0

I am testing web application firewall and I have installed ModSecurity 2.9 runs Core ModSecurity Rule Set ver.2.2.9 and to test on Web application I also install DVWA Platform: Windows and trying to do Command Inject and it allows even if I included rules for command inject modsecurity_crs_40_generic_attacks.conf all other rules for SQLinject,XSS etc works fine . Command Injection in windows

the Rule for Command Inject is as follows

 SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)(?:;|\{|\||\|\||&|&&|\n|\r|`)\s*[\(,@\'\"\s]*(?:[\w'\"\./]+/|[\\\\'\"\^]*\w[\\\\'\"\^]*:.*\\\\|[\^\.\w '\"/\\\\]*\\\\)?[\"\^]*(?:\.[\"\^]*\w+)?\b" \
        "phase:2,rev:'2',ver:'OWASP_CRS/2.2.9',maturity:'9',accuracy:'8',capture,t:none,t:normalisePath,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'950907',tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%{tx.0},skipAfter:END_COMMAND_INJECTION1"

SecMarker END_COMMAND_INJECTION1
I want to know what can be done so that if I inject a command 127.0.0.1 & shutdown /l or anything after "&" in textbox the ModSecurity must redirect to 403 error page . I have read similar post and solutions if I try my apache server will crash .
0

Your rule set (2.2.9) is "bit" old, you should use a newer version (actually 3.3).

I don't understand your question exactly "what can be done if I inject...".

As you can see, the operator is the @rx, and it has an argument. The list of variables contains the ARGS, so I guess your form contains an input field, what will evaluated as an argument (member of ARGS). Here I tried to demonstrate how this rule checks your request.

If your rule doesn't triggered, then it means the comparison (your input field with the operator argument) doesn't match, or the engine isn't turned on.

So, please check your SecRuleEngine setting, it must be on On.

My 2 cents: may be the rule misses the t:urlDecode transformation, because if you sent the character &, I assume your browser will send it as encoded form.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.