Questions tagged [mod-security]

ModSecurity is a web application firewall for Apache, IIS ang Nginx. It provides logging, monitoring and filtering features.

Filter by
Sorted by
Tagged with
0 votes
0 answers
4 views

How to enable ModSecurity to actually block/deny malicious requests? [migrated]

I have setup installed mod security module for apache in ubuntu 22.04, using. sudo apt-get install libapache2-mod-security2 sudo a2enmod security2 sudo systemctl restart apache2 This installs ...
Rahul Thakkar's user avatar
2 votes
1 answer
197 views

Modsecurity blocks blocks my legit XHR POST request (403 forbidden)

I'm new to modsecurity topic so maybe my question is stupid but... I have setup modsecurity on my new nginx/1.24.0 server with default set of recommended rules: coreruleset-3.3.0 and since then my ...
Picard's user avatar
  • 121
0 votes
0 answers
54 views

How to make the rules 920600 and 922110 dynamic to have custom charsets (custom regexp) in CRS 4 [duplicate]

There is a regexp in the rules 920600 and 922110 that (according to my opinion) accepts only 4 charsets in the Accept header. I need to make it custom, so the regexp must be modified based on my ...
user avatar
1 vote
1 answer
375 views

ModSecurity CRS, allow header `accept-charset`

I have ModSecurity v2 on apache with CRS v3. Requests containing header accept-charset are blocked on paranoia level 1, I read this great discussion about the header and that on CRS v4 will be allowed ...
nulll's user avatar
  • 113
0 votes
2 answers
482 views

What is Method Enforcement. How to simulate this attack?

I need to know what is "method enforcement" inside WAF Preconfigured ModSecurity rules. How to test this attack on magento website? What is security best practice to prevent this?
Mamta Singh's user avatar
0 votes
0 answers
194 views

ModSecurity: How to disable error logging for single rule?

Here is my configurations: SecDefaultAction "phase:1,log,deny,status:403" SecDefaultAction "phase:2,log,deny,status:403" SecRule REQUEST_URI "@pm logging_test" \ &...
Felix's user avatar
  • 1
0 votes
1 answer
279 views

Compatibility of ModSecurity Core Rule Set 4

OWASP Core Rule Set has many versions the latest is version 4.0 (release candidate), but I cannot find any indication about compatibility among various modsecurity releases. Could these be used with ...
AndreaF's user avatar
  • 103
0 votes
1 answer
450 views

Updating regular expressions for the rules 920600, 921421, 921422 and 922110 in CRS 3.3.4

After updating to CRS 3.3.4, I want to update the regular expression of the rules 920600, 921421, 921422 and 922110. but the command util/regexp-assemble/regexp-assemble.py update 920600 does not work....
user288156's user avatar
4 votes
2 answers
5k views

ModSecurity: How to increase SecRequestBodyLimit for specific website REQUEST_URI?

I received this error in my ModSecurity logs: ModSecurity: Warning. Matched "Operator `Eq' with parameter `0' against variable `REQBODY_ERROR' (Value: `1' ) [file "/etc/nginx/modsec/...
peppy's user avatar
  • 101
7 votes
1 answer
1k views

How do I interpret the "stopwatch" lines in modsecurity logs?

My modsecurity log produces lines like this in section H: Stopwatch: 1672766910416996 75370993 (- - -) Stopwatch2: 1672766910416996 75370993; combined=8155, p1=1356, p2=5617, p3=149, p4=895, p5=137, ...
Jon G - Megaphone Tech's user avatar
2 votes
1 answer
719 views

ModSecurity: How to whitelist specific cookie name?

I have a false positive involving the content of one of my cookies: ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `REQUEST_COOKIES:xid' (...
peppy's user avatar
  • 101
2 votes
1 answer
1k views

ModSecurity: How to disable logging for specific REQUEST_URI?

I have a specific URL that keeps getting checked by weird bots, and that keeps triggering ModSecurity rules that fill up my logs. I would like to disable logging for that one specific URL to make it ...
peppy's user avatar
  • 101
0 votes
1 answer
1k views

ModSecurity: How to write exclusion rules for list of REQUEST_URIs on separate domain names?

