This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

OWASP ModSec CRS Paranoia Mode

From OWASP
Revision as of 15:30, 19 January 2016 by Spartan (talk | contribs) (→‎Open Tasks)

Jump to: navigation, search

Abstract

This is a page about the development of a paranoia mode aka bringing back the rules that used to yield a high number of false positives. This little project is aimed at inclusion into the 3.0.0 release of the OWASP ModSecurity Core Rules, where some rules have been removed in order to reduce the number of false positives with vanilla installations.

FIXME: Detailed description

Back to the OWASP ModSecurity Core Rules Set.


Sub-Project Infos

Tasks

Open Tasks

Please define state as follows: new, assigned, waiting, closed. When a task it is closed, it is moved to the seperate closed tasks table below.

Task         Who           Status   
Assemble list of disappeared rules, which should be brought back n.n. new
Assemble list of 3.0.0-rc1 rules, which could be moved to the paranoia mode Franziska assigned
Assemble list of 3.0.0-rc1 rules, which could be accompanied with
stricter siblings in paranoia mode
(same idea of the rule, but harder limit etc.) 		Christian assigned
Write new stricter siblings for existing rules Noël assigned
Sort out mechanics of the paranoia mode n.n. new
Define exact syntax of paranoia mode setup Christian waiting
Sort out name: Is "Paranoia Mode" really the right term? Christian waiting
Write pull request n.n. new
Submit pull request n.n. new
Draw flowchart n.n. new
Write documentation n.n. new

Closed Tasks

Task         Who           Status   
Assemble list of rules, which triggered false positives in 2.2.X frequently Christian closed


Rules

Paranoia Mode Candidates

The 3.0.0-rc1 has all rules renumbered. Existing numbering was fairly crazy and the new numbering follows the numbering scheme of the rules files (-> 9<2-digit-rulefile><3-digit-id>) A mapping table exists [IdNumbering.csv] We need to make sure, we do not mess things up, so let's add both IDs to the table, the old one and the new one.

Please set status as follows : candidate, cloning-candidate, unsure, dropped.

  • 'cloning-candidates' are rules, that could be cloned into an even stricter variant with a stricter limit in a higher paranoia setting.
  • If dropped, please provide reasoning in the remarks.


RuleID 2.2.x RuleID 3.0.0-rc1         msg           Status       Remarks   
950001 942150 SQL Injection Attack candidate Christian's 2.2.X experience: frequently false positives
950109 920230 Multiple URL Encoding Detected candidate Christian's 2.2.X experience: frequently false positives
950901 942130 SQL Injection Attack: SQL Tautology Detected. candidate Christian's 2.2.X experience: very frequently false positives
950907 932100 System Command Injection candidate Christian's 2.2.X experience: frequently false positives
959070 gone SQL Injection Attack candidate Christian's 2.2.X experience: frequently false positives
959071 gone SQL Injection Attack candidate Christian's 2.2.X experience: frequently false positives
959072 gone SQL Injection Attack candidate Christian's 2.2.X experience: frequently false positives
959073 gone SQL Injection Attack candidate Christian's 2.2.X experience: very frequently false positives
960015 920300 Request Missing an Accept Header candidate Christian's 2.2.X experience: very frequently false positives
960017 920350 Host header is a numeric IP address candidate Christian's 2.2.X experience: very frequently false positives
960024 gone Meta-Character Anomaly Detection Alert - Repetative Non-Word Characters candidate Christian's 2.2.X experience: very frequently false positives
960035 920440 URL file extension is restricted by policy candidate Christian's 2.2.X experience: frequently false positives
973300 gone Possible XSS Attack Detected - HTML Tag Handler candidate Christian's 2.2.X experience: frequently false positives
973332 gone IE XSS Filters - Attack Detected. candidate Christian's 2.2.X experience: frequently false positives
973333 gone IE XSS Filters - Attack Detected. candidate Christian's 2.2.X experience: frequently false positives
981172 gone Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded candidate Christian's 2.2.X experience: very frequently false positives
981173 gone Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded candidate Christian's 2.2.X experience: very frequently false positives
981231 gone SQL Comment Sequence Detected. candidate Christian's 2.2.X experience: very frequently false positives
981240 942300 Detects MySQL comments, conditions and ch(a)r injections candidate Christian's 2.2.X experience: frequently false positives
981242 942330 Detects classic SQL injection probings 1/2 candidate Christian's 2.2.X experience: frequently false positives
981243 942370 Detects classic SQL injection probings 2/2 candidate Christian's 2.2.X experience: very frequently false positives
981244 942180 Detects basic SQL authentication bypass attempts 1/3 candidate Christian's 2.2.X experience: frequently false positives
981245 942260 Detects basic SQL authentication bypass attempts 2/3 candidate Christian's 2.2.X experience: frequently false positives
981246 942340 Detects basic SQL authentication bypass attempts 3/3 candidate Christian's 2.2.X experience: frequently false positives
981248 942210 Detects chained SQL injection attempts 1/2 candidate Christian's 2.2.X experience: very frequently false positives
981249 942310 Detects chained SQL injection attempts 2/2 candidate Christian's 2.2.X experience: frequently false positives
981257 942200 Detects MySQL comment-/space-obfuscated injections and backtick termination candidate Christian's 2.2.X experience: frequently false positives
981260 gone SQL Hex Encoding Identified candidate Christian's 2.2.X experience: very frequently false positives
981319 942120 SQL Injection Attack: SQL Operator Detected candidate Christian's 2.2.X experience: frequently false positives
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_ModSec_CRS_Paranoia_Mode&oldid=206753"