ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analys…
C Perl C++ M4 Batchfile Makefile Other
Permalink
Failed to load latest commit information.
alp2 Organizes all Makefile.am Dec 13, 2013
apache2 As of 17 May 2016, the country name "Czechia" replaces this MemberSta… Dec 1, 2016
build configure: Fix detection whether libcurl is linked against gnutls Jun 14, 2016
doc Adds doxygen configuration files Nov 14, 2014
ext Adds ssdeep support in our build system Nov 14, 2014
iis Fixed IPv4+Port address parsing Oct 4, 2016
mlogc Allow user to choose between TLS versions(TLSProtocol option introduc… Jan 6, 2016
nginx Adds ssdeep support in our build system Nov 14, 2014
standalone Refactoring conditional directives for if wrappers, alternative if st… Jan 5, 2016
tests Allow mod_proxy's "nocanon" behavior to be specified in proxy actions. Jan 6, 2016
tools Updates to parse_modsec.pl Jan 29, 2016
CHANGES Adds information about pull request #1258 Dec 1, 2016
LICENSE Updated Licensing information to reflect year Jan 11, 2016
Makefile.am tests: adds test-regression-nginx to the makefile Jan 3, 2014
NOTICE Updated copyright dates Apr 19, 2013
README.TXT Fixed broken link in readme #1059 Feb 1, 2016
README_WINDOWS.TXT Author at README_WINDOWS Apr 12, 2011
authors.txt add breno user to authors file Oct 14, 2010
autogen.sh macos: Using glibtoolize instead of libtoolize Dec 12, 2013
configure.ac Fix on the patch proposal #1150 Nov 21, 2016
modsecurity.conf-recommended Updated recommended conf to enter XML processor when content-type is … Jan 11, 2016
stamp-h1 Fix autoconf header and include path so trunk builds. Aug 31, 2010
unicode.mapping Cleanup unicode map file Jun 2, 2011

README.TXT

ModSecurity for Apache 2.x, http://www.modsecurity.org/
Copyright (c) 2004-2013 Trustwave Holdings, Inc. (http://www.trustwave.com/)

You may not use this file except in compliance with
the License.  You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

If any of the files related to licensing are missing or if you have any
other questions related to licensing please contact Trustwave Holdings, Inc.
directly using the email address security@modsecurity.org.


DOCUMENTATION

Please refer to the documentation folder (/doc) for
the reference manual.


##############################################
----------------------------------
OWASP ModSecurity Core Rule Set (CRS)


Project Site:
https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project


Download:
https://github.com/SpiderLabs/owasp-modsecurity-crs

----------------------------------

ModSecurity™ is a web application firewall engine that provides very
little protection on its own. In order to become useful, ModSecurity™ must
be configured with rules. In order to enable users to take full advantage
of ModSecurity™ out of the box, Trustwave's SpiderLabs is providing a free
certified rule set for ModSecurity™ 2.x. Unlike intrusion detection and
prevention systems, which rely on signatures specific to known
vulnerabilities, the Core Rules provide generic protection from unknown
vulnerabilities often found in web applications, which are in most cases
custom coded. The Core Rules are heavily commented to allow it to be used
as a step-by-step deployment guide for ModSecurity™.
Core Rules Content

In order to provide generic web applications protection, the Core Rules
use the following techniques:

* HTTP Protection - detecting violations of the HTTP protocol and a
locally defined usage policy.
* Real-time Blacklist Lookups - utilizes 3rd Party IP Reputation
* Web-based Malware Detection - identifies malicious web content by check
against the Google Safe Browsing API.
* HTTP Denial of Service Protections - defense against HTTP Flooding and
Slow HTTP DoS Attacks.
* Common Web Attacks Protection - detecting common web application
security attack.
* Automation Detection - Detecting bots, crawlers, scanners and other
surface malicious activity.
* Integration with AV Scanning for File Uploads - detects malicious files
uploaded through the web application.
* Tracking Sensitive Data - Tracks Credit Card usage and blocks leakages.
* Trojan Protection - Detecting access to Trojans horses.
* Identification of Application Defects - alerts on application
misconfigurations.
* Error Detection and Hiding - Disguising error messages sent by the
server.


----------------------------------
ModSecurity Rules from Trustwave SpiderLabs

Project Site:
https://www.trustwave.com/modsecurity-rules-support.php

Download:
https://ssl.trustwave.com/web-application-firewall

----------------------------------



Trustwave now provides a commercial certified rule set for ModSecurity 2.x
that protects against known attacks that target vulnerabilities in public
software and are based on intelligence gathered from real-world
investigations, honeypot data and research.

1. More than 16,000 specific rules, broken out into the following attack
categories:
 * SQL injection
 * Cross-site Scripting (XSS)
 * Local File Include
 * Remote File Include

2. User option for application specific rules, covering the same
vulnerability classes for applications such as:
 * WordPress
 * cPanel
 * osCommerce
 * Joomla
 * For a complete listing of application coverage, please refer to this
link (which is updated daily).
https://modsecurity.org/application_coverage.html

3. Complements and integrates with the OWASP Core Rule Set
4. IP Reputation capabilities which provide protection against malicious
clients identified by the Trustwave SpiderLabs Distributed Web Honeypots
5. Malware Detection capabilities which prevent your web site from
distributing malicious code to clients.
##############################################