Questions tagged [mod-security]
ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.
399
questions
1
vote
1answer
32 views
Static Nginx with Modsecurity
Trying to add Modsecurity v3.0.4 in to Nginx v1.19.9 but running in to some errors I do not understand. There are MANY errors similar to the ones I pasted below but did not include them all. My ...
0
votes
0answers
8 views
How to check multi strings in the response body by using modsecurity rule chain
I need to check the response body, find all strings match the pattern firstly. Then check these strings to filter out needed ones in the chain rule, cause there are some reasons I cannot do it by only ...
0
votes
0answers
17 views
How to identify if there are any attachments in REQUEST_BODY for creating a ModSecurity exclusion rule
We are using ModSecurity CRS 3.0.2 and need to exclude rule 930110 which blocks requests if it contains patterns '../' and '..\'(Path Traversal Attack). If we attach a file while submitting the ...
0
votes
0answers
11 views
Kong with OWASP ModSecurity optional configuration include
For customizing of ModSecurity configuration I have included to the modsecurity.conf following line:
Include /etc/modsecurity/*.conf
But without any conf file in the directory (usual case on my ...
0
votes
0answers
18 views
How to check and confirm which version of modsecurity is used in nginx
I try to get the version of modsecurity, but i dont know how to get it, can anyone please help to get this ?
Please find the below,
[root@nixson nginx-1.18.0]# nginx -V
nginx version: nginx/1.18.0
...
0
votes
0answers
6 views
Working around ModSecurity false positives in FormData with Markdown
I have a web application that submits a FormData object as a part of an AJAX call. That FormData object contains Markdown content, a small portion of which is shown below as an example:
One of the ...
0
votes
0answers
8 views
Is it possible to log pattern matched by ModSecurity spambot block rule?
I am new to ModSecurity and I need help with logging. My Modsecurity rule currently looks like this:
SecRule REQUEST_HEADERS:User-Agent "@rx (?:ahrefsbot|mj12bot|yandex|node-fetch)" "...
0
votes
0answers
13 views
Secure wp-login.php in wordpress using ModSecurity3 with Nginx on Ubuntu 20.04
I am trying to restrict access to WordPress login page to specific IPs with libModSecurity3. I have my WordPress running on ubuntu 20.4, Nginx version 1.19.7. I have installed and setup LibModSecurity ...
0
votes
0answers
35 views
Weird behavior of Apache2 ModSecurity2
I am hosting a nextcloud application on my apache2 production server on wich I use modsecurity for hardening.
As modsecurity will detect many requests generated by Nextcloud as false positives, I want ...
0
votes
0answers
47 views
ModSecurity (in DetectionOnly mode) is not giving useful Logs/Warnings
I have configured modsecurity-nginx connector on Kubernetes Nginx Controller.
Currently, my objective to use ModSecurity WAF is to implemented in DetectionOnly mode as I don't want to start blocking ...
0
votes
1answer
16 views
How to ban IP addresses requesting specific directory using apache [duplicate]
Hello I'd like to permenently ban anything requesting the directory "/backups/" now how can I do that using a PHP script or mod_security?
I want to do this in a similar manner as iptables ...
0
votes
0answers
16 views
ModSecuirty Rule Is Not Unblocking Blocked IP After Defined Time Limit
I am trying to create a ModSec rule to block the IP address after a certain amount of the invalid attempt of login. The rule works as expected but after 10 min it is not unblocking the IP.
# Check if ...
0
votes
0answers
29 views
In ModSecurity, how can I change a CRS rule severity level from CRITICAL to NOTICE?
CRS has a set of rules for SQL Data Leakages, and I want to maintain them, but want to change it's severity from CRITICAL to NOTICE, so one match won't instantly block a request.
I can't change the ...
0
votes
0answers
10 views
Logging of Rule triggerd for ruleEngine=Off
I noticed that the rule that is triggered to do ruleEngine=Off doesn't seems to be ever get logged, the other rules with other actions logs well. An example of the rule is as follows:
SecRule ip:...
0
votes
0answers
33 views
Configserver ModSecurity: How to block an ip IF it hits a certain url more than N times?
We have the problem of hackers trying to submit forged payment requests. They return the url /checkout?fail=1 when their attempts fails.
Using modsec, How can we block their ip IF they visit that url ...
0
votes
0answers
67 views
A combination of a specific WordPress plugin + Modsecurity is causing 500 Internal Server Error
I'm using one of the WooCommerce Appointment plugin and it's causing a 500 internal error.
