https:\/\/bbs.apollo-sun.online:8123\/foo?testparam=thisisatestofmodsecurity<\/a>“<\/p>\n\n\n\nHTTP\/1.1 403 Forbidden<\/p>\n\n\n\n
Server: nginx\/1.24.0<\/p>\n\n\n\n
Date: Wed, 06 Mar 2024 07:52:25 GMT<\/p>\n\n\n\n
Content-Type: text\/html<\/p>\n\n\n\n
Content-Length: 153<\/p>\n\n\n\n
Connection: keep-alive<\/p>\n\n\n\n
<html><\/p>\n\n\n\n
<head><title>403 Forbidden<\/title><\/head><\/p>\n\n\n\n
<body><\/p>\n\n\n\n
<center><h1>403 Forbidden<\/h1><\/center><\/p>\n\n\n\n
<hr><center>nginx\/1.24.0<\/center><\/p>\n\n\n\n
<\/body><\/p>\n\n\n\n
<\/html><\/p>\n\n\n\n
\/var\/log\/modsec_audit.log:<\/p>\n\n\n\n
—882F3amP—A–<\/p>\n\n\n\n
[06\/Mar\/2024:15:52:25 +0800] 170971154554.044799 192.168.23.1 44880 192.168.23.4 8123<\/p>\n\n\n\n
—882F3amP—B–<\/p>\n\n\n\n
GET \/foo?testparam=thisisatestofmodsecurity HTTP\/1.1<\/p>\n\n\n\n
Host: bbs.apollo-sun.online:8123<\/p>\n\n\n\n
User-Agent: curl\/7.88.1<\/p>\n\n\n\n
Accept: *\/*<\/p>\n\n\n\n
—882F3amP—D–<\/p>\n\n\n\n
—882F3amP—F–<\/p>\n\n\n\n
HTTP\/1.1 403<\/p>\n\n\n\n
—882F3amP—H–<\/p>\n\n\n\n
ModSecurity: Access denied with code 403 (phase 1). Matched “Operator `Contains’ with parameter `test’ against variable `ARGS:testparam’ (Value: `thisisatestofmodsecurity’ ) [file “\/etc\/nginx\/modsec\/modsecurity.conf”] [line “276”] [id “1234”] [rev “”] [msg “”] [data “”] [severity “0”] [ver “”] [maturity “0”] [accuracy “0”] [hostname “192.168.23.4”] [uri “\/foo”] [unique_id “170971154554.044799”] [ref “o7,4v19,24”]<\/p>\n\n\n\n
—882F3amP—Z–<\/p>\n","protected":false},"excerpt":{"rendered":"
1.\u5b89\u88c5modsecurity \u4e2d\u6587 \u793e\u533a\uff1a http:\/\/www.modsecurity.cn\/ ModSecurity\u529f\u80fd\u4ecb\u7ecd SQL Injection (SQLi)\uff1a\u963b\u6b62SQL\u6ce8\u5165 Cross Site Scripting (XSS)\uff1a\u963b\u6b62\u8de8\u7ad9\u811a\u672c\u653b\u51fb Local File Inclusion (LFI)\uff1a\u963b\u6b62\u5229\u7528\u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\u8fdb\u884c\u653b\u51fb Remote File Inclusione(RFI)\uff1a\u963b\u6b62\u5229\u7528\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\u8fdb\u884c\u653b\u51fb Remote Code Execution (RCE)\uff1a\u963b\u6b62\u5229\u7528\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\u8fdb\u884c\u653b\u51fb PHP Code Injectiod\uff1a\u963b\u6b62PHP\u4ee3\u7801\u6ce8\u5165 HTTP Protocol Violations\uff1a\u963b\u6b62\u8fdd\u53cdHTTP\u534f\u8bae\u7684\u6076\u610f\u8bbf\u95ee HTTPoxy\uff1a\u963b\u6b62\u5229\u7528\u8fdc\u7a0b\u4ee3\u7406\u611f\u67d3\u6f0f\u6d1e\u8fdb\u884c\u653b\u51fb Sshllshock\uff1a\u963b\u6b62\u5229\u7528Shellshock\u6f0f\u6d1e\u8fdb\u884c\u653b\u51fb Session Fixation\uff1a\u963b\u6b62\u5229\u7528Session\u4f1a\u8bddID\u4e0d\u53d8\u7684\u6f0f\u6d1e\u8fdb\u884c\u653b\u51fb Scanner Detection\uff1a\u963b\u6b62\u9ed1\u5ba2\u626b\u63cf\u7f51\u7ad9 Metadata\/Error Leakages\uff1a\u963b\u6b62\u6e90\u4ee3\u7801\/\u9519\u8bef\u4fe1\u606f\u6cc4\u9732 Project Honey Pot Blacklist\uff1a\u871c\u7f50\u9879\u76ee\u9ed1\u540d\u5355 GeoIP Country Blocking\uff1a\u6839\u636e\u5224\u65adIP\u5730\u5740\u5f52\u5c5e\u5730\u6765\u8fdb\u884cIP\u963b\u65ad \u4e0b\u8f7d\u5730\u5740\uff1ahttps:\/\/github.com\/owasp-modsecurity\/ModSecurity\/releases\/download\/v3.0.12\/modsecurity-v3.0.12.tar.gz 2.\u7f16\u8bd1nginx\u65f6\u6dfb\u52a0 ModSecurity-nginx\u6a21\u5757 \u4e0b\u8f7d\u5730\u5740\uff1ahttps:\/\/github.com\/owasp-modsecurity\/ModSecurity-nginx\/releases\/download\/v1.0.3\/modsecurity-nginx-v1.0.3.tar.gz https:\/\/nginx.org\/download\/nginx-1.24.0.tar.gz 3.\u914d\u7f6eModSecurity\u5b89\u5168\u89c4\u5219 \u89c4\u5219\u96c6\u4e0b\u8f7d\u5730\u5740\uff1ahttps:\/\/github.com\/coreruleset\/coreruleset\/archive\/refs\/tags\/v4.0.0.tar.gz 4.\u7f16\u8f91nginx.conf \u5728http\u6216server\u8282\u70b9\u4e2d\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\uff08\u5728http\u8282\u70b9\u6dfb\u52a0\u8868\u793a\u5168\u5c40\u914d\u7f6e\uff0c\u5728server\u8282\u70b9\u6dfb\u52a0\u8868\u793a\u4e3a\u6307\u5b9a\u7f51\u7ad9\u914d\u7f6e\uff09\uff1a 5.\u7f16\u8f91modsecurity.conf SecRuleEngine […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-249","post","type-post","status-publish","format-standard","hentry","category-9"],"_links":{"self":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=249"}],"version-history":[{"count":2,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/249\/revisions"}],"predecessor-version":[{"id":640,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=\/wp\/v2\/posts\/249\/revisions\/640"}],"wp:attachment":[{"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/opshub.com.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}