vasco/FSI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kys13

Browse Source
This commit is contained in:
vasco
2026-06-02 23:20:25 +01:00
parent e9616a8c7c
commit 0f3e2044a0
7 changed files with 50 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
conf/modsecurity.conf
View File

@@ -9,23 +9,24 @@ SecAuditLog /var/log/modsecurity/audit.log
# sql injection # sql injection
SecRule REQUEST_URI|ARGS "['\";]|--" \ SecRule REQUEST_URI|ARGS "['\";]|--" \
"id:950001,phase:1,deny,status:403,msg:'SQL Injection Attack Detected',log" SecRule REQUEST_URI|ARGS "(?i:(?:select|insert|update|delete|drop|union|create|alter|truncate)\s+.+\s+from|'[^']*'|--|;|\b(or|and)\b\s+\d+\s*=\s*\d+)" \
"id:950001,phase:1,deny,status:403,msg:'SQL INJECTION ATTACK DETECTED!!!',log,t:urlDecode,t:sqlHexDecode,t:lowercase"
# xss / html injection # xss / html injection
SecRule REQUEST_URI|ARGS "(<.*>)|(%3C.*%3E)" \ SecRule REQUEST_URI|ARGS "(<.*>)|(%3C.*%3E)" \
"id:950003,phase:1,deny,status:403,msg:'XSS/HTML Injection Detected',log" "id:950003,phase:1,deny,status:403,msg:'XSS/HTML INJECTION DETECTED!!!',log"
# command injection # command injection
SecRule ARGS "(\"role\".*:.*\"admin\")|exec|cat|more|ls|dir|/etc/passwd" \ SecRule ARGS "(\"role\".*:.*\"admin\")|exec|cat|more|ls|dir|/etc/passwd" \
"id:950006,phase:2,deny,status:403,msg:'Command Injection Detected',log" "id:950006,phase:2,deny,status:403,msg:'COMMAND INJECTION DETECTED!!!',log"
# path traversal # path traversal
SecRule REQUEST_URI|ARGS "\%00|\%2500|\.\./|ftp|metrics|api-docs" \ SecRule REQUEST_URI|ARGS "\%00|\%2500|\.\./|ftp|metrics|api-docs" \
"id:950007,phase:2,deny,status:403,msg:'Path traversal attempt',log" "id:950007,phase:2,deny,status:403,msg:'PATH TRAVERSAL ATTEMPT!!!',log"
# exposed stuff (redundante ?) # exposed stuff (redundante ?)
SecRule REQUEST_URI|ARGS "\%00|\%2500|ftp|metrics|api-docs" \ SecRule REQUEST_URI|ARGS "\%00|\%2500|ftp|metrics|api-docs" \
"id:950008,phase:2,deny,status:500,msg:'Attempt to access ftp, metrics, api-docs',log" "id:950008,phase:2,deny,status:500,msg:'ATTEMPT TO ACCESS FTP, METRICS, API-DOCS!!!',log"
# rate limiting on login endpoint # rate limiting on login endpoint
# (max 5 requests per 30s per IP) # (max 5 requests per 30s per IP)

2
relatorio/relatorio.aux
View File

@@ -41,7 +41,7 @@
\@writefile{toc}{\contentsline {section}{\numberline {4}Web Application Security Firewall}{11}{section.4}\protected@file@percent } \@writefile{toc}{\contentsline {section}{\numberline {4}Web Application Security Firewall}{11}{section.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.1}Information Gathering}{12}{subsection.4.1}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {4.1}Information Gathering}{12}{subsection.4.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.2}Configuration and Deployment Management Testing}{12}{subsection.4.2}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {4.2}Configuration and Deployment Management Testing}{12}{subsection.4.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.3}Identity Management Testing}{12}{subsection.4.3}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {4.3}Identity Management Testing}{13}{subsection.4.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.4}Authentication Testing}{13}{subsection.4.4}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {4.4}Authentication Testing}{13}{subsection.4.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.5}Authorization Testing}{13}{subsection.4.5}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {4.5}Authorization Testing}{13}{subsection.4.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.6}Session Management Testing}{13}{subsection.4.6}\protected@file@percent } \@writefile{toc}{\contentsline {subsection}{\numberline {4.6}Session Management Testing}{13}{subsection.4.6}\protected@file@percent }

