You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copyright (c) 2004-2013 Trustwave Holdings, Inc. (http://www.trustwave.com/)
7
+
8
+
You may not use this file except in compliance with the License. You may obtain a copy of the License at: https://www.apache.org/licenses/LICENSE-2.0
9
+
10
+
If any of the files related to licensing are missing or if you have any other questions related to licensing please contact Trustwave Holdings, Inc. directly using the email address: [email protected].
11
+
12
+
13
+
## Documentation
14
+
15
+
Please refer to: [the documentation folder](https://github.com/SpiderLabs/ModSecurity/tree/v2/master/doc) for the reference manual.
ModSecurity™ is a web application firewall engine that provides very little protection on its own. In order to become useful, ModSecurity™ must be configured with rules. In order to enable users to take full advantage of ModSecurity™ out of the box, Trustwave's SpiderLabs is providing a free certified rule set for ModSecurity™ 2.x.
24
+
25
+
Unlike intrusion detection and prevention systems, which rely on signatures specific to known vulnerabilities, the Core Rules provide generic protection from unknown vulnerabilities often found in web applications, which are in most cases custom coded. The Core Rules are heavily commented to allow it to be used as a step-by-step deployment guide for ModSecurity™.
26
+
27
+
### Core Rules Content
28
+
29
+
In order to provide generic web applications protection, the Core Rules use the following techniques:
30
+
31
+
***HTTP Protection** - detecting violations of the HTTP protocol and a locally defined usage policy.
32
+
***Real-time Blacklist Lookups** - utilizes 3rd Party IP Reputation
33
+
***Web-based Malware Detection** - identifies malicious web content by check against the Google Safe Browsing API.
34
+
***HTTP Denial of Service Protections** - defense against HTTP Flooding and Slow HTTP DoS Attacks.
35
+
***Common Web Attacks Protection** - detecting common web application security attack.
36
+
***Automation Detection** - Detecting bots, crawlers, scanners and other surface malicious activity.
37
+
***Integration with AV Scanning for File Uploads** - detects malicious files uploaded through the web application.
Trustwave now provides a commercial certified rule set for ModSecurity 2.x that protects against known attacks that target vulnerabilities in public software and are based on intelligence gathered from real-world investigations, honeypot data and research.
50
+
51
+
1. More than 16,000 specific rules, broken out into the following attack categories:
52
+
53
+
* SQL injection
54
+
* Cross-site Scripting (XSS)
55
+
* Local File Include
56
+
* Remote File Include
57
+
58
+
2. User option for application specific rules, covering the same vulnerability classes for applications such as:
59
+
60
+
* WordPress
61
+
* cPanel
62
+
* osCommerce
63
+
* Joomla
64
+
* For a complete listing of application coverage, please refer to this link (which is updated daily): https://modsecurity.org/application_coverage.html
65
+
66
+
3. Complements and integrates with the OWASP Core Rule Set
67
+
68
+
4. IP Reputation capabilities which provide protection against malicious clients identified by the Trustwave SpiderLabs Distributed Web Honeypots
69
+
70
+
5. Malware Detection capabilities which prevent your web site from distributing malicious code to clients.
[cURL multiprotocol file transfer library](http://curl.haxx.se/) | cURL v7.21.4
16
18
17
-
LibXML2 from: http://xmlsoft.org/ tested with LibXML2 v2.7.7
18
-
Note that LibXML2 v2.7.8 does not build correctly for Windows
19
19
20
-
Lua Scripting Language from: http://www.lua.org/ tested with Lua v5.1.4
20
+
## Before building
21
21
22
-
cURL multiprotocol file transfer library from: http://curl.haxx.se/ tested with cURL v7.21.4
23
-
24
-
25
-
BEFORE BUILDING
26
-
27
-
The directory where you build software from source ( C:\work in this exmaple)
22
+
The directory where you build software from source ( ``C:\work`` in this exmaple)
28
23
must contain the Apache source you used to build the Apache web serverand the mod_security source
29
24
30
25
Apache source is in C:\work\httpd-2.2.17 in this example.
31
26
Apache has been installed to C:\Apache2217 in this example.
32
27
Mod_security source is in C:\work\mod_security in this example.
