Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit 9843858

Browse files
lifeformslifeforms
committed
Merge branch 'v3.2/dev' into v3.3/dev
2 parents 8b5180b + 2bbef4a commit 9843858

File tree

1 file changed

+147
-33
lines changed

1 file changed

+147
-33
lines changed

‎util/send-payload-pls.sh‎

100644100755
Lines changed: 147 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,170 @@
11
#!/bin/bash
22
#
3-
# Script to post a payload against a local webserver at each paranoia level
3+
# Script to post a payload against a local webserver at each paranoia level.
44
#
5-
# Note: Webserver has to be prepared to take desired PL as Request Header "PL"
6-
# Check the access log format at https://www.netnea.com/cms/apache-tutorial-5_extending-access-log/
5+
# Note: Webserver has to be prepared to take desired PL as Request Header "PL".
76
#
7+
# WARNING: Setting the paranoia level using a header without proper
8+
# authentication and authorization is extremely dangerous, and is not
9+
# recommended for production.
10+
#
11+
# Check how to use the Christian Folini's Apache access log format at:
12+
# https://www.netnea.com/cms/apache-tutorial-5_extending-access-log/
13+
#
14+
# LogFormat "%h %{GEOIP_COUNTRY_CODE}e %u [%{%Y-%m-%d %H:%M:%S}t.%{usec_frac}t] \"%r\" %>s %b \
15+
# \"%{Referer}i\" \"%{User-Agent}i\" \"%{Content-Type}i\" %{remote}p %v %A %p %R \
16+
# %{BALANCER_WORKER_ROUTE}e %X \"%{cookie}n\" %{UNIQUE_ID}e %{SSL_PROTOCOL}x %{SSL_CIPHER}x \
17+
# %I %O %{ratio}n%% %D %{ModSecTimeIn}e %{ApplicationTime}e %{ModSecTimeOut}e \
18+
# %{ModSecAnomalyScoreInPLs}e %{ModSecAnomalyScoreOutPLs}e \
19+
# %{ModSecAnomalyScoreIn}e %{ModSecAnomalyScoreOut}e" extended
20+
#
21+
# This script assumes %{ModSecAnomalyScoreIn}e is the column before to last in
22+
# the access log, if this does not match your LogFormat the script won't work
23+
# For better results set the SecDefaultAction to 'pass'.
24+
#
25+
# The anomaly score envvar can be set as follows:
26+
# SecAction "id:90101,phase:5,pass,nolog,\
27+
# setenv:ModSecAnomalyScoreIn=%{TX.anomaly_score}"
28+
#
29+
# Sample rule to setup the PL dynamically from localhost"
30+
# SecRule REMOTE_ADDR "@ipMatch 127.0.0.1,192.168.0.128" \
31+
# "id:90102,phase:1,pass,capture,log,auditlog,\
32+
# msg:'Setting engine to PL%{matched_var}',chain"
33+
# SecRule REQUEST_HEADERS:PL "@rx ([1-4])" \
34+
# "setvar:'tx.executing_paranoia_level=%{matched_var}'"
35+
836
# Path to CRS rule set and local files
9-
CRS="/usr/share/modsecurity-crs/rules/"
37+
CRS="/usr/share/modsecurity-crs/rules"
1038
accesslog="/apache/logs/access.log"
1139
errorlog="/apache/logs/error.log"
40+
URL="localhost:40080"
41+
protocol="http"
42+
while [[ $# > 0 ]]
43+
do
44+
case "$1" in
45+
-c|--crs)
46+
CRS="$2"
47+
shift
48+
;;
49+
-a|--access)
50+
accesslog="$2"
51+
shift
52+
;;
53+
-e|--error)
54+
errorlog="$2"
55+
shift
56+
;;
57+
-u|--url)
58+
URL="$2"
59+
shift
60+
;;
61+
-r|--resolve)
62+
resolve="$2"
63+
resolve="--resolve $resolve"
64+
shift
65+
;;
66+
--protocol)
67+
protocol="$2"
68+
shift
69+
;;
70+
-P|--payload)
71+
PAYLOAD="$2"
72+
shift
73+
;;
74+
-h|--help)
75+
echo "Usage:"
76+
echo " --access \"/apache/logs/access.log\""
77+
echo " --error \"/apache/logs/error.log\""
78+
echo " --url \"localhost:40080\""
79+
echo " --resolve \"someservername:40080:localhost\""
80+
echo " --protocol \"https\""
81+
echo " --payload \"/tmp/payload\""
82+
echo " --help"
83+
exit 1
84+
;;
85+
esac
86+
shift
87+
done
88+
89+
echo "Using CRS: $CRS"
90+
echo "Using accesslog: $accesslog"
91+
echo "Using errorlog: $errorlog"
92+
echo "Using URL: $URL"
93+
echo "Using protocol: $protocol"
94+
95+
if [ -z "${PAYLOAD+x}" ]; then
96+
echo "Please submit valid payload file as parameter. This is fatal. Aborting."
97+
$0 -h
98+
echo "Examples:"
99+
echo " ./send-payload-pls.sh -a /logs/test/access.log \
100+
-e /logs/test/error.log -u test.test.test.com:6443 --protocol https \
101+
--payload /tmp/payload --resolve test.test.test.com:6443:192.168.0.128"
102+
echo " ./send-payload-pls.sh -a /logs/test/access.log \
103+
-e /logs/test/error.log -u test.test.test.com:6443 --protocol https \
104+
--payload 'or 1=1;--' --resolve test.test.test.com:6443:192.168.0.128"
105+
exit 1
106+
fi
12107