26
relatorio/relatorio.listing
View File

@@ -1,6 +1,6 @@
SecRuleEngine On SecRuleEngine On
SecRequestBodyAccess On SecRequestBodyAccess On
SecResponseBodyAccess Off SecResponseBodyAccess On
SecDebugLog /var/log/modsecurity/debug.log SecDebugLog /var/log/modsecurity/debug.log
SecDebugLogLevel 0 SecDebugLogLevel 0
SecAuditLogParts ABIJ SecAuditLogParts ABIJ
@@ -8,26 +8,28 @@ SecAuditLogType Serial
SecAuditLog /var/log/modsecurity/audit.log SecAuditLog /var/log/modsecurity/audit.log
# sql injection # sql injection
SecRule ARGS "['\";]|--" \ SecRule REQUEST_URI|ARGS "['\";]|--" \
"id:950001,phase:2,deny,status:403,msg:'SQL Injection Attack Detected',log" SecRule REQUEST_URI|ARGS "(?i:(?:select|insert|update|delete|drop|union|create|alter|truncate)\s+.+\s+from|'[^']*'|--|;|\b(or|and)\b\s+\d+\s*=\s*\d+)" \
"id:950001,phase:1,deny,status:403,msg:'SQL INJECTION ATTACK DETECTED!!!',log,t:urlDecode,t:sqlHexDecode,t:lowercase"
# xss / html injection # xss / html injection
SecRule ARGS "<.*>" \ SecRule REQUEST_URI|ARGS "(<.*>)|(%3C.*%3E)" \
"id:950003,phase:2,deny,status:403,msg:'XSS/HTML Injection Detected',log" "id:950003,phase:1,deny,status:403,msg:'XSS/HTML INJECTION DETECTED!!!',log"
# command injection # command injection
SecRule ARGS "(\"role\".*:.*\"admin\")|exec|cat|more|ls|dir|/etc/passwd" \ SecRule ARGS "(\"role\".*:.*\"admin\")|exec|cat|more|ls|dir|/etc/passwd" \
"id:950006,phase:2,deny,status:403,msg:'Command Injection Detected',log" "id:950006,phase:2,deny,status:403,msg:'COMMAND INJECTION DETECTED!!!',log"
# path traversal # path traversal
SecRule ARGS "\%00|\%2500|(\./|\.\./)|ftp|metrics|api-docs" \ SecRule REQUEST_URI|ARGS "\%00|\%2500|\.\./|ftp|metrics|api-docs" \
"id:950007,phase:2,deny,status:403,msg:'Path Traversal Attempt',log" "id:950007,phase:2,deny,status:403,msg:'PATH TRAVERSAL ATTEMPT!!!',log"
# exposed stuff # exposed stuff (redundante ?)
SecRule REQUEST_URI "\%00|\%2500|ftp|metrics|api-docs" \ SecRule REQUEST_URI|ARGS "\%00|\%2500|ftp|metrics|api-docs" \
"id:950008,phase:2,deny,status:500,msg:'Attempt to access ftp, metrics, api-docs',log" "id:950008,phase:2,deny,status:500,msg:'ATTEMPT TO ACCESS FTP, METRICS, API-DOCS!!!',log"
# rate limiting on login endpoint (max 5 requests per 30s per IP) # rate limiting on login endpoint
# (max 5 requests per 30s per IP)
SecAction \ SecAction \
"id:950009,phase:1,initcol:ip=%{REMOTE_ADDR},pass,nolog" "id:950009,phase:1,initcol:ip=%{REMOTE_ADDR},pass,nolog"
SecRule REQUEST_URI "@streq /rest/user/login" \ SecRule REQUEST_URI "@streq /rest/user/login" \

