10

I run https://serveo.net/. It provides a stable subdomain as you require, and as an added benefit, it uses SSH port forwarding, so you probably don't even need to install anything—just use your SSH client. Use it like this (where localhost:9000 is the address you want to forward to): ssh -R 80:localhost:9000 serveo.net Or, to make sure you get a ...


9

A URI fragment is never actually sent to the server by a well-behaved client, it's only meant to be processed client-side, where Apache and ModSecurity can't see it. The fragment identifier functions differently to the rest of the URI: its processing is exclusively client-sided with no participation from the web server, though the server typically helps to ...


6

Found the way. vim /etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_10_whitelist.conf And add this line: SecRule REMOTE_ADDR "^192\.168\.50\.1$" phase:1,log,allow,ctl:ruleEngine=Off,id:999945


4

what extra security does this bring Out of the box? None. You need to add rules to the system in order to start restricting access. The problem is that some of these may break your application. We don't know what your magic button in cPanel does. I would recommend you have a look at the OWASP rules. If they don't make any sense to you then you need to work ...


4

It is the 'src' in esrco that triggers the rule. I had to deactivate that rule, because it was impossible to forbid the string src across the whole application.


3

You should use a dedicated, separate virtual environment and not a system in your business environments. If it's for a demo, you should use Virtualbox or similar hypervisor and run it in Host-Only network mode. Running a known-vulnerable service/system in a business environment is asking for trouble.


3

The error you get is from MySQL, not from modsecurity. It informs you that the SQL statement the server has constructed is invalid. For example, maybe the SQL query is contructed like this: UPDATE clients SET useragent='$useragent' With your example, this would become UPDATE clients SET useragent='brick') order by 15 --+' This is clearly invalid, ...


3

ModSecurity-CRS Rules will not work until we have fine tuned rules according to our requirements. The Log entries give us three piece of information. tx.allowed_methods tx.allowed_http_versions modsecurity-crs/base_rules/modsecurity_crs_30_http_policy.conf So what are tx.allowed_methods and tx.allowed_http_version these are the transactions variables we ...


2

mod_spamhaus for Apache 2.2 is alive and well at http://www.miim.com/software/linux/modspamhaus.html. This version is based on Luca Ercoli's earlier versions which are no longer being maintained. It may work under Apache 2.4, but the author says that this hasn't been tested. This is the version that I use. You can also get other protection modules at ...


2

I've managed to make ModSecurity detect and prevent SQL Injection! The problem was with the SqlMap itself and not the OWASP Rule Sets. Before enabling ModSecurity I performed a normal sqlmap scan using the command mentioned previously. SqlMap managed to obtain and decrypt user and password values. I was expecting that to happen because I had no WAF enabled....


2

As of 2017, ModSecurity does not support and does not plan to support WebSockets, as stated by Spiderlabs development team: Currently ModSecurity is not capable to inspect WebSockets. It is only capable to understand the http requests. So, not only it will not be helpful, but it may even have unexpected side effects making your application unreliable.


2

Your approach to this is...a bit misguided. You shouldn't need to be crafting packets to replay events from an Apache log. The log is a list of HTTP requests, so use a library that can make proper HTTP requests, like the requests library itself. You don't even have all the information you need to craft these packets anyway-- in the case of POSTs, you don't ...


2

An error 500 indicates that the server had an internal error. It normally means one of two possibilities: either a component is down - ok, the error will disappear as soon as it is up again or an exceptional condition is not correctly processed by the application The occurence of an error 500 should always be followed by an action: if a component was down, ...


2

ModSecurity is a Web Application Firewall. FTP is not Web traffic, HTTP and HTTPS are. This means ModSecurity cannot be used for filtering FTP traffic not can it be used to filter mail traffic. Also, ModSecurity does not protect against misuse of hacked accounts or severe server misconfiguration in general. If somebody is able to use FTP to upload malicious ...


1

To my knowledge, NGINX does not include anything like to describe, but we can implement our own. As I understand Apache 2 modsecurity_crs_11_slow_dos_protection, limits the number of connections. modsecurity_crs_11_slow_dos_protection NGINX has a webpage, Mitigating DDoS Attacks with NGINX and NGINX Plus which mentions several methods for DDoS. Three ideas ...


