Collaborate Disseminate
Hey i am getting 403 Forbidden when i go to plugin options.
Server : Apache2 (Ondrej)
PHP : 7.3-fpm
Error :
Forbidden You don’t have permission to access
/wp-admin/options-general.php on this server.
VH Config :
Ser… Continue reading Modsecurity blocking WordPress [migrated]
I’m using ModSecurity WAF with Apache. I wanted to know if there’s a way I can restrict to only few browser agent type? I want to do this for two reasons:
Force the users to use an updated browser.
Deny reconnaissance. Thus… Continue reading Whitelisting browser agents in ModSecurrity
Are htaccess rules executed before modsecurity rules?
Sending illegal requests to couple of domains some of them trigger modsecurity but some of them with same illegal requests are not showing modsecurity forbidden message b… Continue reading Apache modsecurity and htaccess which comes first? [migrated]
Scenario:
ModSecurity with a “default” or “generic” configuration (like the one that might be provided by shared hosting providers, for example).
Generic web application (custom, uncommon, or unknown), for which specific ru… Continue reading How useful is the default configuration of ModSecurity for a generic web application?
I’m using Apache’s mod_security module with OWASP rules to protect my website, But it detects some CSS code as unix commands and returns a 403 Forbidden error.
Example code:
#top-categories a .circle {
top: 50%;
}
It … Continue reading Apache Modsec Detects CSS code as unix command
I’m relatively new to ModSecurity and I have been trying to get my head around the rules for weeks. When saving a page in WordPress I was getting the following in modsecurity_audit.log:
Message: Warning. detected XSS using l… Continue reading ModSecurity false positive 941100 and 941160 when saving WordPress page [migrated]
I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so:
<br+/>
<div+style=”border:none;+border-left:solid+blue+… Continue reading Allow ModSecurity to pass specific HTML tags?
I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests stored in the Apache log wit… Continue reading Analyzing Apache log with Snort
Here, I’m trying to accomplish calling a Lua script from modsecurity rules.
There are 2 components:-
1.example.com (WAF)
2.test.com (Web Application)
test.com contains pages:-
index.php
protectedpage.php
If user access… Continue reading Cookie Operations using Modsecurity Rules
ModSecurity blocked access due to the following:
[msg “XSS Filter – Category 3: Javascript URI Vector”] [data “Matched
Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com”]
[severity “CRITICAL”]
Why does… Continue reading ModSecurity Rule 973338