when a client’s GeoIP data changes during his current session.

Ingredients

• MaxMind’s GeoLite City Database2
• ModSecurity
  • SecGeoLookupDb directive
  • RESPONSE_HEADERS:Set-Cookie variable
  • REQUEST_HEADERS:Cookie variable
  • GEO collection variable
  • @geoLookup operator
  • @streq operator
  • setsid action
  • setvar action

When the application issues a SessionID Set-Cookie response header, it is important to capture certain characteristics associated with the network and the client’s geographic location. The rationale is that the client data should not change during a normal session. On the other hand, this data will almost certainly change during a session hijacking attack where an attacker has obtained a valid SessionID and uses it within his own malicious requests. By capturing this data, we can look for any changes during the course of a session and generate alerts.

Tracking the Client’s Network Block

One piece of client source information we can easily track is the network block he is coming from. This allows us to track the IP address block for each request using a specific SessionID token.

The following rule creates a session-based collection when the application issues the Set-Cookie response header:

SecRule RESPONSE_HEADERS:/Set-Cookie2?/ "(?i:(j?sessionid|(php)?sessid| (asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid)=([^\s]+)\;\s?)" "chain,phase:3,id:'981062',t:none,pass,nolog,capture,setsid:%{TX.6}, ...