1 of 13

Week 8: �Apache Mod_Security

SEC 260

2 of 13

Apache and Modules

  • Remember – Apache uses Modules to provide configuration options and specialized services to the web server

​

  • For example: when we configured TLS (HTTPS), we used mod_ssl

​

  • Modules are loaded based on include statements in the httpd.conf file
  • Modules have their own config files to set parameters (e.g. ssl.conf)

3 of 13

Mod_Security

  • Open Source – Web Application Firewall

​

  • Basically – monitors web requests and responses looking for malicious patterns

​

  • Uses regular expressions to match those patterns

​

  • Can block requests or responses if pattern is found

​

​

4 of 13

Mod_Security

  • ModSecurity is a web application layer firewall.
    • It is free software released under the Apache license
  • It is a set of rules with regular expressions that helps to instantly ex-filtrate the commonly known exploits.
  • ModSecurity obstructs the processing of invalid data (code injection attacks)
  • To detect threats, the ModSecurity engine scans all the requests and relative responses
  • If the HTTP request is valid it is, then passed to the website content.
  • Invalid requests are blocked

5 of 13

Mod_Security - Configuration

Relatively easy to set-up:

  1. Install Mod_Security module (yum, apt-get…)

​

  • Ensure module is loaded

​

  • Download the security rules you want to use
    • Basic rules are call the Core RuleSet (or CRS)

​

  • Tune as needed for your application
    • Enable/disable certain rules
    • Create custom rules

6 of 13

Mod_Security: Core Rules

In order to provide protection to generic web applications, the Core Rules use the following techniques:

  • HTTP Protection – detects violations of the HTTP protocol and a locally defined usage policy
  • Real-time Blacklist Lookups – utilizes 3rd Party IP Reputation
  • Web-based Malware Detection – identifies malicious web content by check against the Google Safe Browsing API.
  • HTTP Denial of Service Protections – defends against HTTP Flooding and Slow HTTP DoS Attacks.
  • Common Web Attacks Protection – detects common web application attacks

​

7 of 13

Mod_Security: Core Rules (cont…)

Techniques:

  • Automation Detection – Detects bots, crawlers, scanners and other recognizable malicious activity
  • Integration with AV Scanning for File Uploads – detects malicious files uploaded through the web application.
  • Tracking Sensitive Data – Tracks Credit Card usage and blocks leakages.
  • Trojan Protection – Detects access to Trojans horses.
  • Identification of Application Defects – alerts on application misconfigurations.
  • Error Detection and Hiding – Disguises error messages sent by the server.

​

8 of 13

Introducing Basic Web Attacks: Directory Traversal

Directory traversal aims to access files and directories that are stored outside the web root folder.

​

Attackers could access arbitrary files stored on file system including application source code and/or critical system files

​

  • By manipulating URLs with “dot-dot-slash (../)” sequences and its variations
  • Using absolute file paths

9 of 13

Directory Traversal: Percent Encoding

Percent-encoding is a mechanism to encode 8-bit characters that have specific meaning in the context of URLs.

  • It is sometimes called URL encoding.
  • The encoding consists of substitution: A '%' followed by the hexadecimal representation of the ASCII value of the replace character
  • Special characters needing encoding are:

 ':', '/', '?', '#', '[', ']', '@', '!', '$', '&', "'", '(', ')', '*', '+', ',', ';', '=', as well as '%' itself.

10 of 13

Directory Traversal Encoding

Request variations

  • Encoding and double encoding:
  • %2e%2e%2f represents ../
  • %2e%2e/ represents ../
  • ..%2f represents ../
  • %2e%2e%5c represents ..\
  • %2e%2e\ represents ..\
  • ..%5c represents ..\
  • %252e%252e%255c represents ..\
  • ..%255c represents ..\

11 of 13

Directory Traversal and Mod_Security

  • Found in the ”Tight-Control” rules file

12 of 13

Mod_Evasive

  • Apache Module to help protect server against Denial-of-Service events

​

  • Can block IP’s that are maliciously attacking server to tie up resources

​

  • Can block IP’s that may accidentally connecting and tying up resources

13 of 13

Mod_Evasive (cont…)

  • mod_evasive can report malicious activity via email and syslog. �
  • The mod_evasive module works by creating an internal dynamic hash table of IP addresses and URIs�
  • And denies any single IP address for any of the following conditions:
    • Requesting the same page more than a few times per second

​

    • Making more than 50 concurrent requests on the same child per second

​

    • Making any requests while temporarily blacklisted (on a blocking list)

​