Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent string:

a-zA-Z0-9,.:;?/ ~!@()+_-

Is the above useful and effective? Also, does anyone have a list of acceptable characters for referrer, cookie, request URI and query string?

  • You can lookup the production rules for the mentioned HTTP header field values in the corresponding RFC 7230 and RFC 7231. – Gumbo Feb 21 '15 at 9:49
  • 4
    Rather than rolling your own, consider whether a WAF such as mod_security would help you. – gowenfawr Feb 21 '15 at 14:07

This really isn't useful or effective, it only specifically protects against shellshock (and with the amount of publicity it received I am fairly confident that a similar attack will not happen again. )

I should also point out that your whitelist would not actually protect a system which is effected by shellshock either.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.