Apache mod-security

mod_security can't filter some words :(

hi
i use mod_security 1.9.2 and httpd 2.0.55 test some php software .
on some case i need filter chinaese word in web software .
for example
SecFilterSelective POST_PAYLOAD 中文
SecFilterSelective POST_PAYLOAD testa
is "SecFilterSelective POST_PAYLOAD testa " is pass .but SecFilterSelective POST_PAYLOAD 中文 is not :(

this log is for testa :
==29ae5339==============================
Request: 192.168.202.47 211.157.227.29 - - [03/Apr/2006:14:38:45 +0800] "POST /7/post.php?action=reply&fid=2&tid=4&extra=page%3D1&replysubmit=yes HTTP/1.1" 403 287 " http://192.168.202.47/7/post.php?action=reply&fid=2&tid=4&extra=page%3D1" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1" - "-"
----------------------------------------
POST /7/post.php?action=reply&fid=2&tid=4&extra=page%3D1&replysubmit=yes HTTP/1.1
Host: 192.168.202.47
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q= 0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: zh-cn,zh;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: gb2312,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://192.168.202.47/7/post.php?action=reply&fid=2&tid=4&extra=page%3D1
Cookie: cdb_sid=65F1Y6; cdb_oldtopics=D4D3D2D1D; cdb_fid1=1144044872; cdb_cookietime=2592000; cdb_cpcollapsed=0; cdb_fid2=1144046293; cdb_visitedfid=2; cdb_auth=UFIHUApRUAgHVQwEAFMCDgxWXFsEUFZRUVYPBQQHVAFragQ
Content-Type: multipart/form-data; boundary=---------------------------5150948113011
Content-Length: 4252
mod_security-action: 403
mod_security-message: Access denied with code 403. Pattern match "testa" at POST_PAYLOAD

so if you have some tips .pls mail to this mail list .
thank you
--
http://wanghao.cublog.cn

headers

Ivan Ristic | 3 Apr 10:13

Re: mod_security can't filter some words :(

我爱臭豆腐 wrote:
> hi
> i use mod_security 1.9.2 and httpd 2.0.55 test some php software .
> on some case i need filter chinaese word in web software .
> for example
> SecFilterSelective POST_PAYLOAD 中文
> SecFilterSelective POST_PAYLOAD testa
> is "SecFilterSelective POST_PAYLOAD testa " is pass .but
> SecFilterSelective POST_PAYLOAD 中文 is not :(

  That may be caused by the differences in the encodings
  used to define the signature and to enter the content.

  Can you send me (to my private email address) your raw
  (binary) audit log entry and I'll see if I can do anything
  about it.

--

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642

headers

ego pfe | 4 Apr 17:33

modsecurity log parsers

Hi all,

I wanna now if there are some "log-parsers" for mod_security' audit_log or customlog such as webalizer, sarg etc.

any tool that correlate apache logs with modsecurity logs is needed.

what do you suggest ?

Thanks in advance

Federico

headers

BassPlayer | 4 Apr 18:33

Re: modsecurity log parsers

Enjoy
BP

Augie Schwer wrote:
> On 1/26/06, BassPlayer <bassplayer <at> angmar.com> wrote:
>> I've done some google searches and checked the site and I didn't see any
>> sort of audit_log parser and report generator. Anyone have any scripts
>> already developed?
>
> When I looked a month or so ago I found the same void ; here are the
> few links I did find, but like I said it's not much:
>
> http://textsnippets.com/posts/show/9
> http://orderamidchaos.com/modsec/modsec_auditlog_parser
> http://prwdot.org/code/modsecauditlogparse.txt
>

ego pfe wrote:
> Hi all,
>
> I wanna now if there are some "log-parsers" for mod_security' audit_log or
> customlog such as webalizer, sarg etc.
> any tool that correlate apache logs with modsecurity logs is needed.
>
> what do you suggest ?
>
>
> Thanks in advance
>
> Federico
>
>
> !DSPAM:44329871218801781912415!
>

-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642

headers

Darren | 6 Apr 01:23

Problem with AXS Logging

I installed mod_security and all is well except one odd behavior. The J/S used is this:

Instead of tracking referers correctly, all requests now say: arrived from "page" and visited cgi-bin/ax.pl

I assume one of the rules I installed is causing this. Is there a way to exclude these requests?

Thanks in advance,

Darren

headers

Ivan Ristic | 6 Apr 10:18

Re: Problem with AXS Logging

Darren wrote:
> I installed mod_security and all is well except one odd behavior.  The
> J/S used is this:
>  
> <script type="text/javascript">
> <!--
>         document.write('<img src="/cgi-bin/ax.pl?trans.gif&ref=');
>         document.write(document.referrer);
>         document.write('" height="1" width="1" alt="" />');
> // -->
> </script><noscript>
>       <p>  <img src="/cgi-bin/ax.pl?trans.gif" height="1" width="1"
> alt="" />
> </p>
> </noscript>
>  
> Instead of tracking referers correctly, all requests now say: arrived
> from "page" and visited  cgi-bin/ax.pl
> 
> I assume one of the rules I installed is causing this.

  I don't think that's the case. ModSecurity does not modify
  requests in any way. It blocks them if configured to do so, but
  in that case there wouldn't have been any "hits" in the tracking
  logs. Look into your error log for ModSecurity messages.

