@@ -3203,15 +3377,15 @@ that no severity has been set.
The source code of ModSecurity’s IIS components is fully published +and the binary building process is described (see +mod_security/iis/winbuild/howto.txt). For quick installation it is +highly recommended to use standard MSI installer available from +SourceForge files repository of ModSecurity project or use binary +package and follow the manual installation steps. +
+Before installing ModSecurity one has to install Visual Studio 2010 +Runtime: +
+Download binary package and unzip the content to a separate folder: +
+ +
+
+
appcmd.exe install module /name:ModSecurityIIS /image:%windir%\system32\inetsrv\modsecurityiis.dll+
+
iisschema.exe /install ModSecurity.xml+
<modules> + <remove name="ModSecurityIIS" /> +</modules>+
<?xml version="1.0" encoding="UTF-8"?> +<configuration> + <system.webServer> + <ModSecurity enabled="true" configFile="c:\inetpub\wwwroot\xss.conf" /> + </system.webServer> +</configuration>+
+
Log Name: Application +Source: Microsoft-Windows-IIS-W3SVC-WP +Event ID: 2280 +Task Category: None +Level: Error +Keywords: Classic +User: N/A +Description: +The Module DLL C:\Windows\system32\inetsrv\modsecurityiis.dll failed to load. The data is the error. ++
most likely it means that the installation process has failed and the + ModSecurityIIS.dll module is missing one or more libraries that it +depends on. Repeating installation of the prerequisites and the module +files should fix the problem. The dependency walker tool: +
+ +can be used to figure out which library is missing or cannot be +loaded. +
The following section outlines all of the ModSecurity directives. @@ -2917,7 +3091,7 @@ five phases of the Apache request cycle:
Below is a diagram of the standard Apache Request Cycle. In the diagram, the 5 ModSecurity processing phases are shown.
@@ -3203,15 +3377,15 @@ that no severity has been set.
This variable will be set to 1 when the request body size is above the setting configured by SecRequestBodyLimit directive. Your policies should always contain a rule to check this variable. Depending on the rate of false positives and your default policy you should decide whether to block or just warn when the rule is triggered.
The best way to use this variable is as in the example below: -
SecRule INBOUND_ERROR_DATA "@eq 1"
+
SecRule INBOUND_DATA_ERROR "@eq 1"
"phase:1,t:none,log,pass,msg:'Request Body Larger than
SecRequestBodyLimit Setting'"
Change the rule from blocking to logging-only if many false positives are encountered.
+This variable will be set to 1 when the response body size is above +the setting configured by SecResponseBodyLimit directive. Your policies + should always contain a rule to check this variable. Depending on the +rate of false positives and your default policy you should decide +whether to block or just warn when the rule is triggered. +
The best way to use this variable is as in the example below: +
SecRule OUTBOUND_DATA_ERROR "@eq 1"
+"phase:1,t:none,log,pass,msg:'Response Body Larger than
+SecResponseBodyLimit Setting'"
+
Contains the extra request URI information, also known as path info. @@ -4237,6 +4423,12 @@ zeroed. urlEncode
Encodes input string using URL encoding.
+Converts all UTF-8 characters sequences to Unicode. This help input +normalization specially for non-english languages minimizing +false-positives and false-negatives. (available with 2.7.0) +
Calculates a SHA1 hash from the input string. The computed hash is in a raw binary form and may need encoded into text to be printed (or @@ -4448,9 +4640,9 @@ AND. The disruptive actions specified in the first portion of the chained rule will be triggered only if all of the variable checks return positive hits. If any one aspect of a chained rule comes back negative, then the entire rule chain will fail to match. Also note that -disruptive actions, execution phases, metadata actions (id, rev, msg), -skip, and skipAfter actions can be specified only by the chain starter -rule. +disruptive actions, execution phases, metadata actions (id, rev, msg, +tag, severity, logdata), skip, and skipAfter actions can be specified +only by the chain starter rule.
The following directives can be used in rule chains:
@@ -4788,10 +4980,10 @@ SecRule ARGS "test" "phase:2,log,pass,setvar:TX.test=+1"Description: Pauses transaction processing for the specified number of milliseconds. Starting with ModSecurity 2.7 this feature also supports macro expansion. -
Action Group: Non-disruptive +
Action Group: Disruptive
Example:
-SecRule REQUEST_HEADERS:User-Agent "Test" "log,deny,status:403,pause:5000" +SecRule REQUEST_HEADERS:User-Agent "Test" "log,pause:5000"
Description: Creates, removes, or updates a variable. Variable names are case-insensitive. @@ -5083,6 +5278,9 @@ block,msg:'Blind SQL Injection Attack',id:'959517',tag:'WEB_ATTACK/SQL_INJECTION tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, \ setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/SQL_INJECTION-%{matched_var_name}=%{tx.0}" +
Description: Skips one or more rules (or chains) on successful match. @@ -6233,16 +6431,16 @@ SecCookieFormat 0 - +
+href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual">http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual" @@ -6255,30 +6453,18 @@ href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Refere