Forum Discussion

Esteban_Araya_3's avatar
Esteban_Araya_3
Icon for Nimbostratus rankNimbostratus
Feb 08, 2019

Irule for DDOs Attacks!

Hello,

 

I´m working with a client that is getting DD0s attacks from random IPs. We have some limitations with the Hardware as we only have an ASA and the F5 but no additional security modules, and no IPs for the FW. In the ASA I have limited the embryonic connections using TCP Intercept.

 

In the F5 i would like to write an irule to deny incoming connections containing the following string: UNION%20SELECT%20

 

During the attacks we were able to identify that all the IPs contain UNION%20SELECT%20 in the url. So I´m wondering if this could work:

 

/usr/libexec/bigpipe rule DDOs '{

 

when HTTP_REQUEST {

 

if { [string tolower [HTTP::uri]] contains "UNION%20SELECT%20" } {

 

log local0. "Rejecting [HTTP::uri] request"

 

reject

 

}

 

}

 

}'

 

1- I need this apply for all the VIPs, for all the incoming connections. 2. I know that we should have Security Modules or an IPs or NextGen Firewall, but unfortunatly we have limitations. 3. Any other suggestion is welcome, I really appreciate your help!

 

application delivery
BIG-IP
iRules
security

6 Replies

Sort By
  • Rico's avatar
    Rico
    Icon for Cirrus rankCirrus
    Feb 08, 2019

    Your iRule should work except for the fact that you are checking for an uppercase string in a lowercase string.

    if { [string tolower [HTTP::uri]] contains "UNION%20SELECT%20" } {

    Should be

    if { [string tolower [HTTP::uri]] contains "union%20select%20" } {

    Here is some additional information on how to help mitigate DDoS attacks with the LTM module.

    F5 also has their Silverline product which could help. I figured I would mention it though I understand that the client may have restrictions.

  • Dylan_375544's avatar
    Dylan_375544
    Icon for Cirrocumulus rankCirrocumulus
    Feb 08, 2019

    The one issue I see is that you have "UNION%20SELECT%20" as what you are searching for.

     

    But you also have "stringtolower" which would change the URI to all lowercase, and therefore "UNION%20SELECT%20" would never actually show up since it is in CAPS.

     

    Change that to "union%20select%20"

     

    Hope that helps! If it does please up-vote and select this answer, it'd be greatly appreciated!

     

    -Dylan