0

I am using mod-security V3 on a centos machine with Openlitespeed.

My php file access.php create cookie: honey_bot_trap with value : 16 character [0-9a-zA-z]. - dynamic: ex: au4abbgjk190Bl

in modsecurity create rules:

SecRule REQUEST_HEADERS:Cookie "@contains honey_bot_trap" "chain,id:'990014',phase:1,t=none,block,msg:'fake cookie'"

i want create rules :

  1. All request to my domain will redirect to access.php (the cookie create by file: honey_bot_trap: au4abbgjk190Bl)
  2. Modsecurity check if no cookie honey_bot_trap: au4abbgjk190Bl is block.
  3. if request has honey_bot_trap: au4abbgjk190Bl add to check rate.
  4. if rate of IP over 2 click /s is block (or redirect to https://m ydomain.com/verify.php)

Please help me. Thank for all.

WilliamVine
  • 3
  • 1

2 Answers2

1

OpenLiteSpeed is not a creator of rules, but a consumer of them. We generally recommend the use of pre-created rules like OWASP or Comodo. If you wish to create rules you should check out the rules guide: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v3.x)https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v3.x)

Robert Perper
  • 26
  • 1
1

The rule you are attempting to create is very, very complicated. It may sound simple, but I've written the 2nd edition of the ModSecurity Handbook and trust me, I would take me 2-3 hours to get this working.

With that being said, ModSec is probably not the best tool for what you have in mind. If you want to push through, try to put your hands on a copy of the ModSecurity Handbook (instead of the reference linked above) and use mod_qos or something along those lines for rate limiting and not ModSec.

#CRSDevOnDuty

P.S. Hat tip to Robert Perper.

dune73
  • 339
  • 1
  • 3
  • can you add an example like i mentioned above in your book. I will buy books. because it's really important to me. Above all, I sincerely thank you. – WilliamVine Aug 28 '22 at 03:59
  • 1
    https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SESSION has an example of how you can persist the number of requests to calculate the rate afterwards. You will also need to look into the action deprecatevar and I am not sure if this is supported on ModSec v3 (and OLS). Even if it works, this will result in a brittle and overly complicated setup. My advice is to look for a different solution. – dune73 Aug 29 '22 at 04:56
  • If there is no other solution and you are willing to pay, please contact via netnea.com. – dune73 Aug 29 '22 at 04:56