Collaborate Disseminate
Summary:
I have setup a basic WAF with mod-security and the OWASP coreruleset 3.3.2. When using the WAF I see lots of warnings in modsec_audit.log regarding the CONNECT method, which trigger crs rule 920100:
Message: Warning. Match of &qu… Continue reading OWASP corerulet warning "invalid http request line" triggered by CONNECT method [migrated]
Sorry if this is a "noob" mistake, which I am sure it is, but I can’t figure out why ModSec is ignoring my rule exception.
Situation (Debian 10): I have a ssl secured url for Monit monitoring software, that works on www.example.c… Continue reading ModSec Head Scratcher – Rule Exceptions ignored
We have an issue with ModSecurity rule 941160 being triggered by the WordPress feature legacy-widget-preview because the request to upload an image file into the widget matches "<img src="
The ModSecurity log file has this:
A… Continue reading ModSecurity rule 941160 triggered by WordPress legacy-widget-preview
When the Content-type is application/json, the attack can be intercepted. But when the Content-type is multipart/form-data, the same attack will be missed.
The content of the request body is Unicode encoded. Is it because multipart/form-da… Continue reading CRS cannot intercept attacks in multipart/form-data
I’m trying to configure a
SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg is not printed either on access.log or… Continue reading Why is my SecAction rule being ignored?
We have an issue with ModSecurity rule 932150 being triggered when someone searches a site for "ruby red", because (I presume) the rule thinks it’s blocking potential Ruby on Rails code.
I found this:
"The Remote Command Ex… Continue reading ModSecurity rule 932150 false positive, remove ruby from criteria
The following search queries are blocked by ModSecurity and returns a 403 forbidden error:
www.example.com/s=zip+someword &
www.example.com/s=gzip+someword
but not
www.example.com/s=zip & www.example.com/s=gzip
The Apache error_log… Continue reading ModSecurity OWASP CRS 3.3.0 false positives on a WordPress site
For the past few weeks, I am observing a lots of visits from a specific user-agent – Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 to one particular URL.
The user-agent … Continue reading Suspicious visits to one URL from same user-agent but from unique IPs
I am about to use OWASP CRS rules with mod_security on my WHM/cPanel enabled CentOS server (with apache). But I fear that accidentally Googlebot may be blocked by one rule or the other. After enabling OWASP CRS, If I add the below custom r… Continue reading mod_security with OWASP CRS: Custom rule for whitelisting googlebot
so I just finished setting up my new webserver with nginx 1.19.8 and modsecurity. Now I have found coreruleset and configured everything as I wanted. But I started testing the modsecurity anti dos feature and saw that it was blocking the c… Continue reading ModSecurity CoreRuleSet blocks cloudflare ip instead of attacker [migrated]