Forum Discussion

BerkBurc_314320's avatar
BerkBurc_314320
Icon for Nimbostratus rankNimbostratus
Mar 05, 2019

ASM Flow Order

Greetings, we have been dealing with, someone might say, an issue with our ASM. As I understand, for the solution we need to understand how ASM hierarchy works. I have found some event orders articles but none of them provide the information we needed. We need an in depth ASM flow chart. This requirement rise from the need of the situation below.

 

ASM Advanced WAF
security
  • BerkBurc_314320's avatar
    BerkBurc_314320
    Icon for Nimbostratus rankNimbostratus
    Mar 05, 2019

    I have been playing and testing attacks on our environment through ASM. Let's say path traversal attacks are being tested. For instance, there are three variants of the same attack category. Variant 1 and 2 are being block by Attack Signature called Path Traversal Signatures. But 3rd variant is being blocked by Predictable Resource Location Signature (attack itself tries to reach those resources such as boot.ini). Inside the arguments of the attacks, there is not much different but little changes. We need to mitigate those attack to pinpoint solutions. That is why I need to see for variant 3 to also trigger Path Traversal Signature. FYI this is just an example, same situation happens for XSS, Command Execution or Data Exposure attacks.

     

    The thing is, for the variant 3 which triggered resource location signature also Evasion Detection config is triggered (like in the ASM policy config). To sum up, variant 3 attack, triggered resource location signature and ASM policy "Evasion technique detected" config (multiple decoding, directory traversals etc.) The other two variants also triggered those configs in addition to "correct attack signature".

     

    The question in our minds is why variant 3 triggered Resource Signature instead of Path Traversal Signature or why the other two triggered the "correct signature". Why I'm asking this is that, I need to catch the correct attack technique, because by using that technique someone else might access something entirely different. So the technique itself has to be caught. And to understand this completely, I thought we need to understand the ASM flow. If something else comes to your mind, please elaborate on the topic. Maybe our approach needs tuning, your suggestions will be highly appreciated. Thank you in advance.