SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

Question

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks).

I want to use ModSecurity WAF to protect this web application from SQL Injection attacks. I am using Apache web server to host my web application. The operating system of this ‘victim’ virtual machine is Windows XP SP3.

I know ModSecurity provides very little protection on its own. So I decided to use OWASP ModSecurity Core Rule Set Project to include additional SQL Injection rules.

I copied ‘SQL Injection Attacks rules’ provided in the ‘base_rules’ folder of the OWASP Core Rule Set to the appropriate config file, and made sure these rules were loaded together with ModSecurity itself.

I performed manual SQL Injection attacks on the DVWA from my other virtual machine that had Kali Linux installed. For example:

%’ or 1=0 union select null, concat (first_name, 0x0a, last_name, 0x0a, user, 0x0a, password) from users #

When SQL Injection Core Rule Set was disabled, the following information would be displayed:

However, when these rules were enabled, the server would always return ‘Error 403 – Access forbidden’ meaning that these SQL Injection rules were working correctly.

I then decided to use sqlmap to perform more advanced SQL Injection attacks. I had to hijack the session by using burp suite in order to obtain cookie information. I copied all that information to a .txt file on Kali Linux Virtual machine:

I hid the IP and cookie information.

This is the command that I entered in my Kali Linux virtual machine terminal:

Sqlmap managed to bypass the OWASP ModSecurity SQL Injection rules and displayed the following information:

I really don’t understand why it managed to bypass these rules. Any ideas?

I used the following tutorial to configure ModSecurity on my virtual machine:

http://mewbies.com/how_to_install_mod_security_for_apache_tutorial.htm

Maybe I should have included some additional OWASP Rule sets to prevent sqlmap attack?

Thank you

Answer 1

I've managed to make ModSecurity detect and prevent SQL Injection! The problem was with the SqlMap itself and not the OWASP Rule Sets.

Before enabling ModSecurity I performed a normal sqlmap scan using the command mentioned previously. SqlMap managed to obtain and decrypt user and password values. I was expecting that to happen because I had no WAF enabled.

The next step was to enable the WAF and SQLI rule sets and perform the same scan. SqlMap still managed to get user and password values. The reason for that is because it obtained the cached results that were saved after I had performed my first SqlMap scan with no WAF enabled.

I deleted the whole sqlmap output folder related to that specific IP address where the DVWA was hosted.

rm -rvf /usr/share/sqlmap/output/192.168.220.128*

The final step was to run the sqlmap scan again, and this is what I got:

Answer 2

Just for the future and others having similar problems. If you are not sure if and which requests sqlmap sent you can set the output verbosity (-v) to a higher number.

E.g. by setting it to 4 and adding the following to your payload:
-v 4

sqlmap will show http requests and payloads in the console. Equipped with these you will be able to re-run the requests yourself or spot any anomalies inserted b sqlmap.

See https://github.com/sqlmapproject/sqlmap/wiki/Usage#output-verbosity for further information.