This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP ModSecurity Securing WebGoat Section4 Sublesson 02.4"

From OWASP
Jump to: navigation, search
Line 2: Line 2:
  
 
2.4  Remote Admin Access
 
2.4  Remote Admin Access
 +
  
 
=== Lesson overview ===  
 
=== Lesson overview ===  

Revision as of 11:57, 24 July 2008

2. Access Control Flaws

2.4 Remote Admin Access


Lesson overview

See [relative path].

Lesson solution

See [relative path].

Strategy

The solution is to prevent 'admin=true' from appearing in the query string.

Implementation

The lesson is mitigated in the ruleset 'rulefile_02_access-control-flaws.conf'. 

  # Lesson 2.4: Remote Admin Access; don't allow 'admin=true' in the querystring
  SecRule &ARGS:admin "!@eq 0" "chain,log,auditlog,deny,\
    msg:'Admin Function Attack',tag:'ADMIN_FUNCTION', \
    redirect:/_error_pages_/lesson02-4.html"
  SecRule ARGS:admin "true" "t:lowercase"
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_ModSecurity_Securing_WebGoat_Section4_Sublesson_02.4&oldid=34601"