ip-fragmentation and mod_security?

Question

is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security?

the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.

Answer 1

AviD was on the right track with the idea of taking IP frag attack concepts for evading network level IDS and applying it to layer 7 http data. If you wanted to split up say an SQLi payload so that it may evade input filters and still work against the back-end system, the attack technique is called "HTTP Parameter Pollution (HPP)". HPP is an attack where the user sends a request where multiple parameters have the same name. In these cases, there is a wide level of variance in how the apps will respond. Will they take the first payload? The last? In the case of ASP/ASP.NET sites, they actually will concatenate all payloads with the same name. This allows for a "fragmentation" type of attack. See my previous blog post on the topic - http://tacticalwebappsec.blogspot.com/2009/05/http-parameter-pollution.html

and here

http://tacticalwebappsec.blogspot.com/search?q=parameter+pollution

Also of note - the current version of the OWASP ModSecurity Core Rule Set (CRS) has an experimental ruleset for HPP which will mimic ASP and concatenate any params with the same names into custom TX variables for inspection by later rules -

http://mod-security.svn.sourceforge.net/viewvc/mod-security/crs/trunk/experimental_rules/modsecurity_crs_40_http_parameter_pollution.conf

Cheers, Ryan

Answer 2

To the best of my knowledge, IP fragments are reconstructed before they're handed off to mod_security.
Essentially mod_security is simply a plugin to the webserver, and does not handle any IP stuff on it's own. What it receives is always just a complete HTTP request.

As such, the simple answer would be "No".

However.
If you take your evasion concept (split attack between different packets) and raise this to the application level, there may be room to play there.
E.g. is it possible to run the attack using 2 HTTP requests? That is a very application-specific issue, and would not be trivial at all.

More trivially, however, what about HTTP Range requests?
I'm sorry to say I do not know the answer here, if mod_security knows how to block them.
Most other WAFs do, however, and those that don't have been thoroughly chewed out...