I am quite new to Modsecurity and need some help to secure my development server.
I have Apache 2.4 installed with Mod Security 2.8.0
I have also installed OWASP ModSecurity Core Rule Set ver.3.2.0
Now, I am trying to block all requests that do not follow a specific REQUEST_URI
pattern.
For example, I have this rule:
SecRule REQUEST_URI "!@rx (^(\/loc\/.*)$)" \
"id:1234, phase:1,log,deny,status:404, msg:'Block URI'"
When I access an URL different from mysite.com/loc/
from my browser the rule works and bloacks the request.
The problem is: I see a lot of requests from attackers in Apache log that pass trough despite this rule, so I must be missing something.
My request via browser (identical to the attacker's one) gets blocked (from Apache log):
MY IP - - [18/Oct/2019:09:44:26 +0300] "GET /FxCodeShell.jsp?xxx HTTP/1.1" 404 89 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
The request of the attacker gets passed (from Apache log):
Attacker IP - - [18/Oct/2019:03:37:03 +0300] "GET /FxCodeShell.jsp?xxx HTTP/1.1" 302 310 "http://XX.XX.XX.XX:80/FxCodeShell.jsp?xxx" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
Any suggestions why the rule does not kick in? What am I missing?
any help will be appreciated!