ADC

Custom keyword support for JSON payload

Starting from NetScaler release 13.1 build 33.x, you can add keywords of your choice and check if these configured keywords are present in the JSON payload.

SQL injection and command injection have a predefined set of keywords or patterns that they look for in the incoming requests. These predefined sets of keywords might not cover all the keywords as per your requirement and might lead to an increase in the number of false positives. With this feature, you can add keywords that are not covered in the SQL injection and command injection checks and therefore, reduce the false positives.

After adding the keywords, configure the NetScaler appliance to check if the added keywords are detected in the incoming requests. Then configure the appliance to perform one of the following actions:

Add custom keywords using the CLI

Complete the following steps to add a custom keyword using the CLI:

  1. Configure a web application firewall profile and define an action when the custom keyword is detected in the incoming request.

    set appfw profile <profile-name> –blockKeywordAction (block | log | stats | none)
    <!--NeedCopy-->
    

    By default, blockKeywordAction is set to none.

    Example:

    set appfw profile test_profile -blockKeywordAction block
    <!--NeedCopy-->
    
  2. Bind the web application firewall profile with your custom keywords.

    bind appfw profile <profile_name> -jsonblockkeyword <keyword_name> -key <expression> -JSONBlockkeywordURL <expression> -isRegex ( REGEX | NOTREGEX ) -JSONBlockKeywordType ( literal | PCRE ) [-comment <string>] [-resourceId <string>] [-RuleType ( ALLOW | DENY )] [-state ( ENABLED | DISABLED )] [-isAutoDeployed ( AUTODEPLOYED |NOTAUTODEPLOYED )]
    <!--NeedCopy-->
    

    Example:

    To add blockkeyword as the custom keyword and bind it to test-profile, run the following command:

    bind appfw profile test_profile -jsonblockKeyword "blockkeyword" -key id -jsonblockkeywordurL "/signup.php" JSONBlockKeywordType literal -state enable
    <!--NeedCopy-->
    

View the statistics of the custom keyword in CLI

Run the following command to view the statistics of the custom keyword:

stat appfw profile <profile name>
<!--NeedCopy-->

Example:

stat appfw profile test_profile
<!--NeedCopy-->

Add custom keywords using the GUI

Complete the following steps to add keywords using the GUI:

  1. Navigate to Security > NetScaler Web App Firewall Profile > Profiles.

  2. Select a custom profile and click Edit.

    Note

    Make sure that the selected profile type is JSON.

  3. Go to the Advanced Settings section and click Deny Rules.

  4. Select the Block Keyword option for the JSON check type and click Edit.

  5. Click Add and set the required parameters.

    Add parameters

  6. Click Create.

    The custom keyword that you added is listed in the Block Keyword Deny Rules page.

  7. Go to the Advanced Settings section and click Security Checks.

  8. Select Block Keyword and click Action Settings.

  9. Select the required actions and click OK.

View the statistics of the custom keyword in GUI

Complete the following steps to view the statistics of the custom keyword in the GUI:

  1. Navigate to Security > NetScaler Web App Firewall > Profiles.

  2. In the details pane, select a Web App Firewall profile and click Statistics.

    The NetScaler Web App Firewall Statistics page displays the custom keyword traffic and violation details.

  3. You can select Tabular View or switch to Graphical View to display the data in a tabular or graphical format.

Custom keyword support for JSON payload