1

Can mod_security be used to inspect post variables? It looks like I can through turning SecRequestBodyAccess. I would like to check the username POST field from a form in wp-login.php. If it's value is "admin", I want to return an error and block the IP address for 10 minutes.

I've seen mod_security rules to block an IP for multiple incorrect logins but I would like to catch it before it utilizes PHP or any database requests.

1 Answer 1

2

First enable json parser through this statement:-

SecRule REQUEST_HEADERS:Content-Type "application/json" "id:'1213',phase:1,pass,ctl:requestBodyProcessor=JSON"

and then use the following statement:

SecRule ARGS:payload.username "@streq admin" "id:'1234' block"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .