Web Application Defender's Cookbook

Recipe 13-3: Issuing E-mail Alerts

This recipe shows you how to send e-mails to security personnel as a result of security violations.

Ingredients

• ModSecurity AuditConsole1
• ModSecurity
  • REQUEST_HEADERS variable
  • REQUEST_BODY variable
  • @eq operator
  • exec action
  • setenv action

Sending E-mail Alerts Using the exec Action

ModSecurity’s exec action executes a local binary or script independent of any disruptive actions within the rule. One of the more helpful use cases for the exec action is to send an e-mail to security personnel when certain predefined criteria are met. For instance, consider a scenario in which an attacker attempts SQL Injection to bypass a login page, as shown in Figure 13-1.

Figure 13-1: Authentication bypass SQL Injection attack

If this particular injection attack is not formatted correctly and causes errors in the back-end SQL database, it may respond with error messages similar to those shown in Figure 13-2.

Figure 13-2: Microsoft SQL error messages in response

Even though this particular attack failed, it may be only a matter of time before it succeeds. In these situations it is wise to notify security personnel. The following correlation rule runs when a transaction is complete. It checks for any web attack rules that may have triggered against the ...