{"id":1811,"date":"2021-08-12T11:39:22","date_gmt":"2021-08-12T09:39:22","guid":{"rendered":"https:\/\/www.netnea.com\/cms\/?p=1811"},"modified":"2022-06-08T17:30:10","modified_gmt":"2022-06-08T15:30:10","slug":"rule-exclusion-script-on-steroids","status":"publish","type":"post","link":"https:\/\/www.netnea.com\/cms\/2021\/08\/12\/rule-exclusion-script-on-steroids\/","title":{"rendered":"Rule Exclusion Script on Steroids"},"content":{"rendered":"\n<p>The ModSecurity \/ OWASP Core Rule Set tutorials here at netnea.com are visited by over 8,000 times a month. With many of the unique visitors, the auxiliary script modsec-rulereport.rb is a favorite. The tool allows you to generate rule exclusions based on a ModSecurity rule alert message.<\/p>\n\n\n\n<p>Today, I&#8217;m presenting you a new version of the script. A complete rewrite. The new version has the following features:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>It supports the four canonical types of rule exclusions by id and by tag<\/li><li>Calling the rule exclusion types is now consistent (and it really was not before)<\/li><li>Optional persistence of rule IDs<\/li><li>Special CRS rules that reference variables or administrative rules that should not be<br>excluded are treated specially (instead of a rule exclusion, there is an advisory text)<\/li><li>Optional addition of meta information to comments of the rule exclusion<\/li><li>JSON output<\/li><li>Support for full variety of ModSecurity rule alerts (also for exotic operators)<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Here are a few examples<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Alert 1:\n\n&#91;2021-06-03 22:54:45.858724] &#91;-:error] - - &#91;client 127.0.0.1] ModSecurity: Warning. Pattern match \"(?i:(?:(?:s(?:t(?:d(?:dev(_pop|_samp)?)?|r(?:_to_date|cmp))|u(?:b(?:str(?:ing(_index)?)?|(?:dat|tim)e)|m)|e(?:c(?:_to_time|ond)|ssion_user)|ys(?:tem_user|date)|ha(1|2)?|oundex|chema|ig?n|pace|qrt)|i(?:s(null|_(free_lock|ipv4_compat|ipv4_mapped|ipv4|ipv ...\" at ARGS:keys. &#91;file \"\/apache\/conf\/owasp-modsecurity-crs-3.0.0-rc1\/rules\/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\"] &#91;line \"860\"] &#91;id \"942410\"] &#91;rev \"2\"] &#91;msg \"SQL Injection Attack\"] &#91;data \"Matched Data: union select found within ARGS:keys: union select from users\"] &#91;severity \"CRITICAL\"] &#91;ver \"OWASP_CRS\/3.3.0\"] &#91;maturity \"9\"] &#91;accuracy \"8\"] &#91;tag \"OWASP_CRS\/WEB_ATTACK\/SQL_INJECTION\"] &#91;tag \"WASCTC\/WASC-19\"] &#91;tag \"OWASP_TOP_10\/A1\"] &#91;tag \"OWASP_AppSensor\/CIE1\"] &#91;tag \"PCI\/6.5.2\"] &#91;tag \"paranoia-level\/2\"] &#91;hostname \"localhost\"] &#91;uri \"\/drupal\/index.php\/search\/node\"] &#91;unique_id \"WBuyJX8AAQEAAEdWTgQAAACL\"]\n\n$&gt; cat alert | modsec-rulereport.rb --runtime --target --byid\n# ModSec Rule Exclusion: 942410 : SQL Injection Attack\nSecRule REQUEST_URI \"@beginsWith \/drupal\/index.php\/search\/node\" \"phase:1,nolog,pass,id:10000,ctl:ruleRemoveTargetById=942410;ARGS:keys\"\n\n\n\nAlert 2:\n\n&#91;2020-03-09 12:53:18.862460] &#91;-:error] 127.0.0.1:42014 XmYuLsHShsLLaLoWNWnOBwAAAAA &#91;client 127.0.0.1] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. &#91;file \"\/home\/dune73\/data\/git\/crs-official\/rules\/REQUEST-949-BLOCKING-EVALUATION.conf\"] &#91;line \"91\"] &#91;id \"949110\"] &#91;msg \"Inbound Anomaly Score Exceeded (Total Score: 10)\"] &#91;severity \"CRITICAL\"] &#91;tag \"application-multi\"] &#91;tag \"language-multi\"] &#91;tag \"platform-multi\"] &#91;tag \"attack-generic\"] &#91;hostname \"localhost\"] &#91;uri \"\/index.html\"] &#91;unique_id \"XmYuLsHShsLLaLoWNWnOBwAAAAA\"]\n\n$&gt; cat alert | modsec-rulereport.rb --runtime --target --byid\n\nADVISORY\n--------\n\n***This is not a rule exclusion. Do not paste this into your configuration.***\n\nThere is an alert on rule 949110. This rule has a special role in the rule set. It\nexamines the anomaly score of the incoming request. If the anomaly score is\nequal or higher than the anomaly threshold, then the rule blocks the request.\n\nYou should therefore not disable this rule. Instead you should work on different\nrules so you can avoid false positives and make sure the anomaly score is low.\n\n\n\nAlert 3: \n\n&#91;2021-06-03 22:54:45.858724] &#91;-:error] - - &#91;client 127.0.0.1] ModSecurity: Warning. Pattern match \"(?i:(?:(?:s(?:t(?:d(?:dev(_pop|_samp)?)?|r(?:_to_date|cmp))|u(?:b(?:str(?:ing(_index)?)?|(?:dat|tim)e)|m)|e(?:c(?:_to_time|ond)|ssion_user)|ys(?:tem_user|date)|ha(1|2)?|oundex|chema|ig?n|pace|qrt)|i(?:s(null|_(free_lock|ipv4_compat|ipv4_mapped|ipv4|ipv ...\" at ARGS:keys. &#91;file \"\/apache\/conf\/owasp-modsecurity-crs-3.0.0-rc1\/rules\/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\"] &#91;line \"860\"] &#91;id \"942410\"] &#91;rev \"2\"] &#91;msg \"SQL Injection Attack\"] &#91;data \"Matched Data: union select found within ARGS:keys: union select from users\"] &#91;severity \"CRITICAL\"] &#91;ver \"OWASP_CRS\/3.3.0\"] &#91;maturity \"9\"] &#91;accuracy \"8\"] &#91;tag \"OWASP_CRS\/WEB_ATTACK\/SQL_INJECTION\"] &#91;tag \"WASCTC\/WASC-19\"] &#91;tag \"OWASP_TOP_10\/A1\"] &#91;tag \"OWASP_AppSensor\/CIE1\"] &#91;tag \"PCI\/6.5.2\"] &#91;tag \"paranoia-level\/2\"] &#91;hostname \"localhost\"] &#91;uri \"\/drupal\/index.php\/search\/node\"] &#91;unique_id \"WBuyJX8AAQEAAEdWTgQAAACL\"]\n\n$&gt; cat alert | modsec-rulereport.rb --runtime --target --byid --metainformation --baseruleid 42410\n# ModSec Rule Exclusion: 942410 : SQL Injection Attack\n# Based on following alert:\n# \/\/localhost\/drupal\/index.php\/search\/node\n# timestamp: 2021-06-03 22:54:45.858724 id: WBuyJX8AAQEAAEdWTgQAAACL\n# alert: 942410 Matched Data: union select found within ARGS:keys: union...\n# ruleset\/version: OWASP_CRS\/3.3.0\nSecRule REQUEST_URI \"@beginsWith \/drupal\/index.php\/search\/node\" \"phase:1,nolog,pass,id:42410,ctl:ruleRemoveTargetById=942410;ARGS:keys\"\n<\/code><\/pre>\n\n\n\n<p>Of course, there are also single-letter variants for the command line options. <code>-rTi<\/code> brings the rule exclusion quoted above.<\/p>\n\n\n\n<p>Download: <a href=\"https:\/\/www.netnea.com\/files\/modsec-rulereport.rb\" target=\"_blank\" rel=\"noreferrer noopener\">modsec-rulereport.rb<\/a><\/p>\n\n\n\n<p>The English tutorial <a rel=\"noreferrer noopener\" href=\"https:\/\/www.netnea.com\/cms\/apache-tutorial-8_handling-false-positives-modsecurity-core-rule-set\/\" target=\"_blank\">Handling False Positives with the OWASP ModSecurity Core Rule Set<\/a> has been adopted to the new script. The German one will be updated soon.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The ModSecurity \/ OWASP Core Rule Set tutorials here at netnea.com are visited by over 8,000 times a month. With many of the unique visitors, the auxiliary script modsec-rulereport.rb is a favorite. The tool allows you to generate rule exclusions based on a ModSecurity rule alert message. Today, I&#8217;m presenting you a new version of [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":{"0":"post-1811","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-security","7":"czr-hentry"},"_links":{"self":[{"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/posts\/1811","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/comments?post=1811"}],"version-history":[{"count":3,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/posts\/1811\/revisions"}],"predecessor-version":[{"id":1819,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/posts\/1811\/revisions\/1819"}],"wp:attachment":[{"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/media?parent=1811"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/categories?post=1811"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/tags?post=1811"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}