-
-
- 10.1
+
- 10.1 + accuracy
+- 10.2 allow
-- 10.2 +
- 10.3 append
-- 10.3 +
- 10.4 auditlog
-- 10.4 +
- 10.5 block
-- 10.5 +
- 10.6 capture
-- 10.6 +
- 10.7 chain
-- 10.7 +
- 10.8 ctl
-- 10.8 +
- 10.9 deny
-- 10.9 +
- 10.10 deprecatevar
-- 10.10 +
- 10.11 drop
-- 10.11 +
- 10.12 exec
-- 10.12 +
- 10.13 expirevar
-- 10.13 +
- 10.14 id
-- 10.14 +
- 10.15 initcol
-- 10.15 +
- 10.16 log
-- 10.16 +
- 10.17 logdata
-- 10.17 +
- 10.18 + maturity
+- 10.19 msg
-- 10.18 +
- 10.20 multiMatch
-- 10.19 +
- 10.21 noauditlog
-- 10.20 +
- 10.22 nolog
-- 10.21 +
- 10.23 pass
-- 10.22 +
- 10.24 pause
-- 10.23 +
- 10.25 phase
-- 10.24 +
- 10.26 prepend
-- 10.25 +
- 10.27 proxy
-- 10.26 +
- 10.28 redirect
-- 10.27 +
- 10.29 rev
-- 10.28 +
- 10.30 sanitiseArg
- 10.29 sanitiseMatched
+class="tocnumber">10.31 sanitiseMatched- 10.30 sanitiseMatchedBytes
+class="tocnumber">10.32 sanitiseMatchedBytes- 10.31 sanitiseRequestHeader
+class="tocnumber">10.33 sanitiseRequestHeader- 10.32 sanitiseResponseHeader
-- 10.33 +class="tocnumber">10.34 sanitiseResponseHeader
+- 10.35 severity
-- 10.34 +
- 10.36 setuid
-- 10.35 +
- 10.37 + setrsc
+- 10.38 setsid
-- 10.36 +
- 10.39 setenv
-- 10.37 +
- 10.40 setvar
-- 10.38 +
- 10.41 skip
-- 10.39 +
- 10.42 skipAfter
-- 10.40 +
- 10.43 status
-- 10.41 +
- 10.44 t
-- 10.42 +
- 10.45 tag
-- 10.43 +
- 10.46 + ver
+- 10.47 xmlns
ModSecurity® Reference Manual
--Current as of v2.5.13 and v2.6
+Current as of v2.5.13 v2.6 and v2.7
Copyright © 2004-2011 http://www.modsecurity.org/documentation/ModSecurity-Migration-Matrix.pdf
+- Starting with ModSecurity 2.7.0 there are a few important
+configuration options
+
+- --enable-pcre-jit - Enables JIT support from pcre >=
+8.20 that can improve regex performance.
+
- --enable-cache-lua - Enables lua vm caching that can
+improve lua script performance. Difference just appears if ModSecurity
+must run more than one script per transaction.
+
- --enable-request-early - On ModSecuricy 2.6 phase one
+has been moved to phase 2 hook, if you want to play around it use this
+option.
+
Configuration Directives
The following section outlines all of the ModSecurity directives.
@@ -1245,7 +1301,7 @@ class="mw-headline"> SecArgumentSeparator
for application/x-www-form- urlencoded content.
Syntax: SecArgumentSeparator character
Default: & -
Scope: Main +
Scope: Main(< 2.7.0), Any(2.7.0)
Version: 2.0.0
This directive is needed if a backend web application is using a nonstandard argument separator. Applications are sometimes (very rarely) @@ -1672,7 +1728,7 @@ title="http://blog.spiderlabs.com/2008/07/three-modsecurity-rule-language-annoya frontend compression enabled.