1

TL;DR: Not really useful for security, and will probably break the app somehow. A lot of ModSecurity's default rules are the textbook example of how not to protect from attacks. XSS is the best example: they block requests that look like they contain certain HTML tags, thus breaking any site where people try to post innocuous code samples. (The correct way ...


1

When normal behavior of the application is blocked by the rule set, this is called a false positive. The article Handling False Positives with the OWASP ModSecurity Core Rule Set may be of help to you. It describes how to identify the rule that blocks valid requests and to disable it using the SecRuleRemoveById configuraiton directive.


1

servers errors generally give overall view of how far the attack was successful on server. like if its 403, it shows that specific authentication was successfully blocked by server (means server handled certain illegal activity quite well), but when server throws 500, it means it was not able to handle certain error, hence it got confused , as a result, ...


1

You can check only the URI's for malicious payloads like path traversal, RCI, LFI, XSS, SSRF, CSRF, etc by simply sending them into a new request in a local server with OWASP CRS loaded. Let's say you have an Apache server listening to localhost and CRS enabled and listening to ModSecLivesHere location you may simply send all your access log field 6 (URL) ...


1

I don't think this will be possible, and even if you find a way to do it, it won't represent the real world correctly. Many mod_security rules rely on a variety of data, including various headers in HTTP requests, as well as HTTP request body data. Much of this data (most notably the body of requests) is not generally logged (at least in default ...


1

mod_security sits in the Apache webserver to offer some level of security for applications hosted on that webserver. Assuming you're talking about shared hosting (as opposed to dedicated or VPS providers), there's no reason their mod_security installation wouldn't be able to protect against attacks against any application installed on their webserver. That ...


1

Updates mod_security and its rules. Get help from the pros and their specific community: https://modsecurity.org/help.html While you wait for a response try some of these things. http://www.inmotionhosting.com/support/website/modsecurity/find-and-disable-specific-modsecurity-rules grep ModSecurity /usr/local/apache/logs/error_log | sed -e 's#^.*\[id "\([...


1

My guess is that you referring to CVE-2004-0492 "mod_proxy in Apache 1.3.25 to 1.3.31 ... possibly execute arbitrary code via a negative Content-Length HTTP header field..." . As you can see, this bug did affect apache version 1.3.25 ... 1.3.31 but not your version 2.2.27.


1

modSecurity is a software application firewall as part of Apache. assuming Apache v2+; modSecurity provides a significant array of analysis via regular expressions. the idea is to analysis content coming to your application and modSecurity makes a best guess on the content; if modSecurity believes the content to be malicious it is blocked. modSecurity ...


1

Just for the future and others having similar problems. If you are not sure if and which requests sqlmap sent you can set the output verbosity (-v) to a higher number. E.g. by setting it to 4 and adding the following to your payload: -v 4 sqlmap will show http requests and payloads in the console. Equipped with these you will be able to re-run the ...


1

That depends entirely on your configuration and your wishes. Your setup certainly could re-encrypt after analyzing with mod_security and before forwarding to your application server. You would do so by using the ProxyPassReverse and SSLProxyEngine configuration options - see this question for an example. So that begs the question: should you use TLS ...


1

Yes it is possible to do so. In mod-security they are having action called chain action like for example, SecRule REQUEST_URI "/bank/login.aspx" phase:2,chain,t:none,id:105 SecRule &REQUEST_HEADERS:Content-Length "@eq 0" t:none So you can change your rule accordingly. And google is your best companion for more info.


1

Sorry for the time wasted for everyone, I have caused this myself. I went on reading on SpiderLabs github page line 41 and the first thing that occurred to me was that I ought to either include the file with xx_10_setup.conf in the mods-enabled/security2.conf or do an symbolic link to activated_rules. So name of the file doesn't matter after all. Thanks ...


1

From what I can see from the answer you linked to, the name of the file should be modsecurity_crs_10_config.conf. In your post, you say that yours is instead called modsecurity_crs_10_setup.conf. Two other possible problems I see are that your setvar lines all have spaces before them whereas the answer does not (but I highly doubt that would cause problems)....


Only top voted, non community-wiki answers of a minimum length are eligible