Web Application Defender's Cookbook

Chapter 8

Defending Session State

Now the general who wins a battle makes many calculations in his temple ere the battle is fought. The general who loses a battle makes but few calculations beforehand. Thus do many calculations lead to victory and few calculations to defeat: how much more no calculation at all! It is by attention to this point that I can foresee who is likely to win or lose.

—Sun Tzu in The Art of War

ModSecurity has a robust session-based persistent storage mechanism that allows defenders to track and analyze a variety of data about application users.

Recipe 8-1: Detecting Invalid Cookies

This recipe shows you how to determine when attackers attempt to submit invalid cookie data.

Ingredients

• OWASP ModSecurity Core Rule Set (CRS)
  • modsecurity_crs_40_appsensor_detection_point_2.3_session_exception.conf
• ModSecurity
  • RESPONSE_HEADERS:Set-Cookie variable
  • REQUEST_HEADERS:Cookie variable
  • setsid action
  • setvar action

Session-Guessing Attacks

Although web application authentication serves as the front line defense against unauthorized access, developers tend to overlook an underlying weakness. An attacker does not have to successfully authenticate to the application to gain access. He must simply submit a valid SessionID when making his requests! This means that attackers often focus on analyzing the strength (length, character set, and entropy) of SessionIDs. If the SessionID data is weak and predictable, an attacker may be able to guess a valid value and thus ...