Syntax: SecDisableBackendCompression On|Off
Scope: Any -
Version: Development trunk +
Version: 2.6.0
Default: Off
This directive is necessary in reverse proxy mode when the backend servers support response compression, but you wish to inspect @@ -1681,6 +1737,100 @@ will only see compressed content, which is not very useful. This directive is not necessary in embedded mode, because ModSecurity performs inspection before response compression takes place.
+SecEncryptionEngine
+Description: Configures the encryption engine. +
Syntax: SecEncryptionEngine On|Off
+
Example Usage: SecEncryptionEngine On
+
Scope: Any +
Version: 2.7 +
Default: Off +
The possible values are: +
+- On: Encryption engine can process the request/response +data. +
- Off: Encryption engine will not process any data. +
- Note
- Users must enable stream output variables +and content injection. +
SecEncryptionKey
+Description: Define the key that will be used by HMAC. +
Syntax: SecEncryptionKey rand|TEXT
+KeyOnly|SessionID|RemoteIP
+
Example Usage: SecEncryptionKey "this_is_my_key"
+KeyOnly
+
Scope: Any +
Version: 2.7 +
ModSecurity encryption engine will append, if specified, the +user's session id or remote ip to the key before the MAC operation. If +the first parameter is "rand" then a random key will be generated and +used by the engine. +
+
SecEncryptionParam
+Description: Define the parameter name that will receive the +MAC hash. +
Syntax: SecEncryptionParam TEXT
+
Example Usage: SecEncryptionKey "hmac"
+
Scope: Any +
Version: 2.7 +
ModSecurity encryption engine will add a new parameter to +protected HTML elements containing the MAC hash. +
+SecEncryptionMethodRx
+Description: Configures what kind of HTML data the encryption +engine should sign based on regular expression. +
Syntax: SecEncryptionMethodRx TYPE REGEX
+
Example Usage: SecEncryptionMethodRx HashHref
+"product_info|list_product"
+
Scope: Any +
Version: 2.7.0 +
As a initial support is possible to protect HREF, FRAME, IFRAME +and FORM ACTION html elements as well response Location header when http + redirect code are sent. +
The possible values for TYPE are: +
+- HashHref: Used to sign href= html elements +
- HashFormAction: Used to sign form action= html elements +
- HashIframeSrc: Used to sign iframe src= html elements +
- HashframeSrc: Used to sign frame src= html elements +
- HashLocation: Used to sign Location response header +
- Note
- This directive is used to sign the elements + however user must use the @validateEncryption operator to enforce data +integrity. +
+
SecEncryptionMethodPm
+Description: Configures what kind of HTML data the encryption +engine should sign based on string search algoritm. +
Syntax: SecEncryptionMethodRx TYPE "string1 string2
+string3..."
+
Example Usage: SecEncryptionMethodRx HashHref
+"product_info list_product"
+
Scope: Any +
Version: 2.7.0 +
As a initial support is possible to protect HREF, FRAME, IFRAME +and FORM ACTION html elements as well response Location header when http + redirect code are sent. +
The possible values for TYPE are: +
+- HashHref: Used to sign href= html elements +
- HashFormAction: Used to sign form action= html elements +
- HashIframeSrc: Used to sign iframe src= html elements +
- HashframeSrc: Used to sign frame src= html elements +
- HashLocation: Used to sign Location response header +
- Note
- This directive is used to sign the elements + however user must use the @validateEncryption operator to enforce data +integrity. +
SecGeoLookupDb
Description: Defines the path to the database that will be @@ -1710,9 +1860,11 @@ href="http://code.google.com/apis/safebrowsing/" class="external autonumber" title="http://code.google.com/apis/safebrowsing/" rel="nofollow">[3]
- Note
- After registering and obtaining a Safe
-Browsing API key, you can automatically download the GSB using a tool
-like wget (where KEY is your own API key):
+
- Note
- Deprecated in 2.7.0 after Google dev team +decided to not allow the database download anymore. After registering +and obtaining a Safe Browsing API key, you can automatically download +the GSB using a tool like wget (where KEY is your own API +key):
+wget http://blog.spiderlabs.com/2010/11/advanced-topic-of-the-week-mitigating-slow-http-dos-attacks.htmlSecSensorId
+Description: Define a sensor ID that will be present into log +part H. +
Syntax:
SecSensorId TEXT+Example Usage:
SecSensorId WAFSensor01+Scope: Main +
Version: 2.7.0 +
SecWriteStateLimit
Description: Establishes a per-IP address limit of how many @@ -2187,6 +2348,16 @@ class="mw-headline"> SecRuleEngine
SecRulePerfTime
+Description: Set a performance threshold for rules. Rules that + spends too much time will be logged into audit log Part H in the format + id=usec. +
Syntax: SecRulePerfTime USECS
+
Example Usage: SecRulePerfTime 1000
+
Scope: Any +
Version: 2.7 +
SecRuleRemoveById
Description: Removes the matching rules from the current @@ -2390,7 +2561,7 @@ TARGET1[,TARGET2,TARGET3] REPLACED_TARGET
Version: 2.6
This directive will append (or replace) variables to the current target list of the specified rule with the targets provided in the -second parameter. +second parameter. Starting with 2.7.0 this feature supports id range.
