Forum Discussion

Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Sep 07, 2017

Custom Attack Signature to block request with No UA or Referer

I want to be able to check and see if the request is missing both the User-Agent String and the Referer, and possibly block the request. So I know I can do this with an iRule, but I am wanting to try and perform this check with an Attack Signature. Reason being, that I would like to put the Signature in staging to see how much traffic is getting logged against it before I move it to blocking. I am running 12.1.1 HF1 currently.

 

ASM Advanced WAF
attack signatures
security
  • Richard_Karon's avatar
    Richard_Karon
    Icon for Employee rankEmployee
    Sep 21, 2017

    Another way to say this is that you want the header to be mandatory. There is a setting under

     

    Security ›› Application Security : Headers : HTTP Headers ›› Edit Header

     

    Mandatory to Enabled will say the header must appear in the request

     

    • Mike_Maher's avatar
      Mike_Maher
      Icon for Nimbostratus rankNimbostratus
      Sep 11, 2017

      Thanks for the suggestion, I had not thought about that and it is an interesting solution. The site I am working with is very dynamic and that list may be difficult to maintain. I do appreciate the feed back though, and I am going to keep that iRule idea in my back pocket as it may work well for other solutions in the future.

       

    • nag_54823's avatar
      nag_54823
      Icon for Cirrostratus rankCirrostratus
      Sep 11, 2017

      Hi Mike,

      I'm not sure if it's possible to attach mandatory header conditions per URL. But you can whitelist if an URI is blocked because of MISSING MANDATORY HEADER. You can use below irule. Make sure Trigger ASM iRule Events is enabled in Policy.

      1) create a DG for hosts that need to whitelist 2) create a DG for URI that need to whitelist

          when ASM_REQUEST_DONE {

      if { [ class match [HTTP::host] equals host_dg ] and [string tolower [HTTP::uri]] contains "uri_dg" and ([ASM::violation_data] contains "VIOLATION_MISSING_MANDATORY_HEADER" ) } { ASM::unblock } }

    • Mike_Maher's avatar
      Mike_Maher
      Icon for Nimbostratus rankNimbostratus
      Sep 07, 2017

      Yea, I am not sure that will accomplish what I am looking for. Which is to check if both Headers are missing. If a UA is present but the referer isn't I will still want to allow the traffic. Also I may need the ability to whitelist the signature for certain traffic.

       

      It would be nice if in policy there was a way to attach mandatory header conditions per URL.