Skip to content

Lab5.1WazuhWAF

Jump to bottom
Beth edited this page Feb 26, 2025 · 1 revision

Ensure that there is a "established accept" rule 1 on the WAN-to-DMZ, and create a temporary action accept rule 999 for web01's address (as the source) in order to allow the download and installation of mod_security things. Delete this rule when it is no longer needed.

Install mod security and php on web01

  • sudo yum install mod_security mod_security_crs php php-common php-opcache php-cli php-gd php-curl php-mysqlnd -y

Find the apache error logs in /etc/httpd/logs/error_log, grep for ModSecurity

image

Ensure rw01 can access web01's site

You may need to install curl for this, if necessary create another action accept for rw01 to download and install things

Create a simple php web shell, (example in SEC-260 tech journal) execute cat /etc/passwd and find the related logs on web01 and in wazuh

Clone this wiki locally