4 ms·
Still, publishing suggested rulesets or at least sending them over to OWASP would be Good Guy.
by mmcclellan 12y ago
Still, publishing suggested rulesets or at least sending them over to OWASP would be Good Guy.
- jgrahamc 12y agoThe RedHat advisory had mod_security rules in it. Our rules are our version of that. https://access.redhat.com/articles/1200223 https://access.redhat.com/articles/1200223 SecRule REQUEST_HEADERS: "^\(\) {" "phase:1,deny,id:1000000,t:urlDecode,status:400,log,msg:'CVE-2014-6271 - Bash Attack'" SecRule REQUEST_LINE "\(\) {" "phase:1,deny,id:1000001,status:400,log,msg:'CVE-2014-6271 - Bash Attack'" SecRule ARGS_NAMES "^\(\) {" "phase:2,deny,id:1000002,t:urlDecode,t:urlDecodeUni,status:400,log,msg:'CVE-2014-6271 - Bash Attack'" SecRule ARGS "^\(\) {" "phase:2,deny,id:1000003,t:urlDecode,t:urlDecodeUni,status:400,log,msg:'CVE-2014-6271 - Bash Attack'" SecRule FILES_NAMES "^\(\) {" "phase:2,deny,id:1000004,t:urlDecode,t:urlDecodeUni,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"