topic Re: HTTP Post methods in Automation/API Discussions

HTTP Post methods

migration — Tue, 28 Sep 2010 14:50:55 GMT

Is there an way that i can create an custom application on PAN to block all HTTP post methods for a specific website or a group of websites? I did try by using some things as follows but dint realy work

Re: HTTP Post methods

SRA — Wed, 29 Sep 2010 02:22:03 GMT

There's already an app-id for facebook-posting:

http://ww2.paloaltonetworks.com/applipedia/apps/facebook-posting

See some examples that use the qualifier POST

Custom Application Definition: Popular Web File Sharing Upload 4-Pack

Custom Application Definition: 4Shared, Badongo, Depositfiles Upload

Re: HTTP Post methods

migration — Wed, 29 Sep 2010 06:22:24 GMT

Hi Savasarala,

Thank you for the inputs, i had taken facebook as an example. Is there a way to turn off the HTTP POST method irrespective of any specific website? i.e POST Method on any website is blocked.

Regards,

Sumukh Rao

Re: HTTP Post methods

Retired Member — Thu, 16 Jun 2011 04:29:46 GMT

This should be possible using a custom application signature. There is an example of how to create such a custom app in the PAN-OS 4.0 Administrator's Guide.

https://support.paloaltonetworks.com/index.php?option=com_pan&task=dl_tech_doc&filename=PA-4.0_Administrators_Guide.pdf

Page 163 gives an example of how to detect a POST to a blog site, though really it could be any website.

-Richard

Re: HTTP Post methods

junaid.khan — Mon, 09 Apr 2012 15:30:56 GMT

Good discussion, We are looking for similar filtering for any HTTP or HTTPS post, instead of blocking we would like to capture whats been posted and log it. So, that it could be used for investigation purpose. Is this something possible using PAN products?

Re: HTTP Post methods

jeanmarcn — Thu, 29 Nov 2012 22:00:38 GMT

Hi Guys I have been trying to get something similar to allow "http read" but drop "http write"(put, post, delete) and i am not able to create the application in version 5.0 as it does not corresponds with the Docs. Was wondering if someone knew how to do this.

Re: HTTP Post methods

rvanderveken — Thu, 25 Jul 2013 14:39:57 GMT

Hi,

You can block all http post requests using a vulnerability profile.

Please have a look at the following KB:

Rgds

Raf