diff --git a/content/3-reference-manual/3-2-configuration-directives.md b/content/3-reference-manual/3-2-configuration-directives.md index dbb2d08..9b0808a 100644 --- a/content/3-reference-manual/3-2-configuration-directives.md +++ b/content/3-reference-manual/3-2-configuration-directives.md @@ -455,7 +455,7 @@ Every rule following a previous `SecDefaultAction` directive in the same configu {{% notice warning %}} -`SecDefaultAction` is not inherited across configuration contexts. (For an example of why this may be a problem, read the following ModSecurity Blog entry .) +`SecDefaultAction` is not inherited across configuration contexts. (For an example of why this may be a problem, read the following ModSecurity Blog entry .) {{% /notice %}} @@ -572,7 +572,7 @@ ModSecurity relies on the free Google Safe Browsing database that can be obtaine {{% notice note %}} -Deprecated in 2.7.0 after Google dev team decided to not allow the database download anymore. After registering and obtaining a Safe Browsing API key, you can automatically download the GSB using a tool like wget. For further information on how to proceed with the download, please visit Google's website: +Deprecated in 2.7.0 after Google dev team decided to not allow the database download anymore. After registering and obtaining a Safe Browsing API key, you can automatically download the GSB using a tool like wget. For further information on how to proceed with the download, please visit Google's website: {{% /notice %}} @@ -584,7 +584,7 @@ Configures an external program that will receive the information about every tra libModSecurity v3 rejects this directive with a configuration error, so a configuration containing it cannot be shared between v2 and v3. Guardian logging is designed to send the information about every request to an external program. Because Apache is typically deployed in a multiprocess fashion, which makes information sharing between processes difficult, the idea is to deploy a single external process to observe all requests in a stateful manner, providing additional protection. -Currently the only tool known to work with guardian logging is httpd-guardian, which is part of the Apache httpd tools project [1](http://apache-tools.cvs.sourceforge.net/viewvc/apache-tools/apache-tools/). The httpd-guardian tool is designed to defend against denial of service attacks. It uses the blacklist tool (from the same project) to interact with an iptables-based (on a Linux system) or pf-based (on a BSD system) firewall, dynamically blacklisting the offending IP addresses. It can also interact with SnortSam [2](http://www.snortsam.net). Assuming httpd-guardian is already configured (look into the source code for the detailed instructions), you only need to add one line to your Apache configuration to deploy it. The optional second parameter restricts guardian logging to requests for which the given environment variable is set (or, with the `!` prefix, not set), as with Apache's `CustomLog`: +Currently the only tool known to work with guardian logging is httpd-guardian, which is part of the Apache httpd tools project [1](http://apache-tools.cvs.sourceforge.net/viewvc/apache-tools/apache-tools/). The httpd-guardian tool is designed to defend against denial of service attacks. It uses the blacklist tool (from the same project) to interact with an iptables-based (on a Linux system) or pf-based (on a BSD system) firewall, dynamically blacklisting the offending IP addresses. It can also interact with SnortSam [2](https://web.archive.org/web/20230328075006/http://snortsam.net/). Assuming httpd-guardian is already configured (look into the source code for the detailed instructions), you only need to add one line to your Apache configuration to deploy it. The optional second parameter restricts guardian logging to requests for which the given environment variable is set (or, with the `!` prefix, not set), as with Apache's `CustomLog`: ``` seclang SecGuardianLog |/path/to/httpd-guardian @@ -704,7 +704,7 @@ Establishes a per-IP address limit of how many connections are allowed to be in {{< secmeta syntax="SecConnReadStateLimit LIMIT OPTIONAL_IP_MATCH_OPERATOR" example=`SecConnReadStateLimit 50 "!