Dell SMA 200 Administration Manual page 305

Table 36. Anti-Evasive Measures for Rules (Continued)
Measure
URL Decode
URL Decode (Unicode)
Trim
Example Use Cases for Rules
This section provides examples of positive and negative security models, as well as several examples showing
the use of anti-evasive measures to provide a deeper understanding of these anti-evasive techniques.
Example – Positive Security Model: Blocking Bad Logins
To prevent log in to an Application Offloaded Web site if the length of the password is less than 8 characters,
you would create a rule chain containing the following two rules:
1 Select Host as the Variable and click + to add it, set the Operator to Equals String, and set Value to
the Virtual Host name of the portal. This checks that the Host header of the login request matches the
site you are trying to protect. In this case, the rule chain is only being applied to one site.
2 Select Parameter Value as the Variable and type password into the selection field, then click + to add
the variable and selected item to the rule, set the Operator to < (less than), and set Value to 8. Select
String Length in the Anti-Evasive Measures list to compute the length of the password form
parameter.
The action for the rule chain would be set to Prevent.
Description
Use the URL Decode measure to decode URL encoded strings in the input. Use the
URL Decode (Unicode) measure to handle %uXXXX encoding. URL encoding is used
to safely transmit data over the Internet when URLs contain characters outside the
ASCII character set.
NOTE: Do not use these measures against an input that has been decoded already.
This is an anti-evasive measure to prevent hackers from using URL encoding to bypass
rules, knowing that the backend Web server can interpret their malicious input after
decoding it.
For example, the URI www.eshop.com/hack+URL%3B
www.eshop.com/hack URL
Use the Trim measure to remove spaces before and after the input data before the
comparison. Extra spaces can cause a rule to not match the input, but are
interpreted by the backend Web application.
This is an anti-evasive measure to prevent hackers from adding spaces before and
after the input data to bypass the rule.
by this operator before the comparison is made.
Figure 49 shows the rule chain for this example.
Dell SonicWALL Secure Mobile Access 8.5
is converted to
Administration Guide
305