Nimbostratushello, We recently came to know the F5 ASM is not blocking session management attacks which discloses the admin username and password on reply.
May I know if this has something to do with attack signatures or through dynamic parameters.
Regards,
Akhtar
CirrocumulusCan you please explain the exact nature of the attack you are referring to? What exactly are you observing?
Nimbostratus
CirrusCan you please explain the exact nature of the attack you are referring to? What exactly are you observing?
NimbostratusNimbostratus
Nimbostratus
CirrocumulusYou can encrypt the sensitive cookie using the HTTP Profile Cookie Encryption feature and you can mask the sensitive password in the response using DataGuard in ASM. Be careful though as DataGuard masking can actually break your application if it is actually expecting the administrator password to be present in clear-text in the response.
Sam
EmployeeHello Akhtar, you might try to add the "pwdadmin2" parameter to your parameters list, and then configure it as a sensitive parameter on the Properties screen for it. You will have to test it then to make sure that masking it doesn't harm the functionality of your app.