Editing: 05_additional_directives.conf
# both.conf # This file contains directives that don't work with some older versions # of the PCRE library Apache is compiled against or directives that don't # work properly with versions of Mod Security prior to 2.5. # # Certain dedicated and VPS servers may not support these directives so # any which may not work for these reasons should be placed here. # Deprecated due to security issues so it should be off: # http://blog.modsecurity.org/2008/08/transformation.html SecCacheTransformations Off # Added by T3 to mitigate slow http attacks #SecWriteStateLimit 100 #SecReadStateLimit 100 # SQL injection SecRule REQUEST_FILENAME|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer \ "@pm insert xp_enumdsn infile openrowset nvarchar autonomous_transaction \ print data_type or outfile inner shutdown tbcreator @@version xp_filelist \ sp_prepare sql_longvarchar xp_regenumkeys xp_loginconfig xp_dirtree ifnull \ sp_addextendedproc xp_regaddmultistring delete sp_sqlexec and sp_oacreate \ sp_execute cast xp_ntsec xp_regdeletekey drop varchar xp_execresultset \ having utl_file xp_regenumvalues xp_terminate xp_availablemedia \ xp_regdeletevalue dumpfile isnull sql_variant select 'sa' \ xp_regremovemultistring xp_makecab 'msdasql' xp_cmdshell openquery \ sp_executesql 'sqloledb' dbms_java 'dbo' utl_http sp_makewebtask benchmark \ xp_regread xp_regwrite" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,\ t:compressWhiteSpace,t:lowercase,pass,nolog,skip:1,id:15006" SecAction phase:2,pass,nolog,id:99951,skipAfter:96037 SecRule REQUEST_FILENAME "(?:\b(?:(?:s(?:elect\b(?:.{1,100}?\b(?:(?:length|count|top)\b.{1,100}?\bfrom|from\b.{1,100}?\bwhere)|.*?\b(?:d(?:ump\b.*\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_(?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebtask)|ql_(?:longvarchar|variant))|xp_(?:reg(?:re(?:movemultistring|ad)|delete(?:value|key)|enum(?:value|key)s|addmultistring|write)|e(?:xecresultset|numdsn)|(?:terminat|dirtre)e|availablemedia|loginconfig|cmdshell|filelist|makecab|ntsec)|u(?:nion\b.{1,100}?\bselect|tl_(?:file|http))|group\b.*\bby\b.{1,100}?\bhaving|d(?:elete\b\W*?\bfrom|bms_java)|load\b\W*?\bdata\b.*\binfile|(?:n?varcha|tbcreato)r)\b|i(?:n(?:to\b\W*?\b(?:dump|out)file|sert\b\W*?\binto|ner\b\W*?\bjoin)\b|(?:f(?:\b\W*?\(\W*?\bbenchmark|null\b)|snull\b)\W*?\()|a(?:nd\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|utonomous_transaction\b)|o(?:r\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|pen(?:rowset|query)\b)|having\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|print\b\W*?\@\@|cast\b\W*?\()|(?:;\W*?\b(?:shutdown|drop)|\@\@version)\b|'(?:s(?:qloledb|a)|msdasql|dbo)')" \ "phase:2,deny,status:406,capture,t:none,t:htmlEntityDecode,t:replaceComments,\ t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,\ logdata:'%{TX.0}',id:'96001',severity:'2',\ msg:'SQL Injection Attack',\ tag:'WEB_ATTACK/SQL_INJECTION'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "(?:\b(?:(?:s(?:elect\b(?:.{1,100}?\b(?:(?:length|count|top)\b.{1,100}?\bfrom|from\b.{1,100}?\bwhere)|.*?\b(?:d(?:ump\b.*\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_(?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebtask)|ql_(?:longvarchar|variant))|xp_(?:reg(?:re(?:movemultistring|ad)|delete(?:value|key)|enum(?:value|key)s|addmultistring|write)|e(?:xecresultset|numdsn)|(?:terminat|dirtre)e|availablemedia|loginconfig|cmdshell|filelist|makecab|ntsec)|u(?:nion\b.{1,100}?\bselect|tl_(?:file|http))|group\b.*\bby\b.{1,100}?\bhaving|d(?:elete\b\W*?\bfrom|bms_java)|load\b\W*?\bdata\b.*\binfile|(?:n?varcha|tbcreato)r)\b|i(?:n(?:to\b\W*?\b(?:dump|out)file|sert\b\W*?\binto|ner\b\W*?\bjoin)\b|(?:f(?:\b\W*?\(\W*?\bbenchmark|null\b)|snull\b)\W*?\()|a(?:nd\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|utonomous_transaction\b)|o(?:r\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|pen(?:rowset|query)\b)|having\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|print\b\W*?\@\@|cast\b\W*?\()|(?:;\W*?\b(?:shutdown|drop)|\@\@version)\b|'(?:s(?:qloledb|a)|msdasql|dbo)')" \ "phase:2,deny,status:406,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,\ t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,\ log,auditlog,\ msg:'SQL Injection Attack',id:'96037',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_FILENAME "\b(\d+) ?= ?\1\b|[\'\"](\w+)[\'\"] ?= ?[\'\"]\2\b" \ "phase:2,deny,status:406,t:none,t:htmlEntityDecode,t:replaceComments,\ t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,\ logdata:'%{TX.0}',severity:'2',id:'96010',\ msg:'SQL Injection Attack',\ tag:'WEB_ATTACK/SQL_INJECTION'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie "\b(\d+) ?= ?\1\b|[\'\"](\w+)[\'\"] ?= ?[\'\"]\2\b" \ "phase:2,capture,deny,status:406,t:none,t:urlDecodeUni,t:htmlEntityDecode,\ t:replaceComments,t:compressWhiteSpace,t:lowercase,severity:'2',\ ctl:auditLogParts=+E,log,auditlog,id:'96019',logdata:'%{TX.0}',\ msg:'SQL Injection Attack',\ tag:'WEB_ATTACK/SQL_INJECTION'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer \ "@pm user_objects object_type substr all_objects mb_users column_name \ rownum atttypid substring object_id user_group user_tables pg_attribute \ user_users column_id user_password attrelid object_name table_name pg_class" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,\ t:compressWhiteSpace,t:lowercase,pass,nolog,skip:1,id:15007" SecAction phase:2,pass,nolog,id:15008 SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "\b(?:user_(?:(?:object|table|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|substr(?:ing)?|table_name|mb_users|rownum)\b" \ "phase:2,deny,status:406,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,\ t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,\ log,auditlog,id:'96021',logdata:'%{TX.0}',severity:'2',\ msg:'SQL Injection Attack',\ tag:'WEB_ATTACK/SQL_INJECTION'" SecRule REQUEST_FILENAME|!REQUEST_HEADERS:via "\b(?:coalesce\b|root\@)" \ "phase:2,deny,status:406,capture,t:none,t:htmlEntityDecode,t:replaceComments,\ t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,\ auditlog,logdata:'%{TX.0}',severity:'2',\ msg:'SQL Injection Attack',id:'96011',\ tag:'WEB_ATTACK/SQL_INJECTION'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:via "\b(?:coalesce\b|root\@)" \ "phase:2,deny,status:406,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,\ t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,\ log,auditlog,id:'96022',logdata:'%{TX.0}',severity:'2',\ msg:'SQL Injection Attack',\ tag:'WEB_ATTACK/SQL_INJECTION'"
Save
Back