Explicitly Appending Targets
This is useful for implementing exceptions where you want to externally update a target list to exclude inspection of specific @@ -2439,6 +2610,107 @@ example, lets say you want to only inspect ARGS for a particular URL:
SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetById=958895;REQUEST_URI;REQUEST_FILENAME"+
- Note
- This ctl is deprecated and will be removed +from the code, since we cannot use it per-transaction. +
+ SecRuleUpdateTargetByMsg
+Description: Updates the target (variable) list of the +specified rule by rule message. +
Syntax: SecRuleUpdateTargetByMsg TEXT
+TARGET1[,TARGET2,TARGET3] REPLACED_TARGET
+
Example Usage: SecRuleUpdateTargetByMsg "Cross-site
+Scripting (XSS) Attack" "!ARGS:foo"
+
Scope: Any +
Version: 2.7 +
This directive will append (or replace) variables to the current +target list of the specified rule with the targets provided in the +second parameter. +
Explicitly Appending Targets +
This is useful for implementing exceptions where you want to +externally update a target list to exclude inspection of specific +variable(s). +
+SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+ "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}"
+
+SecRuleUpdateTargetByMsg "System Command Injection" !ARGS:email
+
+The effective resulting rule in the previous example will append the +target to the end of the variable list as follows: +
+SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|!ARGS:email "[\;\|\`]\W*?\bmail\b" \
+ "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}""
+
+Explicitly Replacing Targets +
You can also entirely replace the target list to something more +appropriate for your environment. For example, lets say you want to +inspect REQUEST_URI instead of REQUEST_FILENAME, you could do this: +
+SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+ "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}"
+
+SecRuleUpdateTargetByMsg "System Command Injection" REQUEST_URI REQUEST_FILENAME
+
+The effective resulting rule in the previous example will append the +target to the end of the variable list as follows: +
+SecRule REQUEST_URI|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+ "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}""
+
++ SecRuleUpdateTargetByTag
+Description: Updates the target (variable) list of the +specified rule by rule tag. +
Syntax: SecRuleUpdateTargetByTag TEXT
+TARGET1[,TARGET2,TARGET3] REPLACED_TARGET
+
Example Usage: SecRuleUpdateTargetByTag
+"WEB_ATTACK/XSS" "!ARGS:foo"
+
Scope: Any +
Version: 2.7 +
This directive will append (or replace) variables to the current +target list of the specified rule with the targets provided in the +second parameter. +
Explicitly Appending Targets +
This is useful for implementing exceptions where you want to +externally update a target list to exclude inspection of specific +variable(s). +
+SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+ "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}"
+
+SecRuleUpdateTargetByTag "WASCTC/WASC-31" !ARGS:email
+
+The effective resulting rule in the previous example will append the +target to the end of the variable list as follows: +
+SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|!ARGS:email "[\;\|\`]\W*?\bmail\b" \
+ "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}""
+
+Explicitly Replacing Targets +
You can also entirely replace the target list to something more +appropriate for your environment. For example, lets say you want to +inspect REQUEST_URI instead of REQUEST_FILENAME, you could do this: +
+SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+ "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}"
+
+SecRuleUpdateTargetByTag "WASCTC/WASC-31" REQUEST_URI REQUEST_FILENAME
+
+The effective resulting rule in the previous example will append the +target to the end of the variable list as follows: +
+SecRule REQUEST_URI|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \
+ "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%
+{tx.0}""
+
SecServerSignature
Description: Instructs ModSecurity to change the data @@ -2645,7 +2917,7 @@ five phases of the Apache request cycle:
Below is a diagram of the standard Apache Request Cycle. In the diagram, the 5 ModSecurity processing phases are shown.
