vasco/FSI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kys9

Browse Source
This commit is contained in:
vasco
2026-06-02 22:16:25 +01:00
parent ad84c1ba29
commit 05cbbfbe18
9 changed files with 3750 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
conf/modsecurity.conf
View File

@@ -8,23 +8,23 @@ SecAuditLogType Serial
SecAuditLog /var/log/modsecurity/audit.log
# sql injection
SecRule ARGS "['\";]|--" \
SecRule REQUEST_URI|ARGS "['\";]|--" \
"id:950001,phase:2,deny,status:403,msg:'SQL Injection Attack Detected',log"
# xss / html injection
SecRule ARGS "<.*>" \
SecRule REQUEST_URI|ARGS "<.*>" \
"id:950003,phase:2,deny,status:403,msg:'XSS/HTML Injection Detected',log"
# command injection
SecRule ARGS "(\"role\".*:.*\"admin\")|exec|cat|more|ls|dir|/etc/passwd" \
SecRule REQUEST_URI|ARGS "(\"role\".*:.*\"admin\")|exec|cat|more|ls|dir|/etc/passwd" \
"id:950006,phase:2,deny,status:403,msg:'Command Injection Detected',log"
# path traversal
SecRule ARGS "\%00|\%2500|(\./|\.\./)|ftp|metrics|api-docs" \
"id:950007,phase:2,deny,status:403,msg:'Path Traversal Attempt',log"
SecRule REQUEST_URI|ARGS "\%00|\%2500|(\./|\.\./)|ftp|metrics|api-docs" \
"id:950007,phase:2,deny,status:403,msg:'Path traversal attempt',log"
# exposed stuff
SecRule REQUEST_URI "\%00|\%2500|ftp|metrics|api-docs" \
# exposed stuff (redundante ?)
SecRule REQUEST_URI|ARGS "\%00|\%2500|ftp|metrics|api-docs" \
"id:950008,phase:2,deny,status:500,msg:'Attempt to access ftp, metrics, api-docs',log"
# rate limiting on login endpoint