Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [mod-security]

ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

5
votes
1answer
931 views

ModSecurity on Apache (Debian Wheezy), Authentication logging

I am new to ModSecurity, it works great on the server, but I would like to control the way it logs things. For example as I am troubleshooting my website in order to whitelist or correct php coding ...
3
votes
1answer
429 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
2
votes
0answers
236 views

Any versions of ModSecurity that works with recent versions of Nginx?

I'm building Nginx and ModSecurity together in order to use the OWASP- Core Rule Set Project. According to the modsecurity download page, the latest version of modsecurity (2.9.1) is not stable when ...
2
votes
0answers
177 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" "phase:1,deny,status:403,id:...
2
votes
0answers
1k views

How to filter POST data with mod_security when type is text/xml?

I'm trying to craft a rule which would match certain regex in POST requests. Rule I have so far looks like; SecRule REQUEST_FILENAME "form.php" \ "id:'12345',chain,deny,status:406,log,msg:'foobar ...
2
votes
0answers
479 views

Nginx and dynamic X-Forwarded-For blocklist

I am running Nginx behind a proxy. I am getting visitors' real IP addresses through X-Forwarded-For HTTP request header. I'd like to block individual IPs based on a dynamic block list, up to 10000+ ...
2
votes
0answers
531 views

How to solve UNIQUE_ID variable issue in modsecurity_crs_16_session_hijacking.conf ubuntu 10.04

I have been trying to harden ubuntu 10.04 using modsecurity and its core rules from owasp version 2.2.5. I have used the package from their github . After the symbolic link of the files in the ...
2
votes
0answers
2k views

ModSecurity: collections_remove_stale: Failed deleting collection

Environment: Ubuntu Server 12.04 64Bit with Apache/2.2.22 (Ubuntu) and Worker mpm with modsecurity 2.7.5 and OWASP CRS latest. Problem: When server is under a load of 1500 concurrent users ...
2
votes
0answers
618 views

log/dump response body

Is there any way to log response body in Apache 2? I need the exact content that will be sent to user browser. I tried mod_security audit logging, but it won't log response body for all requests. (...
2
votes
0answers
243 views

Custom collections with mod_security

I would like to create a mod_security collection that is based on something other than the user's IP, Session ID, or username. Specifically, based on the REQUEST_URI. However, mod_security indicates ...
1
vote
0answers
2k views

mod_security gives “Multipart parser detected a possible unmatched boundary” for Wordpress

I have mod_security (apache2) installed on my server hosting Wordpress websites. When I attempt to install a plugin by uploading a .zip file from the disk it fails with 403 Forbidden and "Multipart ...
1
vote
0answers
593 views

ModSecurity and custom headers

How can we add a custom header using the 'msg' value from a ModSecurity rule, for all rules triggered? I'm basically trying to track the ModSec block reason at an edge point (Varnish) based on Apache'...
1
vote
0answers
546 views

mod_security forcing to redirect to Apache test page

i have installed drupal and installed couple of modules to provide the admin export to excel feature. when i click on the export button the page is getting redirected to Apache test page. I have done ...
1
vote
0answers
327 views

How install PHP 5.4, mod_security and mod_evasive together without conflict

I need create webserver with PHP 5.4, and install mod_security and mod_evasive. But when I try to join the php 5.4 and the mods on an EC2 server, it returns an error of conflict between the versions ...
1
vote
0answers
360 views

Apache header order

I am working on a private server application for a web based mobile game that uses php to generate responses. In order to do this I am trying to replicate the behavior of the main server as closely as ...
1
vote
0answers
340 views

Test for length of ARG parameter in SecRule - Mod Security

What is the most efficient way to limit the length of a http request parameter using Mod Security? For example, to limit WordPress comment length : SecRule ARGS:comment "^.{65530}" Would this regex ...
1
vote
0answers
173 views

