Collaborate Disseminate
I am tripping mod_security on apache when outlook365 client on a laptop runs autodiscover.. Win10 os. ModSecurity thinks its an SQL injection.. “Detects basic SQL authentication bypass attempts”.
Is there a known issue with… Continue reading outlook client autodiscover SQL Injection
I have deployed an opensource web Application named “opencart” it has simple password. My question is can attacker login my system and escalate privileges if he login web application and even know the password of mysql databa… Continue reading Can attacker escalate its privileges if he has access a web Application running with www-data
I Set this in my .htaccess
Header always set Referrer-Policy strict-origin-when-cross-origin
and i get this error
Failed to set referrer policy: The value ‘strict-origin-when-cross-origin’ is not one of ‘no-referrer’, ‘no-referrer-when-downgrade’, ‘origin’, ‘origin-when-cross-origin’, or ‘unsafe-url’. The referrer policy has been left unchanged.
so the quesiton i reckon is how do i add these external urls to pass through this security setting I cant find any info on allowing them to pass through
shows addthis.com ogp.me and facebook.com probably need to add other urls as i enable social sharing and such
http://ogp.me/ns# fb: http://ogp.me/ns/fb#“>
Continue reading Referrer-Policy blocking addthis plugin wordpress
/usr/share/modsecurity-crs/ seems to have changed in Debian 9 (Stretch), and I assume this is because Debian 9 uses the latest version of mod_security? Anyways..
How do I enable CRS rules in Debian 9?
I tried to create a sy… Continue reading How do you enable CRS rules in mod_security in Debian 9? [migrated]
I’m trying to evaluate benefits of using ModSecurity in our system. From that what I read till now, I have feeling it is not very useful for us.
In our web app, there is single entry point, which is encrypted websocket conne… Continue reading Is it worth using ModSecurity on a single entry point websocket connection?
I am using:
apache2-2.4.25-5.1.x86_64
apache2-mod_security2-2.9.0-6.1.x86_64
Apr 13 18:59:36 mail start_apache2[16810]: AH00526: Syntax error on
line 1 of /etc/apache2/mod_security2.d/crs_whitelist.conf:
Apr 13 18:59:36 mail sta… Continue reading apache modsecurity SecRule ipmatch errors
This question already has an answer here:
How to filter https traffic in mod-security WAF?
1 answer
I have installed Apache 2… Continue reading Apache ModSecurity for HTTPS traffic? [duplicate]
I have the application in Spring Boot with embedded Tomcat. I’ll want use owasp mod security. How can I redirect network traffic that mod security will see it? I develop my app on localhost and I only show how Mod Security wo… Continue reading Mod Security OWASP with Spring Boot [migrated]
Running a shared hosting service, a client contacted me if I could disable mod_security for their webapp. The thing is, there is this patchwork webshop CMS called Prestashop with some hair-raising solutions (I’m not here to c… Continue reading Prestashop + mod_security concerns
Running a shared hosting service, a client contacted me if I could disable mod_security for their webapp. The thing is, there is this patchwork webshop CMS called Prestashop with some hair-raising solutions (I’m not here to c… Continue reading Prestashop + mod_security concerns