OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)
Lua Perl C Ruby JavaScript
Latest commit 0475e92 Oct 18, 2016 @csanders-git csanders-git committed on GitHub Create .travis.yml
Required for use with other branches


OWASP ModSecurity Core Rule Set (CRS)

ModSecurity™ is a web application firewall engine that provides very little protection on its own. In order to become useful, ModSecurity™ must be configured with rules. In order to enable users to take full advantage of ModSecurity™ out of the box, Trustwave's SpiderLabs is sponsoring and maintaining a free certified rule set for the community. Unlike intrusion detection and prevention systems, which rely on signatures specific to known vulnerabilities, the OWASP ModSecurity Core Rule Set provides generic protection from unknown vulnerabilities often found in web applications, which are in most cases custom coded. The Core Rules are heavily commented to allow it to be used as a step-by-step deployment guide for ModSecurity™.


(c) 2006-2012 Trustwave

The ModSecurity Core Rule Set is provided to you under the terms and conditions of Apache Software License Version 2 (ASLv2)



For more information refer to the OWASP Core Rule Set Project page at http://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project

Core Rules Mail-list - Suscribe here: https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set Archive: https://lists.owasp.org/pipermail/owasp-modsecurity-core-rule-set/


You can manually download the latest CRS from the GitHub Repo: https://github.com/SpiderLabs/owasp-modsecurity-crs