ModSecurity is a web application firewall for Apache, IIS ang Nginx. It provides logging, monitoring and filtering features.
-3
votes
1answer
70 views
Web GUI for Snort + ModSecurity [closed]
I'm trying to find a suitable (or easily modifiable) web GUI for snort + modsecurity logs. As far as I know, Splunk can do that by installing the snort and modsecurity plugins. Is there any other ...
1
vote
2answers
59 views
Remote File Injection in ARGS blocking form updating database
I am getting a page forbidden because mod_security blocks it with Remote File Injection in ARGS rule.
How do I stop this apart from not including URLs in the form fields or removing the http:// ...
2
votes
1answer
67 views
How to do security configuration for ibm http server?
We are using IBM HTTP Server Version 7.0
Need help related to Cross Site Scripting Prevention in IBM http server.
Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
-1
votes
1answer
130 views
Using ModSecurity as transparent mode
I want to use Mod Security as transparent mode. Mod security WAF should be between server and client and client provided with only server's ip address to access the site. The client should not ...
4
votes
1answer
185 views
Securing a simple webservice against brute-force with mod-security
I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
1
vote
1answer
94 views
How to filter https traffic in mod-security WAF?
I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
0
votes
2answers
151 views
Is there an easy way to secure Apache on debian?
I run an Apache webserver with lots of PHP-sites of several customers.
I tried install apache-mod_security2 after this (german) tutorial
that is using these rulesets: ...
1
vote
2answers
129 views
Is apache mod_spamhaus still being maintained?
I only found this:
http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar
and that is from 2008
Is there any newer apache mod that is up-to-date?
Someone has experience with it? Maybe ...
1
vote
3answers
226 views
Testing Web Application Firewall Configuration (ModSecurity)
What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
3
votes
1answer
52 views
auditing mod security rule sets
Is there a audit system that can help me try my strings? Such as user agents, post/get data, a simple way to test general sql injections to see how my rule sets hold?
I know with fire fox I can ...
1
vote
1answer
158 views
Exclude file names from mod_security patterns
I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page.
For example, one problem ...
1
vote
1answer
145 views
Web Application Firewall Rule Optimization
Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
2
votes
2answers
181 views
Web Application Firewall Rules
For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
-2
votes
1answer
348 views
Safest and most secure way for backing up private data
Here is what happened, I first collected my data into one folder,tar'd it, encrypted it with gpg, put it in truecrypt container, and after that started to copy the container to another place, but ...
0
votes
2answers
474 views
What IDS Do you recommend? [closed]
I am running a Debian Squeeze VPS and need a good IDS. I have used snort before and it was quite good but i am wandering if there are any other good ones out there.
Preferably compatible with ...
0
votes
1answer
149 views
how to make a web based system that connects only the authorized user in the wi-fi access [closed]
this is for our thesis project. we proposed to study the Wi-Fi security in most related to the users.
0
votes
1answer
331 views
Mod_security rules-updater.pl fails to pull new release
Mod_security has a rules updater distributed with their release packages on sourceforge:
http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/
Usually, you can run the script ...
1
vote
1answer
309 views
Wireshark log analyzing
I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
2
votes
1answer
771 views
w00tw00t.at.ISC.SANS.DFind iptables fix - abusable?
It's only an idea. I've recently logged that my server is scanned by w00tw00t tools.
I found many solutions to this, such as use of apache mod-security, fail2ban, etc..
The one I want to speak ...
2
votes
1answer
458 views
Mod Security for apache2 blocks curl!
I'm trying to get my users lat and lng from their address using google's geocoding api but when mod security is enabled it prevents it and the script timesout. How can I add an exception by ip or ...
2
votes
2answers
205 views
ip-fragmentation and mod_security?
is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security?
the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
5
votes
4answers
1k views
Does default ModSecurity protect enough against XSS?
It's been a few years since I mucked around with modsecurity...
Will simply installing the package with the default rules provide enough validation to prevent any (okay, let's be honest - best we ...
7
votes
5answers
998 views
Master thesis topic - mod_security
I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...
7
votes
1answer
386 views
Relative importance of CHROOT for web servers
I have read extremely mixed opinions on the process of chrooting for a web server (non-shared environment). Some people swear by it, yet others say that it isn't as secure as everyone says.
Given ...
4
votes
2answers
376 views
How to improve VPS security?
I’m using Linux based VPS hosting, and a firewall and mod_sec help to keep most hackers out. However, over the last couple of weeks I noticed several entries in mod_sec showing that an unknown domain ...