It seems the Modsecurity intercepts the http access but I don't know what's wrong in the following log.
--...
1
vote
0answers
40 views
Modsecurity rules to avoid brute force attack
I have two websites.
http://example1.com/project1/login.php
http://example2.com/project2/login.php
Both need to log in to use. And they send username and password to
/project1/action1/login_submit1....
0
votes
1answer
118 views
Minio uploads through the web interface and API receives “Unauthorized request.”
I can successfully upload files to my Minio server using mc command line client (logged in as root):
./mc cp roobina.jpg minio/mag
roobina.jpg: 63.50 KiB / 63.50 KiB
But when ...
0
votes
0answers
38 views
Mod-security paranoia level not taking in K8s implementation
I'm deploying franbuehler/modsecurity-crs-rp (https://hub.docker.com/r/franbuehler/modsecurity-crs-rp) in a kubernetes pod in front of a web app from a manifest yaml file. It's prep for a class on ...
1
vote
1answer
47 views
Is there a way to lower anomaly score per request path and per rule in modsec?
Hi I am trying to tweak down the anomaly score for a web page that has free text in it.
I have found the anomaly score can be customized per rule basis in the core rule set and that it can be ...
0
votes
1answer
117 views
How to integrate a Web Application firewall (ModSecurity) with Heroku?
I have an application running on the flask server in Heroku. This there any way to integrate ModSecurity or any open-source Web Application Firewall (WAF) to protect my application in Heroku. Any ...
0
votes
1answer
20 views
ModSecurity blocked requests stats
I installed ModSecurity, I would like to get stats out from its usage. The number of blocked requests would be a good starting point.
The only solution I was able to imagine is to parse access_log to ...
0
votes
1answer
77 views
libmodsecurity as a library to process my own web requests
Is it possible to use libmodsecurity as a library and process requests on my own? I was messing with the examples in the repo ModSecurity examples, but I cant figure out how to make it take my request....
0
votes
1answer
58 views
Stop CRS rule from triggering for a given argument
I am an absolute newcomer to OWASP ModSecurity, so please excuse me if this is a simple question! Currently, for an image upload function, I get a bunch of "warnings" like the following:
...
0
votes
1answer
104 views
Modsecurity not check POST data even SecRequestBodyAccess on is enabled
I have installed modsecurity on Nginx and as well as the owasp rules,
i have check SecRequestBodyAccess to on,
but when i send a request with a malicious post data, it pass ok with no problem
Can ...
0
votes
1answer
916 views
403 - modsecurity action in the live website?
I just make my first project in asp.net mvc and make it live on hostgator.in. On 1 page of my application I am loading partial view through ajax which is not working properly and in console I am ...
0
votes
1answer
18 views
Secrule modsecurity random numbers and adress ip post method
I have an attack on my server, several thousand logs.
Please take a look. I am looking for a method that could help me block these queries to my wordpress. I tried to block by IP, but there are others ...
0
votes
1answer
77 views
Apache site that redirects to https version of site is not applying modsecurity rules
I have an https website with modsecurity.
It also has a virtual host that listens to the http port and redirects to the https website, with a simple rule:
RewriteEngine On
RewriteRule ^(.*)$ https://${...
0
votes
0answers
66 views
mod_security with ip2location blocks a few accesses from same ip
Via mod_security I block accesses which do not belong to defined countries which are allowed. This actually works very well.
Now, by chance, a few accesses are blocked (from the same IP). The majority ...
0
votes
0answers
18 views
Modsecurity: in which phase should I disable a CRS response rule if I'm deciding based only on the request
The scenario is that there is a particular CRS rule from one of the response rule sets that is causing false positives. Initially I made an exemption that removed that rule when two conditions were ...
0
votes
0answers
54 views
Block IPs using apache mod_security and mod_evasive
If anyone trying to access the below URL from more than one IPs at particular time interval(1-10 min), we need to block those IPs except the first IP.
URL: http://abc/a/b/1234/c
is it possible to ...
0
votes
1answer
122 views
is wordpress safe even if mod security is disabled?
enabling modSecurity is not an option for my site to work properly. I just want to know if disabling ModSecurity is safe for a wordpress site. does wordpress take it's own security measures even if ...
1
vote
1answer
399 views
Carding attack on Magento 2 / Braintree
I am trying to fend off carding attacks on a Magento 2 store.
The attacker manually creates a shopping cart and from it is able to send repeated requests to Braintree and my store to test credit card ...
