We’re rewarding the question askers & reputations are being recalculated! Read more.
8

I run https://serveo.net/. It provides a stable subdomain as you require, and as an added benefit, it uses SSH port forwarding, so you probably don't even need to install anything—just use your SSH client. Use it like this (where localhost:9000 is the address you want to forward to): ssh -R 80:localhost:9000 serveo.net Or, to make sure you get a ...


6

Found the way. vim /etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_10_whitelist.conf And add this line: SecRule REMOTE_ADDR "^192\.168\.50\.1$" phase:1,log,allow,ctl:ruleEngine=Off,id:999945


6

mod_security sent the user a HTTP 403 response, which means (quoted from RFC 2616): The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the ...


6

Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack. ...


5

Does order of Rules matter ? Of course. It's mostly about performance. Even if your firewall only implements an accept/deny policy (it could, for instance, decide to route the request elsewhere) then the length of time it will take to decide what to do with it will depend on the number of rules it has to process in order to reach a decision and the effort ...


4

I've been in the hosting industry for years now and I've never even heard of these 2 ever being brought up in the industry by other professionals. Honestly, I would consider them "dead". Not too mention that the idea of blocking at Apache's level is not the best. You can better block IPs at the firewall and prevent them from hitting the server all together.


4

The only generic approach to preventing SQL injection is to use parameterised queries, also known as prepared statements. These essentially separate out the data from the query language at the protocol level, so the DBMS software will not try to parse any query language from the parameters. The mechanism you described looks like it's filtering requests with ...


4

what extra security does this bring Out of the box? None. You need to add rules to the system in order to start restricting access. The problem is that some of these may break your application. We don't know what your magic button in cPanel does. I would recommend you have a look at the OWASP rules. If they don't make any sense to you then you need to work ...


3

Those logs are all created in standard syslog format so any log aggregation solution will allow you to view and search the logs. There are plenty of options such as you mentioned but also proprietary like LogRhythm, ArcSight, LogLogic and others or open source like Alienware (OSSIM), OSSEC, Snare etc There's also a GUI using BASE for Snort.


3

ModSecurity-CRS Rules will not work until we have fine tuned rules according to our requirements. The Log entries give us three piece of information. tx.allowed_methods tx.allowed_http_versions modsecurity-crs/base_rules/modsecurity_crs_30_http_policy.conf So what are tx.allowed_methods and tx.allowed_http_version these are the transactions variables we ...


3

I personally prefer OSSEC. It is a free, open source tool backed up with commercial support.


3

You should test your code in a real world scenario with a web application scanner like skipfish. You could also try manually exploiting Damn Vulnerable Web App. Tamperdata can be used to build and modify requests. Or just plain old html.


3

I work for a security company (Incapsula) and one of our product features is a PCI DDS compliant WAF. I think @symcbean already gave a great answer, so I`m just here to add a little info to the discussion: Does order of Rules matter ? @symcbean said it all. How inconsistent rules are handle. If you are referring to a scenario in which several (...


3

The error you get is from MySQL, not from modsecurity. It informs you that the SQL statement the server has constructed is invalid. For example, maybe the SQL query is contructed like this: UPDATE clients SET useragent='$useragent' With your example, this would become UPDATE clients SET useragent='brick') order by 15 --+' This is clearly invalid, ...


3

You should use a dedicated, separate virtual environment and not a system in your business environments. If it's for a demo, you should use Virtualbox or similar hypervisor and run it in Host-Only network mode. Running a known-vulnerable service/system in a business environment is asking for trouble.


3

It is the 'src' in esrco that triggers the rule. I had to deactivate that rule, because it was impossible to forbid the string src across the whole application.


2

You could run a web security scanner against your website and see what vulnerabilities still come up in the report. There are several offerings out there, some are desktop tools while others are SaaS: Acunetix, Cenzic, Qualys, White Hat, IBM AppScan, HP WebInspect. Better yet if you can afford it, hire a pen-tester to do a security audit of the website. If ...


