Tamper Rules

Overview

The Tamper rule is a feature of Haltdos WAF that provides encryption for user input fields to protect from browser-based malware stealing user's credentials. It also validates hidden input fields.

Tamper Rules

How to Use

1. Follow the links: WAF > Listener > Security Profiles > Rules > Tamper Rules

2. Click on Add Rule and set relevant parameters described in the table below.

3. Click on Save.

PARAMETERS	ACCEPTED VALUES	DEFAULT
Rule Name	String	Blank
Rule Message	String	Blank
Rule Priority	Integer	0
Tamper Action	Drop-down	None
Rule Action	Drop-down	None
Attribute Extraction - URI	Valid URI eg. /login	Blank
Attribute Extraction - Method	Drop-down	All
Attribute Extraction - Evaluation Phase	Drop-down	Response Phase
Attribute Extraction - Extract From	Drop-down	Field Name
Attribute Extraction - Parameter	String	Blank
Attribute Validation - URI	Valid URI eg. /login	Blank
Attribute Validation - Method	Drop-down	All
Attribute Validation - Evaluation Phase	Drop-down	Response Phase
Attribute Validation - Extract From	Drop-down	Body Argument Value
Attribute Validation - Parameter	String	Blank

Attribute Extraction and Attribute Validation

Description

Rule Name

Specify a rule name to identify the rule which is to be created. The rule name takes alpha-numeric input.

Rule Message

Specify a rule message containing a detailed description to identify the rule which is to be created.

Rule Priority

Specify the priority for the rule for execution when matched with the request.

Tamper Action

Specify the tamper action to be taken for the request matched

Rule Action

Specify the action to be taken for the request matched i.e. Drop & Record Request, Record Request, Bypass Request, Temporary Blacklist Src IP, Redirect, Send Challenge, Send Response, Tarpit Src IP, No Action, Skip Learning, Send Empty Response.

Attribute Extraction

URI

Specify the URI on which the tamper rule will be applied.

• Example /login

Method

Select the HTTP method for the rule to extract when matched with the request.

Evaluation Phase

Select the evaluation phase for the rule i.e. Request or Response.

Extract From

Select the location from where you want to extract the attribute i.e. Field, Cookie, Header, Body, HTML.

Parameter

Specify the parameter which will be used for the rule for extraction.

Attribute Validation

URI

Specify the URI on which the tamper rule will be applied.

• Example /login

Method

Select the HTTP method for the rule to validate when matched with the request.

Evaluation Phase

Select the evaluation phase for the rule i.e. Request or Response.

Extract From

Select the location from where you want to validate the attribute i.e. Header, Cookie, Body, Argument Name or Value.

Parameter

Specify the parameter which will be used for the rule for extraction.