ASM: Disable violations for a certain URL

if you know the IP address of the source, whitelist the address and it will bypass the ASM signature match.

 

-Jinshu

 

There are severall pentesters around. I don't recognize if a new member to the site is added. I would always have to manage this whitelist. I would prefer a more comfortable way :-)

 

Joachim

 

This one is driving me crazy. I can't figure out how to tell ASM to not inspect Request that belong to /sites/pentest/*

It is still complaining with Requests like

/sites/pentest/lists/discussion0x20board/style0x20type=textcssbodybackgroundurl(javascriptalert('xss'))style

Of course it detects Attack signtature on that URL. But how to allow that for a certain URL ?

Any suggestions? Maybe the only way is to disable ASM by iRule when a request for /sites/pentest arrives. But thats not a good solution.

- Joachim

Joachim,

 

My view would be to create a separate ASM policy for the pentest site and then use a Local Traffic Policy or iRule to point traffic to /sites/pentest to the new ASM policy. This policy can be amended without compromising the other areas of your website.

 

Hope this helps,

 

N

 

Hi Joachim,

Try using below irule for bypass the ASM. Let me know if this helps.

when HTTP_CLASS_SELECTED { 
ASM::enable 
if { [HTTP::uri] starts_with "/sites/pentest/" } { 
ASM::disable 
} 
}

-Jinshu

You can also use policies.

 

Local Traffic > Policies > asm_l7_policy_whatever.website.com > under Rules click on Add, give it a name, like policy_whitelist, operand: http-uri (leave rest of fields default) > condition: choose equals/contains/etc, value = your URI, click add, then click the Add further down where operand/event/etc is located.

 

In the Actions area, target > asm, action > disable. Click Add where target/event/etc are. and Finished.

 

Then once back at the main policy page, do a re-order and move the policy_whitelist you created above default, so it will disable on the URI string prior to hitting the default ASM enable.. once you done this once or twice, pretty simple and can be used a lot.

 

The above iRule by Jinshu also works (does the same thing).

 

Hi Dan,

 

tried your method for a different scenario, but it works great. Never played around with this section, but seems to be very powerful and useful as well.

 

Thank you!

 

Ciao Stefan :)