28
relatorio/relatorio.log
View File

@@ -1,4 +1,4 @@
This is pdfTeX, Version 3.141592653-2.6-1.40.29 (TeX Live 2026/Arch Linux) (preloaded format=pdflatex 2026.5.3) 31 MAY 2026 22:42 This is pdfTeX, Version 3.141592653-2.6-1.40.29 (TeX Live 2026/Arch Linux) (preloaded format=pdflatex 2026.5.3) 2 JUN 2026 23:18
entering extended mode entering extended mode
restricted \write18 enabled. restricted \write18 enabled.
%&-line parsing enabled. %&-line parsing enabled.
@@ -1277,21 +1277,21 @@ LaTeX Warning: `!h' float specifier changed to `!ht'.
\openout6 = `relatorio.listing'. \openout6 = `relatorio.listing'.
(./relatorio.listing) [11 <./imgs/stack-trace.png>] (./relatorio.listing) [11 <./imgs/stack-trace.png>]
Overfull \hbox (2.16914pt too wide) in paragraph at lines 444--447 Overfull \hbox (2.16914pt too wide) in paragraph at lines 446--449
\T1/Raleway-OsF/m/n/10.95 com tags HTML nos cam-pos de \T1/Raleway-OsF/m/it/10. \T1/Raleway-OsF/m/n/10.95 com tags HTML nos cam-pos de \T1/Raleway-OsF/m/it/10.
95 in-put\T1/Raleway-OsF/m/n/10.95 , como \T1/cmtt/m/n/10.95 <h1>STRONG\T1/Rale 95 in-put\T1/Raleway-OsF/m/n/10.95 , como \T1/cmtt/m/n/10.95 <h1>STRONG\T1/Rale
way-OsF/m/n/10.95 , de-vol-vendo um erro \T1/cmtt/m/n/10.95 403 Forbidden way-OsF/m/n/10.95 , de-vol-vendo um erro \T1/cmtt/m/n/10.95 403 Forbidden
[] []
[12]
Overfull \hbox (51.12938pt too wide) in paragraph at lines 448--454 Overfull \hbox (51.12938pt too wide) in paragraph at lines 450--456
\T1/Raleway-OsF/m/n/10.95 corpo JSON do re-gisto) \T1/Raleway-OsF/b/n/10.95 é m \T1/Raleway-OsF/m/n/10.95 corpo JSON do re-gisto) \T1/Raleway-OsF/b/n/10.95 é m
i-ti-gada pela re-gra id:950006\T1/Raleway-OsF/m/n/10.95 , que de-teta a se-quê i-ti-gada pela re-gra id:950006\T1/Raleway-OsF/m/n/10.95 , que de-teta a se-quê
n-cia \T1/cmtt/m/n/10.95 "role".*:.*"admin" n-cia \T1/cmtt/m/n/10.95 "role".*:.*"admin"
[] []
[12] [13] [13]
Overfull \hbox (111.73438pt too wide) in paragraph at lines 507--511 Overfull \hbox (111.73438pt too wide) in paragraph at lines 509--513
\T1/Raleway-OsF/m/n/10.95 O pay-load de ex-fil-tra-ção do to-ken JWT via XSS (\ \T1/Raleway-OsF/m/n/10.95 O pay-load de ex-fil-tra-ção do to-ken JWT via XSS (\
