Web Application Defender's Cookbook

Recipe 14-2: Dropping Connections

This recipe shows you how to use ModSecurity’s drop action to forcibly terminate the network connection.

Ingredients

• ModSecurity
  • drop action

The use of the redirect action in Recipe 14-1 is the most useful response for basic attacks because it acts just like the application. This is ideal when you are dealing with a real person who is using the application with a web browser. However, sometimes sending back helpful HTML data to the client is not the best course of action. This is most often the case when you have identified that some type of automated program is accessing your application. Recipe 12-1 showed you how to identify when automated programs are executing a denial-of-service (DoS) attack against your application. In this case, after the attack has been identified, the best response action to use is the ModSecurity drop action.

Recipe 12-1 showed the following DoS rule, which issues alerts and uses the drop action:

#
# --[ Block DoS Attacker Traffic and Issue Periodic Alerts ]--
#
# We don't want to get flooded by alerts during an attack or scan so
# we are only triggering an alert once/minute.  You can adjust how 
# often you want to receive status alerts by changing the expirevar
# setting below.
#
SecRule IP:DOS_BLOCK "@eq 1" "chain,phase:1,id:'981044',drop,msg: 'Denial of Service (DoS) Attack Identified from %{remote_addr} (%{tx.dos_block_counter} hits since last alert)', setvar:ip.dos_block_counter=+1" SecRule &IP:DOS_BLOCK_FLAG ...