Forum

I'm having a problem with ipv6 with hiawatha. For example alot of the logs show the servers ipv6 causing csrf problems when running cron like this.

2b32:3r60:110:3da3::1|Wed 24 Oct 2018 02:53:35 -0400|domain.com|/wp-cron.php?doing_wp_cron=1541234015.0831990242004391234250|CSRF

I already whitelist the ip6 to ::/64 and remove the leading 0 in the address because log removes it but the csrf protection blocks it. How to resolve this?

Sorry for my ignorance but I disabled ipv6 and my ipv4 gets blocked in CSRF Log. Is there a way to whitelist the CSRF/XSS/SQLi prevention?

Yes, use RequestLimitMask for SQLi. There is no whitelist for CSRF or XSS, because it's the victim, not the attacker. Therefor, it will not be banned.

Thanks Hugo. So there is no way to get the server ipv4/ipv6 requests to bypass csrf without disabling the protection? What about omitting it in the exploit.log?

Thanks for any info.

What you can do is add the URL of your website as the Referer header to your request. That's what Hiawatha checks for.