T1/cmtt/m/n/10.95 <img src="x"onerror="alert(localStorage.getItem('token'))^^T\ T1/cmtt/m/n/10.95 <img src="x"onerror="alert(localStorage.getItem('token'))^^T\
T1/Raleway-OsF/m/n/10.95 ) T1/Raleway-OsF/m/n/10.95 )
@@ -1306,10 +1306,10 @@ Package rerunfilecheck Info: File `relatorio.out' has not changed.
(rerunfilecheck) Checksum: 71F23F30E8D22A202B518A954FE83332;4897. (rerunfilecheck) Checksum: 71F23F30E8D22A202B518A954FE83332;4897.
) )
Here is how much of TeX's memory you used: Here is how much of TeX's memory you used:
31810 strings out of 469495 31813 strings out of 469495
627873 string characters out of 5470099 627922 string characters out of 5470099
1238894 words of memory out of 5000000 1260894 words of memory out of 5000000
59760 multiletter control sequences out of 15000+600000 59761 multiletter control sequences out of 15000+600000
791342 words of font info for 89 fonts, out of 8000000 for 9000 791342 words of font info for 89 fonts, out of 8000000 for 9000
16 hyphenation exceptions out of 8191 16 hyphenation exceptions out of 8191
113i,8n,122p,697b,1727s stack positions out of 10000i,1000n,20000p,200000b,200000s 113i,8n,122p,697b,1727s stack positions out of 10000i,1000n,20000p,200000b,200000s
@@ -1318,10 +1318,10 @@ hare/texmf-dist/fonts/type1/impallari/raleway/Raleway-Italic.pfb></usr/share/te
xmf-dist/fonts/type1/impallari/raleway/Raleway-Regular.pfb></usr/share/texmf-di xmf-dist/fonts/type1/impallari/raleway/Raleway-Regular.pfb></usr/share/texmf-di
st/fonts/type1/public/cm-super/sftt0900.pfb></usr/share/texmf-dist/fonts/type1/ st/fonts/type1/public/cm-super/sftt0900.pfb></usr/share/texmf-dist/fonts/type1/
public/cm-super/sftt1095.pfb> public/cm-super/sftt1095.pfb>
Output written on relatorio.pdf (14 pages, 882504 bytes). Output written on relatorio.pdf (14 pages, 883965 bytes).
PDF statistics: PDF statistics:
425 PDF objects out of 1000 (max. 8388607) 427 PDF objects out of 1000 (max. 8388607)
361 compressed objects within 4 object streams 363 compressed objects within 4 object streams
147 named destinations out of 1000 (max. 500000) 149 named destinations out of 1000 (max. 500000)
413 words of extra memory for PDF output out of 10000 (max. 10000000) 413 words of extra memory for PDF output out of 10000 (max. 10000000)

