WAF 330131
| Rule 330131 | |
|---|---|
| Status | Active |
| Alert Message | Atomicorp.com WAF Rules: Fake Mozilla User Agent String Detected |
Contents |
Description
This rules detects invalid Mozilla user agent strings. For example, it will detect both when clients generate fake Mozilla user agent strings, as well was Netscape strings.
That is, if a client pretends to be using the old web browser Netscape (which is the forefather of Mozilla, and uses the user agent string Mozilla) this rule will block access. Netscape browsers are both unlikely to be in use, and would not work correctly with modern websites.
Troubleshooting
False Positives
A false positive can occur if a user is using an extremely old version of Netscape.
Tuning Guidance
If you know you have users using extremely old versions of the Netscape browser, you will need to disable this rule. We do not recommend you use old versions of browsers, they are known to contain security vulnerabilities that may cause your users to be compromised.
Additional Information
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
Notes
Attackers will often use old Netscape and invalid Mozilla client user-agent headers to try to trick web applications into trusting them, or to hide activity by pretending to be a legitimate user.