@ipMatch 127.0.0.1"` default="0 (no limit)" scope="Any" v2="2.8.0" v3="no" >}} -This measure is effective against Slowloris-style attacks from a single IP address, but it may not be as good against modified attacks that work by slowly sending request body content. This is because Apache to switches state to SERVER_BUSY_WRITE once request headers have been read. As an alternative, consider mod_reqtimeout (part of Apache as of 2.2.15), which is expected be effective against both attack types. See Blog post on mitigating slow DoS attacks - . v2.8.0 and newest supports the @ipMatch, @ipMatchF and @ipMatchFromFile operator along with the its negative (e.g. !@ipMatch) these were used to create suspicious or whitelist. When a suspicious list is informed, just the IPs that belongs to the list will be filtered. A combination of suspicious and whitelist is possible by using multiple definitions of SecConnReadStateLimit, note, however, that the limit will be always overwrite by its successor. +This measure is effective against Slowloris-style attacks from a single IP address, but it may not be as good against modified attacks that work by slowly sending request body content. This is because Apache to switches state to SERVER_BUSY_WRITE once request headers have been read. As an alternative, consider mod_reqtimeout (part of Apache as of 2.2.15), which is expected be effective against both attack types. See Blog post on mitigating slow DoS attacks - . v2.8.0 and newest supports the @ipMatch, @ipMatchF and @ipMatchFromFile operator along with the its negative (e.g. !@ipMatch) these were used to create suspicious or whitelist. When a suspicious list is informed, just the IPs that belongs to the list will be filtered. A combination of suspicious and whitelist is possible by using multiple definitions of SecConnReadStateLimit, note, however, that the limit will be always overwrite by its successor. LIMIT must be greater than zero. diff --git a/content/3-reference-manual/3-4-transformation-functions.md b/content/3-reference-manual/3-4-transformation-functions.md index 160f9de..f3730da 100644 --- a/content/3-reference-manual/3-4-transformation-functions.md +++ b/content/3-reference-manual/3-4-transformation-functions.md @@ -74,7 +74,7 @@ Decodes a Base64-encoded string. Unlike base64Decode, this version uses a more f Both engines accept the URL-safe alphabet (`-` and `_`) since ModSecurity 2.9.15 and libModSecurity 3.0.17. ModSecurity v2 skips only space, tab, CR, LF and padding (`=`) characters: any other byte outside the Base64 alphabet makes the whole decode fail and the output is an empty string. It also stops decoding at the first NUL byte in the input. libModSecurity v3 skips every byte outside the alphabet and processes every byte. -See blog post on Base64Decoding evasion issues on PHP sites - +See the blog post on Base64 decoding evasion issues on PHP sites, [Impedance Mismatch and Base64](https://web.archive.org/web/20110713164920/http://blog.spiderlabs.com/2010/04/impedance-mismatch-and-base64.html) (Internet Archive copy; the original SpiderLabs blog is offline). ## base64Encode diff --git a/content/3-reference-manual/3-5-actions.md b/content/3-reference-manual/3-5-actions.md index 20f941a..3f4ad57 100644 --- a/content/3-reference-manual/3-5-actions.md +++ b/content/3-reference-manual/3-5-actions.md @@ -441,17 +441,17 @@ These are the reserved ranges: - 200,000–299,999: reserved for rules published Comodo - 300,000–399,999: reserved for rules published at gotroot.com - 400,000–419,999: unused (available for reservation) -- 420,000–429,999: reserved for ScallyWhack [1](http://projects.otaku42.de/wiki/Scally-Whack) +- 420,000–429,999: reserved for ScallyWhack [1](https://web.archive.org/web/20120807063638/http://projects.otaku42.de:80/wiki/Scally-Whack) - 430,000–439,999: reserved for rules published by Flameeyes [2](http://www.flameeyes.eu/projects/modsec) - 440.000-599,999: unused (available for reservation) - 600,000-699,999: reserved for use by Akamai [3](http://www.akamai.com/html/solutions/waf.html) - 700,000–799,999: reserved for Ivan Ristic -- 900,000–999,999: reserved for the OWASP CRS [4](http://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project) project +- 900,000–999,999: reserved for the OWASP CRS [4](https://coreruleset.org/) project - 1,000,000-1,009,999: reserved for rules published by Redhat Security Team - 1,010,000-1,999,999: reserved for WAF \| Web Application Firewall and Load Balancer Security (kemptechnologies.com) [5](https://kemptechnologies.com/solutions/waf/) - 2,000,000-2,999,999: reserved for rules from Trustwave's SpiderLabs Research team - 3,000,000-3,999,999: reserved for use by Akamai [6](http://www.akamai.com/html/solutions/waf.html) -- 4,000,000-4,099,999 reserved: in use by AviNetworks [7](https://kb.avinetworks.com/docs/latest/vantage-web-app-firewall-beta/) +- 4,000,000-4,099,999 reserved: in use by AviNetworks - 4,100,000-4,199,999 reserved: in use by Fastly [8](https://www.fastly.com/products/cloud-security/#products-cloud-security-web-application-firewall) - 4,200,000-4,299,999 reserved: in use by CMS-Garden [9](https://www.cms-garden.org/en) - 4,300,000-4,300,999 reserved: in use by Ensim.hu [10](http://ensim.hu/) diff --git a/content/3-reference-manual/3-6-operators.md b/content/3-reference-manual/3-6-operators.md index 2651214..61bb746 100644 --- a/content/3-reference-manual/3-6-operators.md +++ b/content/3-reference-manual/3-6-operators.md @@ -325,7 +325,7 @@ Use @inspectFile with caution. It may not be safe to use @inspectFile with varia {{% /notice %}} -**Reference:** +**Reference:** **Reference:** diff --git a/content/5-troubleshooting/5-2-iis-troubleshooting.md b/content/5-troubleshooting/5-2-iis-troubleshooting.md index 773a093..d1069c6 100644 --- a/content/5-troubleshooting/5-2-iis-troubleshooting.md +++ b/content/5-troubleshooting/5-2-iis-troubleshooting.md @@ -26,9 +26,9 @@ In order to use the _Microsoft FixIt_ visit the website: [http://support.microso ## Looking for missing dependencies -ModSecurity itself is distributed along with some dependencies, as an example but not limited to the libapr. Dependencies may changed according to the version. Not all dependencies are part of ModSecurity as an example of the Visual C++ Redistribution files which is not part of the currently release (see bug [#627](https://github.com/SpiderLabs/ModSecurity/issues/628), to check if your version contains those C++ Redistribution files). Some dependencies are expected to be loaded from the system but sometimes, due to version changes or specific configuration of the server those dependencies are not found, leading ModSecurity to fail to be loaded. While not loaded the error messages are not verbose enough to help the user to identify the missing symbol or library. +ModSecurity itself is distributed along with some dependencies, as an example but not limited to the libapr. Dependencies may changed according to the version. Not all dependencies are part of ModSecurity as an example of the Visual C++ Redistribution files which is not part of the currently release (see bug [#627](https://github.com/owasp-modsecurity/ModSecurity/issues/628), to check if your version contains those C++ Redistribution files). Some dependencies are expected to be loaded from the system but sometimes, due to version changes or specific configuration of the server those dependencies are not found, leading ModSecurity to fail to be loaded. While not loaded the error messages are not verbose enough to help the user to identify the missing symbol or library. -In order to identify that all dependencies are match, we recommend the utilization of [dumpbin](http://support.microsoft.com/kb/177429/en-us). _Dumpbin_ is a utility that is part of the Visual Studio package and it should be in your path after the execution of the _vcvars_ batch script. The path to the script and the mane may vary from version to version of Visual Studio, on Win 8.1 using Visual Studio 2013, here is the path: +In order to identify that all dependencies are match, we recommend the utilization of [dumpbin](https://learn.microsoft.com/en-us/cpp/build/reference/dumpbin-reference). _Dumpbin_ is a utility that is part of the Visual Studio package and it should be in your path after the execution of the _vcvars_ batch script. The path to the script and the mane may vary from version to version of Visual Studio, on Win 8.1 using Visual Studio 2013, here is the path: ``` C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\bin\x86_amd64\vcvarsx86_amd64.bat ``` diff --git a/content/6-migration/6-2-migrating-from-1x-to-2x.md b/content/6-migration/6-2-migrating-from-1x-to-2x.md index 434c10c..64dc184 100644 --- a/content/6-migration/6-2-migrating-from-1x-to-2x.md +++ b/content/6-migration/6-2-migrating-from-1x-to-2x.md @@ -213,7 +213,7 @@ In Mod 2.x, using the “allow” action may not be enough to truly let a reques **How To Upgrade** -See Blog post on handling false positives and creating custom rules - http://blog.spiderlabs.com/2010/11/modsecurity-advanced-topic-of-the-week-exception-handling.html +See Blog post on handling false positives and creating custom rules - https://web.archive.org/web/20110612004522/http://blog.spiderlabs.com:80/2010/11/modsecurity-advanced-topic-of-the-week-exception-handling.html ## Directive to control rule inheritance to Apache Scope locations (Virtual Hosts, Location, Directory) diff --git a/content/7-development/7-1-contributing.md b/content/7-development/7-1-contributing.md index 7cf4443..63d5740 100644 --- a/content/7-development/7-1-contributing.md +++ b/content/7-development/7-1-contributing.md @@ -16,8 +16,7 @@ what a good contribution looks like. [ModSecurity-apache](https://github.com/owasp-modsecurity/ModSecurity-apache). - This documentation: (every page has an edit link). - Discussion: the `#project-modsecurity` channel on the [OWASP Slack](https://owasp.org/slack/invite) and - the GitHub issue tracker. Questions about configuration and rules are best asked on Slack or as a - [GitHub discussion](https://github.com/owasp-modsecurity/ModSecurity/discussions) before opening an issue. + the GitHub issue tracker. Questions about configuration and rules are best asked on Slack before opening an issue. - Project page: , which lists the project leaders. They review and merge every pull request. diff --git a/content/7-development/7-3-tools.md b/content/7-development/7-3-tools.md index 0b36908..3cb78ea 100644 --- a/content/7-development/7-3-tools.md +++ b/content/7-development/7-3-tools.md @@ -14,7 +14,7 @@ maintainers) produce most of the current tooling. [plugin registry](https://github.com/coreruleset/plugin-registry) for application-specific exclusions (WordPress, Nextcloud, Drupal, phpBB, phpMyAdmin, DokuWiki, cPanel, XenForo) and add-ons such as the DoS-protection, antivirus, body-decompress, fake-bot and auto-decoding plugins. -- [Comodo free ModSecurity rules](https://waf.comodo.com/) - a commercial vendor's free rule set. +- [Comodo free ModSecurity rules](https://web.archive.org/web/20260212164915/https://waf.comodo.com/) - a commercial vendor's free rule set. ## Writing and checking rules diff --git a/content/8-archive/8-1-gsoc-2016-ideas.md b/content/8-archive/8-1-gsoc-2016-ideas.md index 126c771..82fc32d 100644 --- a/content/8-archive/8-1-gsoc-2016-ideas.md +++ b/content/8-archive/8-1-gsoc-2016-ideas.md @@ -10,7 +10,7 @@ Below are a number of suggestions for students interested in the ModSecurity pro **Brief explanation:** Adding the capability of rapid prototyping to ModSecurity functionalities through scripts will open the possibility for easy rules production and customization, It also opens the possibility for a large community such as Ruby developers to create their own customization on the top of ModSecurity and so customize their own rules, analogous of today's Lua support. **Expected results:** An implementation able to handle Ruby scripts which will interact to ModSecurity as Lua does. **References:** -- Embedding Ruby into C++ (ModSecurity is C, using C++ as reference): http://aeditor.rubyforge.org/ruby_cplusplus/index.html +- Embedding Ruby into C++ (ModSecurity is C, using C++ as reference): https://web.archive.org/web/20160415222459/http://aeditor.rubyforge.org/ruby_cplusplus/index.html - ModSecurity Reference Manual, Lua:{{% relref "3-reference-manual/3-2-configuration-directives#secrulescript" %}}" ###ModSecurity JavaScript support @@ -24,7 +24,7 @@ Below are a number of suggestions for students interested in the ModSecurity pro Expected results: A connector which will allow ModSecurity to be used inside node.js **References:** - ModSecurity version 3.0: -https://www.trustwave.com/Resources/SpiderLabs-Blog/An-Overview-of-the-Upcoming-libModSecurity/?page=1&year=0&month=0 +https://web.archive.org/web/20180313114027/https://www.trustwave.com/Resources/SpiderLabs-Blog/An-Overview-of-the-Upcoming-libModSecurity/ - ModSecurity nginx connector: https://github.com/SpiderLabs/ModSecurity-nginx" @@ -33,7 +33,7 @@ https://github.com/SpiderLabs/ModSecurity-nginx" Expected results: A workable but no feature complete connector which will allow ModSecurity v3 to be used inside Apache **References:** - ModSecurity version 3.0: -https://www.trustwave.com/Resources/SpiderLabs-Blog/An-Overview-of-the-Upcoming-libModSecurity/?page=1&year=0&month=0 +https://web.archive.org/web/20180313114027/https://www.trustwave.com/Resources/SpiderLabs-Blog/An-Overview-of-the-Upcoming-libModSecurity/ - ModSecurity nginx connector: https://github.com/SpiderLabs/ModSecurity-nginx" @@ -70,7 +70,7 @@ t:encrypt(%{TX.mykey}%) ###ModSecurity sub-phases **Brief explanation:** ModSecurity supports real phases 1-4 and the 'virtual' one 5. Having intermediate virtual phases, like