Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mod-security]

ModSecurity is a web application firewall for Apache, IIS ang Nginx. It provides logging, monitoring and filtering features.

3
votes
3answers
64 views

How useful is the default configuration of ModSecurity for a generic web application?

Scenario: ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example). Generic web application (custom, uncommon, or unknown)...
0
votes
1answer
47 views

Allow ModSecurity to pass specific HTML tags?

I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so: <br+/> <div+style="border:none;...
0
votes
1answer
86 views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
0
votes
1answer
107 views

Cookie Operations using Modsecurity Rules

Here, I'm trying to accomplish calling a Lua script from modsecurity rules. There are 2 components:- 1.example.com (WAF) 2.test.com (Web Application) test.com contains pages:- index.php ...
2
votes
1answer
102 views

ModSecurity Rule 973338

ModSecurity blocked access due to the following: [msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com"] [...
2
votes
2answers
3k views

Any Alternative to Ngrok for constant Connection? [closed]

Im trying to build RAT to test on my computer. I use ngrok for hacking on WAN. But ngrok has a problem of changing its subdomain once the connection is reset. So, I cant use ngrok for hacking over WAN....
-5
votes
1answer
111 views

what type of server is best for launching a vulnerable application on an Organization network? [closed]

For a demo purpose i need to install a vulnerable application and i tried using XAMP server but it opens up many ports and not safe to use it. so please recommend a server to launch a vulnerable demo ...
0
votes
2answers
238 views

ModSecurity Block based on ARGS_NAMES starting character

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post Example allow name=Joe Example block #name=Joe Test rule that is not working SecRule ...
0
votes
2answers
138 views

How to test ModSecurity rules against access/error logs?

I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my ...
0
votes
2answers
142 views

Can ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well?

Can the software ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well? A particular hosting company providing shared hosting told me that ModSecurity should cover ...
0
votes
1answer
168 views

How can I prevent modsecurity from logging binary data

In my modsecurity auditlog there is a binary file logged as text: How can I prevent modsecurity from bloating my logfiles with the content of binary files like that?
1
vote
1answer
81 views

Can attacker escalate its privileges if he has access a web Application running with www-data [closed]

I have deployed an opensource web Application named "opencart" it has simple password. My question is can attacker login my system and escalate privileges if he login web application and even know the ...
5
votes
1answer
318 views

Is it worth using ModSecurity on a single entry point websocket connection?

I'm trying to evaluate benefits of using ModSecurity in our system. From that what I read till now, I have feeling it is not very useful for us. In our web app, there is single entry point, which is ...
1
vote
0answers
130 views

apache modsecurity SecRule ipmatch errors

I am using: apache2-2.4.25-5.1.x86_64 apache2-mod_security2-2.9.0-6.1.x86_64 Apr 13 18:59:36 mail start_apache2[16810]: AH00526: Syntax error on line 1 of /etc/apache2/mod_security2.d/...
0
votes
1answer
1k views

Apache ModSecurity for HTTPS traffic? [duplicate]

I have installed Apache 2.4.7 with Drupal HTTPS site using Let's Encrypt cert. Mod_security is sucessfully installed, but is it able to defend against attacks, since the site is HTTPS? I tried ...
0
votes
2answers
684 views

Prestashop + mod_security concerns

Running a shared hosting service, a client contacted me if I could disable mod_security for their webapp. The thing is, there is this patchwork webshop CMS called Prestashop with some hair-raising ...
2
votes
0answers
2k views

Anyone can identify tool used to perform this attack?

recently I've identified that some hack attempt was performed at one of my servers. I have dumped nginx logs to github, please take a look and try to identify which tool was used to perform this ...
0
votes
1answer
229 views

Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability

We have a Windows Server 2012 R2 running Apache 2.2.27 and Apache tomcat8 version 1.0.15.0. Can you guys shed a few words on what the vulnerability is and also how to re-mediate this with the two ...
0
votes
0answers
176 views

Why does OWASP modsecurity block remote file inclusion for ?& in URL for Rule 950119

OWASP modsecurity rule 950119 for Remote File inclusion blocks the following URL: https://mydomain.com?myparam=http://mysite.com?&param2=abcd What's the issue with having ?& in an URL ...
2
votes
2answers
679 views

Should I expose HTTP status code 500 on a REST application?

In my Spring MVC 3 application, I am following REST patterns and lots of logic is based on HTTP status codes. For instance 500 defines a server error. But OWASP modsecurity says not to expose this ...
1
vote
1answer
727 views

Using user agent & inputs for SQL injection with ModSecurity WAF

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds ...
1
vote
2answers
85 views

What does ModSecurity bring to my hosting account?

