[mod-security-users] CRS

[Vieri Di P. <vie...@gm...>]

Hi,

I'm new to modsecurity so what I say here might not be fully correct.

According to:

https://raw.githubusercontent.com/SpiderLabs/owasp-modsecurity-crs/v3.0/master/INSTALL

"There are currently no known packages of CRS 3.x."

However, I'm using Gentoo Linux with a 3.x package:

https://packages.gentoo.org/packages/www-apache/modsecurity-crs

The Gentoo Linux package manager downloads from:

https://github.com/SpiderLabs/owasp-${PN}/archive/v${PV}.tar.gz

Where
PN=modsecurity-crs
PV=3.1.0 (in my case)

Are there more recent archives?

I'd rather use my package manager instead of making a custom script to
update the CRS from GIT.

Also, the same INSTALL file suggests to test the installation by
making a request to a specific URL.

I tried this:
curl 'http://myapacheserver/?param="><script>alert(1);</script>'

However, it doesn't seem to trigger any rule. The apache server
actually replies normally with a web page, and there are no errors in
the log.
I have mod_security 2.9.3.

What can I try?

Vieri