Re: [mod-security-users] Problem with AXS Logging

[Ivan R. <iv...@we...>]

Darren wrote:
> I installed mod_security and all is well except one odd behavior.  The
> J/S used is this:
>  
> <script type="text/javascript">
> <!--
>         document.write('<img src="/cgi-bin/ax.pl?trans.gif&ref=');
>         document.write(document.referrer);
>         document.write('" height="1" width="1" alt="" />');
> // -->
> </script><noscript>
>       <p>  <img src="/cgi-bin/ax.pl?trans.gif" height="1" width="1"
> alt="" />
> </p>
> </noscript>
>  
> Instead of tracking referers correctly, all requests now say: arrived
> from "page" and visited  cgi-bin/ax.pl
> 
> I assume one of the rules I installed is causing this.

  I don't think that's the case. ModSecurity does not modify
  requests in any way. It blocks them if configured to do so, but
  in that case there wouldn't have been any "hits" in the tracking
  logs. Look into your error log for ModSecurity messages.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net