I run https://serveo.net/. It provides a stable subdomain as you require, and as an added benefit, it uses SSH port forwarding, so you probably don't even need to install anything—just use your SSH client.
Use it like this (where localhost:9000 is the address you want to forward to):
ssh -R 80:localhost:9000 serveo.net
Or, to make sure you get a ...
Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack.
The only generic approach to preventing SQL injection is to use parameterised queries, also known as prepared statements. These essentially separate out the data from the query language at the protocol level, so the DBMS software will not try to parse any query language from the parameters.
The mechanism you described looks like it's filtering requests with ...
Does order of Rules matter ?
Of course. It's mostly about performance.
Even if your firewall only implements an accept/deny policy (it could, for instance, decide to route the request elsewhere) then the length of time it will take to decide what to do with it will depend on the number of rules it has to process in order to reach a decision and the effort ...
I've been in the hosting industry for years now and I've never even heard of these 2 ever being brought up in the industry by other professionals. Honestly, I would consider them "dead". Not too mention that the idea of blocking at Apache's level is not the best. You can better block IPs at the firewall and prevent them from hitting the server all together.
what extra security does this bring
Out of the box? None. You need to add rules to the system in order to start restricting access. The problem is that some of these may break your application.
We don't know what your magic button in cPanel does. I would recommend you have a look at the OWASP rules. If they don't make any sense to you then you need to work ...
ModSecurity-CRS Rules will not work until we have fine tuned rules according to our requirements. The Log entries give us three piece of information.
So what are tx.allowed_methods and tx.allowed_http_version these are the transactions variables we ...
Those logs are all created in standard syslog format so any log aggregation solution will allow you to view and search the logs. There are plenty of options such as you mentioned but also proprietary like LogRhythm, ArcSight, LogLogic and others or open source like Alienware (OSSIM), OSSEC, Snare etc
There's also a GUI using BASE for Snort.
You should test your code in a real world scenario with a web application scanner like skipfish. You could also try manually exploiting Damn Vulnerable Web App.
Tamperdata can be used to build and modify requests. Or just plain old html.
I work for a security company (Incapsula) and one of our product features is a PCI DDS compliant WAF. I think @symcbean already gave a great answer, so I`m just here to add a little info to the discussion:
Does order of Rules matter ?
@symcbean said it all.
How inconsistent rules are handle.
If you are referring to a scenario in which several (...
The error you get is from MySQL, not from modsecurity. It informs you that the SQL statement the server has constructed is invalid.
For example, maybe the SQL query is contructed like this:
UPDATE clients SET useragent='$useragent'
With your example, this would become
UPDATE clients SET useragent='brick') order by 15 --+'
This is clearly invalid, ...
You should use a dedicated, separate virtual environment and not a system in your business environments.
If it's for a demo, you should use Virtualbox or similar hypervisor and run it in Host-Only network mode. Running a known-vulnerable service/system in a business environment is asking for trouble.
You could run a web security scanner against your website and see what vulnerabilities still come up in the report. There are several offerings out there, some are desktop tools while others are SaaS: Acunetix, Cenzic, Qualys, White Hat, IBM AppScan, HP WebInspect.
Better yet if you can afford it, hire a pen-tester to do a security audit of the website. If ...
As Mark Hillick said, we'd have to see the mod_security audit logs to answer this. The logs will show just which OWASP rules are being matched. You could then read the documentation for the rule(s) here. Or you could post a couple of examples of the logs here, showing the specific matches. Then we could better help sort this out with you.
Terminate your SSL sessions as the very first thing you do at your reverse proxy / load balancer. Then feed the terminated sessions through your WAF, then to your regular daemon. Basically, you need to add another reverse proxy to the chain.
ModSecurity is just a module for apache web server and we need to to add Modsecurity module in the apache configuration for the modsecurity to work. In order for the modsecurity to work we need to configure modsecurity as a reverse proxy we need to configure apache configuration like an example.
For the understanding of basic reverse proxy configuration i ...
ModSecurity is a kind of Web-level firewall (so, at least, claims the manual). Its point is to allow you to establish filters for requests tailored to your specific application. Being able to turn it on and off but not to alter its configuration nullifies its benefits. So my advice would be to deactivate it. It is like having a steel door on your house, but ...
I've managed to make ModSecurity detect and prevent SQL Injection! The problem was with the SqlMap itself and not the OWASP Rule Sets.
Before enabling ModSecurity I performed a normal sqlmap scan using the command mentioned previously. SqlMap managed to obtain and decrypt user and password values. I was expecting that to happen because I had no WAF enabled....
An error 500 indicates that the server had an internal error. It normally means one of two possibilities:
either a component is down - ok, the error will disappear as soon as it is up again
or an exceptional condition is not correctly processed by the application
The occurence of an error 500 should always be followed by an action: if a component was down, ...
As of 2017, ModSecurity does not support and does not plan to support WebSockets, as stated by Spiderlabs development team:
Currently ModSecurity is not capable to inspect WebSockets. It is only capable to understand the http requests.
So, not only it will not be helpful, but it may even have unexpected side effects making your application unreliable.
Your approach to this is...a bit misguided.
You shouldn't need to be crafting packets to replay events from an Apache log. The log is a list of HTTP requests, so use a library that can make proper HTTP requests, like the requests library itself. You don't even have all the information you need to craft these packets anyway-- in the case of POSTs, you don't ...
ModSecurity is a Web Application Firewall. FTP is not Web traffic, HTTP and HTTPS are. This means ModSecurity cannot be used for filtering FTP traffic not can it be used to filter mail traffic.
Also, ModSecurity does not protect against misuse of hacked accounts or severe server misconfiguration in general. If somebody is able to use FTP to upload malicious ...
Just for the future and others having similar problems. If you are not sure if and which requests sqlmap sent you can set the output verbosity (-v) to a higher number.
E.g. by setting it to 4 and adding the following to your payload:
sqlmap will show http requests and payloads in the console. Equipped with these you will be able to re-run the ...
That depends entirely on your configuration and your wishes.
Your setup certainly could re-encrypt after analyzing with mod_security and before forwarding to your application server. You would do so by using the ProxyPassReverse and SSLProxyEngine configuration options - see this question for an example.
So that begs the question: should you use TLS ...
Yes it is possible to do so. In mod-security they are having action called chain action like for example,
SecRule REQUEST_URI "/bank/login.aspx" phase:2,chain,t:none,id:105
SecRule &REQUEST_HEADERS:Content-Length "@eq 0" t:none
So you can change your rule accordingly. And google is your best companion for more info.
Sorry for the time wasted for everyone, I have caused this myself. I went on reading on SpiderLabs github page line 41 and the first thing that occurred to me was that I ought to either include the file with xx_10_setup.conf in the mods-enabled/security2.conf or do an symbolic link to activated_rules.
So name of the file doesn't matter after all.
From what I can see from the answer you linked to, the name of the file should be modsecurity_crs_10_config.conf. In your post, you say that yours is instead called modsecurity_crs_10_setup.conf.
Two other possible problems I see are that your setvar lines all have spaces before them whereas the answer does not (but I highly doubt that would cause problems)....
Have you considered using Splunk?
Very easy to set up, with apps available for *nix platforms and mod_security ready.
Splunk isn't open source, but free to use for up to 500mb of data per day - you can send data via regular syslog, or using their universal forwarder. Their dashboards and charting capabilities are fantastic and easy to use.
You can set up ...