For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dechir_21483's avatar
dechir_21483
Icon for Nimbostratus rankNimbostratus
Dec 05, 2013

custom page response

Hi,

I would custom the page response when Brute force attack is blocked. below the irule implemented:

when ASM_REQUEST_BLOCKING { set x [ASM::violation_data]

for {set i 0} { $i < 7 } {incr i} {

  switch $i {

  0         { log local0. "violation=[lindex $x $i]" }

  1         { log local0. "support_id=[lindex $x $i]" }

  2         { log local0. "web_application=[lindex $x $i]" }

  3         { log local0. "severity=[lindex $x $i]" }

  4         { log local0. "source_ip=[lindex $x $i]" }

  5         { log local0. "attack_type=[lindex $x $i]" }

  6         { log local0. "request_status=[lindex $x $i]" }
}} if {([lindex $x 0] contains "VIOLATION_BRUTE_FORCE")}{ log local0. "VIOLATION_BRUTE_FORCE_ATTACK_DETECTED, let's customized reject page"

  HTTP::header remove Content-Length
  HTTP::header insert header_1 value_1
  set response "We are sorry,\
but the site you are looking for is temporarily out of service\If you feel you have reached this page in error, please try again."

  ASM::payload replace 0 [ASM::payload length] ""

  ASM::payload replace 0 0 $response
}

}

but after join the irule to the VS, the irule not worked.

can you help me ?

5 Replies

  • Try just ;

    ASM::payload replace 0 [ASM::payload length] "" $response
    

    Instead of the 2 different 'ASM::payload replace' statements.

    Also - don't touch the Content-Length header - I think "ASM::payload replace" will automagically fix it for you.

  • Hi, thanks for your replay I have tryed the line: ASM::payload replace 0 [ASM::payload length] "" $response

     

    below the error:

     

    01070151:3: Rule [/Common/Bruteforceresponse] error: line 33: [wrong args] [ASM::payload replace 0 [ASM::payload length] "" $response]

     

  • Hi, thanks for your replay I have tryed the line: ASM::payload replace 0 [ASM::payload length] "" $response

     

    below the error:

     

    01070151:3: Rule [/Common/Bruteforceresponse] error: line 33: [wrong args] [ASM::payload replace 0 [ASM::payload length] "" $response]

     

  • Remove the double quotes. It should look like this:

    ASM::payload replace 0 [ASM::payload length] $response