13108
# URL of web server
14-
URL="localhost:40080"
15109

16110
# Rules per Paranoia level
17-
# Paranoia level 1 rules, rule 012 is the phase 2 rule delimiter of the start of PL1
18-
# Paranoia level 1 rules, rule 013 is the phase 1 rule delimiter of the finish of PL1
111+
# Paranoia level 1 rules, rule 012 is the delimiter of the start of PL1
112+
# Paranoia level 1 rules, rule 013 is the delimiter of the end of PL1
19113
PL1=$(awk "/012,phase:2/,/013,phase:1/" $CRS/*.conf |egrep -v "(012|013),phase" |egrep -o "id:[0-9]+" |sed -r 's,id:([0-9]+),\1\\,' |tr -t '\n' '\|' |sed -r 's,\\\|$,,')
20114

21-
# Paranoia level 2 rules, rule 014 is the phase 2 rule delimiter of the start of PL2
22-
# Paranoia level 2 rules, rule 015 is the phase 1 rule delimiter of the finish of PL2
115+
# Paranoia level 2 rules, rule 014 is the delimiter of the start of PL2
116+
# Paranoia level 2 rules, rule 015 is the delimiter of the end of PL2
23117
PL2=$(awk "/014,phase:2/,/015,phase:1/" $CRS/*.conf |egrep -v "(014|015),phase" |egrep -o "id:[0-9]+" |sed -r 's,id:([0-9]+),\1\\,' |tr -t '\n' '\|' |sed -r 's,\\\|$,,')
24118

25-
# Paranoia level 3 rules, rule 016 is the phase 2 rule delimiter of the start of PL3
26-
# Paranoia level 3 rules, rule 017 is the phase 1 rule delimiter of the finish of PL3
119+
# Paranoia level 3 rules, rule 016 is the delimiter of the start of PL3
120+
# Paranoia level 3 rules, rule 017 is the delimiter of the end of PL3
27121
PL3=$(awk "/016,phase:2/,/017,phase:1/" $CRS/*.conf |egrep -v "(016|017),phase" |egrep -o "id:[0-9]+" |sed -r 's,id:([0-9]+),\1\\,' |tr -t '\n' '\|' |sed -r 's,\\\|$,,')
28122

29-
# Paranoia level 4 rules, rule 018 is the phase 2 rule delimiter of the start of PL4
30-
# Paranoia level 4 rules, "Paranoia Levels Finished" delimiter of the finish of PL4
123+
# Paranoia level 4 rules, rule 018 is the delimiter of the start of PL4
124+
# Paranoia level 4 rules, "Paranoia Levels Finished" delimiter of the end of PL4
31125
PL4=$(awk "/018,phase:2/,/Paranoia Levels Finished/" $CRS/*.conf |egrep -v "018,phase" |egrep -o "id:[0-9]+" |sed -r 's,id:([0-9]+),\1\\,' |tr -t '\n' '\|' |sed -r 's,\\\|$,,')
32126