BIN
relatorio/relatorio.pdf
View File

Binary file not shown.

26
relatorio/relatorio.tex
View File

@@ -389,7 +389,7 @@ acesso de forma persistente.
\begin{codeblock}{modsecurity.conf} \begin{codeblock}{modsecurity.conf}
SecRuleEngine On SecRuleEngine On
SecRequestBodyAccess On SecRequestBodyAccess On
SecResponseBodyAccess Off SecResponseBodyAccess On
SecDebugLog /var/log/modsecurity/debug.log SecDebugLog /var/log/modsecurity/debug.log
SecDebugLogLevel 0 SecDebugLogLevel 0
SecAuditLogParts ABIJ SecAuditLogParts ABIJ
@@ -397,26 +397,28 @@ SecAuditLogType Serial
SecAuditLog /var/log/modsecurity/audit.log SecAuditLog /var/log/modsecurity/audit.log
# sql injection # sql injection
SecRule ARGS "['\";]|--" \ SecRule REQUEST_URI|ARGS "['\";]|--" \
"id:950001,phase:2,deny,status:403,msg:'SQL Injection Attack Detected',log" SecRule REQUEST_URI|ARGS "(?i:(?:select|insert|update|delete|drop|union|create|alter|truncate)\s+.+\s+from|'[^']*'|--|;|\b(or|and)\b\s+\d+\s*=\s*\d+)" \
"id:950001,phase:1,deny,status:403,msg:'SQL INJECTION ATTACK DETECTED!!!',log,t:urlDecode,t:sqlHexDecode,t:lowercase"
# xss / html injection # xss / html injection
SecRule ARGS "<.*>" \ SecRule REQUEST_URI|ARGS "(<.*>)|(%3C.*%3E)" \
"id:950003,phase:2,deny,status:403,msg:'XSS/HTML Injection Detected',log" "id:950003,phase:1,deny,status:403,msg:'XSS/HTML INJECTION DETECTED!!!',log"
# command injection # command injection
SecRule ARGS "(\"role\".*:.*\"admin\")|exec|cat|more|ls|dir|/etc/passwd" \ SecRule ARGS "(\"role\".*:.*\"admin\")|exec|cat|more|ls|dir|/etc/passwd" \
"id:950006,phase:2,deny,status:403,msg:'Command Injection Detected',log" "id:950006,phase:2,deny,status:403,msg:'COMMAND INJECTION DETECTED!!!',log"
# path traversal # path traversal
SecRule ARGS "\%00|\%2500|(\./|\.\./)|ftp|metrics|api-docs" \ SecRule REQUEST_URI|ARGS "\%00|\%2500|\.\./|ftp|metrics|api-docs" \
"id:950007,phase:2,deny,status:403,msg:'Path Traversal Attempt',log" "id:950007,phase:2,deny,status:403,msg:'PATH TRAVERSAL ATTEMPT!!!',log"
# exposed stuff # exposed stuff (redundante ?)
SecRule REQUEST_URI "\%00|\%2500|ftp|metrics|api-docs" \ SecRule REQUEST_URI|ARGS "\%00|\%2500|ftp|metrics|api-docs" \
"id:950008,phase:2,deny,status:500,msg:'Attempt to access ftp, metrics, api-docs',log" "id:950008,phase:2,deny,status:500,msg:'ATTEMPT TO ACCESS FTP, METRICS, API-DOCS!!!',log"
# rate limiting on login endpoint (max 5 requests per 30s per IP) # rate limiting on login endpoint
# (max 5 requests per 30s per IP)
SecAction \ SecAction \
"id:950009,phase:1,initcol:ip=%{REMOTE_ADDR},pass,nolog" "id:950009,phase:1,initcol:ip=%{REMOTE_ADDR},pass,nolog"
SecRule REQUEST_URI "@streq /rest/user/login" \ SecRule REQUEST_URI "@streq /rest/user/login" \

2
relatorio/relatorio.toc
View File

@@ -18,7 +18,7 @@
\contentsline {section}{\numberline {4}Web Application Security Firewall}{11}{section.4}% \contentsline {section}{\numberline {4}Web Application Security Firewall}{11}{section.4}%
\contentsline {subsection}{\numberline {4.1}Information Gathering}{12}{subsection.4.1}% \contentsline {subsection}{\numberline {4.1}Information Gathering}{12}{subsection.4.1}%
\contentsline {subsection}{\numberline {4.2}Configuration and Deployment Management Testing}{12}{subsection.4.2}% \contentsline {subsection}{\numberline {4.2}Configuration and Deployment Management Testing}{12}{subsection.4.2}%
\contentsline {subsection}{\numberline {4.3}Identity Management Testing}{12}{subsection.4.3}% \contentsline {subsection}{\numberline {4.3}Identity Management Testing}{13}{subsection.4.3}%
\contentsline {subsection}{\numberline {4.4}Authentication Testing}{13}{subsection.4.4}% \contentsline {subsection}{\numberline {4.4}Authentication Testing}{13}{subsection.4.4}%
\contentsline {subsection}{\numberline {4.5}Authorization Testing}{13}{subsection.4.5}% \contentsline {subsection}{\numberline {4.5}Authorization Testing}{13}{subsection.4.5}%
\contentsline {subsection}{\numberline {4.6}Session Management Testing}{13}{subsection.4.6}% \contentsline {subsection}{\numberline {4.6}Session Management Testing}{13}{subsection.4.6}%