24 lines
753 B
Plaintext
24 lines
753 B
Plaintext
SecRuleEngine On
|
|
SecRequestBodyAccess On
|
|
SecResponseBodyAccess Off
|
|
SecDebugLog /var/log/modsecurity/debug.log
|
|
SecDebugLogLevel 0
|
|
SecAuditLogParts ABIJ
|
|
SecAuditLogType Serial
|
|
SecAuditLog /var/log/modsecurity/audit.log
|
|
|
|
# sql injection
|
|
SecRule ARGS "['\";]|--" \
|
|
"id:950001,phase:2,deny,status:403,msg:'SQL Injection Attack Detected',log"
|
|
|
|
# xss / html injection
|
|
SecRule ARGS "<.*>" \
|
|
"id:950003,phase:2,deny,status:403,msg:'XSS/HTML Injection Detected',log"
|
|
|
|
# command injection
|
|
SecRule ARGS "exec|cat|more|ls|dir|/etc/passwd" \
|
|
"id:950006,phase:2,deny,status:403,msg:'Command Injection Detected',log"
|
|
|
|
# path traversal
|
|
SecRule ARGS "(\./|\.\./)|ftp|metrics|api-docs" \
|
|
"id:950007,phase:2,deny,status:403,msg:'Path Traversal Attempt',log" |