Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

ModSecurity is a web application firewall for Apache, IIS ang Nginx. It provides logging, monitoring and filtering features.

0
votes
0answers
10 views

ModSecurity false positive 941100 and 941160 when saving WordPress page [migrated]

I'm relatively new to ModSecurity and I have been trying to get my head around the rules for weeks. When saving a page in WordPress I was getting the following in modsecurity_audit.log: Message: ...
0
votes
1answer
25 views

Allow ModSecurity to pass specific HTML tags?

I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so: <br+/> <div+style="border:none;...
0
votes
1answer
56 views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
0
votes
1answer
60 views

Cookie Operations using Modsecurity Rules

Here, I'm trying to accomplish calling a Lua script from modsecurity rules. There are 2 components:- 1.example.com (WAF) 2.test.com (Web Application) test.com contains pages:- index.php ...
2
votes
1answer
89 views

ModSecurity Rule 973338

ModSecurity blocked access due to the following: [msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com"] [...
0
votes
0answers
39 views

Convert Mod_security to Snort

I can't seem to find a tool to convert mod_security rules to snort rules. I searched, maybe it was a bad search day for me, but didn't come up with anything recent. Does anyone know how to do this?
2
votes
2answers
2k views

Any Alternative to Ngrok for constant Connection? [closed]

Im trying to build RAT to test on my computer. I use ngrok for hacking on WAN. But ngrok has a problem of changing its subdomain once the connection is reset. So, I cant use ngrok for hacking over WAN....
-5
votes
1answer
110 views

what type of server is best for launching a vulnerable application on an Organization network? [closed]

For a demo purpose i need to install a vulnerable application and i tried using XAMP server but it opens up many ports and not safe to use it. so please recommend a server to launch a vulnerable demo ...
0
votes
2answers
156 views

ModSecurity Block based on ARGS_NAMES starting character

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post Example allow name=Joe Example block #name=Joe Test rule that is not working SecRule ...
0
votes
2answers
87 views

How to test ModSecurity rules against access/error logs?

I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my ...
0
votes
2answers
107 views

Can ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well?

Can the software ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well? A particular hosting company providing shared hosting told me that ModSecurity should cover ...
0
votes
1answer
135 views

How can I prevent modsecurity from logging binary data

In my modsecurity auditlog there is a binary file logged as text: How can I prevent modsecurity from bloating my logfiles with the content of binary files like that?
1
vote
1answer
80 views

Can attacker escalate its privileges if he has access a web Application running with www-data [closed]

I have deployed an opensource web Application named "opencart" it has simple password. My question is can attacker login my system and escalate privileges if he login web application and even know the ...
5
votes
1answer
292 views

Is it worth using ModSecurity on a single entry point websocket connection?

I'm trying to evaluate benefits of using ModSecurity in our system. From that what I read till now, I have feeling it is not very useful for us. In our web app, there is single entry point, which is ...
1
vote
0answers
123 views

apache modsecurity SecRule ipmatch errors

I am using: apache2-2.4.25-5.1.x86_64 apache2-mod_security2-2.9.0-6.1.x86_64 Apr 13 18:59:36 mail start_apache2[16810]: AH00526: Syntax error on line 1 of /etc/apache2/mod_security2.d/...
0
votes
1answer
934 views

Apache ModSecurity for HTTPS traffic? [duplicate]

I have installed Apache 2.4.7 with Drupal HTTPS site using Let's Encrypt cert. Mod_security is sucessfully installed, but is it able to defend against attacks, since the site is HTTPS? I tried ...
0
votes
2answers
632 views

Prestashop + mod_security concerns

Running a shared hosting service, a client contacted me if I could disable mod_security for their webapp. The thing is, there is this patchwork webshop CMS called Prestashop with some hair-raising ...
2
votes
0answers
2k views

Anyone can identify tool used to perform this attack?

recently I've identified that some hack attempt was performed at one of my servers. I have dumped nginx logs to github, please take a look and try to identify which tool was used to perform this ...
0
votes
1answer
217 views

Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability

We have a Windows Server 2012 R2 running Apache 2.2.27 and Apache tomcat8 version 1.0.15.0. Can you guys shed a few words on what the vulnerability is and also how to re-mediate this with the two ...
0
votes
0answers
173 views

Why does OWASP modsecurity block remote file inclusion for ?& in URL for Rule 950119

OWASP modsecurity rule 950119 for Remote File inclusion blocks the following URL: https://mydomain.com?myparam=http://mysite.com?&param2=abcd What's the issue with having ?& in an URL ...
2
votes
2answers
616 views

Should I expose HTTP status code 500 on a REST application?

In my Spring MVC 3 application, I am following REST patterns and lots of logic is based on HTTP status codes. For instance 500 defines a server error. But OWASP modsecurity says not to expose this ...
1
vote
1answer
684 views

Using user agent & inputs for SQL injection with ModSecurity WAF

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds ...
1
vote
2answers
84 views

What does ModSecurity bring to my hosting account?