@@ -2836,6 +3108,9 @@ DURATION
Contains the number of milliseconds elapsed since the beginning of the current transaction. Available starting with 2.6.0.
+- Note
- Starting with ModSecurity 2.7.0 the time is + microseconds. +
ENV
Collection that provides access to environment variables set by ModSecurity. Requires a single parameter to specify the name of the @@ -3110,6 +3385,12 @@ class="mw-headline"> PERF_PHASE5
Contains the time, in microseconds, spent processing phase 5. Available starting with 2.6.
++ PERF_RULES
+Contains the time of rules, in microseconds. Available starting with +2.7. +
SecRule PERF_RULES "@gt 1000" "id:12345,phase:5"
+
PERF_SREAD
Contains the time, in microseconds, spent reading from persistent @@ -3617,6 +3898,12 @@ SecAction "nolog,pass,setuid:%{REMOTE_USER}" # Is the current user the administrator? SecRule USERID "admin" +
USERAGENT_IP
+This variable is created when running modsecurity with apache2.4 and +will contains the client ip address set by mod_remoteip in proxied +connections. +
WEBAPPID
This variable contains the current application name, which is set in @@ -3983,7 +4270,7 @@ chain, a disruptive action can only appear in the first rule).
- Note
- Disruptive actions will NOT be executed if the SecRuleEngine is set to DetectionOnly. If you are creating exception/whitelisting rules that use the allow action, you should also -add the ctl:ruleEngine=DetectionOnly action to execute the action. +add the ctl:ruleEngine=On action to execute the action.
- Non-disruptive actions - Do something, but that something does not and cannot affect the rule processing flow. Setting a @@ -4000,6 +4287,20 @@ containers that hold data used by other actions. For example, the status action holds the status that will be used for blocking (if it takes place).
+accuracy
+Description: Specifies the relative accuracy level of the rule + related to false positives/negatives. The value is a string based on a + numeric scale (1-9 where 9 is very strong and 1 has many false +positives). +
Action Group: Meta-data +
Version: 2.7 +
Example: +
+SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bgetparentfolder\b" \
+ "phase:2,ver:'CRS/2.2.4,accuracy:'9',maturity:'9',capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,msg:'Cross-site Scripting (XSS) Attack',id:'958016',tag:'WEB_ATTACK/XSS',tag:'WASCTC/WASC-8',tag:'WASCTC/WASC-22',tag:'OWASP_TOP_10/A2',tag:'OWASP_AppSensor/IE1',tag:'PCI/6.5.1',logdata:'% \
+{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.xss_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}"
+
allow
Description: Stops rule processing on a successful match and allows the transaction to proceed. @@ -4195,7 +4496,13 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml "nolog,pass,ctl:requestBodyProcessor=XML"
With the exception of the requestBodyProcessor and forceRequestBodyVariable settings, each configuration option corresponds @@ -4304,7 +4611,8 @@ time will be reset.
id
Description: Assigns a unique ID to the rule or chain in which - it appears. + it appears. Starting with ModSecurity 2.7 this action is mandatory and +must be numeric.
