Web Application Defender's Cookbook

Recipe 14-5: Forcing Transaction Delays

This recipe shows you how to use ModSecurity’s pause action to introduce transactional latency.

Ingredients

• ModSecurity
  • pause action

In a number of attack scenarios, rather than blocking the transaction, responding with variable transaction delays may be a better option. Let’s look at the main use-case scenario.

Slowing Down Automated Attack Tools

Attackers love to use automation to expedite their actions. From the beginning reconnaissance phase through the exploit phase, attackers can quickly compromise web applications using automated tools. These tools allow the attackers to complete tasks that, if executed manually, would be infeasible. Let’s look at a real-world sample use case that demonstrates how quickly automated SQL Injection exploitation tools work. SQLMap5 is an extremely popular and robust automated SQL Injection tool. The following example demonstrates running SQLMap against a vulnerable page on the acuforum Acunetix public demo site:6

$ python sqlmap.py --wizard
 
    sqlmap/1.0-dev-f6716cf - automatic SQL injection and database
takeover tool
    http://sqlmap.org
 
[!] legal disclaimer: Usage of sqlmap for attacking targets without
prior mutual consent is illegal. It is the end user's responsibility
to obey all applicable local, state and federal laws. Developers
assume no liability and are not responsible for any misuse or damage
caused by this program
 
[*] starting at 13:26:34 Please enter full target URL (-u): http://testasp.vulnweb.com/ ...