0

The Apache web server is logging X-Forwarded-For environment variable as expected, but I have an Owasp rule where I'm trying to log this environment variable value too but without luck so far.

Here's my rule:

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "(?i:(?:select \* from|select\*from|load_file|sleep\())" "phase:2,capture,t:none,t:urlDecodeUni,block,deny,status:510,msg:'IP: %{REMOTE_ADDR} %{X-Forwarded-For} SQL injection and other data/structure manipulation attempts',id:'9900002',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.id}-%{rule.msg}',setvar:tx.sql_injection_score=+1,setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:'tx.%{tx.msg}-WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"

Is it possible to log X-Forwarded-For environment variable? If it is possible, which is the correct syntax? because %{X-Forwarded-For} is not working.

1

You probably want this:

REQUEST_HEADERS:X-Forwarded-For

To me, it seems that X-Forwarded-For is not an environment variable, but a request header.

In some environments, each header is automatically converted to an environment variable, in the form HTTP_X_FORWARDED_FOR. However, it seems that in ModSecurity you can simply retrieve the request header.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.