Collaborate Disseminate
Running a shared hosting service, a client contacted me if I could disable mod_security for their webapp. The thing is, there is this patchwork webshop CMS called Prestashop with some hair-raising solutions (I’m not here to c… Continue reading Prestashop + mod_security concerns
recently I’ve identified that some hack attempt was performed at one of my servers.
I have dumped nginx logs to github, please take a look and try to identify which tool was used to perform this attack.
Excerpt from log:
195.154.41.132 … Continue reading Anyone can identify tool used to perform this attack?
This page describes definition of ‘TX’ as following:
“This is the transient transaction collection, which is used to store pieces of data, create a transaction anomaly score, and so on. The variables placed into this collection are availab… Continue reading What’s the difference between ‘TX’ and ‘tx’ in modsecurity rule
I am trying to put modsecurity in apache 2.4.7 a reverse proxy for a tomcat applcation. For a normal request it’s throwing lots of logs about allowed methods even though the method used is get.
[Wed Mar 11 10:35:33.187404 2015] [:error] [… Continue reading ModSecurity is behaving funnily in apache2.4 on ubuntu 14.04
Is it possible to white list an IP address in mod_security?
I found white ist whole domain name in mod_security. But I want to white list only the administrator IP.
OS: CentOS 6
Server: Apache httpd 2.15
Mod Security: Vers… Continue reading How to whitelist IP address mod_security CentOS 6
Is it possible to white list an IP address in mod_security?
I found white ist whole domain name in mod_security. But I want to white list only the administrator IP.
OS: CentOS 6
Server: Apache httpd 2.15
Mod Security: Vers… Continue reading How to whitelist IP address mod_security CentOS 6
I only found this:
http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar
and that is from 2008
Is there any newer apache mod that is up-to-date?
Someone has experience with it? Maybe mod_defensible?
Continue reading Is apache mod_spamhaus still being maintained?
Mod_security has a rules updater distributed with their release packages on sourceforge:
http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/
Usually, you can run the script and modsec will update the rules for y… Continue reading Mod_security rules-updater.pl fails to pull new release
It’s been a few years since I mucked around with modsecurity…
Will simply installing the package with the default rules provide enough validation to prevent any (okay, let’s be honest – best we can hope for is “most”) t… Continue reading Does default ModSecurity protect enough against XSS?