Forum Discussion
Preet_pk
Cirrus
CirrusInvestigation/identification of WAF violations from archived F5 ASM security logs
Hi,
In our infrastructure, F5 ASM application events are available only for 2 hrs, logs which are older that 2 hrs is getting purged out. Please let me know how to identify/investigate violations for eg: invalid meta character from archived F5 ASM logs.
For eg: how to identify from below logs, which parameter metacharacter is getting block.
<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>7300e85b1979c8-4003000000000000</block><alarm>7702e85b1979c8-4003000000000000</alarm><learn>7300e85b1979c8-4000000000000000</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>24</viol_index><viol_name>VIOL_PARAMETER_VALUE_METACHAR</viol_name><parameter_data><value_error/><enforcement_level>URL</enforcement_level><name>TE9BRF9QT1JU</name><value>QkVORUZJQ0lBUlknUyBXQVJFSE9VU0UgSU4gVUFFIEFORC9PUiBLVVdBSVQ=</value></parameter_data><staging>0</staging><language_type>4</language_type><metachar_index>39</metachar_index></violation><violation><viol_index>24</viol_index><viol_name>VIOL_PARAMETER_VALUE_METACHAR</viol_name><parameter_data><value_error/><enforcement_level>URL</enforcement_level><name>REVTVF9QT1JU</name><value>QVBQTElDQU5UJ1MgV0FSRUhPVVNFIElOIEFCVSBESEFCSQ==</value></parameter_data><staging>0</staging><language_type>4</language_type><metachar_index>39</metachar_index></violation></request-violations></BAD_MSG>
- Daniel_Wolf
MVP
Hi Preet,
I think I figured it out.
<metachar_index>39</metachar_index>
DECIMAL: 39
BINARY: 0010 0111
According to RFC 20 this should be an ' (apostrophe).
Can you confirm?
KR
Daniel
Preet_pkHi,
Please let me know how you figured it out, can you help me with the steps to figure out the same.
- Daniel_Wolf
I tried to find some way that the 39 made sense. I found K6998 and I exported one of my Security Polices to XML. There you will find something like:
<metachar character="0x22">disallow</metachar> <metachar character="0x23">allow</metachar> <metachar character="0x24">allow</metachar> <metachar character="0x25">disallow</metachar> <metachar character="0x26">allow</metachar> <metachar character="0x27">allow</metachar>On position 39 you will find 0x27. Now I knew the HEX and DEC representation of the character.
With this information I found the binary value and I could reverse it from the table in the RFC.
I tried a couple of other values to verify that my assumption is correct.
- Preet_pk
Thanks for above details. Also just want know how to figure out below values.
<enforcement_level>URL</enforcement_level><name>REVTVF9QT1JU</name><value>QVBQTElDQU5UJ1MgV0FSRUhPVVNFIElOIEFCVSBESEFCSQ==</value>
