Take the 2-minute tour ×

is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security?

the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.

share|improve this question
thx guys. it was a misunderstanding. i thought mod_security would run standalone as a NIDS but its a reverse-proxy. fragroute does the trick for snort sans.org/security-resources/idfaq/fragroute.php –  baj May 4 '11 at 21:18
add comment

2 Answers

To the best of my knowledge, IP fragments are reconstructed before they're handed off to mod_security.
Essentially mod_security is simply a plugin to the webserver, and does not handle any IP stuff on it's own. What it receives is always just a complete HTTP request.

As such, the simple answer would be "No".

If you take your evasion concept (split attack between different packets) and raise this to the application level, there may be room to play there.
E.g. is it possible to run the attack using 2 HTTP requests? That is a very application-specific issue, and would not be trivial at all.

More trivially, however, what about HTTP Range requests?
I'm sorry to say I do not know the answer here, if mod_security knows how to block them.
Most other WAFs do, however, and those that don't have been thoroughly chewed out...

share|improve this answer
i was thinking about the standalone version not the module. but i guess its preassembled there too. cant find anything on google –  baj May 4 '11 at 1:44
I didnt know modsecurity comes as a standalone... Are you referring to the OWASP package, or something else? Got link? –  AviD May 4 '11 at 6:50
add comment

AviD was on the right track with the idea of taking IP frag attack concepts for evading network level IDS and applying it to layer 7 http data. If you wanted to split up say an SQLi payload so that it may evade input filters and still work against the back-end system, the attack technique is called "HTTP Parameter Pollution (HPP)". HPP is an attack where the user sends a request where multiple parameters have the same name. In these cases, there is a wide level of variance in how the apps will respond. Will they take the first payload? The last? In the case of ASP/ASP.NET sites, they actually will concatenate all payloads with the same name. This allows for a "fragmentation" type of attack. See my previous blog post on the topic - http://tacticalwebappsec.blogspot.com/2009/05/http-parameter-pollution.html

and here


Also of note - the current version of the OWASP ModSecurity Core Rule Set (CRS) has an experimental ruleset for HPP which will mimic ASP and concatenate any params with the same names into custom TX variables for inspection by later rules -


Cheers, Ryan

share|improve this answer
Thanks, @Ryan! And as long as you're on the line here :), what about range requests? Does modsecurity properly handle these, and apply rules correctly? How - aggregating, dropping, other? –  AviD May 4 '11 at 13:04
Can you give more info as to your Range request issue? You mean a request that includes a Range request header? –  Ryan Barnett May 4 '11 at 13:23
@Ryan yes, I mean a request that includes Range headers. As you know, this can cause "special" behavior, where the exploit would not appear all at once, but split in two. This could allow an attacker to evade some types of WAF rules, unless explicitly handled for by the WAF. An issue that has buggered some of the other WAF products in the past... –  AviD May 4 '11 at 13:41
Hmm, not sure I see how this would be problem for any WAF. The requests are treated as stand alone so rules would be applied to each of them. If there is a range header - that is just asking for specific portions of the response payload. The inbound Range requests aren't "reassembled" server-side like the concept of ip fragmentation. The idea with Range is that, with HTTP v1.1 pipelining, the response bodies can be send asynchronously and then the client is responsible for putting them back together in the right sequence. The server is treating each Range request as stand alone. –  Ryan Barnett May 4 '11 at 14:16
Right, and modsecurity treats each response as standalone too. I guess this problem would only be relevant if you have rules that apply to your response - but if so, it would be possible to evade any of those rules, unless range headers are accounted for. –  AviD May 4 '11 at 15:07
show 2 more comments

Your Answer


