Comments on: CORE GRASP - PHP Web Application Protection Software

By: Ofer Shezaf

Ofer Shezaf — Thu, 15 Nov 2007 03:22:09 +0000

@fazed: while I would be the 1st to tell you that no security solution, including a WAF is perfect, I think that your example is not relevant.

First, if this is the risk you forecast in your application, you can easily write a rule to prevent it - just detect base64 (detecting long strings without spaces would do the work). Saying that, avoiding use of HTTP as a hidden channel between two points controlled by the bad guys is very very difficult.

The strength of ModSecurity is that it can do whatever you want it to. The Core Rule Set, which is one example of such a use, does provide a pretty good solution for the problems it tries to address within its design limitations, namely: minimum false positives and minimal configuration.

By: Ofer Shezaf

Ofer Shezaf — Thu, 15 Nov 2007 03:15:07 +0000

@dre: Fortify hooks to the application. SecureSphere does not.

By: CORE GRASP para PHP at Share the information

CORE GRASP para PHP at Share the information — Wed, 07 Nov 2007 14:14:31 +0000

[...] Fuente: Darknet [...]

By: dre

dre — Wed, 31 Oct 2007 06:18:59 +0000

@fazed: hence why i was recommending fortifysoftware defender or imperva securesphere over mod_security - they go a little further by hooking into your application.

of course, no WAF will ever stop many complex business logic flaws, session management issues - e.g. CSRF

By: dre

dre — Wed, 31 Oct 2007 06:17:00 +0000

@fak3r: read the last link i provided to "web security gateway" or just go to the mod_security website. there's also tons of other resources such as http://www.apachesecurity.net, this PDF on APIDS with ModSecurity by Ivan Ristic. Ryan Barnett also wrote a great book that covered mod_security well, Preventing Web Attacks with Apache, which included some custom mod_security rules as well as linked to the now popular gotroot rulset.

By: fazed

fazed — Tue, 30 Oct 2007 17:23:53 +0000

@Ofer Shezaf
mod_security is actually very poor
at security a system, although alot
of sys admins rely on it there are many
bypass’s to get around its restrictions.
for example an attacker could base64 encode
their GET vars and pass them to a script he
has placed on the server which decodes it
and mod_security does not detect it.
it does mean that the attacker must
first have that file on the webserver
some how but after this the rest is
easy to bypass (such as base path restrictions)

By: fak3r

fak3r — Mon, 29 Oct 2007 21:08:55 +0000

@Dre
Thanks for the advice, I’ve moved to Lighty from Apache 2.x on Debian recently, and I run Varnish for a reverse proxy/http accelerator. Can you tell me how you’d run mod_security in this setup? Would Varnish intercept php requests and run them through mod_sec or would Lighty use it directly? If it’s easier and you want to help more my email is my username at my username dot com

Thanks!

fak3r.

By: dre

dre — Fri, 26 Oct 2007 21:25:20 +0000

@fak3r: there are multiple ways of running mod_security - the only way it wouldn’t work with lighttpd is the apache loaded module that only works with a local installation of apache.

probably the most common way deployed in your scenario (without apache) is in reverse-proxy mode

By: fak3r

fak3r — Fri, 26 Oct 2007 01:12:07 +0000

@Ofer Shezaf
As to your performance issues: what rules are you using for ModSecurity? the popular gotroot rules are way to big an inefficient, but on the other hand offer you alot the GRASP does not do provide you, such as blacklists.

You must have been watching over my shoulder, this is exactly the problem. I will try again with the core rules only next.

So, is there any way to get mod_security to work with Lighttpd?

Thanks Ofer!

By: Sandeep Nain

Sandeep Nain — Fri, 26 Oct 2007 00:24:13 +0000

I must say that modSecurity is the best WAF i have come across so far and that is because of the flexibility and powerful realtime traffic monitoring and analysis it provides.

it will also give excellent results on big commercial web applications if implemented correctly and not just everyday websites.