Difference between revisions of "WAF 330131"
(Created page with "{{Infobox |header1= Rule 330131 |label2 = Status |data2 = Active |label3 = Alert Message |data3 = Atomicorp.com WAF Rules: Fake Mozilla User Agent String Detected }} = Descri...") |
m (→Description) |
||
| Line 11: | Line 11: | ||
This rules detects invalid Mozilla user agent strings. For example, it will detect both when clients generate fake Mozilla user agent strings, as well was Netscape strings. | This rules detects invalid Mozilla user agent strings. For example, it will detect both when clients generate fake Mozilla user agent strings, as well was Netscape strings. | ||
| − | That is, if a client pretends to be using the old web browser Netscape (which is the forefather of Mozilla, and uses the user agent string Mozilla) this rule will block access. Netscape browsers are both unlikely to be in use, and would not work correctly with modern websites. | + | That is, if a client pretends to be using the old web browser Netscape (which is the forefather of Mozilla, and uses the user agent string Mozilla) this rule will block access. Netscape browsers are both unlikely to be in use, and would not work correctly with modern websites. |
| + | |||
| + | == Examples == | ||
| + | |||
| + | User-Agent: Mozilla/5.1 (X11; U; Linux i686; en-US; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Hv3/alpha | ||
| + | |||
| + | There are no browsers that use Mozilla 5.1. All browsers use either Mozilla 4.0 or Mozilla 5.0. There are no .1, .2, etc. Mozilla User-Agents. | ||
= Troubleshooting = | = Troubleshooting = | ||
Revision as of 10:01, 7 May 2013
| Rule 330131 | |
|---|---|
| Status | Active |
| Alert Message | Atomicorp.com WAF Rules: Fake Mozilla User Agent String Detected |
Contents |
Description
This rules detects invalid Mozilla user agent strings. For example, it will detect both when clients generate fake Mozilla user agent strings, as well was Netscape strings.
That is, if a client pretends to be using the old web browser Netscape (which is the forefather of Mozilla, and uses the user agent string Mozilla) this rule will block access. Netscape browsers are both unlikely to be in use, and would not work correctly with modern websites.
Examples
User-Agent: Mozilla/5.1 (X11; U; Linux i686; en-US; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Hv3/alpha
There are no browsers that use Mozilla 5.1. All browsers use either Mozilla 4.0 or Mozilla 5.0. There are no .1, .2, etc. Mozilla User-Agents.
Troubleshooting
False Positives
A false positive can occur if a user is using an extremely old version of Netscape.
Tuning Guidance
If you know you have users using extremely old versions of the Netscape browser, you will need to disable this rule. We do not recommend you use old versions of browsers, they are known to contain security vulnerabilities that may cause your users to be compromised.
Additional Information
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
Notes
Attackers will often use old Netscape and invalid Mozilla client user-agent headers to try to trick web applications into trusting them, or to hide activity by pretending to be a legitimate user.