ModSecurity on Apache 2.2 in EC2 - HTTP Status 413 messages dropped

Hi I am running Mod_Security on Ubuntu instances in EC2 behind an Elastic Loadbalancer. The app is a Ruby App. I have set SecRequestBodyLimit 293601280 When I upload files below that size, they are ...
1
vote
0answers
1k views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly different....
1
vote
0answers
450 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
326 views

apache DirectoryMatch matching filenames

I have the following code in my security.conf file of apache <DirectoryMatch "/(albums|attachment(s)?|upload(s)?)"> Options -ExecCGI <IfModule php5_module> php_flag engine off &...
1
vote
0answers
679 views

short Apache outages (VPS, ModSecurity)

I have a problem with my site recently hosted at Liquidweb, none of their techs seems to be able to solve this issue even after days. Was hoping I could get some help here. Occasionally, my site's ...
0
votes
0answers
14 views

Wordpress wp-admin login behind modsecurity reverse proxy

Ok, i've been fighting with this error, and I'm running out of options. I have previously asked a question with a redirect issue when accessing /wp-admin: wp-admin redirect loop when behind apache ...
0
votes
0answers
14 views

Libapache2-mod-security2 causes error 403 and prevents access even after uninstall

I have an Ubuntu 18.04 server with Nextcloud installed in an Apache2 (Apache/2.4.29 (Ubuntu)) virtual host. I am using PHP 7.3. In an attempt to harden the server, I installed libapache2-mod-security2....
0
votes
0answers
19 views

Is it safe / OK to send ModSecurity Detail Logs to an ISP after hack attempts?

Would it be ill advisable to send a copy of the Mod Security Audit Log to an ISP abuse department after a hack attempt? Someone just tried an SQL Injection attack against my server and fortunately ...
0
votes
0answers
42 views

Apache config test failed because of duplicate ID in mod security.conf

I have installed mod security and cloned the rules and then added the rules in security2.conf. <IfModule security2_module> # Default Debian dir for modsecurity's persistent data ...
0
votes
0answers
19 views

How to whitelist Ip so that the IP can pass the Mod_security rules

I am finding that mod_security 3.0.3 will block wordpress user to post an article. The question is How I whitelist an IP so that I can post an article via the IP ? Mod_security : 3.0.3 OS : Centos 7 ...
0
votes
0answers
18 views

My nginx log not read the web activity in real time

I am confused, my nginx log does not read the web activity in real time. The log will tell what happens after several time (it is hours ). Do you know why? Thanks
0
votes
0answers
81 views

Compilation Error : Nginx with pagespeed,http2,brotli and mod security

After searching for whole internet i didnt found anything on how to build all these together , there are tutorials for individual but not together so i tried on my own. Error : .........................
0
votes
0answers
19 views

Can ModSecurity Sniffing on Mirror (SPAN) Trafic?

My Debian Linux has an interface which configured in promiscuous mode and receives Mirror (SPAN) Traffic from Cisco Switch. Is there any way to running ModSecurity for sniffing this traffic to ...
0
votes
0answers
56 views

Enable mod_security only for specific directory

Current settings: - mod-security 2.9 Mod-security itself work as expected if enabled globally with SecRuleEngine on on main config but I need to enable it only for one specific folder for testing ...
0
votes
0answers
37 views

Apache modsecurity and htaccess which comes first?

Are htaccess rules executed before modsecurity rules? Sending illegal requests to couple of domains some of them trigger modsecurity but some of them with same illegal requests are not showing ...
0
votes
0answers
48 views

Mod security syntax error

when i ran the command apache2ctl configtest it is showing this error AH00526: Syntax error on line 193 of /etc/modsecurity/modsecurity.conf: ModSecurity: Failed to open the audit log file: /var/log/...
0
votes
0answers
322 views

PHP is not working after installing ModSecurity for NGINX on Ubuntu 16.04

My server is running on Ubuntu 16.04. One of my web app(php app) was running on my nginx server. To install ModSecurity I removed the NGINX completely and then followed the following steps to complie ...
0
votes
0answers
57 views

how can I whitelist dyndns host in mod security?

