I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks).

I want to use ModSecurity WAF to protect this web application from SQL Injection attacks. I am using Apache web server to host my web application. The operating system of this ‘victim’ virtual machine is Windows XP SP3.

I know ModSecurity provides very little protection on its own. So I decided to use OWASP ModSecurity Core Rule Set Project to include additional SQL Injection rules.

I copied ‘SQL Injection Attacks rules’ provided in the ‘base_rules’ folder of the OWASP Core Rule Set to the appropriate config file, and made sure these rules were loaded together with ModSecurity itself.

I performed manual SQL Injection attacks on the DVWA from my other virtual machine that had Kali Linux installed. For example:

%’ or 1=0 union select null, concat (first_name, 0x0a, last_name, 0x0a, user, 0x0a, password) from users #

When SQL Injection Core Rule Set was disabled, the following information would be displayed:

enter image description here

However, when these rules were enabled, the server would always return ‘Error 403 – Access forbidden’ meaning that these SQL Injection rules were working correctly.

I then decided to use sqlmap to perform more advanced SQL Injection attacks. I had to hijack the session by using burp suite in order to obtain cookie information. I copied all that information to a .txt file on Kali Linux Virtual machine:

enter image description here

I hid the IP and cookie information.

This is the command that I entered in my Kali Linux virtual machine terminal:

enter image description here

Sqlmap managed to bypass the OWASP ModSecurity SQL Injection rules and displayed the following information:

enter image description here

I really don’t understand why it managed to bypass these rules. Any ideas?

I used the following tutorial to configure ModSecurity on my virtual machine:


Maybe I should have included some additional OWASP Rule sets to prevent sqlmap attack?

Thank you

  • There you see it: Don’t trust in WAFs, they are ineffective.
    – Gumbo
    Mar 18, 2014 at 6:54
  • What's the point of hiding a private IP and a private session ID?
    – user15194
    Mar 18, 2014 at 10:09
  • @yzT, I really don't know why I did that, sorry. I posted this question at 5 am, so maybe that's why ;)
    – Alex
    Mar 18, 2014 at 12:49
  • ;) Have you thought that maybe sqlmap bypasses the WAF because it's obfuscating the payload? Can you bypass it manual encoding the URL as well?
    – user15194
    Mar 18, 2014 at 12:52
  • 1
    I thought it can only obfuscate the payload if you add the '--tamper' flag to it. for example: '--tamper='tamper/randomcase.py, tamper/charencode.py'. This is mentioned in a paper called 'Using Web Application Firewall to detect and block common web application attacks' that discusses how to use ModSecurity and how to prevent sqlmap attacks by including additional rules. They used the following rule: SecRule ARGS "(union|xor|rlike|--|#|union all|;|'|drop|delete|having|1=1|admin|select|and)" "msg: 'SQL Injection'". However, I can't even load Apache with this rule included.
    – Alex
    Mar 18, 2014 at 13:03

2 Answers 2


I've managed to make ModSecurity detect and prevent SQL Injection! The problem was with the SqlMap itself and not the OWASP Rule Sets.

Before enabling ModSecurity I performed a normal sqlmap scan using the command mentioned previously. SqlMap managed to obtain and decrypt user and password values. I was expecting that to happen because I had no WAF enabled.

The next step was to enable the WAF and SQLI rule sets and perform the same scan. SqlMap still managed to get user and password values. The reason for that is because it obtained the cached results that were saved after I had performed my first SqlMap scan with no WAF enabled.

I deleted the whole sqlmap output folder related to that specific IP address where the DVWA was hosted.

rm -rvf /usr/share/sqlmap/output/*

The final step was to run the sqlmap scan again, and this is what I got:

enter image description here


Just for the future and others having similar problems. If you are not sure if and which requests sqlmap sent you can set the output verbosity (-v) to a higher number.

E.g. by setting it to 4 and adding the following to your payload:
-v 4

sqlmap will show http requests and payloads in the console. Equipped with these you will be able to re-run the requests yourself or spot any anomalies inserted b sqlmap.

See https://github.com/sqlmapproject/sqlmap/wiki/Usage#output-verbosity for further information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .