Forum Discussion
CirrusASM disallowed url %
All,
Running into an issue with disallowed url on ASM. We needed to block the ecp in owa like so https://owa.host.com/ecp, this works as expected just by adding /ecp in the disallowed list. If you use trustwave or another filter that changes the url to the below example, you bypass the /ecp block,
https://owa.host.com/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fowa.host.com%2fecp%2f
I need to be able to block this request as well but unable to figure out how to have ASM detect the %2fecp%2f.
Any thoughts?
DRJAltocumulus
Have you verified that the evasion techniques are set correctly? I'm not able to check at the moment, but this may also depend on your parameter settings/require an explicit parameter check?
Ivan_ChernenkiiEmployee
Is request logged with /ecp URL in second case?
As I see, in second case you send /ecp URL in query string parameter, that is why disallowed URL doesn't have affect on it.
To block all requests with /ecp in URL or in query string you can create attack signature like uricontent:"/ecp"; nocase;
Dave_PisarekI just created a customer signature for the specific ecp pattern.