0

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post

Example allow

name=Joe

Example block

#name=Joe

Test rule that is not working

SecRule ARGS_NAMES "^(#.*)$" "phase:1,id:199,log,deny,msg:'Block Argname with hash'"

2 Answers 2

0

These rules seems to work on 2.8

SecRule ARGS_GET_NAMES "^(#.*)$" "id:193,log,deny,msg:'Block ARGS Name with hash GET'"


SecRule ARGS_POST_NAMES "^(#.*)$" "id:192,log,deny,msg:'Block ARGS Name with hash POST',logdata:'%{tx.httpbl_msg}',setvar:tx.httpbl_msg=$"


SecRule REQUEST_COOKIES_NAMES "^(#.*)$" "id:194,log,deny,msg:'Block ARGS Name with hash COOKIE'"

But better solution https://twitter.com/CoreRuleSet

SecRule ARGS_NAMES|REQUEST_COOKIES_NAMES "@beginswith #" "id:123,phase:2,block,msg:'SA-CORE-2018-002'"
0

ModSecurity rules in phase 1 will work only with GET args as POST args are not available until phase 2, cookies are available since phase 1.

BIG WARNING: phase 1 rules inside location blocks in Apache are silently discarded as locations are not available until phase 2 so anything phase 1 is ignored, to avoid mistakes/issues may be better to stick to phase 2.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .