ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

learn more… | top users | synonyms

0
votes
1answer
14 views

Modsecurity check REQUEST_URI without query parameters

Currently, I am using Modsecurity XSS prevention, but I'm having a hard time understanding how exactly I can restrict what I'm checking for in the REQUEST_URI variable. My Example: # # -=[ XSS ...
0
votes
1answer
7 views

Linux, apache2, modsecurity blocks Google reCAPTCHA variables

I have a Debian Jessie box, Apache 2.4 and default mod_security enabled with base rules activated. When I try to implement a Google reCAPTCHA solution in a PHP code, modsecurity blocks page with ...
-1
votes
0answers
7 views

Will loading passive content in secure Iframe will show up on all browsers?

Hey we would like to move our site to HTTPS, but the main question is will our passive content that hosted on 3rd party website shown in secure iframe, Example: The page on website is using HTTPS ...
1
vote
0answers
8 views

Steps to find the specific rule for Mod_security

I am running an web portal on Lamp stack. I am facing an issue with a export button functionality when i click on the button it redirects to Apache test page. When i comment the #Include ...
1
vote
1answer
1k views

mod_security2.so: undefined symbol: ap_unixd_set_gl

service httpd restart Stopping httpd: [ OK ] Starting httpd: httpd: Syntax error on line 205 of /etc/httpd/conf/httpd.conf: Cannot load ...
1
vote
0answers
25 views

mod_security forcing to redirect to Apache test page

i have installed drupal and installed couple of modules to provide the admin export to excel feature. when i click on the export button the page is getting redirected to Apache test page. I have done ...
0
votes
1answer
32 views

Disabling ModSecurity's SQL injection Rule

I've been trying to disable mod_security sql injection rule by adding this to the conf file SecRuleRemoveById 981172 SecRuleRemoveById 981243 SecRuleRemoveById 981173 SecRuleRemoveById 981249 ...
2
votes
0answers
29 views

Any versions of ModSecurity that works with recent versions of Nginx?

I'm building Nginx and ModSecurity together in order to use the OWASP- Core Rule Set Project. According to the modsecurity download page, the latest version of modsecurity (2.9.1) is not stable when ...
3
votes
1answer
103 views

ModSecurity on IIS: Single threaded?

I installed ModSecurity on a web server running IIS 8.5, and noticed the response time has increased 15 times (0.15 ms/request vs. 2.2 ms/request), even with SecEngine set to off. It seems that IIS is ...
0
votes
1answer
1k views

csf lfd denied by desktop because of mod_security

I have a WHM/Cpanel server with CSF/LFD installed and mod_security enabled. I used to login to WHM/cpanel from one of my local windows box through a linux (Centos 5)NAT gateway(with a public IP ...
-1
votes
1answer
27 views

Clone http traffic to another port on same server transparently

I am experimenting with following setup. Clone/copy (but not redirect) all incoming HTTP requests from port 80 to another port say 8080 on same machine. I have a simple NGINX + Lua based WAF which is ...
7
votes
2answers
10k views

Disable modsecurity For a Specific Directory

How do you disable modsecurity for just a specific directory. I'm getting errors in phpMyAdmin that are caused by modsecurity tripping based on rules. I have the following files set up: # ...
0
votes
1answer
41 views

mod_security unable to add OWASP CRS - CentOS 7

My website has been under constant attack from hackers since the day I set up the virtual server and installed WordPress. I was able to install mod_security, however, I am unable to add the OWASP CSR. ...
0
votes
0answers
33 views

convert modsecurity apache specific rules for nginx

Using ModSecurity with Apache and OWASP CRS there are some rules which use apache specific directives like (in modsecurity_crs_55_application_defects.conf file): Header edit Set-Cookie ...
0
votes
2answers
63 views

mod_security too strict rule? [closed]

i just installed mod_security on my server but every page gets blocked with a forbidden error. i feel the rules are to strict, no? how can change it? this is the last line on my log Message: Access ...
0
votes
0answers
10 views

Is there a way around Apache HTTPS redirect filtering blocks?

I am currently using a mod_security HTTPS redirect in order to maintain PCI requirements. However, I have noticed that many commercial web filters (i.e. websense) are blocking the site due to a proxy ...
0
votes
1answer
117 views

Chrooting Apache 2.4 on Debian Jessie with mod_security

I have been advised to chroot my apache2 installation to better secure the sensitive content on the rest of the server. I have installed and setup mod_security properly and can see in the logs that it ...
-3
votes
1answer
109 views

ModSecurity error on wordpress wp-login rules

I have made i ModSecurity rule for apache for cPanel server to protect wordpress, but it have some error, so please suggest me some modification to work it fine. # This has to be global, cannot exist ...
0
votes
0answers
7 views

modsecurity Does not contain custom REDQUEST_HEADER_NAMES

Trying to build a rule that will 403 any incoming traffic that doesn't contain the header X-CFKey and match a specific of X-CFKey. I've got modsecurity testing X-CFKey value successfully but fails ...
0
votes
2answers
234 views

What rule can I use in ModSecurity to log POST payload for a specific site?

I need to inspect POST payload for a specific website (the server is rather busy and I wouldn't turn on POST logging for the entire server). The server is LiteSpeed 5.0.7. SecRequestBodyAccess is set ...
0
votes
1answer
19 views

mod_security: What's the point of action auditlog?

I'm fiddling around with mod_security to log POST request payloads for a specific URI. As stated in this response http://serverfault.com/a/729079/292993 to a similar question mod_security's ...
0
votes
1answer
31 views

mod_security: How to log POST requests for specific URI?

I'm trying to set up mod_security to log POST requests payload for a specific URI, as it seems that a customers webpage is used as a spam relay and these requests corrupt the server side cache. I ...
0
votes
0answers
16 views

Mosecurity with Nginx logs the 127.0.0.1 as destination

I am using Modsecurity with Nginx. It works and everything is fine unless the modsecurity logs the destination as 127.0.0.1. How can I set the destination with Nginx $proxy_host variable or whatever ...
0
votes
0answers
23 views

Nginx set_real_ip_from clears source port

I am using Modsecurity with Nginx behind another proxy (reverse cache proxy). To have the correct IP addresses of the clients am using ngx_http_realip_module using directives: set_real_ip_from ...
0
votes
1answer
26 views

Modsecurity Whitelist and keep logging

I am white listing a tag and I am curious if there is a way to white list this and keep the logging to this at the same time. SecRuleUpdateTargetByTag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION" ...
0
votes
1answer
29 views

Modsecurity Ignore/Whitelist IP

I have looked around on the net and have seen many common answers for this , however, none of them are working. I am trying to use this to ignore whenever our scans kick off in the morning. SecRule ...
0
votes
1answer
70 views

security2_module for apache with owsap modsecurity crs base rules is causing the “Forbidden You don't have permission to access / on this server”

I installed the security2 module to my apache server with owasp mod security base rules by adding these following lines to my httpd.conf: <IfModule security2_module> Include ...
0
votes
0answers
22 views

Modsecurity: How can I consolidate all SecRules to ignore aparameter

How can I consolidate all or any secrule to ignore a parameter with modsecurity? I have a form that will always flag as XSS, unfortunately, my rule list is getting rather large as the site grows. I ...
0
votes
1answer
97 views

SecRuleEngine Off not working on a single domain in virtual host

I have modSecurity installed and working on a server with multiple hosts and I want to disable some rules for one host only. This is what is what I put in the virtual host file: <IfModule ...
0
votes
1answer
64 views

SecChrootDir Jailing apache 2.2.X on Centos 6.7

I was trying to do apache jailing on centos 6.7 with modsec. I already built everything even the jail directory and remodeled the config files. httpd(apache) says it started nicely, however its dead. ...
1
vote
1answer
1k views

Nginx with mod_security support

I have compiled nginx with mod_security support. In error log I can see the support for mod_security 2012/08/27 11:13:11 [info] 602096#0: ModSecurity for nginx/2.7.0-rc2 ...
-1
votes
1answer
70 views

Nginx with mod_security on EC2 [closed]

I am looking to get some ideas and see what others are doing in terms of managing/keeping updated Nginx + mod_security on EC2 instances. The catch with this is that mod_security needs to be compiled ...
1
vote
1answer
17 views

Apache 2: Limit Ressources

I'm running some web pages on apache 2.4. At the moment I can see a lot of connections like these on status-page: Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request 2-0 - ...
1
vote
1answer
36 views

How can I decrease mod-security severity?

Actually the module blocks calls with "notice" level. How can I decrease the severity level and take it to "warning"?
2
votes
3answers
4k views

Test whether mod_security is actually working

I'm running this on my staging server for the first time and I think I did everything correctly. I can see entries in modsec_audit.log when I run nikto2 against it, but for the life of me I can't ...
1
vote
1answer
199 views

modsecurity whitelisting certian types of cookies

I am seeing cookies being generated on our server which appear to be from 3rd party objects in the site and don't show themselves when one logs in or navigates through the site. The cookies are ...
0
votes
0answers
59 views

Apache mod-security - Deny access from IP addresses listed in a blacklist file

I want to deny access from IP addresses listed in a blacklist file (not realy matters, but the file is /etc/csf/csf.deny). This is my custom rule (at the moment..): SecRule REQUEST_URI ...
0
votes
1answer
99 views

workaround for modsecurity false positive?

I was pasting "drwxr-xr-x. 2 root root 6 Sep 24 04:35 images" into a dokuwiki page That triggered modsecurity and I got a HTTP error. How can this rule be modified to avoid this kind of false ...
1
vote
2answers
218 views

Passwords in modsec log files

Are there any best practices or approaches I can take to prevent certain data (e.g. passwords) from being logged into mod-security's log files? We've a call coming into our Apache server (and onto ...
0
votes
1answer
116 views

Already enabled x-forwarded for in haproxy, but mod_remoteip 2.2 backport still doesn't work

I'm using haproxy to forward requests to Apache 2.2 bundled with modsecurity 2.7 and OWASP_CRS. I have enabled insertion of the X-Forwarded-For header in the haproxy config: defaults: option ...
4
votes
1answer
186 views

SecAuditLogParts not working: mod_security keeps logging response body

I have set SecAuditLogParts in modsecurity.conf to just log ABFH, but the modsecurity audit log keeps logging -E- part (response body) which makes the audit log too big. What can I do to disable ...
0
votes
0answers
25 views

ModSecurity - Matching multiple occurences in XML body

I have the following XML request body: <myMethod> <struct> <member> <name>Member_1</name> ...
0
votes
2answers
942 views

Apache2 mod_security simple default deny rules for specific directory

How to configure the simplest useful default-deny rule set for mod_security? I want to configure mod_security to allow only very specific queries to single directory: In short: I use Apache as a ...
0
votes
1answer
146 views

mod_security behind reverse proxy and clients IP

client -> haproxy -> mod_security boxes -> backends Problem: mod_security boxes use mod_rpaf with ip of haproxy in 'RPAFproxy_ips'. Apache logging shows clients real ip but mod_security ...
1
vote
1answer
145 views

mod_security rule to block GET requests via querystring or referer

In the last days in my VPS there are many many GET requests on 1 file that cause a high memory load (all came from a single refer url, with different IPs). Until now I've blocked these requests via ...
1
vote
1answer
138 views

mod_security - How to process text/xml request_body

I'm trying to process REQUEST_BODY of web request, which has Content-Type: text/xml and some XML inside it. Let say I have the following request: curl -v -d " <?xml version="1.0" ...
0
votes
1answer
59 views

Change Mod Security Rule for Deny ( 401 Status Page )

I Used a mod security rule for deny wp login attept. <LocationMatch /wp-login.php> SecRule REQUEST_METHOD "@streq POST" \ "phase:5,chain,t:none,auditlog,pass,msg:'Login Failure Detection: ...
0
votes
0answers
86 views

enable PUT with ModSecurity

I'm hosted in a VPS with Inmotionhosting, and I need to expose PUT and DELETE method for a REST API I'm programming. They tell me that if I want to use PUT, I need to disable ModSecurity. I think ...
0
votes
0answers
19 views

ModSecurity shows server ip as source instead of attacker ip

after upgrade to PHP 5.5 and everything works well i found that mod security is logging all attacks with the server ip itself instead of attacker ip !! before upgrade it was showing the attacker ip ...
3
votes
2answers
3k views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...