Book Image

ModSecurity 2.5

Book Image

ModSecurity 2.5

Overview of this book

With more than 67% of web servers running Apache and web-based attacks becoming more and more prevalent, web security has become a critical area for web site managers. Most existing tools work on the TCP/IP level, failing to use the specifics of the HTTP protocol in their operation. Mod_security is a module running on Apache, which will help you overcome the security threats prevalent in the online world. A complete guide to using ModSecurity, this book will show you how to secure your web application and server, and does so by using real-world examples of attacks currently in use. It will help you learn about SQL injection, cross-site scripting attacks, cross-site request forgeries, null byte attacks, and many more so that you know how attackers operate. Using clear, step-by-step instructions this book starts by teaching you how to install and set up ModSecurity, before diving into the rule language with examples. It assumes no prior knowledge of ModSecurity, so as long as you are familiar with basic Linux administration, you can start to learn right away. Real-life case studies are used to illustrate the dangers on the Web today ñ you will for example learn how the recent worm that hit Twitter works, and how you could have used ModSecurity to stop it in its tracks. The mechanisms behind these and other attacks are described in detail, and you will learn everything you need to know to make sure your server and web application remain unscathed on the increasingly dangerous web. Have you ever wondered how attackers figure out the exact web server version running on a system? They use a technique called HTTP fingerprinting, and you will learn about this in depth and how to defend against it by flying your web server under a "false flag". The last part of the book shows you how to really lock down a web application by implementing a positive security model that only allows through requests that conform to a specific, pre-approved model, and denying anything that is even the slightest bit out of line.
Table of Contents (17 chapters)
ModSecurity 2.5
Credits
About the Author
About the Reviewers
Preface
Directives and Variables
Index

Lazy quantifiers


By default, regex engines will try to match as much as possible when applying a regex. If you matched The number is \d+ against the string The number is 108, then the entire string would match, as \d+ would be "greedy" and try to match as much as possible (hence matching \d+ against the entire number 108 and not just the first digit).

Sometimes you want to match as little as possible, and that is where lazy quantifiers come in. A lazy quantifier will cause the regex engine to only include the minimum text possible so that a match can be achieved. You make a quantifier lazy by putting a question mark after it. So for example to make the plus quantifier lazy, you write it as +?. The lazy version of our regex would thus be The number is \d+? and when matched against The number is 108, the resulting match would be The number is 1, as the lazy version of \d+ would be satisfied with a single digit, since that achieves the requirement of the plus quantifier of "one or more".

The following table lists the lazy quantifiers that are available for use.

Quantifier

Description

+?

Lazy plus.

*?

Lazy star.

??

Lazy question mark.

{min,max}?

Lazy range.

So when are lazy quantifiers needed? One example is if you're trying to extract the first HTML tag from the string This is <b>an example</b> of using bold text. If you use the regex <.+> then the resulting match will be <b>an example</b>, since the regex engine tries to be greedy and match as much as possible. In this case that causes it to keep trying to match after encountering the first > character, and when it finds the second >, it concludes that it has matched as much as it can and returns the match.

The solution in this case is to use the lazy version of the plus quantifier, which turns the regex into <.+?>. This will stop as soon as the first match is found, and so will return <b>, which is exactly what we wanted.