is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security?

the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.


2 Answers 2


AviD was on the right track with the idea of taking IP frag attack concepts for evading network level IDS and applying it to layer 7 http data. If you wanted to split up say an SQLi payload so that it may evade input filters and still work against the back-end system, the attack technique is called "HTTP Parameter Pollution (HPP)". HPP is an attack where the user sends a request where multiple parameters have the same name. In these cases, there is a wide level of variance in how the apps will respond. Will they take the first payload? The last? In the case of ASP/ASP.NET sites, they actually will concatenate all payloads with the same name. This allows for a "fragmentation" type of attack. See my previous blog post on the topic - http://tacticalwebappsec.blogspot.com/2009/05/http-parameter-pollution.html

and here


Also of note - the current version of the OWASP ModSecurity Core Rule Set (CRS) has an experimental ruleset for HPP which will mimic ASP and concatenate any params with the same names into custom TX variables for inspection by later rules -


Cheers, Ryan

  • Thanks, @Ryan! And as long as you're on the line here :), what about range requests? Does modsecurity properly handle these, and apply rules correctly? How - aggregating, dropping, other?
    – AviD
    May 4, 2011 at 13:04
  • Can you give more info as to your Range request issue? You mean a request that includes a Range request header? May 4, 2011 at 13:23
  • @Ryan yes, I mean a request that includes Range headers. As you know, this can cause "special" behavior, where the exploit would not appear all at once, but split in two. This could allow an attacker to evade some types of WAF rules, unless explicitly handled for by the WAF. An issue that has buggered some of the other WAF products in the past...
    – AviD
    May 4, 2011 at 13:41
  • Hmm, not sure I see how this would be problem for any WAF. The requests are treated as stand alone so rules would be applied to each of them. If there is a range header - that is just asking for specific portions of the response payload. The inbound Range requests aren't "reassembled" server-side like the concept of ip fragmentation. The idea with Range is that, with HTTP v1.1 pipelining, the response bodies can be send asynchronously and then the client is responsible for putting them back together in the right sequence. The server is treating each Range request as stand alone. May 4, 2011 at 14:16
  • Right, and modsecurity treats each response as standalone too. I guess this problem would only be relevant if you have rules that apply to your response - but if so, it would be possible to evade any of those rules, unless range headers are accounted for.
    – AviD
    May 4, 2011 at 15:07

To the best of my knowledge, IP fragments are reconstructed before they're handed off to mod_security.
Essentially mod_security is simply a plugin to the webserver, and does not handle any IP stuff on it's own. What it receives is always just a complete HTTP request.

As such, the simple answer would be "No".

If you take your evasion concept (split attack between different packets) and raise this to the application level, there may be room to play there.
E.g. is it possible to run the attack using 2 HTTP requests? That is a very application-specific issue, and would not be trivial at all.

More trivially, however, what about HTTP Range requests?
I'm sorry to say I do not know the answer here, if mod_security knows how to block them.
Most other WAFs do, however, and those that don't have been thoroughly chewed out...

  • i was thinking about the standalone version not the module. but i guess its preassembled there too. cant find anything on google
    – baj
    May 4, 2011 at 1:44
  • I didnt know modsecurity comes as a standalone... Are you referring to the OWASP package, or something else? Got link?
    – AviD
    May 4, 2011 at 6:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .