Section 3: ModSecurity protecting WebGoat - Revision history

Stephen Evans: /* Testing ModSecurity rules - tips and tricks */ clean up

2008-10-29T10:16:04Z

‎Testing ModSecurity rules - tips and tricks: clean up

Stephen Evans: /* Doing the WebGoat lessons - tips and tricks */ typo

2008-10-29T10:13:55Z

‎Doing the WebGoat lessons - tips and tricks: typo

Stephen Evans: OWASP ModSecurity Securing WebGoat Section 3 ModSecurity WebGoat at 50 percent moved to Section 3: ModSecurity protecting WebGoat: To align with TOC on main page

2008-10-27T09:59:42Z

OWASP ModSecurity Securing WebGoat Section 3 ModSecurity WebGoat at 50 percent moved to Section 3: ModSecurity protecting WebGoat: To align with TOC on main page

Stephen Evans: added Christians' contributions

2008-10-21T08:53:48Z

added Christians' contributions

Stephen Evans: /* Doing the WebGoat lessons - tips and tricks */

2008-10-21T04:13:53Z

‎Doing the WebGoat lessons - tips and tricks

Stephen Evans at 02:12, 20 October 2008

2008-10-20T02:12:18Z

Stephen Evans at 07:18, 24 July 2008

2008-07-24T07:18:31Z

Stephen Evans: /* Error pages */ add jpg

2008-07-24T07:09:34Z

‎Error pages: add jpg

Stephen Evans: add content

2008-07-24T07:05:56Z

add content

Stephen Evans at 06:48, 24 July 2008

2008-07-24T06:48:49Z

@@ Line 49: / Line 49: @@
 "I work with 4 shells on a single screen and I believe I get quite close to what you
-are looking for.
+are looking for:
-- 1 (top left): Apache config
+* 1 (top left): Apache config
-- 2 (bottom left): Apache commands (-> alias "apareload")
+* 2 (bottom left): Apache commands (-> alias "apareload")
-- 3 (bottom right): curl commands
+* 3 (bottom right): curl commands
-- 4 (top right): tail on the debug log (this can be filtered with tail -f ... | grep -v (...|...|...)
+* 4 (top right): tail on the debug log (this can be filtered with tail -f ... | grep -v (...|...|...)
 Alias apareload: That is a command alias to reload apache with the latest timestamp on the command line. This is very helpful when you play around with multiple apaches and configs. If you want to be really nifty, then you can script apareload into a while loop and whenever you press enter in that shell window, it reloads apache.
@@ Line 79: / Line 79: @@
+"
 - Christian Bockermann
 === Project organization ===

@@ Line 39: / Line 39: @@
 * Different browsers have their pluses and minuses:
-** Internet Eexplorer 7: The solutions were done with IE7 (or, at least, the screenshots in the solutions are of IE7) so use it if all else fails. But, to toggle IE7 to use a web proxy requires closing the browser and re-opening it.
+** Internet Explorer 7: The solutions were done with IE7 (or, at least, the screenshots in the solutions are of IE7) so use it if all else fails. But, to toggle IE7 to use a web proxy requires closing the browser and re-opening it.
 ** Firefox 2: The fewest mouse clicks are required to remove the WebGoat session cookies and clear the cache. Also, reconfiguring a web proxy is done on the fly and does not require restarting the browser. One sublesson, 3.8 Insecure Client Storage, uses Firebug - a Firefox extension - but the other browsers have similar browser plug-ins (e.g. Opera has Dragonfly as of version 9.5).
 ** Opera 9.26: The AJAX Security lessons seemed to work best with Opera.

@@ Line 29: / Line 29: @@
 * A text editor with line numbers: the ModSecurity debug file makes extensive references to line numbers with rulesets, so having a text editor with line numbers is essential for a debugging session. 'kate' was used on Kubuntu 7.10 and 'Notepad2' was used on WinXP.
 === Doing the WebGoat lessons - tips and tricks ===
@@ Line 44: / Line 43: @@
 ** Opera 9.26: The AJAX Security lessons seemed to work best with Opera.
 ** Keep in mind that when a browser is going through a web proxy and you want to block requests and/or responses, unwanted crap gets sent from the browser to the outside world (anything Google-related was the biggest culprit, with Yahoo coming in second) and interferes with the Web proxy session. So, you might want to have more than one browser open; either your browser of choice to use with the proxy, or your browser of choice to use for general surfing and research while you are using WebGoat.
 === Project organization ===

@@ Line 35: / Line 35: @@
 Here are some tips and tricks to consider while using the ModSecurity rules from this project with WebGoat:
-* WebGoat keeps track of the user's position within WebGoat on the back end out of the reach of ModSecurity. For instance, typing in the URL http://192.168.0.5/WebGoat/attack when the session ID (the JSESSIONID cookie) still exists will take the user directly to the position that they were previously. Since there is no 'menu' parameter in the URL, the ModSecurity rule for that lesson will not be invoked. It is necessary to explicitly choose the sublesson from the left side menu to invoke the ModSecurity rules for that lesson. To get WebGoat to forget the user's current position, erase the session cookie from within the browser and empty the cash (Firefox requires the fewest clicks to do this). In some scenarios, it is also necessary to intercept the HTTP request in a proxy and remove the Basic Authentication line (e.g 'Authorization: Basic Z3Vlc3Q6Z3Vlc3Q='), which will require the user to re-login.
+* WebGoat keeps track of the user's position within WebGoat on the back end out of the reach of ModSecurity. For instance, typing in the URL http://192.168.0.5/WebGoat/attack when the session ID (the JSESSIONID cookie) still exists will take the user directly to the position that they were previously. Since there is no 'menu' parameter in the URL, the ModSecurity rule for that lesson will not be invoked. It is necessary to explicitly choose the sublesson from the left side menu to invoke the ModSecurity rules for that lesson. To get WebGoat to forget the user's current position, erase the session cookie from within the browser and empty the cache (Firefox requires the fewest clicks to do this). In some scenarios, it is also necessary to intercept the HTTP request in a proxy and remove the Basic Authentication line (e.g 'Authorization: Basic Z3Vlc3Q6Z3Vlc3Q='), which will require the user to re-login.
 * Within lessons, there is no unique identifier to easily distinguish a sublesson or stage of a sublesson from the others. The best way is to determine uniqueness by parameter names (ARG_NAMES in ModSecurity lingo). But this can get tricky; for example, in one lesson, one key in one sublesson is 'Username' while in another sublesson the key is 'username'. However, it is technically possible to key on the sublesson name in the web page banner, but the trade-off in extra clutter in the rulesets is not deemed a worthy trade-off.
@@ Line 44: / Line 44: @@
 ** Opera 9.26: The AJAX Security lessons seemed to work best with Opera.
 ** Keep in mind that when a browser is going through a web proxy and you want to block requests and/or responses, unwanted crap gets sent from the browser to the outside world (anything Google-related was the biggest culprit, with Yahoo coming in second) and interferes with the Web proxy session. So, you might want to have more than one browser open; either your browser of choice to use with the proxy, or your browser of choice to use for general surfing and research while you are using WebGoat.
 === Project organization ===

← Older revision		Revision as of 02:12, 20 October 2008
Line 1:		Line 1:
−	This section details the strategy and work done in order to reach the ~~50% milestone~~ of the project. When the term 'mitigated' is used throughout this document, it is used in the sense that the WebGoat vulnerability in a lesson has been prevented by ModSecurity from being exploited.	+	This section details the strategy and work done in order to reach the goals of the project. When the term 'mitigated' is used throughout this document, it is used in the sense that the WebGoat vulnerability in a lesson has been prevented by ModSecurity from being exploited.

← Older revision	Revision as of 09:59, 27 October 2008
(No difference)

