Re: [mod-security-users] Can mod-security help with this?

[Gerwin K. <ge...@di...>]

Sure you can use:
SecFilterSelective ARG_highlight %27

Our company also filters for the following:
    SecFilterSelective ARGS "fwrite"
    SecFilterSelective ARGS "fopen"
    SecFilterSelective ARGS "chr\("
    SecFilterSelective ARGS "echr\("
    SecFilterSelective ARGS "system\("

To be really secure :) I hope it will help you

Danny Shurett wrote:

>I am seeing a dos attack with a random string, but it includes this:
>
>highlight=%2527%252Esystem(chr(112)%252Echr(101)
>
>Can someone let me know if mod-security can help with this and how I could
>use it to stop it?
>
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
>Tool for open source databases. Create drag-&-drop reports. Save time
>by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
>Download a FREE copy at http://www.intelliview.com/go/osdn_nl
>_______________________________________________
>mod-security-users mailing list
>mod...@li...
>https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
>
>  
>