This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "ModSecurity CRS Rule Description Template"

From OWASP
Jump to: navigation, search
Line 5: Line 5:
 
   
 
   
 
== Rule ID: XXXXX ==
 
== Rule ID: XXXXX ==
−
 
+
<table style="border-style:double;border-width:3px;" >
−
=== Rule Message: Message Text ==
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule ID</td>
−
 
+
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
−
=== Rule ===
+
Place Rule ID Here
−
Provide the entire rule/rule chain here
+
</td></tr>
−
 
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Message</td>
−
=== Rule Summary ===
+
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 +
Place Rule Message Here
 +
</td></tr>
 +
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Summary</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 
Provide rule background.  What is the rule looking for?  What attack is trying to identify or prevent.
 
Provide rule background.  What is the rule looking for?  What attack is trying to identify or prevent.
−
 
+
</td></tr>
−
=== Impact ===
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Impact</td>
−
This should be the Severity rating specified in the rule.
+
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
−
 
+
This should be the Severity rating specified in the rule. (Example: 4 - Warning)
−
=== Detailed Information ===
+
</td></tr>
 +
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 +
<code>Provide the entire rule/rule chain here</code>
 +
</td></tr>
 +
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Detailed Rule Information</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 
Provide detailed information about the rule construction such as:
 
Provide detailed information about the rule construction such as:
 
*Why the variable list specified was used
 
*Why the variable list specified was used
−
*A description of the regular expression used - what is is looking for in plain english
 
 
*What actions are used and why
 
*What actions are used and why
−
 
+
<pre>
−
=== Example Payload ===
+
A description of the regular expression used - what is is looking for in plain english (Example RegEx analysis from Expresso tool)
 +
</pre>
 +
</td></tr>
 +
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Example Payload</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 
Provide an example payload that will trigger this rule.
 
Provide an example payload that will trigger this rule.
  
−
  attack payload data
+
  Example Apache log entry or HTTP payload captured by another tool
−
 
+
</td></tr>
−
=== Example Audit Log Entry ===
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Example Audit Log Entry</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 
Include an example ModSecurity Audit Log Entry for when this rule matchs.
 
Include an example ModSecurity Audit Log Entry for when this rule matchs.
−
 
+
<pre>
−
audit log data
+
Audit Log Entry
−
 
+
</pre>
−
=== Affected Software ===
+
</td></tr>
−
If this attack only affects a specific piece of public software (if this is a virtual patch for a public disclosure) specify which info.
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Attack Scenarios</td>
−
 
+
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
−
=== Attack Scenarios ===
 
 
Provide any data around "how" the attack is carried out.
 
Provide any data around "how" the attack is carried out.
−
 
+
</td></tr>
−
=== Ease of Attack ===
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Ease of Attack</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 
How easy is it for an attacker to carry out the attack?
 
How easy is it for an attacker to carry out the attack?
−
 
+
</td></tr>
−
=== Ease of Detection ===
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Ease of Detection</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 
How easy is it for a defender to use ModSecurity to accurately detect this attack?
 
How easy is it for a defender to use ModSecurity to accurately detect this attack?
−
 
+
</td></tr>
−
=== False Positives ===
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >False Positives</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 
If there are any known false positives - specify them here
 
If there are any known false positives - specify them here
−
 
+
</td></tr>
−
=== False Negatives ===
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >False Negatives</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 
Are there any know issues with evasions or how an attacker might bypass detection?
 
Are there any know issues with evasions or how an attacker might bypass detection?
−
 
+
</td></tr>
−
=== Corrective Action  ===
+
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Documentation Contributor(s)</td>
−
Any tuning recommendations for the existing rule?
+
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
−
 
 
−
=== Contributors ===
 
 
Specify your name and email if you want credit for the rule or documentation of it.
 
Specify your name and email if you want credit for the rule or documentation of it.
−
 
+
Example: Ryan Barnett - rcbarnett[[Image:Justat.gif|10px]]gmail.com
−
=== Additional References ===
+
</td></tr>
 +
<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Additional References</td>
 +
<td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 
Provide any external reference links (e.g. - if this is a virtual patch for a known vuln link to the Bugtraq or CVE page).
 
Provide any external reference links (e.g. - if this is a virtual patch for a known vuln link to the Bugtraq or CVE page).
 +
</td></tr>
 +
</table>
  
−
[[Category:OWASP Project|ModSecurity Core Rule Set Project]]
+
[[Category:OWASP ModSecurity Core Rule Set Project]]

Revision as of 15:54, 20 September 2010

- This is a template for submitting or documenting ModSecurity CRS rule/signature descriptions to
    the OWASP ModSecurity Core Rule Set (CRS) Project.
- Project participants are encouraged to copy this template and create landing pages for each CRS rule
- Use this template and create a new page using the following format - http://www.owasp.org/index.php?title=ModSecurity_CRS_RuleID-XXXXX (where XXXXX is the CRS ruleID)

Rule ID: XXXXX

Rule ID

Place Rule ID Here

Rule Message

Place Rule Message Here

Rule Summary

Provide rule background. What is the rule looking for? What attack is trying to identify or prevent.

Impact

This should be the Severity rating specified in the rule. (Example: 4 - Warning)

Rule

Provide the entire rule/rule chain here

Detailed Rule Information

Provide detailed information about the rule construction such as:

  • Why the variable list specified was used
  • What actions are used and why
A description of the regular expression used - what is is looking for in plain english (Example RegEx analysis from Expresso tool)
Example Payload

Provide an example payload that will trigger this rule. 

Example Apache log entry or HTTP payload captured by another tool
Example Audit Log Entry

Include an example ModSecurity Audit Log Entry for when this rule matchs. 

Audit Log Entry
Attack Scenarios

Provide any data around "how" the attack is carried out.

Ease of Attack

How easy is it for an attacker to carry out the attack?

Ease of Detection

How easy is it for a defender to use ModSecurity to accurately detect this attack?

False Positives

If there are any known false positives - specify them here

False Negatives

Are there any know issues with evasions or how an attacker might bypass detection?

Rule Documentation Contributor(s)

Specify your name and email if you want credit for the rule or documentation of it. Example: Ryan Barnett - rcbarnettJustat.gifgmail.com

Additional References

Provide any external reference links (e.g. - if this is a virtual patch for a known vuln link to the Bugtraq or CVE page).

Retrieved from "https://wiki.owasp.org/index.php?title=ModSecurity_CRS_Rule_Description_Template&oldid=89594"