33
28
34
-
Download and untar the prerequite library sources:
29
+
## Download and untar the prerequisite library sources:
35
30
36
31
Download pcre-8.12.tar.gz from ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/
37
32
untar it into C:\work\ creating C:\work\pcre-8.12
@@ -45,75 +40,87 @@ Download and untar the prerequite library sources:
45
40
Download curl-7.21.4.tar.gz from http://curl.haxx.se/download.html
46
41
untar it into C:\work\ creating C:\work\curl-7.21.4
47
42
48
-
Setup your build environment:
43
+
## Setup your build environment:
44
+
45
+
1. The ``PATH`` environment variable must include the Visual Studio variables as set by ``vsvars32.bat``
46
+
47
+
2. The ``PATH`` environment variable must also include the CMAKE ``bin\`` directory
49
48
50
-
The PATH environment variable must include the Visual Studio variables as set by vsvars32.bat
51
-
The PATH environment variable must also include the CMAKE bin\ directory
49
+
3. Set an environment variable to the Apache source code directory:
52
50
53
-
Set an environment variable to the Apache source code directory:
51
+
```
52
+
SET HTTPD_BUILD=C:\work\httpd-2.2.17
53
+
```
54
54
55
-
SET HTTPD_BUILD=C:\work\httpd-2.2.17
55
+
### Optional:
56
56
57
-
If OpenSSL and Zlib support were included when you built Apache 2.2, and you want them available to LIBXML2 and CURL
57
+
If OpenSSL and zlib support were included when you built Apache 2.2, and you want them available to LibXML2 and cURL
58
58
59
-
Ensure that cURL and libXML2 can find the OpenSSL and Zlib includes and libraries that Apache was built with.
59
+
1.Ensure that cURL and LibXML2 can find the OpenSSL and zlib includes and libraries that Apache was built with.
60
60
61
-
SET INCLUDE=%INCLUDE%;%HTTPD_BUILD%\srclib\openssl\inc32;%HTTPD_BUILD%\srclib\zlib
62
-
SET LIB=%LIB%;%HTTPD_BUILD%\srclib\openssl\out32dll;%HTTPD_BUILD%\srclib\zlib
61
+
```
62
+
SET INCLUDE=%INCLUDE%;%HTTPD_BUILD%\srclib\openssl\inc32;%HTTPD_BUILD%\srclib\zlib
63
+
SET LIB=%LIB%;%HTTPD_BUILD%\srclib\openssl\out32dll;%HTTPD_BUILD%\srclib\zlib
64
+
```
63
65
64
-
Ensure that cURL and libXML2 don't use the static zlib library: zlib.lib.
65
-
Force cURL and libXML2 to use zdll.lib instead, requiring zlib1.dll at runtime:
66
+
2. Ensure that cURL and libXML2 don't use the static zlib library: ``zlib.lib``. Force cURL and libXML2 to use ``zdll.lib`` instead, requiring ``zlib1.dll`` at runtime:
66
67
67
-
IF EXIST %HTTPD_BUILD%\srclib\zlib\zlib.lib DEL %HTTPD_BUILD%\srclib\zlib\zlib.lib
68
+
```
69
+
IF EXIST %HTTPD_BUILD%\srclib\zlib\zlib.lib DEL %HTTPD_BUILD%\srclib\zlib\zlib.lib
You may also copy C:\work\curl-7.21.4\curl.exe to C:\Apache2217\bin, if you want to use the cURL command-line program.
121
+
You may also copy ``C:\work\curl-7.21.4\curl.exe`` to ``C:\Apache2217\bin``, if you want to use the cURL command-line program.
114
122
115
-
Download the core rules from http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/
116
-
and unzip them into C:\Apache2217\conf\modsecurity_crs
123
+
Download the core rules from http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/ and unzip them into ``C:\Apache2217\conf\modsecurity_crs``
117
124
118
125
Add configuration directives to your Apache conf\httpd.conf:
119
126
@@ -134,11 +141,9 @@ Add configuration directives to your Apache conf\httpd.conf:
134
141
SecAuditLog logs/modsecurity.log
135
142
</IfModule>
136
143
144
+
## Optional: Build and configure the ModSecurity-2.x MLOGC piped-logging program
0 commit comments