Forum Discussion

uknoodler_23999's avatar
uknoodler_23999
Icon for Altostratus rankAltostratus
Jan 06, 2017

How could I exclude Vulnerability scanners from Session Tracking?

I have enabled session tracking on an application and it has quickly blocked my vulnerability scanner. Of course this is "scan interference" and makes the results invalid.

The options on the IP Address Exceptions page allow me to "Never Block" the IP , but then I get false results and ASM is not providing any protection.

Because I've seen that when blocked by Session Tracking the other violations were still recorded in the logs I thought this may work as an iRule

when ASM_REQUEST_DONE {
    if {  ([ASM::violation count] equals 1) && ([ASM::violation names] eq "VIOL_SESSION_AWARENESS") && ([IP::addr [IP::client_addr] equals n.n.n.n]) } {
        ASM::unblock
        }
    }

But it didn't, the connections were still blocked when the session tracking count was reached.

Can anyone suggest something to try next?

ASM Advanced WAF
irule
iRules
security
session tracking
vulnerbility scanning
  • uknoodler_23999's avatar
    uknoodler_23999
    Jan 10, 2017

    Is it bad form to answer my own question?

    Anyhow, using logging I discovered that the violation name wasn't matching correctly. Here is a rule that I've now deployed and tested. 

    when ASM_REQUEST_DONE {
  if {([ASM::violation names] contains "SESSION_AWARENESS" && [ASM::violation count] < 2 && [IP::addr [IP::client_addr] equals n.n.n.n/m])} {
    ASM::unblock
  }
}
  • uknoodler_23999's avatar
    uknoodler_23999
    Icon for Altostratus rankAltostratus
    Jan 10, 2017

    Is it bad form to answer my own question?

    Anyhow, using logging I discovered that the violation name wasn't matching correctly. Here is a rule that I've now deployed and tested. 

    when ASM_REQUEST_DONE {
  if {([ASM::violation names] contains "SESSION_AWARENESS" && [ASM::violation count] < 2 && [IP::addr [IP::client_addr] equals n.n.n.n/m])} {
    ASM::unblock
  }
}
    • cdjac0bsen's avatar
      cdjac0bsen
      Icon for Nimbostratus rankNimbostratus
      Feb 23, 2017

      You're a genius, thanks so much. This is exactly the same issue we are having. If you don't mind, I'm going to submit this as a feature enhancement request to add this option to the IP address exception configuration. Seems like a no-brainer to me, I'm surprised it wasn't added already. You don't want legitimate vuln scanners to get blocked by session tracking--makes the results invalid.

       

    • cdjac0bsen's avatar
      cdjac0bsen
      Icon for Nimbostratus rankNimbostratus
      Mar 01, 2017

      You're welcome. What would be the best syntax to add multiple IP addresses/subnets? We have about 15 we need to exclude. And I'm not keen on reading in a list of IP's from a separate file.