vasco/FSI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mod security

Browse Source
This commit is contained in:
Vasco Alves
2026-05-31 20:11:27 +01:00
parent 73c5b1c5d5
commit e3d7b83059
1 changed files with 8 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
conf/modsecurity.conf
View File

@@ -7,22 +7,18 @@ SecAuditLogParts ABIJ
SecAuditLogType Serial SecAuditLogType Serial
SecAuditLog /var/log/modsecurity/audit.log SecAuditLog /var/log/modsecurity/audit.log
# SQL Injection protection # sql injection
SecRule ARGS "(?i)(union(\s+all)?\s+select|select\s+.*\s+from|insert\s+into|update\s+.*\s+set|delete\s+from|drop\s+table|or\s+1=1|--|#|/\*|\*/|\bexec\b|\bexecute\b)" \ SecRule ARGS "['\";]|--" \
"id:950001,phase:2,deny,status:403,msg:'SQL Injection Attack Detected',log" "id:950001,phase:2,deny,status:403,msg:'SQL Injection Attack Detected',log"
# XSS / HTML Injection protection # xss / html injection
SecRule ARGS "(?i)(<script|javascript:|on\w+=|<img|<svg|<iframe|<object|<embed|<form|<input|%3c|%3e|%22|%27|%60)" \ SecRule ARGS "<.*>" \
"id:950003,phase:2,deny,status:403,msg:'XSS/HTML Injection Detected',log" "id:950003,phase:2,deny,status:403,msg:'XSS/HTML Injection Detected',log"
# Remote File Inclusion protection # command injection
SecRule ARGS "(?i)(https?|ftp)://" \ SecRule ARGS "exec|cat|more|ls|dir|/etc/passwd" \
"id:950005,phase:2,deny,status:403,msg:'Remote File Inclusion Attempt',log"
# Command Injection protection
SecRule ARGS "(?i)(;|&&|\|\||\$\(|\`|\bexec\b|\bcmd\b|\bsystem\b)" \
"id:950006,phase:2,deny,status:403,msg:'Command Injection Detected',log" "id:950006,phase:2,deny,status:403,msg:'Command Injection Detected',log"
# Path Traversal protection # path traversal
SecRule ARGS "(\./|\.\./)" \ SecRule ARGS "(\./|\.\./)|ftp|metrics|api-docs" \
"id:950007,phase:2,deny,status:403,msg:'Path Traversal Attempt',log" "id:950007,phase:2,deny,status:403,msg:'Path Traversal Attempt',log"