Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post

Example allow


Example block


Test rule that is not working

SecRule ARGS_NAMES "^(#.*)$" "phase:1,id:199,log,deny,msg:'Block Argname with hash'"

These rules seems to work on 2.8

SecRule ARGS_GET_NAMES "^(#.*)$" "id:193,log,deny,msg:'Block ARGS Name with hash GET'"

SecRule ARGS_POST_NAMES "^(#.*)$" "id:192,log,deny,msg:'Block ARGS Name with hash POST',logdata:'%{tx.httpbl_msg}',setvar:tx.httpbl_msg=$"

SecRule REQUEST_COOKIES_NAMES "^(#.*)$" "id:194,log,deny,msg:'Block ARGS Name with hash COOKIE'"

But better solution https://twitter.com/CoreRuleSet

SecRule ARGS_NAMES|REQUEST_COOKIES_NAMES "@beginswith #" "id:123,phase:2,block,msg:'SA-CORE-2018-002'"

ModSecurity rules in phase 1 will work only with GET args as POST args are not available until phase 2, cookies are available since phase 1.

BIG WARNING: phase 1 rules inside location blocks in Apache are silently discarded as locations are not available until phase 2 so anything phase 1 is ignored, to avoid mistakes/issues may be better to stick to phase 2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.