Hands-On ModSecurity and Logging

This talk combines two of the OWASP top ten security risks:
* Injections (A1:2017): We are using a simple application that is exploitable by an injection and will then secure it with ModSecurity.
* Insufficient Logging & Monitoring (A10:2017): We are logging and monitoring the application both with and without ModSecurity with the open source Elastic Stack.

To make it more interactive the audience has to do the injections, which we are then live monitoring and mitigating with ModSecurity.

Transcript

1. Hands-On
   ModSecurity and Logging
   Philipp Krenn̴ ̴̴̴@xeraa
   

   View Slide

2. Let's talk about security...
   ̴̴@xeraa
   

   View Slide

3. ̴̴@xeraa
   

   View Slide

4. A1:2017-Injection
   https://www.owasp.org/index.php/
   Top_10-2017_Top_10
   ̴̴@xeraa
   

   View Slide

5. ̴̴@xeraa
   

   View Slide

6. A10:2017-Insufficient Logging &
   Monitoring
   https://www.owasp.org/index.php/
   Top_10-2017_Top_10
   ̴̴@xeraa
   

   View Slide

7. ̴̴@xeraa
   

   View Slide

8. Developer
   ̴̴@xeraa
   

   View Slide

9. Disclaimer
   I build highly monitored Hello World
   apps
   ̴̴@xeraa
   

   View Slide

10. Hello World of SQL Injection:
    https://xeraa.wtf
    ̴̴@xeraa
    

    View Slide

11. https://xeraa.wtf/read.php?id=1
    ̴̴@xeraa
    

    View Slide

12. ̴̴@xeraa
    

    View Slide

13. python sqlmap.py --url "https://xeraa.wtf/read.php?id=1" --
    purge
    ̴̴@xeraa
    

    View Slide

14. Injection
    ;INSERT INTO employees (id,name,city,salary) VALUES
    (4,'new','employee',10000)
    ̴̴@xeraa
    

    View Slide

15. No Escaping Either
    ;INSERT INTO employees (id,name,city,salary) VALUES
    (5,'alert("hello")','evil',0)
    ̴̴@xeraa
    

    View Slide

16. View Slide

17. View Slide

18. ̴̴@xeraa
    

    View Slide

19. View Slide

20. ̴̴@xeraa
    

    View Slide

21. ̴̴@xeraa
    

    View Slide

22. ̴̴@xeraa
    

    View Slide

23. View Slide

24. What's going on in our app?
    ̴̴@xeraa
    

    View Slide

25. View Slide

26. DELETE
    or
    DROP
    ?
    ̴̴@xeraa
    

    View Slide

27. ̴̴@xeraa
    

    View Slide

28. ModSecurity is an open source, cross-platform web application
    firewall (WAF) module. Known as the "Swiss Army Knife" of WAFs,
    it enables web application defenders to gain visibility into HTTP(S)
    traffic and provides a power rules language and API to implement
    advanced protections.
    ̴̴@xeraa
    

    View Slide

29. OWASP ModSecurity Core Rule Set (CRS) Version 3
    • HTTP Protocol Protection
    • Real-time Blacklist Lookups
    • HTTP Denial of Service Protections
    • Generic Web Attack Protection
    • Error Detection and Hiding
    ̴̴@xeraa
    

    View Slide

30. Commercial Rules from Trustwave SpiderLabs
    • Virtual Patching
    • IP Reputation
    • Web-based Malware Detection
    • Webshell / Backdoor Detection
    • Botnet Attack Detection
    • HTTP Denial of Service (DoS) Attack Detection
    ̴̴@xeraa
    

    View Slide

31. Run sqlmap again
    python sqlmap.py --url "https://xeraa.wtf/read.php:8080?
    id=1" --purge
    ̴̴@xeraa
    

    View Slide

32. Custom Rule
    SecRule REQUEST_FILENAME "form.php" "id:'400001',chain,deny,log,msg:'Spam detected'"
    SecRule REQUEST_METHOD "POST" chain
    SecRule REQUEST_BODY "@rx (?i:(pills|insurance|rolex))"
    ̴̴@xeraa
    

    View Slide

33. ̴̴@xeraa
    

    View Slide

34. Conclusion̴̴
    ̴̴@xeraa
    

    View Slide

35. Examples
    https://github.com/xeraa/mod_security-log
    ̴̴@xeraa
    

    View Slide

36. Code
    Logging
    ModSecurity
    ̴̴@xeraa
    

    View Slide

37. Questions?̴̴
    Philipp Krenn̴̴̴̴̴@xeraa
    ̴̴@xeraa
    

    View Slide