Example Use Cases For Rules - Dell SonicWall SRA 4200 Administrator's Manual

Operation
URL Decode
URL Decode (Unicode)
Trim

Example Use Cases for Rules

This section provides examples of positive and negative security models, as well as several
examples showing the use of advanced operations to provide a deeper understanding of these
anti-evasive techniques.
Example – Positive Security Model: Blocking Bad Logins
To prevent login to an Application Offloaded Web site if the length of the password is less than
8 characters, you would create a rule chain containing the following two rules:
1.
2.
270 | SRA 6.0 Administrator's Guide
Description
Use the URL Decode operation to decode URL encoded strings in the input.
Use the URL Decode (Unicode) operation to handle %uXXXX encoding.
URL encoding is used to safely transmit data over the Internet when URLs
contain characters outside the ASCII character set.
NOTE: Do not use these operations against an input that has been decoded
already.
This is an anti-evasive operation to prevent hackers from using URL encoding
to bypass rules, knowing that the backend Web server can interpret their mali-
cious input after decoding it.
For example, the URI
www.eshop.com/hack URL
Use the Trim operation to remove spaces before and after the input data
before the comparison. Extra spaces can cause a rule to not match the input,
but are interpreted by the backend Web application.
This is an anti-evasive operation to prevent hackers from adding spaces
before and after the input data to bypass the rule.
Select Host as the Variable and click + to add it, set the Operator to Equals String, and
set Value to the Virtual Host name of the portal. This checks that the Host header of the
login request matches the site you are trying to protect. In this case, the rule chain is only
being applied to one site.
Select Parameter Value as the Variable and type password into the selection field, then
click + to add the variable and selected item to the rule, set the Operator to < (less than),
and set Value to 8. Select String Length in the Advanced Operations list to compute the
length of the password form parameter.
www.eshop.com/hack+URL%3B
by this operator before the comparison is made.
is converted to