is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security?
the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
To the best of my knowledge, IP fragments are reconstructed before they're handed off to mod_security.
As such, the simple answer would be "No".
More trivially, however, what about HTTP Range requests?
AviD was on the right track with the idea of taking IP frag attack concepts for evading network level IDS and applying it to layer 7 http data. If you wanted to split up say an SQLi payload so that it may evade input filters and still work against the back-end system, the attack technique is called "HTTP Parameter Pollution (HPP)". HPP is an attack where the user sends a request where multiple parameters have the same name. In these cases, there is a wide level of variance in how the apps will respond. Will they take the first payload? The last? In the case of ASP/ASP.NET sites, they actually will concatenate all payloads with the same name. This allows for a "fragmentation" type of attack. See my previous blog post on the topic - http://tacticalwebappsec.blogspot.com/2009/05/http-parameter-pollution.html
Also of note - the current version of the OWASP ModSecurity Core Rule Set (CRS) has an experimental ruleset for HPP which will mimic ASP and concatenate any params with the same names into custom TX variables for inspection by later rules -
|show 2 more comments|