I read about the hack at Ubuntu Forums yesterday. Since we hold customer data things like this always makes me worried, and I look to minimise our risk of attack. There is an option to enable ...
1
vote
1answer
111 views

Modsecurity Encrypted traffic in 3 tier architecture

The scenario is that we have 3 tier architecture DMZ > BEA > DB with end to end encryption the data is encrypted within DMZ > BEA > DB. I have read that modsecurity doest deal with encrypted traffic ...
0
votes
0answers
437 views

What's the difference between 'TX' and 'tx' in modsecurity rule

This page describes definition of 'TX' as following: "This is the transient transaction collection, which is used to store pieces of data, create a transaction anomaly score, and so on. The variables ...
1
vote
0answers
150 views

Identifying recon in web

I recently deployed mod_security module in my Apache Web Server. I know the OWASP CRS rules include tags to categorize attacks but I want to make higher level categories, particularly to identify ...
0
votes
1answer
306 views

Modsecurity create config file with rules for specific URL

I'm starting to learn about ModSecurity and rule creation so say I know a page in an web app is vulnerable to cross site scripting. The rule in question would look something like this: SecRule ARGS|...
1
vote
0answers
701 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
0
votes
1answer
198 views

OWASP + Atomic ModSecurity Rulesets - Too much?

Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be ...
0
votes
1answer
409 views

mod_security : affordable rule sets

I'm looking for practical advice on the OWASP rule set for mod_security. I've heard it has many false positives, and wondering if people have successfully applied it? I can't afford the TrustWave and ...
1
vote
2answers
635 views

ModSecurity is behaving funnily in apache2.4 on ubuntu 14.04

I am trying to put modsecurity in apache 2.4.7 a reverse proxy for a tomcat applcation. For a normal request it's throwing lots of logs about allowed methods even though the method used is get. [Wed ...
1
vote
2answers
657 views

Open Source Security Dashboard? [closed]

I'm looking for an open source security dashboard that gives a basic overview of security warnings. Google has pointed me in a few directions but nothing promising. I need something to deal w/ selinux ...
1
vote
0answers
364 views

Which OWASP modsecurity crs version to install on apache 2.2.22

Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7 First I ...
2
votes
2answers
19k views

How to whitelist IP address mod_security CentOS 6

Is it possible to white list an IP address in mod_security? I found white ist whole domain name in mod_security. But I want to white list only the administrator IP. OS: CentOS 6 Server: Apache ...
1
vote
1answer
2k views

Strange bug in ModSecurity with the rule 950901

I have a classic ModSecurity configuration (apt-get...) SecRuleEngine Off SecPcreMatchLimit 1000 SecPcreMatchLimitRecursion 1000 SecAction "phase:1,t:none,nolog,pass, \ setvar:'tx.allowed_methods=...
2
votes
2answers
10k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
6
votes
1answer
2k views

Why these 2 regexp won't work as expected in ModSecurity?

PROBLEMRULE #1; SecRule REQUEST_URI "^/(|(.*)/)(lpt1|lpt2|lpt3|lpt4)(/|\.|\?|$)" "t:none,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,block,msg:'X',id:'1000'" PROBLEMRULE #2; SecRule REQUEST_URI "...
1
vote
3answers
7k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...
-3
votes
1answer
2k views

Web GUI for Snort + ModSecurity [closed]

I'm trying to find a suitable (or easily modifiable) web GUI for snort + modsecurity logs. As far as I know, Splunk can do that by installing the snort and modsecurity plugins. Is there any other ...
2
votes
4answers
2k views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
1
vote
2answers
681 views

Remote File Injection in ARGS blocking form updating database

I am getting a page forbidden because mod_security blocks it with Remote File Injection in ARGS rule. How do I stop this apart from not including URLs in the form fields or removing the http:// ...
-1
votes
1answer
2k views

Using ModSecurity as transparent mode

I want to use Mod Security as transparent mode. Mod security WAF should be between server and client and client provided with only server's ip address to access the site. The client should not aware ...
4
votes
1answer
2k views

Securing a simple webservice against brute-force with mod-security

I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
2
votes
1answer
2k views

How to filter https traffic in mod-security WAF?

I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
0
votes
3answers
1k views

Is apache mod_spamhaus still being maintained?

I only found this: http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar and that is from 2008 Is there any newer apache mod that is up-to-date? Someone has experience with it? Maybe ...
0
votes
2answers
413 views

Is there an easy way to secure Apache on debian?

I run an Apache webserver with lots of PHP-sites of several customers. I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: http://www.modsecurity.org/...
1
vote
3answers
2k views

Testing Web Application Firewall Configuration (ModSecurity)

What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
3
votes
1answer
96 views

auditing mod security rule sets

Is there a audit system that can help me try my strings? Such as user agents, post/get data, a simple way to test general sql injections to see how my rule sets hold? I know with fire fox I can ...
2
votes
2answers
437 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
1
vote
1answer
419 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...