Menu

Introduction to PCI DSS (Payment Card Industry Data Security Standard)   Introduction to PCI DSS (Payment Card Industry Data Security Standard)   

Data Protection Act 1998   Data Protection Act 1998   

Secure HTML Practices   Secure HTML Practices   

SQL Injection Attack - Introduction and Mitigation Steps   SQL Injection Attack - Introduction and Mitigation Steps   

Cross Site Scripting (XSS) – Introduction and Mitigation Steps   Cross Site Scripting (XSS) – Introduction and Mitigation Steps   

Audit and Testing Tools for Web Application Security   Audit and Testing Tools for Web Application Security   

Threat Modeling for Web Application Security - Practice Guide   Threat Modeling for Web Application Security - Practice Guide   

OWASP Project - ModSecurity Core Rule Set

Published on: 8/16/2014
Topic: Web Application Security
Overview
ModSecurity is a web application firewall engine that provides very little protection on its own. In order to become useful, ModSecurity must be configured with rules. In order to enable users to take full advantage of ModSecurity out of the box, Trustwave’s SpiderLabs is providing a free certified rule set for ModSecurity 2.x. Unlike intrusion detection and prevention systems, which rely on signatures specific to known vulnerabilities, the Core Rules provide generic protection from unknown vulnerabilities often found in web applications, which are in most cases custom coded. The Core Rules are heavily commented to allow it to be used as a step-by-step deployment guide for ModSecurity™.

OWASP ModSecurity - Core Rules Content

In order to provide generic web applications protection, the Core Rules use the following techniques:

HTTP Protection – detecting violations of the HTTP protocol and a locally defined usage policy.

Real-time Blacklist Lookups – utilizes 3rd Party IP Reputation

Web-based Malware Detection – identifies malicious web content by check against the Google Safe Browsing API.

HTTP Denial of Service Protections – defense against HTTP Flooding and Slow HTTP DoS Attacks.

Common Web Attacks Protection – detecting common web application security attack.

Automation Detection – Detecting bots, crawlers, scanners and other surface malicious activity.

Integration with AV Scanning for File Uploads – detects malicious files uploaded through the web application.

Tracking Sensitive Data – Tracks Credit Card usage and blocks leakages.

Trojan Protection – Detecting access to Trojans horses.

Identification of Application Defects – alerts on application misconfigurations.

Error Detection and Hiding – Disguising error messages sent by the server.


[Show All Sections]