Generating Traffic Learnings through Explore scans

Hi Nik,

 

 

I generally don't define every URL for a web app in a policy. I define the filetypes and lock down the metacharacters for URLs and the rest of the charsets. I then define explicit URLs if there are is a character set violation for a URL. If there are odd metacharacters in the URLs, then a crawl of the site might help. Or if you have a lot of filetypes it would help to run the crawler.

 

 

Are you able to put the policy in transparent mode on a production virtual server that does receive traffic?

 

 

Aaron

 

Aaron,

 

 

Just to understand you clearly, Does this mean

 

1) We generally do not create a wildcard parameter "*" for allowed URLs and try to learn the URLs accessed on the learning screen. (since crawlers would do just the same)

 

 

 

Based on your suggested approach , is it ok then not to learn from the metacharacters on parameters (policy-->blocking-->settings) , as it may not be very useful:

 

2) Illegal meta characters in parameter name

 

3) Illegal meta characters in parameter value

 

 

Specific Yes/No answers to 1),2) & 3) will save me a lot of time & effort.

 

 

Yes, the policy is in transparent mode on production. Regards,

 

 

regards,

 

Nik

 

 

 

Hi Nik,

 

 

I personally like defining a * URL and only define specific URLs if they trigger meta-character or attack signature violations. So for 1) I would say no, do not define every URL for a web application in the security policy.

 

 

I highly suggest enforcing meta-characters for each of the four character sets (header, URL, parameter name, parameter value). For 2) and 3) I suggest you do use learning or other tools to keep a tight list of globally allowed meta-characters for parameter names and values and make only make specific exceptions. For parameter names and values, I try to make exceptions by defining a specific global parameter and relax the character set there.

 

 

For example, on the * global parameter, only allow "A-Z a-z 0-9 Space ! " ( ) + , - . @ [ ] _ { } $ ? = :" for parameter names. For parameter values, only allow "A-Z a-z 0-9 Space CR LF ! " ( ) + , - . @ [ ] _ { } $ ? = : ". Then if for example the web app requires use of meta-characters in this list for the password parameter "' % < > &; `", create a global parameter named password and allow the meta-characters only on that parameter value.

 

 

I added some of this info on what I use for character sets to a recent post with you:

 

https://devcentral.f5.com/Community/GroupDetails/tabid/1082223/asg/52/aft/2161357/showtab/groupforums/Default.aspx2238613

 

 

Aaron