33-
if [ ! -z "$1" ]; then
34-
PAYLOAD="$1"
35-
else
36-
echo "Please submit payload as parameter. This is fatal. Aborting."
37-
exit 1
38-
fi
39-
40127
echo "Sending the following payload at multiple paranoia levels: $PAYLOAD"
41128
echo
42129

43-
for PL in 1 2 3 4; do
44-
echo "--- Paranoia Level $PL ---"
45-
echo
46-
if [ -f "$PAYLOAD" ]; then
47-
curl $URL --data-binary "@$PAYLOAD" -H "PL: $PL" -o /dev/null -s
48-
else
49-
curl $URL -d "$PAYLOAD" -H "PL: $PL" -o /dev/null -s
50-
fi
51-
grep $(tail -1 $accesslog | cut -d\" -f11 | cut -b2-26) $errorlog | sed -e "s/.*\[id \"//" -e "s/\(......\).*\[msg \"/\1 /" -e "s/\"\].*//" -e "s/(Total .*/(Total ...) .../" -e "s/Incoming and Outgoing Score: [0-9]* [0-9]*/Incoming and Outgoing Score: .../" | sed -e "s/$PL1/& PL1/" -e "s/$PL2/& PL2/" -e "s/$PL3/& PL3/ "-e "s/$PL4/& PL4/" | sort -k2
52-
echo
53-
echo -n "Total Incoming Score: "
54-
tail -1 $accesslog | cut -d\" -f11 | cut -d\ -f14 | tr "-" "0"
55-
echo
130+
for PL in 1 2 3 4; do
131+
echo "--- Paranoia Level $PL ---"
132+
echo
133+
if [ -f "$PAYLOAD" ]; then
134+
curl $protocol://$URL $resolve -k --data-binary "@$PAYLOAD" -H "PL: $PL" -o /dev/null -s
135+
else
136+
curl $protocol://$URL $resolve -k -d "$PAYLOAD" -H "PL: $PL" -o /dev/null -s
137+
fi
138+
139+
# Here are three ways to get the transaction unique id,
140+
# the first one is Christian's format, second is Spartan's format,
141+
# and the third one tries to guess which is the unique id using a
142+
# regular expression, the first two require specific format.
143+
# The automatic format detection may cause the script to malfunction.
144+
# Uncomment only the required format.
145+
# To use Christian's accesslog format uncomment the following line
146+
uniq_id=$(tail -1 $accesslog | cut -d\" -f11 | cut -b2-26)
147+
148+
# To use Spartan's accesslog format (21 col) uncomment the following line
149+
#uniq_id=$(tail -1 $accesslog | awk '{print $21}')
150+
151+
# To use the automatic unique_id detection uncomment the following line
152+
#uniq_id=$(tail -1 $accesslog | egrep -o '[a-zA-Z0-9]{26,28}')
153+
154+
echo "Tracking unique id: $uniq_id"
155+
156+
grep $uniq_id $errorlog | sed -e "s/.*\[id \"//" -e "s/\(......\).*\[msg \"/\1 /" -e "s/\"\].*//" -e "s/(Total .*/(Total ...) .../" -e "s/Incoming and Outgoing Score: [0-9]* [0-9]*/Incoming and Outgoing Score: .../" | sed -e "s/$PL1/& PL1/" -e "s/$PL2/& PL2/" -e "s/$PL3/& PL3/ " -e "s/$PL4/& PL4/" | sort -k2 | sed -r "s/^([0-9]+)$/\1 FOREIGN RULE NOT IN CRS/"
157+
158+
echo
159+
echo -n "Total Incoming Score: "
160+
161+
# Here are two ways to get the transaction anomaly score,
162+
# the first one is Christian's format, second is Spartan's format
163+
# To use Christian's accesslog format uncomment the following line
164+
tail -1 $accesslog | cut -d\" -f11 | cut -d\ -f14 | tr "-" "0"
165+
166+
# To use Spartan's accesslog format (21 col) uncomment the following line
167+
# To use a different column change the $NF value, e.g. $(NF-1)
168+
#tail -1 $accesslog | awk '{print $NF}' | tr "-" "0"
169+
echo
56170
done

0 commit comments

Comments
 (0)