phase:2.2, would allow to order rules inside a real phase. This is especially useful for configurations integrating rules provided, for example, by a hoster and customs ones. **Expected results:** Rules will be ordered, inside a phase, not only based on their occurence but also based on their sub-phase. -**References:** https://github.com/SpiderLabs/ModSecurity/issues/371 +**References:** https://github.com/owasp-modsecurity/ModSecurity/issues/371 **Example:** - SecRule ... phase:2.6,id:1 - SecRule ... phase:2,id:2 diff --git a/content/8-archive/8-2-v3-earlier-rc1-notes.md b/content/8-archive/8-2-v3-earlier-rc1-notes.md index 84f4f33..e8bb2e9 100644 --- a/content/8-archive/8-2-v3-earlier-rc1-notes.md +++ b/content/8-archive/8-2-v3-earlier-rc1-notes.md @@ -21,33 +21,33 @@ All the missing features belong to a milestone: Feature complete. This milestone For easy reading, they are also listed below. #### Actions - - exec - https://github.com/SpiderLabs/ModSecurity/issues/1050 + - exec - https://github.com/owasp-modsecurity/ModSecurity/issues/1050 #### Variables - - WEBAPPID - https://github.com/SpiderLabs/ModSecurity/issues/1027 - - STREAM_INPUT_BODY - https://github.com/SpiderLabs/ModSecurity/issues/1021 - - STREAM_OUTPUT_BODY - https://github.com/SpiderLabs/ModSecurity/issues/1022 - - USERAGENT_IP - https://github.com/SpiderLabs/ModSecurity/issues/1025 - - STATUS_LINE - https://github.com/SpiderLabs/ModSecurity/issues/1020 - - SCRIPT_* - https://github.com/SpiderLabs/ModSecurity/issues/1017 - - PERF_* - https://github.com/SpiderLabs/ModSecurity/issues/1011 - - RESOURCE - https://github.com/SpiderLabs/ModSecurity/issues/1014 + - WEBAPPID - https://github.com/owasp-modsecurity/ModSecurity/issues/1027 + - STREAM_INPUT_BODY - https://github.com/owasp-modsecurity/ModSecurity/issues/1021 + - STREAM_OUTPUT_BODY - https://github.com/owasp-modsecurity/ModSecurity/issues/1022 + - USERAGENT_IP - https://github.com/owasp-modsecurity/ModSecurity/issues/1025 + - STATUS_LINE - https://github.com/owasp-modsecurity/ModSecurity/issues/1020 + - SCRIPT_* - https://github.com/owasp-modsecurity/ModSecurity/issues/1017 + - PERF_* - https://github.com/owasp-modsecurity/ModSecurity/issues/1011 + - RESOURCE - https://github.com/owasp-modsecurity/ModSecurity/issues/1014 #### Operators - - verifySSN - https://github.com/SpiderLabs/ModSecurity/issues/1007 - - verifyCPF - https://github.com/SpiderLabs/ModSecurity/issues/1006 - - fuzzyHash - https://github.com/SpiderLabs/ModSecurity/issues/997 - - gsbLookup - https://github.com/SpiderLabs/ModSecurity/issues/998 - - inspectFile - https://github.com/SpiderLabs/ModSecurity/issues/999 - - rsub - https://github.com/SpiderLabs/ModSecurity/issues/1001 - - validateHash - https://github.com/SpiderLabs/ModSecurity/issues/1004 + - verifySSN - https://github.com/owasp-modsecurity/ModSecurity/issues/1007 + - verifyCPF - https://github.com/owasp-modsecurity/ModSecurity/issues/1006 + - fuzzyHash - https://github.com/owasp-modsecurity/ModSecurity/issues/997 + - gsbLookup - https://github.com/owasp-modsecurity/ModSecurity/issues/998 + - inspectFile - https://github.com/owasp-modsecurity/ModSecurity/issues/999 + - rsub - https://github.com/owasp-modsecurity/ModSecurity/issues/1001 + - validateHash - https://github.com/owasp-modsecurity/ModSecurity/issues/1004 #### Others - - Support to Lua Scripts - https://github.com/SpiderLabs/ModSecurity/issues/994 + - Support to Lua Scripts - https://github.com/owasp-modsecurity/ModSecurity/issues/994 ### What we don't want to support anymore The list of unsupported features is very minimal at this point, although it may be bigger till the feature complete milestone. The single item is listed below. -- WEBSERVER_ERROR_LOG - https://github.com/SpiderLabs/ModSecurity/issues/1028 +- WEBSERVER_ERROR_LOG - https://github.com/owasp-modsecurity/ModSecurity/issues/1028 - {{% relref "3-reference-manual/3-3-variables#webserver_error_log" %}} diff --git a/lychee.toml b/lychee.toml index 50cc6c7..e083c87 100644 --- a/lychee.toml +++ b/lychee.toml @@ -1,4 +1,4 @@ -exclude = ["github.com/owasp-modsecurity.*/SECURITY.md", "github.com/owasp-modsecurity.*/.github/.*", "github.com/owasp-modsecurity/ModSecurity/blob/?$"] +exclude = ["github.com/owasp-modsecurity.*/SECURITY.md", "github.com/owasp-modsecurity.*/.github/.*", "github.com/owasp-modsecurity/ModSecurity/blob/?$", "^https://url/?$", "yourserver\\.com", "linkedin\\.com"] user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0" no_progress = true cache = true