Forum Discussion
NimbostratusASM / WAF : block request containing certain string?
I have added as much XSS blocking to a policy as possible. A request containing onmouseover or onclick or .... ="alert('hello')" is blocked fine.
But when it's coded like onmouseover or onclick or .... ="self['\x....... the ASM accepts this as valid.
Can I block a request with this parameter value?
How do I achieve this?
2 Replies
SajidCirrostratus
try custom attack signature
Security ›› Options: Application Security: Attack Signatures: Attack Signatures List
Click create and define your own pattern.
AndréBHi Sajid,
Your suggestion creates a "global" attack signature. And will, on creation, as I read it, be added to all the policies.
We have several policies running and I don't want to mess up policies for which I'm not responsible.
There is an attack signature self[] (parameter) (id 200101630) to choose from and is already added/active to the policy.
But it doesn't block self['\x... ], self with HEX in it as it is added in the value part of a parameter.
Maybe it's better to report it to F5 Support
