Collaborate Disseminate
I’ve installed nginx with modsec with the following versions:
Modsec verion: v3.0.3
Nginx version: 1.13.6
and I’ve excluded rule 933160 as followed:
SecRule REQUEST_URI "@beginsWith /a/b/c/d" \
"phase:2,log,pass,id:… Continue reading Rule 933160 violated even though it’s been excluded [migrated]
I am trying the latest ruleset with Modsecurity and use crs-setup.conf.example (https://github.com/coreruleset/coreruleset/blob/v3.3/dev/crs-setup.conf.example) as an example but it seems that blocking never triggers.
As in the documentati… Continue reading Anomaly Score Mode and blocking
Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules…
On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them differently from the example config file?
… Continue reading Is `SecAction` order important for an OWASP ModSecurity config file?
I’m getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines:
setvar:’tx.anomaly_score=0′,\
setvar:’tx.anomaly_score_pl1=0′,… Continue reading OWASP CRS Anomaly scoring, ModSecurity WAF
I’ve the following logs rotation set up in the OS for nginx’s and modsec’s logs, and it works for nginx’s logs but not for modsec’s. The result for modsec is that, it made a copy for the log file but it keeps on writing to the old one as f… Continue reading ModSecurity not writing to new rotated log files? [migrated]
We have set up Modsecurity CRS with Nginx and we are in the phase of customization (or writing the exclusion rules).
We’d like to know if it is possible that modsec can only log the exception for certain URIs without adding up the score wh… Continue reading For certain URI, is it possible to log the rule violation instead of returning access deny?
I would appreciate if someone can point me to the right way solving this
Have a POST for a refresh token and modsec closes the connection(?) — the browser goes into an endless loop back and forth ; using apache 2.4.6 and modsec 2.9.2 in … Continue reading modest 2.9.2 – response body: transformed: dechunked
At the moment, there aren’t any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
I am triggering a modsecurity rule that I am trying to whitelist, the following is in the .log:
ModSecurity: Access denied with code 403 (phase 2). [file “/etc/nginx/conf.d/modsecurity/rules/3.0.2/REQUEST-942-APPLICATION-ATTACK-SQLI.c… Continue reading Whitelist all ARGS_NAMES modsecurity-CRS
I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one “problem” if I upload Shell through an ftp client then I can use shell in hosting. my … Continue reading How to block for open Web Shell in my CentOS 6