Interesting article on the latest Apache and ModSecurity techniques to prevent DoS HTTP attacks.
The attacks are well explained. I personally knew about Slowloris but didn’t about RUDY and post attacks.
Tag Archives: ModSecurity
waf00f
waf00f is another nice fingerprinting tool.
It is a good complement to a tool like httprint. It is able to detect Web Application Firewalls.
Its output can help you to determine the trust you can have in what httprint or any other web server fingerprinting tool found out.
Check it there.
ModSecurity 2.5 review
I finished reading the ModSecurity 2.5 book, written by Magnus Mischell and published by Packt Publishing.
I found a lot of interest reading it as I was already using ModSecurity – and I think anyone exposing an Apache web server should.
I was actually using it partially. It is not trivial to secure a web application, and the rule engine of ModSecurity is very powerful but it is also quite complex.
So this book was a good opportunity for me to dig into it further.
The book covers all topics : from the set-up to a real use-case.
The author explains how to write rules, how to deal with the performance impact, logging and gives us a range of various core rules to implement to get a good security basis.
The difficulty goes up progressively and the author doesn’t forget the beginners.
The set-up of the module is precisely described. All requirements are also explained and there are some good recalls about regular expressions, common attacks on systems, server and client sides, and other stuff like that.
After reading the book, I could harden my rules, reorganize and optimize them for better performance – something I hadn’t cared about before.
So I have nothing else to say but to recommend this book.
It is definitely a great handbook about ModSecurity that’s worth having next to you. The variety of configuration patterns makes it a reference.
Check it there. I also appreciated the availability of PDF version, so that I can carry it everywhere with my laptop and index it with Beagle.
New book about ModSecurity
There will be a new book about mod-security coming out : ModSecurity 2.5.
ModSecurity is essential when it comes to secure any web site.
It will make the work of the attacker much harder and it may save you even if your favorite dynamic pages have a security hole.
However, it must be configured wisely to be efficient. It is just a firewall that works at the application layer : you need to know the attacker point of view and the basics before writing any mod-security rules, otherwise at best it will useless (and at worst, it will kick legitimate traffic off).
So, stay tuned : I will talk more about the ModSecurity stuff and publish a review about this book soon.
http://www.packtpub.com/modsecurity-2-5/book