We are unsing the ModSecurity-Annotation in our ingress-nginx-controller. We are using the OWAP-Core-Ruleset included with the modsecurity-snipped annotation: enable-modsecurity: "true" modsecurity-snippet: | Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf We've customized several rules and it works well. For some reason our last rule (allowing text/plain)…
I am using: Ubuntu 24.04 Plesk Obsidian 18.0.62 Apache/2.4.59 Tomcat/10.1.16 tomcat-connectors-1.2.49 libapache2-mod-jk ModSecurity Fail2ban Free ModSecurity Rules from Comodo And I have a servlet on worker1. In Plesk, ModSecurity is set to "On" and uses Free ModSecurity Rules from Comodo.…
I'm using a ModSecurity WAF for my application that is defined within a k8s ingress. The configuration looks like this: nginx.ingress.kubernetes.io/enable-owasp-core-rules: "true" nginx.ingress.kubernetes.io/enable-modsecurity: "true" nginx.ingress.kubernetes.io/modsecurity-snippet: | SecAuditEngine RelevantOnly SecRuleEngine On SecAuditLogParts AZ SecAuditLog /dev/stdout SecAuditLogFormat JSON SecRequestBodyAccess On SecRequestBodyLimit 104857600…
Unsurprisingly, the OWAS coreset rules 3.3.2 break phpMyAdmin. (Is there anything OWAS doesn't break?) Among other things, they block importing SQL files into the database. To circumvent this, I have written an exception rule (in fact, tried many variants of…
I am currently creating a plugin for WordPress that will log errors in the admin area that may happen in a custom code. This log is not intended for PHP errors, which are already stored in debug.log. It's more to…
I am using mod-security V3 on a centos machine with Openlitespeed. My php file access.php create cookie: honey_bot_trap with value : 16 character [0-9a-zA-z]. - dynamic: ex: au4abbgjk190Bl in modsecurity create rules: SecRule REQUEST_HEADERS:Cookie "@contains honey_bot_trap" "chain,id:'990014',phase:1,t=none,block,msg:'fake cookie'" i want…
I'm really new to modsecurity and I'm having some issues in understanding the rule editing. I need to return 200 to the requests arriving form a specific endpoint that starts with /myendpoint/ but I still want to deny the endpoint…
I'm using Modsecurity v3.0.3 with the blocking module and I need to get my auditlog. Also, because I need it, I have to use some custom error pages. Unfortunately, I have my logs, but I'm losing my auditlog. I tried…
I have configured modsecurity-nginx connector on Kubernetes Nginx Controller. Currently, my objective to use ModSecurity WAF is to implemented in DetectionOnly mode as I don't want to start blocking everything right away. So to fulfil that I used below configuration…
I am trying to fend off carding attacks on a Magento 2 store. The attacker manually creates a shopping cart and from it is able to send repeated requests to Braintree and my store to test credit card numbers. Our…