Forum Discussion

uknoodler_23999's avatar
uknoodler_23999
Icon for Altostratus rankAltostratus
Jan 06, 2017

How could I exclude Vulnerability scanners from Session Tracking?

I have enabled session tracking on an application and it has quickly blocked my vulnerability scanner. Of course this is "scan interference" and makes the results invalid. The options on the IP Ad...
ASM Advanced WAF
irule
iRules
security
session tracking
vulnerbility scanning
  • uknoodler_23999's avatar
    uknoodler_23999
    Jan 10, 2017

    Is it bad form to answer my own question?

    Anyhow, using logging I discovered that the violation name wasn't matching correctly. Here is a rule that I've now deployed and tested. 

    when ASM_REQUEST_DONE {
  if {([ASM::violation names] contains "SESSION_AWARENESS" && [ASM::violation count] < 2 && [IP::addr [IP::client_addr] equals n.n.n.n/m])} {
    ASM::unblock
  }
}
uknoodler_23999's avatar
uknoodler_23999
Icon for Altostratus rankAltostratus

Is it bad form to answer my own question?

Anyhow, using logging I discovered that the violation name wasn't matching correctly. Here is a rule that I've now deployed and tested. 

when ASM_REQUEST_DONE {
  if {([ASM::violation names] contains "SESSION_AWARENESS" && [ASM::violation count] < 2 && [IP::addr [IP::client_addr] equals n.n.n.n/m])} {
    ASM::unblock
  }
}
uknoodler_23999's avatar
uknoodler_23999
Icon for Altostratus rankAltostratus
Feb 23, 2017

no problem, thanks for putting in the feature request.

 

Related Content