topic Re: Is it possible to block method POST in any website? in General Topics

Is it possible to block method POST in any website?

pjetiyanun — Thu, 04 Jul 2013 04:40:16 GMT

Hi guys,

Our company don't want employee to post anything on internet so we're trying to create custom application that block method POST on http-request-message. But when we're trying to write a pattern. It's always pop up an alert to say that at least 7 bytes require. we've tried it so many ways such as [a-zA-Z0-9] but it still won't working.

Can anybody advice us to write a pattern that will be match any message?

Best Regards,

Piyapol

Re: Is it possible to block method POST in any website?

UhMayYeah — Thu, 04 Jul 2013 04:54:27 GMT

Helpful References

For help with understanding strings or inputs that match a RegEx pattern, try Regex Tester.
For help with understanding RegEx, check: Regular expression - Wikipedia, the free encyclopedia or Regular-Expressions.info - Regex Tutorial, Examples and Reference - Regexp Patterns
For how the PAN RegEx engine works, refer to Regular expression syntax for patterns in custom app signatures

TechNote : Custom Application Signatures

Re: Is it possible to block method POST in any website?

sraghunandan — Thu, 04 Jul 2013 05:02:24 GMT

Similar discussion can be found here https://live.paloaltonetworks.com/message/14234#14234

Re: Is it possible to block method POST in any website?

sraghunandan — Thu, 04 Jul 2013 05:05:05 GMT

You can also refer page 156 of https://live.paloaltonetworks.com/docs/DOC-2029 under the heading Example - Detect a post to a specified blog

Re: Is it possible to block method POST in any website?

UhMayYeah — Thu, 04 Jul 2013 05:53:50 GMT

Typically for a Custom-Signature based on the HTTP-POST request ,you can add Context http-req-uri-path and then add a qualifier as http-method with Value=Post

Re: Is it possible to block method POST in any website?

mikand — Thu, 04 Jul 2013 18:15:24 GMT

In this case would it be best to create a custom app or a custom signature?

I (currently) think that creating a custom signature would be better that acts on all http traffic and by that set an default action of block (or alert).

Re: Is it possible to block method POST in any website?

pjetiyanun — Fri, 05 Jul 2013 02:11:43 GMT

Thankyou for all answer.

But I can't block path /imgs , /files because palo alto alert " The minimum length for this field is 7 ".

I test insert /imgs{7}. It not work.

Refer :

{ } Min/Max number of bytes.

Example: {10,20} matches any string that is between 10 and 20 bytes. This must be directly in front of fixed string, and only supports “.”.

Please share any idea to fix It.

Re: Is it possible to block method POST in any website?

Mark-Nakrop — Fri, 05 Jul 2013 04:42:17 GMT

We found the same problem here. I've try create an pattern like [a-zA-Z0-9] which should match everything already (tested on Regex Tester). And also use Byte Counter to count this pattern which it said 11 bytes. But On Paloalto, when we tried to add. Same errors pop up like this

-> signature -> PostMethod -> and-condition -> And Condition 1 -> or-condition -> Or Condition 1 -> operator -> pattern-match -> pattern '[a-zA-Z0-9]' is invalid. pattern must be at least 7 byte

Re: Is it possible to block method POST in any website?

mikand — Fri, 05 Jul 2013 08:17:49 GMT

Context: http-req-header

Qualifier: http-method

Value: POST

and yet it complains that there is no pattern... hmpf... so damn close 😞

Is there some kind of bogus wildcard one can use to make the GUI happy, like ******* (seven * in a row) or such?

There is this example in the manual which is sort of what is needed, except that this signature (which this thread is needing) should trigger on ANY site (no matter if its ipv4, ipv6 or fqdn) and that this example is an appid instead of a vuln signature which would be a better choice:

set application specifiedblog_posting category collaboration subcategory web-posting technology browser-based signature s1 and-condition a1 or-condition o1 operator pattern-match context http-req-host-header pattern specifiedblog.com qualifier http-method value POST