--

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642

headers

gotroot | 6 Apr 14:41

Filtering on POST

Hello,

I wanted to filter some of my website on POST payload because I got some
blog spammed by POST requests.

So I've activated SecFilterScanPOST On

but now, when I want to POST a new story (which is rather legitimate ;))
I get these errors in apache logs and a blank page in the webblog :

Wed Apr 05 10:20:42 2006 error client xx.yy.ww.zz mod_security:
Filtering against POST payload requested but payload is not available
hostname "www.aaaaa.net" uri "/admin/story.php"

Any idea ?

I'm using :
- Debian 3.1 (mixed testing/unstable)
- Apache 2.055-4
- Mod_security 1.9.2-rc3-1
- Php4 4.4.2-1

Sioban.

-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642

headers

Ryan Barnett | 6 Apr 14:42

Re: Filtering on POST

My first reaction was - Are you using Apache 2.X branch? I have seen similar messages when trying to enable/scan POST payloads with Apache 1.X versions as that functionality is not available. I see, however, that you are using 2.055-4 version.

Ivan's first recommendation is almost always - "Look in the mod_security debug log file". It should give you some more detailed info than the normal Apache error log.

--
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
Author: Preventing Web Attacks with Apache

On 4/6/06, gotroot <at> sioban.net <gotroot <at> sioban.net> wrote:

Hello,

I wanted to filter some of my website on POST payload because I got some
blog spammed by POST requests.

So I've activated SecFilterScanPOST On

but now, when I want to POST a new story (which is rather legitimate ;))
I get these errors in apache logs and a blank page in the webblog :

Wed Apr 05 10:20:42 2006 error client xx.yy.ww.zz mod_security:
Filtering against POST payload requested but payload is not available
hostname "www.aaaaa.net" uri "/admin/story.php"

Any idea ?

I'm using :
- Debian 3.1 (mixed testing/unstable)
- Apache 2.055-4
- Mod_security 1.9.2-rc3-1
- Php4 4.4.2-1

Sioban.

-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users

headers

Ivan Ristic | 6 Apr 14:46

Re: Filtering on POST

Ryan Barnett wrote:
> My first reaction was - Are you using Apache 2.X branch?  I have seen
> similar messages when trying to enable/scan POST payloads with Apache
> 1.X versions as that functionality is not available.  I see, however,
> that you are using 2.055-4 version.
>  
> Ivan's first recommendation is almost always - "Look in the mod_security
> debug log file".  It should give you some more detailed info than the
> normal Apache error log.

  What Ryan said :)

  Feel free to send me your configuration information, as specified
  here:

  http://www.thinkingstone.com/download/ModSecurity_Support_Request_Preparation_Guide.pdf

  to my private email address.

  That message, "Filtering against POST payload..." is something you'd
  get with SecFilterScanPOST set to off.

--

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642

headers

gotroot@sioban.net | 6 Apr 16:44

Re: Filtering on POST


>> Ivan's first recommendation is almost always - "Look in the mod_security
>> debug log file".  It should give you some more detailed info than the
>> normal Apache error log.

quite huge..

I've done it so, but I don't know what to look for in it...

>   Feel free to send me your configuration information, as specified

Done.

>   That message, "Filtering against POST payload..." is something you'd
>   get with SecFilterScanPOST set to off.

Yes, my fault.
First I didn't found any error message and when I finally found this one,
I was happy and thought that was enough for you to help me, seems I was
totally wrong ;)

Thanks.

-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642

63	February 2012
80	January 2012
44	December 2011
51	November 2011
78	October 2011
108	September 2011
104	August 2011
111	July 2011
66	June 2011
185	May 2011
54	April 2011
72	March 2011
69	February 2011
76	January 2011
26	December 2010
51	November 2010
69	October 2010
79	September 2010
67	August 2010
67	July 2010
59	June 2010
88	May 2010
59	April 2010
130	March 2010
117	February 2010
99	January 2010
80	December 2009
156	November 2009
112	October 2009
73	September 2009
134	August 2009
92	July 2009
78	June 2009
132	May 2009
104	April 2009
127	March 2009
131	February 2009
137	January 2009
85	December 2008
82	November 2008
84	October 2008
154	September 2008
167	August 2008
187	July 2008
95	June 2008
115	May 2008
89	April 2008
97	March 2008
134	February 2008
159	January 2008
56	December 2007
205	November 2007
135	October 2007
97	September 2007
162	August 2007
130	July 2007
250	June 2007
191	May 2007
150	April 2007
181	March 2007
161	February 2007
166	January 2007
104	December 2006
172	November 2006
103	October 2006
83	September 2006
101	August 2006
92	July 2006
116	June 2006
65	May 2006
139	April 2006
82	March 2006
148	February 2006
61	January 2006
74	December 2005
104	November 2005
49	October 2005
28	September 2005
51	August 2005
27	July 2005
71	June 2005
26	May 2005
53	April 2005
82	March 2005
61	February 2005
67	January 2005
12	December 2004
22	November 2004
28	October 2004
31	September 2004
24	August 2004
36	July 2004
20	June 2004
15	May 2004
47	April 2004
21	March 2004
13	February 2004
44	January 2004
18	December 2003
13	November 2003
11	October 2003
9	September 2003
7	August 2003
16	July 2003
1	June 2003

Mon	Tue	Wed	Thu	Fri	Sat	Sun

					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30