Stack Overflow
Stack Overflow

Questions tagged [mod-security]

ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

As of December 27, 2015 the latest stable release of ModSecurity is version 2.9.0.

Useful links:

476 questions
0
votes
1 answer

How to configure modsecurity to log response which is greater than configured SecResponseBodyLimit?

Modsecurity is a great tool to find data leakage issues in the response body. For my current project, I want to detect data leakage issues with a configured response body size set via SecResponseBodyLimit and the action for response body greater…
lahsivjar
  • 29
  • 5
0
votes
1 answer

Ignore specific rules for a group of IP addresses

Is it possible to ignore specific rules (OWASP CRS for ModSecurity on NGINX) for a specific group of whitelisted IPs? Thanks
NOP-MOV
  • 792
  • 2
  • 8
  • 28
0
votes
1 answer

SecContentInjection is not yet supported

I am getting below error when using ContentInjection rule vi /etc/nginx/nginx.conf nginx -s reload 10:26:25 [notice] 118#118: ModSecurity-nginx v1.0.0 10:26:25 [emerg] 118#118: "modsecurity_rules" directive Rules error. File: <>. Line: 1.…
Divya Vyas
  • 323
  • 1
  • 4
  • 16
0
votes
1 answer

Proxy to validate xml with xsd

I've been searching for a while for something that can act as a proxy that I can feed it XSDs to validate xml content within the request body of HTTP traffic. Does anyone know if such a thing exists on Windows or Linux? I checked out ModSecurity but…
PKCS12
  • 407
  • 15
  • 41
0
votes
2 answers

Cross site URL linking with mod_security

I run my own web server, but after I installed mod_security I was unable to get cross site linking to work, always had an error! So if I tried to post a link on Facebook from my web site (captnslounge.com) I would get the following…
Nigel Aves
  • 1
  • 1
0
votes
1 answer

Modsecurity waf in nginx server

I am struggling with mod-security WAF in nginx setup any explain what is mod-security and how to implement in nginx. Please help.
Bala
  • 117
  • 4
  • 13
0
votes
1 answer

Apache mod_security and chat server

My website is hosted on a virtual server that runs Apache and Plesk. I would like to integrate a chat from livezilla.de on my website. The chat server runs on my server as well. To secure my system, I have activated plesk_modsecurity. However, that…
LaDude
  • 1,383
  • 1
  • 11
  • 27
0
votes
1 answer

Jquery serialize() triggering 403 when open PHP tag entered in textarea

So I've been going through my forms recently to check my SQL queries are secure along with sanitizing any input and have just found that entering
Andrew Ward
  • 109
  • 2
  • 9
0
votes
0 answers

can I make apache mod_security log file to desired format?

I am trying to save FULL Apache logs (including all request/response headers with the help of Mod_security) to Elasticsearch. Currently I am using Filebeat and Logstash to transform the log into a desired format. However if it is possible to make…
DavidK
  • 13
  • 5
0
votes
1 answer

ModSecurity rule giving SQL Injection false positives, generating 500 Internal Server Error, even when using PHP PDO prepared statements

TL;DR - A default ModSecurity rule on my server is generating a 500 Internal Server Error when trying to submit a PHP form field that contains the word "from", since it's seeing it as a possible SQL injection, even though I'm using PDO prepared…
Greg Chetcuti
  • 33
  • 1
  • 5
0
votes
1 answer

owasp-modsecurity-crs detected but not deny the request

I built Nginx 1.10.3 with ModSecurity and owasp-modsecurity-crs, and test it with curl. From the nginx log, it works since it has already been detected with rules, but the client still get http response success, not the expected deny response like…
Bo Wang
  • 499
  • 1
  • 8
  • 15
0
votes
0 answers

File uploads fail with through web application firewall with mod_security and mod_rewrite

I've built a Web Application Firewall using Apache 2.4.27 and mod_security 2.9.2. The WAF is stand alone, and forwards requests through to another web server using mod_rewrite with the [P] proxy directive. Everything works fine EXCEPT file…
vaFyreHeart
  • 275
  • 1
  • 3
  • 13
0
votes
2 answers

Not able to create a good regular expression for mod-security analysis

Not able to create a good regular expression for capturing complete data between --c5eda821-H- and --c5eda821-Z- My regex for this query is re.compile('--([a-f0-9]{8})-H-(.+?)--[a-f0-9]{8}', re.MULTILINE | re.DOTALL) --c5eda821-F-- HTTP/1.1 200…
dumbo
  • 41
  • 5
0
votes
1 answer

Transfer encoding: chunked causing problems for html response (using Modsecurity)

I have a Java-Servlet based web application using spring saml and Modsecurity. For one of the GET requests (URL - /saml/login), the response is a HTML page returned as text/html(I can read the html file in browser network tools) along with…
adarsh hegde
  • 1,353
  • 2
  • 21
  • 43
0
votes
4 answers

Compatibility of ModSecurity with NginX

I'm using NginX and want to incorporate ModSec as a module. After doing some research, there only was one link that talked about how "ModSecurity must be compiled with the source code of the main server." I'm assuming that means it needs to compiled…
Dyl
  • 15
  • 7
1 2 3
…
31 32