Am 15.03.2012 13:33, schrieb Anwar Bin Rajih:
> I encounter some problem after my server modsecurity got upgraded automatically via cpanel i was on 2.3.6
i guess you did some manual config change cpanel not supports
that's why i do never use such backends from 3rd parties
> my websites got hacked because my rules that i was created does not working after update
if your website got hacked a few day after some manual
rules are not working you have really a bigger problem
> i only want to filter or deny some words for example "test_vb" from begin requested via url and post
> i added this line in moduser2.user.conf
> SecRule ARGS_POST|REQUEST_LINE|RESPONSE_BODY|REQUEST_BODY|REQUEST_URI "test_vb"
as said - fix the application
modsec should filter in first front generic attacks
but it is NOT a solution having known vulerable scripts
and rely only on the protetction of any WAF
> before upgrading i was not able request test_vb anywhere on the server for
> expamle in the login forms or in the url address
>
> but now my rules seem to be not working is there any alternative method to do this ?
nobody can help you without knowing your configuration
how did you include "moduser2.user.conf" in your configuration
and have you made sure this manual change was not overwritten
by cpanel?
|