Web Application Defender's Cookbook

Recipe 14-8: Forcing an Application Logout

This recipe shows you how to use ModSecurity’s exec action to send a request to log the user out of the application.

Ingredients

• ModSecurity
  • exec action

An excellent and highly underutilized response action is to forcibly log a user out of the application. This type of response action is ideal for postauthentication attack scenarios where malicious transactions are identified, such as suspected session hijacking attacks. Implementing a forced application logout makes the application SessionID invalid, and the attacker must reinitiate his attack to obtain a new SessionID from a victim.

The ModSecurity exec action allows you to externally execute any local script that you would like when a rule matches. With this ability, you can rather easily fire off a curl command from the local web server to spoof an application logoff request.

Profiling Application Logins/Logouts

To use an external curl request, you must first profile what an actual application logout request looks like. This is easy enough to do if you have the proper ModSecurity audit logging enabled. For demonstration purposes, we will use the WordPress application. When a user successfully logs into WordPress, she receives a response similar to the following:

HTTP/1.1 200 OK Date: Wed, 05 Sep 2012 19:40:06 GMT Server: Microsoft-IIS/7.0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Wed, 05 Sep 2012 19:40:07 GMT Cache-Control: no-cache, must-revalidate, max-age=0 ...