@@ Line 1: / Line 1: @@
-This section details the strategy and work done in order to reach the 50% milestone of the project. When the term 'mitigated' is used throughout this document, it is used in the sense that the WebGoat vulnerability in a lesson has been prevented from being exploited by using ModSecurity.
+This section details the strategy and work done in order to reach the 50% milestone of the project. When the term 'mitigated' is used throughout this document, it is used in the sense that the WebGoat vulnerability in a lesson has been prevented by ModSecurity from being exploited.
@@ Line 12: / Line 12: @@
 Firefox 2.0, Internet Explorer 7.0, and Opera 9.26 were used remotely on Windows XP SP2, and occasionally Firefox 2.0 was used on the Web server itself.
-WebGoat version 5.2 Beta 1 was used. The standard release of WebGoat 5.2 was posted to Google Code on 12 July 2008 and the second half of this project will be based on the standard release. Also, the ModSecurity solutions provided for the first 50% will be re-tested.
+WebGoat version 5.2 beta 1 was used. The standard release of WebGoat 5.2 was posted to Google Code on 12 July 2008 and the second half of this project will be based on the standard release. Also, the ModSecurity solutions provided for the first 50% will be re-tested.
-ModSecurity 2.5.1 was compiled, installed and used. For the 2nd half of the project, the current release of ModSecurity 2.5.5 will be utilized.
+ModSecurity 2.5.1 was compiled, installed and used. For the 2nd half of the project, ModSecurity 2.5.5 (or a newer version if available) will be utilized.
 ==== Tools used ====
-* WebScarab/Paros Proxy web proxies: The solutions use WebScarab and the project member used both WebScarab and Paros Proxy interchangably throughout the project.
+* WebScarab/Paros Proxy web proxies: The solutions use WebScarab and the project member used both WebScarab and Paros Proxy interchangeably throughout the project.
-* Remo - Rule Editor for ModSecurity (http://remo.netnea.com/) was invaluable to get started with an easy-to-use GUI that builds ModSecurity rules. Besides the tutorial video on the Remo site, another very helpful tutorial is at http://www.howtoforge.com/remo_modsecurity_apache.
+* Remo - Rule Editor for ModSecurity (http://remo.netnea.com/): Remo was invaluable to get started with an easy-to-use GUI that builds ModSecurity rules. Besides the tutorial video on the Remo site, another very helpful tutorial is at http://www.howtoforge.com/remo_modsecurity_apache.
 * Regex tools: The Regex Coach 0.9.2 (http://weitz.de/regex-coach/) and Expresso 3.0 (http://www.ultrapico.com/Expresso.htm) were used for building, testing, and analyzing regular expressions.
@@ Line 40: / Line 40: @@
 * Different browsers have their pluses and minuses:
-** IE7: The solutions were done with IE7 (or, at least, the screenshots in the solutions are of IE7) so use it if all else fails. But, to toggle IE7 to use a web proxy requires closing the browser and re-opening it.
+** Internet Eexplorer 7: The solutions were done with IE7 (or, at least, the screenshots in the solutions are of IE7) so use it if all else fails. But, to toggle IE7 to use a web proxy requires closing the browser and re-opening it.
-** FF2: The fewest mouse clicks are required to remove the WebGoat session cookies and clear the cache. Also, reconfiguring a web proxy is done on the fly and does not require restarting the browser. One sublesson, 3.8 Insecure Client Storage, uses Firebug - a FireFox extension - but the other browsers have similar browser plug-ins (e.g. Opera has Dragonfly as of version 9.5).
+** Firefox 2: The fewest mouse clicks are required to remove the WebGoat session cookies and clear the cache. Also, reconfiguring a web proxy is done on the fly and does not require restarting the browser. One sublesson, 3.8 Insecure Client Storage, uses Firebug - a Firefox extension - but the other browsers have similar browser plug-ins (e.g. Opera has Dragonfly as of version 9.5).
-** Opera: The AJAX Security lessons seemed to work best with Opera.
+** Opera 9.26: The AJAX Security lessons seemed to work best with Opera.
 ** Keep in mind that when a browser is going through a web proxy and you want to block requests and/or responses, unwanted crap gets sent from the browser to the outside world (anything Google-related was the biggest culprit, with Yahoo coming in second) and interferes with the Web proxy session. So, you might want to have more than one browser open; either your browser of choice to use with the proxy, or your browser of choice to use for general surfing and research while you are using WebGoat.
@@ Line 64: / Line 64: @@
 ==== Error pages ====
-In the real world, only generic error messages should be reflected back to the end user. In our situation, this is an educational project so each rule in each ruleset has its own html error file page that it is redirected to; for example, the error file 'lesson08a.html' for many of the XSS vulnerabilities in Lesson 8 is:
+In the real world, only generic error messages should be reflected back to the end user. In our situation, this is an educational project so each rule in each ruleset has its own HTML error file page that it is redirected to; for example, the error file 'lesson08a.html' for many of the XSS vulnerabilities in Lesson 8 is:
 [[Image:OWASP_ModSecurity_Securing_WebGoat_Section_3_SS1.jpg]]
 ==== Informational and debug messages ====
 Rules and Lua scripts contain informational and debug messages. It is a good practice to use unique and specific words in them (per rule and per ruleset) to make it easier to search through the ModSecurity debug and audit log files.