I have a server with 100 domain names. On each domain name, I have a unique list of pages/directories that I would like to whitelist (put ModSecurity into DetectionOnly mode temporarily). Basically, ...
peppy's user avatar
  • 101
1 vote
2 answers
566 views

ModSecurity / CRS: Need custom rule to deal with false positive (user-inserted HTML formatted listings)

ModSecurity 3.0.8 ModSecurity-Nginx 1.0.3 CRS 4.0.0-rc1 I have a marketplace where sellers can list anything for sale. On the "item description" section, we allow users to copy and paste ...
peppy's user avatar
  • 101
0 votes
2 answers
2k views

Execution error - PCRE limits exceeded

I have problem when implementing modsecurity and crs. Here is the issue, I hope anyone can give us some guide for resolving this issue. Apache version : Server version: Apache/2.4.29 (Ubuntu) Server ...
navotera's user avatar
  • 101
1 vote
1 answer
225 views

text/plain removed from list Content-Types default

in the CRS v3.3.3 update, some Content-Types allowed in rule 900220 were removed and explanatory comment added, but it generated a doubt when I saw that text/plain was removed from this list. Why not ...
user283584wc's user avatar
0 votes
0 answers
211 views

Very slow SOAP POST request processing with ModSecure for certain rules (SQL, IIS and system exploits)

While trying to implement NGinx WAF with ModSecurity 3.0.6 I am facing the issue with very poor XML SOAP POST performance. Rrequests takes ~5 seconds with occasional spikes up to 10 seconds. If I ...
Elvinas's user avatar
2 votes
2 answers
944 views

ModSecurity: Block all IPs except for a list of defined IPs

I have an apache server with ModSecurity. I need to block all IPs except for a few ones. The list of IPs is like this: 194.83.128.0/21 191.143.32.0/19 145.126.72.0/21 101.28.248.0/22 40.64.64.0/22 180....
Jacobo's user avatar
  • 121
0 votes
1 answer
533 views

ModSec Head Scratcher - Rule Exceptions ignored

Sorry if this is a "noob" mistake, which I am sure it is, but I can't figure out why ModSec is ignoring my rule exception. Situation (Debian 10): I have a ssl secured url for Monit ...
minataur's user avatar
0 votes
1 answer
1k views

ModSecurity rule 941160 triggered by WordPress legacy-widget-preview

We have an issue with ModSecurity rule 941160 being triggered by the WordPress feature legacy-widget-preview because the request to upload an image file into the widget matches "<img src="...
Peter's user avatar
  • 13
0 votes
1 answer
358 views

Why is my SecAction rule being ignored?

I'm trying to configure a SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
Ronaldo's user avatar
  • 51
1 vote
1 answer
698 views

ModSecurity rule 932150 false positive, remove ruby from criteria

We have an issue with ModSecurity rule 932150 being triggered when someone searches a site for "ruby red", because (I presume) the rule thinks it's blocking potential Ruby on Rails code. I ...
Peter's user avatar
  • 13
0 votes
1 answer
1k views

ModSecurity OWASP CRS 3.3.0 false positives on a Wordpress site

The following search queries are blocked by ModSecurity and returns a 403 forbidden error: www.example.com/s=zip+someword & www.example.com/s=gzip+someword but not www.example.com/s=zip & www....
skinnedpanda's user avatar
0 votes
1 answer
224 views

Suspicious visits to one URL from same user-agent but from unique IPs

For the past few weeks, I am observing a lots of visits from a specific user-agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 ...
Kannan's user avatar
  • 107
1 vote
0 answers
319 views

regexp of a modsec rule

Is there a place I can view modsec rules? Trying to save some javascipt & html code through elementor on wordpress triggered some modsec rule. Specifically: [file "/etc/apache2/conf.d/modsec/...
epeleg's user avatar
  • 615
3 votes
1 answer
757 views

ModSecurity - XSS not blocked when #/ (hash) is added in the url by NodeJS application

I have installed ModSecurity in Apache server and using it as a reverse proxy to forward request to a NodeJS applicaiton. I have followed this tutorial to configure ModSecurity in Apache, https://www....
cookiejar1's user avatar
2 votes
1 answer
417 views

Can modsecurity 2.x read data from a text file that has been updated?

I'm writing a rule for modsecurity 2.x to match an IP address to those in a file. SecRule REMOTE_ADDR "@ipMatchFromFile /etc/modsecurity/address_list.txt" I understand how this works, I'm ...
steveH's user avatar
  • 123
2 votes
0 answers
380 views

Mod-security and WordPress WAF

On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence. I was wondering if a better practice would be to replace them with a host-based ...
Roberto Jobet's user avatar
1 vote
2 answers
239 views

ModSecurity Command Injection not working

I am testing web application firewall and I have installed ModSecurity 2.9 runs Core ModSecurity Rule Set ver.2.2.9 and to test on Web application I also install DVWA Platform: Windows and trying ...
Shree Har's user avatar
1 vote
1 answer
849 views

How to exclude rule 930120 for google oauth

I've this error: ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `ARGS:scope' (Value: `email profile https://www.googleapis.com/auth/...
skwokie's user avatar
  • 115
1 vote
1 answer
489 views

Is `SecAction` order important for an OWASP ModSecurity config file?

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules... On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
intika's user avatar
  • 111
1 vote
1 answer
1k views

OWASP CRS Anomaly scoring, ModSecurity WAF

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines: setvar:'tx....
Murad's user avatar
  • 11
0 votes
1 answer
350 views

For certain URI, is it possible to log the rule violation instead of returning access deny?

We have set up Modsecurity CRS with Nginx and we are in the phase of customization (or writing the exclusion rules). We'd like to know if it is possible that modsec can only log the exception for ...
skwokie's user avatar
  • 115
0 votes
1 answer
367 views

How apache tomcat favicon can be malicious or cause unintended results in application?

At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
Ajay Takur's user avatar
0 votes
1 answer
247 views

How to block for open Web Shell in my CentOS 6

I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one "problem" if I upload Shell through an ftp ...
Квлади's user avatar
1 vote
1 answer
416 views

Modsecurity - OWASP CRS 901001

Ubuntu 18.04 Apache/2.4.29 ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0 modsecurity-crs 3.0.2-1 This is a new server. The following message appears in modsec_audit.log ...
user1801810's user avatar
2 votes
0 answers
153 views

mod_security flush persistence

I run a website with a resource & time consuming URL, say ~20 seconds per request. In the last few days this URL is being targeted by some kind of DoS attack, and I'm trying to use mod_security so ...
MrPip's user avatar
  • 21
0 votes
1 answer
1k views

ClamAV detects virus in Modsec Audit logs

I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV ...
Èl Sea's user avatar
  • 35
1 vote
1 answer
2k views

Nginx: mod-security rule for http slow DoS attack

The only related rule in mod-security for slow DoS is modsecurity_crs_11_slow_dos_protection, and it's for Apache only. Is there a rule for Nginx?
Be1inda's user avatar
  • 11
3 votes
3 answers
664 views

How useful is the default configuration of ModSecurity for a generic web application?

Scenario: ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example). Generic web application (custom, uncommon, or unknown)...
reed's user avatar
  • 15.8k
0 votes
1 answer
1k views

Allow ModSecurity to pass specific HTML tags?

I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so: <br+/> <div+style="border:none;...
mrashid's user avatar
  • 195
0 votes
1 answer
1k views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
Neveralways's user avatar
0 votes
1 answer
764 views

Cookie Operations using Modsecurity Rules

Here, I'm trying to accomplish calling a Lua script from modsecurity rules. There are 2 components:- 1.example.com (WAF) 2.test.com (Web Application) test.com contains pages:- index.php ...
Gowtham's user avatar
  • 1,003
2 votes
1 answer
891 views

ModSecurity Rule 973338

ModSecurity blocked access due to the following: [msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:[email protected]"] [...
Mocking's user avatar
  • 213
7 votes
2 answers
12k views

Any Alternative to Ngrok for constant Connection? [closed]

Im trying to build RAT to test on my computer. I use ngrok for hacking on WAN. But ngrok has a problem of changing its subdomain once the connection is reset. So, I cant use ngrok for hacking over WAN....
Adithyan AK's user avatar
-5 votes
1 answer
180 views

what type of server is best for launching a vulnerable application on an Organization network? [closed]

For a demo purpose i need to install a vulnerable application and i tried using XAMP server but it opens up many ports and not safe to use it. so please recommend a server to launch a vulnerable demo ...
Ekalavya's user avatar
  • 164
0 votes
2 answers
1k views

ModSecurity Block based on ARGS_NAMES starting character

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post Example allow name=Joe Example block #name=Joe Test rule that is not working SecRule ...
jozwikjp's user avatar
  • 111
0 votes
2 answers
1k views

How to test ModSecurity rules against access/error logs?

I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my ...
Nirvilus's user avatar
0 votes
3 answers
666 views

Can ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well?

Can the software ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well? A particular hosting company providing shared hosting told me that ModSecurity should cover ...
Arcticooling's user avatar
3 votes
1 answer
823 views

How can I prevent modsecurity from logging binary data

In my modsecurity auditlog there is a binary file logged as text: How can I prevent modsecurity from bloating my logfiles with the content of binary files like that?
markgraeflerland's user avatar