Setvar:'**tx.dos_counter_threshold=5**', \īut still nothing. conf from owasp (I have a very low threshold and a smaller burst time slice) #SecAction \ To test a little I have modified the variable in the. I have no mention whatsoever that the server was under DOS attack (I checked in the modsecurity audit log and http error log.) I have then started Low Orbit Ion Cannon and spammed my index page for 5 minutes. When I start http and check in the /var/log/httpd I can see that modsecurity_auditlog is created and that it logs all the error (5x and 4x) -b7148938-H. I have checked that /etc/httpd/nf includes the /etc/httpd/conf.d folder.I have checked that /etc/httpd/conf.d/mod_nf includes these 2.I put the owasp dos rule in the /etc/httpd/modsecurity.d/activated-rules.I put the modsecurity_crs_10_nf in the /etc/httpd/modsecurity.d.I have followed the basic steps yum install mod_security These are the following payload which OWASP CRS 3 & comodo WAF rules failed to detected while testing.I'm trying to setup the mod_security on my httpd web server. i.e OWASP CRS & Comodo Rules failed to detect base64 encoded payload or anyother encoding method that works on the application back-end. While testing the OWASP CRS 3 & Comodo WAF rules, I have found some loop hole which allow user to bypass sql injection rules. Start testing the WAF rule i.e Comodo free WAF rules or OWASP CRS rules with vulnerable web application and identifying the security issue in their rules. But when I tried injection payloads with different encoding techniques i.e Base64,urlencoded (any other encoding method that support on application back-end), it failed to detect which lead to all possible injection attack. When i started testing normal injection technique on both OWASP CRS 3 & Comodo WAF Ruleset configured separately with vulnerable app i.e SQLI-LABS, WAF works well. Restart the Apache server and start testing the WAF rules.conf and include in the default rules directory. The rule IDs from the 2.x.x release (s) are not listed / covered. This page here covers the 3.x release (s).
Handling of false positives / false alarms / blocking of legitimate traffic is explained in this tutorial. Follow the modsecurity syntax to write a new rule. This is a list of rules from the OWASP ModSecurity Core Rule Set.Based on that develope regex pattern to match that payload.
0 kommentar(er)