Action Group: Meta-data
Example:
@@ -4324,14 +4632,22 @@ modsecurity.org href="http://projects.otaku42.de/wiki/Scally-Whack" class="external autonumber" title="http://projects.otaku42.de/wiki/Scally-Whack" rel="nofollow">[9]+maturity
+Description: Specifies the relative maturity level of the rule + related to the length of time a rule has been public and the amount of +testing it has received. The value is a string based on a numeric scale + (1-9 where 9 is extensively tested and 1 is a brand new experimental +rule). +
Action Group: Meta-data +
Version: 2.7 +
Example: +
+SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bgetparentfolder\b" \
+ "phase:2,ver:'CRS/2.2.4,accuracy:'9',maturity:'9',capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,msg:'Cross-site Scripting (XSS) Attack',id:'958016',tag:'WEB_ATTACK/XSS',tag:'WASCTC/WASC-8',tag:'WASCTC/WASC-22',tag:'OWASP_TOP_10/A2',tag:'OWASP_AppSensor/IE1',tag:'PCI/6.5.1',logdata:'% \
+{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.xss_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}"
+
msg
Description: Assigns a custom message to the rule or chain in which it appears. The message will be logged along with every alert. @@ -4455,7 +4786,8 @@ SecRule ARGS "test" "phase:2,log,pass,setvar:TX.test=+1"
pause
Description: Pauses transaction processing for the specified -number of milliseconds. +number of milliseconds. Starting with ModSecurity 2.7 this feature also +supports macro expansion.
Action Group: Non-disruptive
Example:
@@ -4478,6 +4810,17 @@ establish the rule defaults.# Initialize IP address tracking in phase 1
SecAction phase:1,nolog,pass,initcol:IP=%{REMOTE_ADDR}
+Starting in ModSecurity version v2.7 there are aliases for some phase + numbers: +
+- 2 - request +
- 4 - response +
- 5 - logging +
Example: +
+SecRule REQUEST_HEADERS:User-Agent "Test" "phase:request,log,deny" +
- Warning
- Keep in mind that if you specify the
incorrect phase, the variable used in the rule may not yet be available.
This could lead to a false negative situation where your variable and
@@ -4684,6 +5027,17 @@ available for use in the subsequent rules. This action understands
application namespaces (configured using SecWebAppId), and will use one
if it is configured.
+
setrsc
+Description: Special-purpose action that initializes the +RESOURCE collection using a key provided as parameter. +
Action Group: Non-disruptive +
Example: +
+SecAction "phase:1,pass,id:3,log,setrsc:'abcd1234'" +
+This action understands application namespaces (configured using +SecWebAppId), and will use one if it is configured. +
setsid
Description: Special-purpose action that initializes the SESSION collection using the session token provided as parameter. @@ -4830,6 +5184,16 @@ of events. Multiple tags can be specified on the same rule. Use forward slashes to create a hierarchy of categories (as in the example). Since ModSecurity 2.6.0 tag supports macro expansion.
+ver
+Description: Specifies the rule set version. +
Action Group: Meta-data +
Version: 2.7 +
Example: +
+SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bgetparentfolder\b" \ + "phase:2,ver:'CRS/2.2.4,capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,msg:'Cross-site Scripting (XSS) Attack',id:'958016',tag:'WEB_ATTACK/XSS',tag:'WASCTC/WASC-8',tag:'WASCTC/WASC-22',tag:'OWASP_TOP_10/A2',tag:'OWASP_AppSensor/IE1',tag:'PCI/6.5.1',logdata:'% \ +{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.xss_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}" +xmlns
Description: Configures an XML namespace, which will be used in the execution of XPath expressions. @@ -4865,6 +5229,24 @@ string before comparison.
