Skip to content

Commit e5aea89

Browse files
author
Felipe Zimmerle
committed
Adds regression test to cover the @fuzzeHash operator
Added 30-fuzzyHash.t and the ssdeep hash files. Hash files was generated using files from ModSecurity repository.
1 parent 2c423ba commit e5aea89

File tree

3 files changed

+130
-0
lines changed

3 files changed

+130
-0
lines changed

‎tests/regression/misc/30-fuzzyHash.t

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
### libinjection.
2+
3+
{
4+
type => "misc",
5+
comment => "fuzzyHash test",
6+
conf => qq(
7+
SecRuleEngine On
8+
SecDebugLog $ENV{DEBUG_LOG}
9+
SecDebugLogLevel 9
10+
SecRequestBodyAccess On
11+
12+
SecRule REQUEST_BODY "\@fuzzyHash $ENV{CONF_DIR}/ssdeep.txt 1" "id:192372,log,deny"
13+
),
14+
match_log => {
15+
error => [ qr/ModSecurity: Access denied with code 403 \(phase 2\)\. Fuzzy hash of REQUEST_BODY matched with 96:MbQ1L0LDX8GPI8ov3D2D9zd6.*"modsecurity.conf-recommended"/, 1],
16+
debug => [ qr/Access denied with code 403 \(phase 2\)\. Fuzzy hash of REQUEST_BODY matched with 96:MbQ1L0LDX8GPI8ov3D2D9zd6.*"modsecurity.conf-recommended"/, 1],
17+
},
18+
match_response => {
19+
status => qr/^403$/,
20+
},
21+
request => new HTTP::Request(
22+
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/index.html",
23+
[
24+
"Content-Type" => "application/x-www-form-urlencoded",
25+
],
26+
# Args
27+
"
28+
# -- Rule engine initialization ----------------------------------------------
29+
30+
# Enable ModSecurity, attaching it to every transaction. Use detection
31+
# only to start with, because that minimises the chances of post-installation
32+
# disruption.
33+
#
34+
SecRuleEngine DetectionOnly
35+
36+
37+
# -- Request body handling ---------------------------------------------------
38+
39+
# Allow ModSecurity to access request bodies. If you don't, ModSecurity
40+
# won't be able to see any POST parameters, which opens a large security
41+
# hole for attackers to exploit.
42+
#
43+
SecRequestBodyAccess On
44+
45+
46+
# Enable XML request body parser.
47+
# Initiate XML Processor in case of xml content-type
48+
#
49+
SecRule REQUEST_HEADERS:Content-Type \"text/xml\" \
50+
\"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML\"
51+
52+
# Enable JSON request body parser.
53+
# Initiate JSON Processor in case of JSON content-type; change accordingly
54+
# if your application does not use 'application/json'
55+
#
56+
SecRule REQUEST_HEADERS:Content-Type \"application/json\" \
57+
\"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON\"
58+
59+
# Maximum request body size we will accept for buffering. If you support
60+
# file uploads then the value given on the first line has to be as large
61+
# as the largest file you are willing to accept. The second value refers
62+
# to the size of data, with files excluded. You want to keep that value as
63+
# low as practical.
64+
#
65+
SecRequestBodyLimit 13107200
66+
SecRequestBodyNoFilesLimit 131072
67+
68+
# Store up to 128 KB of request body data in memory. When the multipart
69+
# parser reachers this limit, it will start using your hard disk for
70+
# storage. That is slow, but unavoidable.
71+
#
72+
SecRequestBodyInMemoryLimit 131072
73+
74+
# What do do if the request body size is above our configured limit.
75+
# Keep in mind that this setting will automatically be set to ProcessPartial
76+
# when SecRuleEngine is set to DetectionOnly mode in order to minimize
77+
# disruptions when initially deploying ModSecurity.
78+
#
79+
SecRequestBodyLimitAction Reject
80+
81+
# Verify that we've correctly processed the request body.
82+
# As a rule of thumb, when failing to process a request body
83+
# you should reject the request (when deployed in blocking mode)
84+
# or log a high-severity alert (when deployed in detection-only mode).
85+
#
86+
SecRule REQBODY_ERROR \"!\@eq 0\" \
87+
\"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2\"
88+
"
89+
),
90+
},
91+
92+
{
93+
type => "misc",
94+
comment => "fuzzyHash test",
95+
conf => qq(
96+
SecRuleEngine On
97+
SecDebugLog $ENV{DEBUG_LOG}
98+
SecDebugLogLevel 9
99+
SecRequestBodyAccess On
100+
101+
SecRule REQUEST_BODY "\@fuzzyHash $ENV{CONF_DIR}/ssdeep.txt 1" "id:192372,log,deny"
102+
),
103+
match_log => {
104+
-error => [ qr/Fuzzy hash of REQUEST_BODY matched/, 1],
105+
-debug => [ qr/Fuzzy hash of REQUEST_BODY matched/, 1],
106+
},
107+
match_response => {
108+
status => qr/^200$/,
109+
},
110+
request => new HTTP::Request(
111+
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/index.html",
112+
[
113+
"Content-Type" => "application/x-www-form-urlencoded",
114+
],
115+
# Args
116+
"
117+
wheee
118+
"
119+
),
120+
},
121+
122+

‎tests/regression/nginx/conf/ssdeep.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
ssdeep,1.1--blocksize:hash:hash,filename
2+
96:MbQ1L0LDX8GPI8ov3D2D9zd6/gz2wZhFvV0O598La8Kqvfi0znNa8Xi5SM7XRWCK:KvL8Gg8rWIz2ZKqvfjzQ55RpRHjftQ++,"modsecurity.conf-recommended"
3+
192:b8B5UQvywcMIJuavpde/Yyz/U/vF+vGCoCvrQr/dw:afcnrvp8zqUvGrzr6,"README_WINDOWS.TXT"
4+
96:+qK8Z4gA165/hquKNMi68zuEyMM9qNB26x:+RG4z6c1LyZOB26x,"README.TXT"

‎tests/regression/server_root/conf/ssdeep.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
ssdeep,1.1--blocksize:hash:hash,filename
2+
96:MbQ1L0LDX8GPI8ov3D2D9zd6/gz2wZhFvV0O598La8Kqvfi0znNa8Xi5SM7XRWCK:KvL8Gg8rWIz2ZKqvfjzQ55RpRHjftQ++,"modsecurity.conf-recommended"
3+
192:b8B5UQvywcMIJuavpde/Yyz/U/vF+vGCoCvrQr/dw:afcnrvp8zqUvGrzr6,"README_WINDOWS.TXT"
4+
96:+qK8Z4gA165/hquKNMi68zuEyMM9qNB26x:+RG4z6c1LyZOB26x,"README.TXT"

0 commit comments

Comments
 (0)