0

I need to know what is "method enforcement" inside WAF Preconfigured ModSecurity rules.

How to test this attack on magento website? What is security best practice to prevent this?

2 Answers 2

2

What is Method Enforcement

Method enforcement" is about allowing only specific HTTP methods when accessing a web application. You need to define the allowed methods in tx.allowed_methods. It is used in this rule and for example described in Web application firewall: Modsecurity and Core Rule Set in section "Defining the allowed HTTP methods".

How to test this attack ...

Just restrict which HTTP methods can be used as described in above documentation. Then try to use a HTTP method not allowed against the protected system, like with curl -X "TRACE" ... if TRACE method should not be allowed. You should get an error back and the problem should show up in the logs of the WAF. See also ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET of what to expect.

1

I think a good start is to review CRS's regression test cases, especially in this case the tests against the mentioned subset, here. You should look the tests with log_contains field (not with no_log_contains, which are so called negative tests), eg. this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .