Forum Discussion

fwilliams_31097's avatar
fwilliams_31097
Icon for Nimbostratus rankNimbostratus
Jan 14, 2011

using ASM to validate form filed

sorry.. i am a totally new to F5 and ASM etc.

 

I am tasked with using the F5 to validate form field submissions in 3rd party web apps .. these can be login forms, user request forms whatever.

 

My first focus will be on login forms..I think the way to go about it is create a user defined attack signature and then use a regex to validate the username and password confirm to our requirements..

 

Is this even close.. if so how would I do this?

 

Again , I apologize for such a novice question but I could really use the guidance.

 

Thanks

 

 

app sec
BIG-IP Access Policy Manager (APM)
security

2 Replies

Sort By
  • fwilliams_31097's avatar
    fwilliams_31097
    Icon for Nimbostratus rankNimbostratus
    Jan 14, 2011
    another thought occurred to me.. could I use the asm learning option to do this?

     

    again if so how?

     

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Jan 18, 2011
    You should define (or use Learning to learn) the Parameters of the forms and configure them to be the valid DataType(i.e. Integer/Alphanumeric) and set the allowed Min/Max values, Lengths etc,

     

     

     

    See "Working With Paramteres" chapter of ASM Configuration guide here (v10.2):

     

     

    http://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/config_guide_asm_10_2_0/asm_parameters.html

     

     

    --

     

    Sam