I'm using mod security with apache on Debian 8 and I'd like to add an exception for my IP. However I'm behind a dynamic IP address so it keeps changing. Is there a way to whitelist a hostname instead ...
0
votes
0answers
251 views

ModSecurity false positive 941100 and 941160 when saving WordPress page

I'm relatively new to ModSecurity and I have been trying to get my head around the rules for weeks. When saving a page in WordPress I was getting the following in modsecurity_audit.log: Message: ...
0
votes
0answers
24 views

Mod-Security whitelist page or more narrowly with query string?

I'm getting some Mod-Security 2 rule false positives from content updates in my cms. (300015 - generic sql injection) Since all admin.php.* URLs are login-walled, is there any risk in whitelisting ...
0
votes
0answers
35 views

Modsecurity v3 CRS + Nginx - separate vhost inclusions

I have the following setup: Nginx 1.14 ModSecurity v3 CRS v3 ModSecurity nginx connector I want to be able to specify in every vhost different collection of rules. For example: vhost1: filter all ...
0
votes
0answers
75 views

Get total number of cookie's from modsecurity using LUA script

I'm trying to access total number of cookies sent in response intercepted by mod-security and passed to LUA script. Below is an example response from server HTTP/1.1 200 OK Date: Tue, 21 Aug 2018 ...
0
votes
0answers
119 views

SPOE and modsecurity contrib Failed to decode HELLO frame

I'm compile modsec as described in the instructions contib/modsec/README, but have the next errors: # /usr/local/bin/modsecurity -n 4 -d -f /etc/haproxy/waf/modsecurity.conf 1534409877.286475 [00] ...
0
votes
0answers
33 views

Modsecurity connector does not allow rule update

I am using nginx and modsecurity compiled with nginx-modsecurity connector. When I try to add a custom rule: SecRuleUpdateActionById 200004 "allow" the following error occurs when nginx is restarted:...
0
votes
0answers
370 views

mod_security blocking SOAP client simulation

I'm writing a PHP SOAP server and I'm using PAW ( mac app ) to simulate SOAP client request on my local server I get a SOAP response on production server a get an 403 Forbidden error, since on this ...
0
votes
0answers
635 views

modsecurity add custom rules

I recently installed mod_security on apache 2.4.6 using owasp rule set, But there'e some problems with google recaptcha and non-english utf8 characters. I googled and for recaptcha I should add ...
0
votes
0answers
714 views

modsecurity doesn't log all response bodies

I'm trying to get response body of every request. (200 or 500, etc.) But mod_security doesn't put -E-- part (response body) in every request. For example, for this request: Request Body: POST /...
0
votes
0answers
107 views

convert modsecurity apache specific rules for nginx

Using ModSecurity with Apache and OWASP CRS there are some rules which use apache specific directives like (in modsecurity_crs_55_application_defects.conf file): Header edit Set-Cookie "^((?i:(_?(...
0
votes
0answers
54 views

Modsecurity: How can I consolidate all SecRules to ignore aparameter

How can I consolidate all or any secrule to ignore a parameter with modsecurity? I have a form that will always flag as XSS, unfortunately, my rule list is getting rather large as the site grows. I ...
0
votes
0answers
645 views

After install mod_security and mod_evasive, php not working

I followed this tutorial ( tutorial.centos.com.my/?p=69 ) and got success to install mod_security and mod_evasive. But php does not run, displays the code in the browser. Insert an index.php file in ...
0
votes
0answers
475 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
419 views

Server wont let me save URLs to MySQL database?

I am posting here because all other forum say it's a server environ issue. I have a site with the ModX CMS on it hosted on a GoDaddy server (not sure about the specific setup is as client has ...
0
votes
0answers
573 views

Nginx + mod_security without a backend server

I want to start using mod_security for Nginx. However, I have read the official doc and something got my atention: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#installation-for-...
-1
votes
0answers
23 views

Apache security - Drupal 8 related

In one of the log entries I see something strange which to me suggest an attempt to execute code. I have never seen this and cannot yet decipher this, does anyone have any idea what this log entry ...