I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my access/error logs?
An other approach could be to extract regexes from ModSecurity but I struggle to find a way to do that.
I don't think this will be possible, and even if you find a way to do it, it won't represent the real world correctly. Many mod_security rules rely on a variety of data, including various headers in HTTP requests, as well as HTTP request body data. Much of this data (most notably the body of requests) is not generally logged (at least in default configurations), so even if you could feed the logs back in, mod_security would not be able to evaluate the full request.
You can check only the URI's for malicious payloads like path traversal, RCI, LFI, XSS, SSRF, CSRF, etc by simply sending them into a new request in a local server with OWASP CRS loaded.
Let's say you have an Apache server listening to localhost and CRS enabled and listening to ModSecLivesHere location you may simply send all your access log field 6 (URL) to that address and catch 403 responses.
for i in $(cat access.log |awk '{print $6}'); do
curl http://127.0.0.1/ModSecLivesHere/${i}
done
This is assuming that the location will always respond with a 200 OK except if ModSecurity intercepts the request in which case it will reply a 403 Forbidden
RewriteEngine On
RewriteRule .* - [R=200,L]
The best way if you have a big beefy storage attached is to use the audit log and store all requests and responses (kind of FPC with decrypted payloads) not only the RelevantOnly transactions so then you can do a full traffic playback check bitsensor.io they have some cools stuff.
With the auditlog you can do checks on the entire request not only the URI as you would with the access log, the error log is full of stuff not related with only the requests so you have to filter it first and then do something similar to what I suggested.