0
votes
0answers
43 views
Modsecurity rule exemption using ARGS with parameter name and value
The OWASP CRS3 rule 930120 blocks when a parameter value includes the string: .profile. I want to make an exception for transactions that meet the following:
A specific application (lets say ...
0
votes
0answers
14 views
how to use modsecurity and proxy modules via pache2 in ubuntu
I installed Apache 2 on the server and enabled modsecurity and
proxy modules . But module modsecurity does not work on traffic passing through the apache server and does not prevent attacks. my config ...
0
votes
0answers
12 views
how to use modsecurity in my web server application(no apache, no nginx)
How to use modsecurity in my web server application (No apache , No nginx) to check if the URL is safe?
example:
i have URL http://192.168.1.30/index.php?id='alert'
use modsecurity api check this url
0
votes
0answers
24 views
Load only XSS rules file with modsecurity and core rule set?
I want to debug core rule set's rules for XSS injections. Therefore I only want to load the corresponding rule REQUEST-941-APPLICATION-ATTACK-XSS.conf and not all the others rules like those for SQL ...
0
votes
0answers
42 views
Should ModSecurity Configuration SecConnEngine be set to on by default?
Just wondering if anyone knew if the Connections Engine SecConnEngine should be set to 'Process the rules' if vendor OWASP ModSecurity Core Rule Set V3.0 is enabled. Thought maybe there was something ...
0
votes
1answer
43 views
Can't disable mod_security rule on apache
If I post data of a form on my website, I keep getting this error in the log file.
[Thu Jul 16 09:45:25 2020] [error] [client 85.1.202.234] ModSecurity: Access denied with
code 403 (phase 2). Pattern ...
0
votes
1answer
288 views
ModSecurity False Positive SQL Injection
So I was able to wrangle several other ModSecurity rules giving false positives for other situations but I'm having issues with this specific ruleset. When customers submit a form with a double ...
0
votes
1answer
128 views
Debugging triggered modsecurity rule hits
TL;DR:
How do I debug a hit on the mod-security rules to identify the part of the request triggering the rule?.
The situation
I have a site runing on an environment with modsecurity and Free OWASP ...
0
votes
0answers
76 views
Nginx with modsecurity OWASP does not stop SQL injection
I am using Ubuntu 20.04 and I’ve mainly followed this blog to get nginx open source and modsecurity working. I have also configured the owasp rule set to modsecurity. However it does not stop simple ...
0
votes
0answers
24 views
how to block all traffic in modsecurity WAF
I am quite new to Modsecurity and need some help
I want to enable positive security in modsecurity for example :
allow just this links :
/a.php
/b.php
and last block all other http or https traffic
...
2
votes
3answers
4k views
Ubuntu 'Failed to restart apache2.service: Unit apache2.service not found.'
I am using Google Cloud Platform to test out ModSecurity and I am using a tutorial to launch it. However, I need to restart Apache every once in a while. I'm using Ubuntu 18.04. I write sudo systemctl ...
5
votes
3answers
9k views
Ubuntu '-bash: nano: command not found'
I am trying to use Ubuntu 18.04 to download ModSecurity on Google Cloud, but whenever I try writing sudo nano *file*.conf or nano *file*.conf. I get an error saying -bash: nano: command not found or ...
0
votes
1answer
2k views
Curl ends with “curl: (6) Could not resolve host: HTTP”
I've been following a blog on how to compile modsecurity with nginx, Blog. I tried to verify that everything works with creating the file /etc/nginx/conf.d/echo.conf which contains:
server {
...
0
votes
0answers
25 views
Mod_security doesn't work without Content-Type header on Http Request
I needed to enable my apache mod_security to prevent generic web atack, but, in a http request if i don't pass the Content-Type Header the mod_security does not work.
For example:
In a HTTP Request: ...
2
votes
3answers
948 views
python web scraping request error(mod security)
I am new and I try to grap source code of an Web page for tutorial.I got beautifulsoup install,request install. At first I want to grap the source.I am doing this scraping job from "https://pythonhow....
0
votes
0answers
114 views
Laravel Dropbox upload ModSecurity: Request body (Content-Length) is larger
I am trying to upload file to Dropbox from a Laravel website.
Dropbox's normal or session upload method fails
when the upload file size is over 12MB, it returns internal server error 500:
[Thu May ...
0
votes
0answers
110 views
Azure Gateway WAF - how to have a exclusion for 1 field and 1 rule?
I want to be able to have an exclusion for say an argument but only for a specific ruleID.
In the Exclusions page I can add an exclusion by argument,cookie or header names but then all rules will be ...