2

Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent string:

a-zA-Z0-9,.:;?/ ~!@()+_-

Is the above useful and effective? Also, does anyone have a list of acceptable characters for referrer, cookie, request URI and query string?

Improve this question
2
  • You can lookup the production rules for the mentioned HTTP header field values in the corresponding RFC 7230 and RFC 7231.
    – Gumbo
    Commented Feb 21, 2015 at 9:49
  • 4
    Rather than rolling your own, consider whether a WAF such as mod_security would help you.
    – gowenfawr
    Commented Feb 21, 2015 at 14:07

1 Answer 1

Reset to default
1

This really isn't useful or effective, it only specifically protects against shellshock (and with the amount of publicity it received I am fairly confident that a similar attack will not happen again. )

I should also point out that your whitelist would not actually protect a system which is effected by shellshock either.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .