Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

All Questions

Tagged with
4
votes
3answers
136 views

How useful is the default configuration of ModSecurity for a generic web application?

Scenario: ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example). Generic web application (custom, uncommon, or unknown)...
0
votes
1answer
245 views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
0
votes
2answers
426 views

ModSecurity Block based on ARGS_NAMES starting character

Working on a rule to block traffic based on the starting character of ARGS_NAMES either cookie, get or post Example allow name=Joe Example block #name=Joe Test rule that is not working SecRule ...
0
votes
2answers
243 views

How to test ModSecurity rules against access/error logs?

I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my ...
1
vote
1answer
902 views

Using user agent & inputs for SQL injection with ModSecurity WAF

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds ...
1
vote
3answers
8k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...
3
votes
4answers
2k views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
-1
votes
1answer
2k views

Using ModSecurity as transparent mode

I want to use Mod Security as transparent mode. Mod security WAF should be between server and client and client provided with only server's ip address to access the site. The client should not aware ...
4
votes
1answer
2k views

Securing a simple webservice against brute-force with mod-security

I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
2
votes
1answer
2k views

How to filter https traffic in mod-security WAF?

I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
1
vote
3answers
2k views

Testing Web Application Firewall Configuration (ModSecurity)

What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
2
votes
2answers
448 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
1
vote
1answer
434 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
3
votes
1answer
2k views

Mod_security for Apache2 blocks cURL!

I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...
2
votes
2answers
300 views

ip-fragmentation and mod_security?

is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security? the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
7
votes
5answers
2k views

Master thesis topic - mod_security

I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...