I read about the hack at Ubuntu Forums yesterday. Since we hold customer data things like this always makes me worried, and I look to minimise our risk of attack. There is an option to enable ...
1
vote
1answer
113 views

Modsecurity Encrypted traffic in 3 tier architecture

The scenario is that we have 3 tier architecture DMZ > BEA > DB with end to end encryption the data is encrypted within DMZ > BEA > DB. I have read that modsecurity doest deal with encrypted traffic ...
0
votes
0answers
462 views

What's the difference between 'TX' and 'tx' in modsecurity rule

This page describes definition of 'TX' as following: "This is the transient transaction collection, which is used to store pieces of data, create a transaction anomaly score, and so on. The variables ...
1
vote
0answers
151 views

Identifying recon in web

I recently deployed mod_security module in my Apache Web Server. I know the OWASP CRS rules include tags to categorize attacks but I want to make higher level categories, particularly to identify ...
0
votes
1answer
331 views

Modsecurity create config file with rules for specific URL

I'm starting to learn about ModSecurity and rule creation so say I know a page in an web app is vulnerable to cross site scripting. The rule in question would look something like this: SecRule ARGS|...
1
vote
0answers
734 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
0
votes
1answer
209 views

OWASP + Atomic ModSecurity Rulesets - Too much?

Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be ...
0
votes
1answer
411 views

mod_security : affordable rule sets

I'm looking for practical advice on the OWASP rule set for mod_security. I've heard it has many false positives, and wondering if people have successfully applied it? I can't afford the TrustWave and ...
1
vote
2answers
635 views

ModSecurity is behaving funnily in apache2.4 on ubuntu 14.04

I am trying to put modsecurity in apache 2.4.7 a reverse proxy for a tomcat applcation. For a normal request it's throwing lots of logs about allowed methods even though the method used is get. [Wed ...
1
vote
2answers
669 views

Open Source Security Dashboard? [closed]

I'm looking for an open source security dashboard that gives a basic overview of security warnings. Google has pointed me in a few directions but nothing promising. I need something to deal w/ selinux ...
1
vote
0answers
372 views

Which OWASP modsecurity crs version to install on apache 2.2.22

Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7 First I ...
2
votes
2answers
19k views

How to whitelist IP address mod_security CentOS 6

Is it possible to white list an IP address in mod_security? I found white ist whole domain name in mod_security. But I want to white list only the administrator IP. OS: CentOS 6 Server: Apache ...
1
vote
1answer
2k views

Strange bug in ModSecurity with the rule 950901

I have a classic ModSecurity configuration (apt-get...) SecRuleEngine Off SecPcreMatchLimit 1000 SecPcreMatchLimitRecursion 1000 SecAction "phase:1,t:none,nolog,pass, \ setvar:'tx.allowed_methods=...
2
votes
2answers
10k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
6
votes
1answer
2k views

Why these 2 regexp won't work as expected in ModSecurity?

PROBLEMRULE #1; SecRule REQUEST_URI "^/(|(.*)/)(lpt1|lpt2|lpt3|lpt4)(/|\.|\?|$)" "t:none,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,block,msg:'X',id:'1000'" PROBLEMRULE #2; SecRule REQUEST_URI "...
1
vote
3answers
7k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...
-3
votes
1answer
2k views

Web GUI for Snort + ModSecurity [closed]

I'm trying to find a suitable (or easily modifiable) web GUI for snort + modsecurity logs. As far as I know, Splunk can do that by installing the snort and modsecurity plugins. Is there any other ...
2
votes
4answers
2k views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
1
vote
2answers
698 views

Remote File Injection in ARGS blocking form updating database

I am getting a page forbidden because mod_security blocks it with Remote File Injection in ARGS rule. How do I stop this apart from not including URLs in the form fields or removing the http:// ...
-1
votes
1answer
2k views

Using ModSecurity as transparent mode

I want to use Mod Security as transparent mode. Mod security WAF should be between server and client and client provided with only server's ip address to access the site. The client should not aware ...
4
votes
1answer
2k views

Securing a simple webservice against brute-force with mod-security

I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
2
votes
1answer
2k views

How to filter https traffic in mod-security WAF?

I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
0
votes
3answers
1k views

Is apache mod_spamhaus still being maintained?

I only found this: http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar and that is from 2008 Is there any newer apache mod that is up-to-date? Someone has experience with it? Maybe ...
0
votes
2answers
413 views

Is there an easy way to secure Apache on debian?

I run an Apache webserver with lots of PHP-sites of several customers. I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: http://www.modsecurity.org/...
1
vote
3answers
2k views

Testing Web Application Firewall Configuration (ModSecurity)

What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
3
votes
1answer
97 views

auditing mod security rule sets

Is there a audit system that can help me try my strings? Such as user agents, post/get data, a simple way to test general sql injections to see how my rule sets hold? I know with fire fox I can ...
2
votes
2answers
438 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
1
vote
1answer
424 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
1
vote
1answer
564 views

Exclude file names from mod_security patterns

I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page. For example, one problem ...