# Detect ".php" anywhere in the request line SecRule REQUEST_LINE "@contains .php"
+containsWord
+Description: Returns true if the parameter string (with word +boundaries) is found anywhere in the input. Macro expansion is performed + on the parameter string before comparison. +
Example: +
+# Detect "select" anywhere in ARGS +SecRule ARGS "@containsWord select" +
+Would match on -
+-1 union select +BENCHMARK(2142500,MD5(CHAR(115,113,108,109,97,112))) FROM wp_users WHERE + ID=1 and (ascii(substr(user_login,1,1))&0x01=0) from wp_users where + ID=1-- +But not on -
+Your site has a wide selection of computers. +endsWith
Description: Returns true if the parameter string is found at @@ -4967,7 +5349,7 @@ script in the /util directory called runav.pl [11] that allows the file approval mechanism to + rel="nofollow">[13]
SecRule REMOTE_ADDR "@ipMatch 192.168.1.100,192.168.1.50,10.10.50.0/24"+
+ipMatchF
+short alias for ipMatchFromFile +
+ipMatchFromFile
+Description: Performs a fast ipv4 or ipv6 match of REMOTE_ADDR + variable, loading data from a file. Can handle the following formats: +
+- Full IPv4 Address - 192.168.1.100 +
- Network Block/CIDR Address - 192.168.1.0/24 +
- Full IPv6 Address - 2001:db8:85a3:8d3:1319:8a2e:370:7348 +
- Network Block/CIDR Address - +2001:db8:85a3:8d3:1319:8a2e:370:0/24 +
Examples: +
+SecRule REMOTE_ADDR "@ipMatch ips.txt" ++
The file ips.txt may contain: +
+192.168.0.1 +172.16.0.0/16 +10.0.0.0/8 +
le
Description: Performs numerical comparison and returns true if the input value is less than or equal to the operator parameter. Macro @@ -5191,7 +5598,9 @@ specific RBL the IP was found in.
rsub
Description: Performs regular expression data substitution when applied to either the STREAM_INPUT_BODY or STREAM_OUTPUT_BODY -variables. This operator also supports macro expansion. +variables. This operator also supports macro expansion. Starting with +ModSecurity 2.7.0 this operator supports the syntax |hex| allowing users + to use special chars like \n \r
Syntax: @rsub s/regex/str/[id]
Examples: Removing HTML Comments from response bodies: @@ -5205,7 +5614,7 @@ SecContentInjection directive.
Regular expressions are handled by the PCRE library [12]. ModSecurity +title="http://www.pcre.org" rel="nofollow">[14]
- The entire input is treated as a single line, even when there
@@ -5243,7 +5652,7 @@ SecRule REQUEST_HEADERS:User-Agent "(?i)nikto"
Regular expressions are handled by the PCRE library [13]. ModSecurity +title="http://www.pcre.org" rel="nofollow">[15]
- The entire input is treated as a single line, even when there
@@ -5340,6 +5749,15 @@ SecRule REQUEST_HEADERS:Content-Type ^text/xml$ "phase:1,nolog,pass,t:lowercase,
# Validate XML payload against DTD
SecRule XML "@validateDTD /path/to/xml.dtd" "phase:2,deny,msg:'Failed DTD validation'"
+
validateEncryption
+Description: Validates REQUEST_URI that contains data +protected by the encryption engine. +
Example: +
+# Validates requested URI that matches a regular expression. +SecRule REQUEST_URI "@validateEncryption "product_info|product_list" "phase:1,deny,id:123456" +
validateSchema
Description: Validates the XML DOM tree against the supplied @@ -5815,16 +6233,16 @@ SecCookieFormat 0 - +
+href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual">https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual
- Page
- Discussion -
- View source +
- Edit
- History +
- Delete +
- Move +
- Protect +
- Watch
-
+
- Brenosilva +
- My talk +
- My preferences +
- My watchlist +
- My +contributions +
-
-
- This page was last modified on 19 December 2011, -at 12:16. -
- This page has been accessed 77,761 times. +
- This page was last modified on 23 July 2012, at +17:54. +
- This page has been accessed 142,275 times.