2

As Mark Hillick said, we'd have to see the mod_security audit logs to answer this. The logs will show just which OWASP rules are being matched. You could then read the documentation for the rule(s) here. Or you could post a couple of examples of the logs here, showing the specific matches. Then we could better help sort this out with you.


2

Terminate your SSL sessions as the very first thing you do at your reverse proxy / load balancer. Then feed the terminated sessions through your WAF, then to your regular daemon. Basically, you need to add another reverse proxy to the chain.


2

ModSecurity is just a module for apache web server and we need to to add Modsecurity module in the apache configuration for the modsecurity to work. In order for the modsecurity to work we need to configure modsecurity as a reverse proxy we need to configure apache configuration like an example. For the understanding of basic reverse proxy configuration i ...


2

ModSecurity is a kind of Web-level firewall (so, at least, claims the manual). Its point is to allow you to establish filters for requests tailored to your specific application. Being able to turn it on and off but not to alter its configuration nullifies its benefits. So my advice would be to deactivate it. It is like having a steel door on your house, but ...


2

I've managed to make ModSecurity detect and prevent SQL Injection! The problem was with the SqlMap itself and not the OWASP Rule Sets. Before enabling ModSecurity I performed a normal sqlmap scan using the command mentioned previously. SqlMap managed to obtain and decrypt user and password values. I was expecting that to happen because I had no WAF enabled....


2

An error 500 indicates that the server had an internal error. It normally means one of two possibilities: either a component is down - ok, the error will disappear as soon as it is up again or an exceptional condition is not correctly processed by the application The occurence of an error 500 should always be followed by an action: if a component was down, ...


2

As of 2017, ModSecurity does not support and does not plan to support WebSockets, as stated by Spiderlabs development team: Currently ModSecurity is not capable to inspect WebSockets. It is only capable to understand the http requests. So, not only it will not be helpful, but it may even have unexpected side effects making your application unreliable.


2

Your approach to this is...a bit misguided. You shouldn't need to be crafting packets to replay events from an Apache log. The log is a list of HTTP requests, so use a library that can make proper HTTP requests, like the requests library itself. You don't even have all the information you need to craft these packets anyway-- in the case of POSTs, you don't ...


1

From what I can see from the answer you linked to, the name of the file should be modsecurity_crs_10_config.conf. In your post, you say that yours is instead called modsecurity_crs_10_setup.conf. Two other possible problems I see are that your setvar lines all have spaces before them whereas the answer does not (but I highly doubt that would cause problems)....


1

Have you considered using Splunk? Very easy to set up, with apps available for *nix platforms and mod_security ready. Splunk isn't open source, but free to use for up to 500mb of data per day - you can send data via regular syslog, or using their universal forwarder. Their dashboards and charting capabilities are fantastic and easy to use. You can set up ...


1

Just for the future and others having similar problems. If you are not sure if and which requests sqlmap sent you can set the output verbosity (-v) to a higher number. E.g. by setting it to 4 and adding the following to your payload: -v 4 sqlmap will show http requests and payloads in the console. Equipped with these you will be able to re-run the ...


1

SecRule REQUEST_URI "^/(|(.*)/)(lpt1|lpt2|lpt3|lpt4)(/|\.|\?|$)" "t:none,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,block,msg:'X',id:'1000' There can be two problems with these rules. HTTP request Transformation functions i.e t:htmlEntityDecode,t:lowercase,t:removeWhitespace should be in compliance with actual encoding scheme used in HTTP request. ...


1

Web Application Firewall like Modsecurity is just an operation security measure to protect web application from malicious input. WAF is just an application layer filter that can compare each request and response with the malicious signature provided my the WAF ruleset. Modsecurity Core Rule provides comprehensive generic rule set against different attacks ...


Only top voted, non community-wiki answers of a minimum length are eligible