OWASP ModSec CRS Paranoia Mode Sibling 981173 - Revision history

Zino: /* 981173 : SQL Injection Character Anomaly Usage */

2016-03-15T06:44:34Z

‎981173 : SQL Injection Character Anomaly Usage

Zino: /* 981173 : SQL Injection Character Anomaly Usage */

2016-03-10T07:24:02Z

‎981173 : SQL Injection Character Anomaly Usage

Dune73 at 07:17, 8 March 2016

2016-03-08T07:17:58Z

Zino: additional Rule ID information added to table

2016-03-01T19:47:18Z

additional Rule ID information added to table

Zino: /* 981173 : SQL Injection Character Anomaly Usage */

2016-03-01T19:44:56Z

‎981173 : SQL Injection Character Anomaly Usage

Zino at 08:44, 10 February 2016

2016-02-10T08:44:02Z

Zino: /* 981173 : SQL Injection Character Anomaly Usage */ - table added for clearness

2016-02-10T08:05:52Z

‎981173 : SQL Injection Character Anomaly Usage: - table added for clearness

Zino at 05:33, 10 February 2016

2016-02-10T05:33:23Z

Zino: Created page with "==== 981173 : SQL Injection Character Anomaly Usage ==== Original ID (2.2.X): 981173
Change: Regex counter decreased to '1', anomaly score set to 'critical', paranoia tag..."

2016-02-10T05:25:15Z

Created page with "==== 981173 : SQL Injection Character Anomaly Usage ==== Original ID (2.2.X): 981173<br> Change: Regex counter decreased to '1', anomaly score set to 'critical', paranoia tag..."

New page

==== 981173 : SQL Injection Character Anomaly Usage ====

Original ID (2.2.X): 981173<br>
Change: Regex counter decreased to '1', anomaly score set to 'critical', paranoia tag added<br>
FP Filter: UUIDs<br>

#
# -=[ SQL Injection Character Anomaly Usage ]=-
#
# This is a paranoid sibling to 2.2.9 Rule 981173.
# The regex limit is set to {1,}, adjust to your own needs.
# For dealing with false positives caused by uuids, the rule is now chained.
# Also the anomaly score is now set to critical.
#
SecRule ARGS_NAMES|ARGS|XML:/* "([\~\!\@\#\$\%\^\&\*\-\+\=\{\}\[\]\|\:\;\"\'\´\’\‘\`\<\>].*?){1,}"\
"chain,\
phase:request,\
rev:'2',\
ver:'OWASP_CRS/3.0.0',\
maturity:'X',\
accuracy:'Y',\
t:none,t:urlDecodeUni,\
block,\
msg:'Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded',\
id:'XXXXXX',\
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
tag:'Paranoia rule on level 40',\
logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
severity:'CRITICAL',\
setvar:'tx.msg=%{rule.msg}',\
setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RESTRICTED_SQLI_CHARS-%{matched_var_name}=%{tx.0}"
SecRule MATCHED_VARS "!@rx ^[a-f0-9-]{36}$"\
"t:lowercase,\
setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
setvar:tx.sql_injection_score=+1"

@@ Line 11: / Line 11: @@
 |-
   | 981173
-  | tbd
+  | 942430
-  | tbd
+  | 942431-942434
   | Regex counter decreased from 4 to 1.<br>Anomaly scoring increased to critical.
   | Regex for UUIDs in chained Rule

@@ Line 11: / Line 11: @@
 |-
   | 981173
   | tbd
-  | Regex counter decreased from 4 to 1.<br>Anomaly scoring increased to critical
+ | tbd
   | Regex for UUIDs in chained Rule
 |}
@@ Line 23: / Line 23: @@
    # The regex limit is set to '1' and the anomaly scoring is increased to 'critical'.
    # For dealing with false positives, UUID format is whitelisted with a chained rule.
+   #
    SecRule ARGS_NAMES|ARGS|XML:/* "([\~\!\@\#\$\%\^\&\*\(\)\-\+\=\{\}\[\]\|\:\;\"\'\´\’\‘\`\<\>].*?){1,}"\

← Older revision		Revision as of 07:17, 8 March 2016
Line 45:		Line 45:
	setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\		setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
	setvar:tx.sql_injection_score=+1"		setvar:tx.sql_injection_score=+1"
		+
		+	[[Category:OWASP ModSecurity Core Rule Set Project]]

@@ Line 5: / Line 5: @@
 {|- class="wikitable"
   | '''RuleID 2.2.x'''
-  | '''RuleID 3.0.0-rc1'''
+  | '''RuleID 3.0.0-rc1 (original Rule)'''
   | '''Change'''
   | '''Whitelisting'''
@@ Line 11: / Line 12: @@
   | 981173
   | none
   | Regex counter decreased from 4 to 1.<br>Anomaly scoring increased to critical
   | Regex for UUIDs in chained Rule

@@ Line 4: / Line 4: @@
 {|- class="wikitable"
-  | '''Original ID (2.2.x)'''
+  | '''RuleID 2.2.x'''
   | '''Change'''
   | '''Whitelisting'''
 |-
   | 981173
-  | Regex counter decreased from 4 to 1.<br>Anomaly scoring increased to critical.
+ | none
-  | Regex for UUIDs in chained Rule.
+  | Regex counter decreased from 4 to 1.<br>Anomaly scoring increased to critical
 |}
@@ Line 16: / Line 18: @@
    # -=[ SQL Injection Character Anomaly Usage ]=-
+   #
-   # This is a paranoid sibling to 2.2.9 Rule 981173.
+   # This is a paranoid sibling to 2.2.x Rule 981173.
    # The regex limit is set to '1' and the anomaly scoring is increased to 'critical'.
    # For dealing with false positives, UUID format is whitelisted with a chained rule.

@@ Line 1: / Line 1: @@
 ''This page contains a proposal for a stricter rule-clone for [[OWASP_ModSec_CRS_Paranoia_Mode|ModSecurity CRS Paranoia Mode]].''
 == 981173 : SQL Injection Character Anomaly Usage ==
@@ Line 31: / Line 32: @@
          id:'XXXXXX',\
          tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
-         tag:'Paranoia rule on level 40',\
+         tag:'Paranoia rule on level Z',\
          logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
          severity:'CRITICAL',\

← Older revision		Revision as of 05:33, 10 February 2016
Line 1:		Line 1:
		+	''This page contains a proposal for a stricter rule-clone for [[OWASP_ModSec_CRS_Paranoia_Mode\|ModSecurity CRS Paranoia Mode]].''
	==== 981173 : SQL Injection Character Anomaly Usage ====		==== 981173 : SQL Injection Character Anomaly Usage ====

OWASP ModSec CRS Paranoia Mode Sibling 981173 - Revision history

Zino: /* 981173 : SQL Injection Character Anomaly Usage */

Zino: /* 981173 : SQL Injection Character Anomaly Usage */

Dune73 at 07:17, 8 March 2016

Zino: additional Rule ID information added to table

Zino: /* 981173 : SQL Injection Character Anomaly Usage */

Zino at 08:44, 10 February 2016

Zino: /* 981173 : SQL Injection Character Anomaly Usage */ - table added for clearness

Zino at 05:33, 10 February 2016

Zino: Created page with "==== 981173 : SQL Injection Character Anomaly Usage ==== Original ID (2.2.X): 981173 Change: Regex counter decreased to '1', anomaly score set to 'critical', paranoia tag..."

Zino: Created page with "==== 981173 : SQL Injection Character Anomaly Usage ==== Original ID (2.2.X): 981173
Change: Regex counter decreased to '1', anomaly score set to 'critical', paranoia tag..."