Web Application Defender's Cookbook

Recipe 8-5: Detecting Browser Fingerprint Changes During Sessions

This recipe demonstrates how to identify changes to the client’s browser fingerprint during a session.

Ingredients

• ModSecurity
  • SecContentInjection directive
  • RESPONSE_HEADERS:Set-Cookie variable
  • REQUEST_HEADERS:Cookie variable
  • GEO collection variable
  • @streq operator
  • setsid action
  • setvar action
  • append action

Tracking User-Agent Field Changes

Besides tracking source location data, as shown in Recipe 8-4, we can inspect certain characteristics of the web client. Specifically, we can easily track the client’s User-Agent string value and ensure that it does not change during the course of a session. If it does change, this may indicate some type of session hijacking scenario. First, let’s look at the following ruleset that captures a hash of the current client’s User-Agent value when the application issues a Set-Cookie response header:

SecRule RESPONSE_HEADERS:/Set-Cookie2?/ "(?i:(j?sessionid|(php)?sess
id|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid)=([^\s]+)\;\s?)
" "chain,
phase:3,id:'981062',t:none,pass,nolog,capture,setsid:%{TX.6},
setvar:session.sessionid=%{TX.6},setvar:session.valid=1,
expirevar:session.valid=3600,
setvar:session.country_name=%{geo.country_name}"
        SecRule REMOTE_ADDR "^(\d{1,3}\.\d{1,3}\.\d{1,3}\.)"  
"chain,capture,setvar:session.ip_block=%{tx.1}"
                SecRule REQUEST_HEADERS:User-Agent ".*" "t:none,
t:sha1,t:hexEncode,setvar:session.ua=%{matched_var}"

The bold rule captures the current ...