modSecurity规则学习(四)——规则指令编写
规则语言是使用9个指令实现:
语法:SecRule VARIABLES OPERATOR [TRANSFORMATION_FUNCTIONS, ACTIONS]
Variables 以下几种:
Regular variables
Contain only one piece of information, or one string. For example, REMOTE_ADDR, always
contains the IP address of the client.
Collections
Groups of regular variables. Some collections (e.g., ARGS) allow enumeration, making
it possible to use its every member in a rule. Some other collections (e.g., ENV)
are not as flexible, but there is always going to be some way to extract individual regular
variables out of them.
Read-only collections
Many of the collections point to some data that cannot be modified, in which case
the collection itself will be available only for reading.
Read/write collections
When a collection is not based on immutable data ModSecurity will allow you to
modify it. A good example of a read/write collection is TX, which a collection that
starts empty and exists only as long as the currently processed transaction exists.
Special collections
Sometimes a collection is just a handy mechanism to retrieve information from
something that is not organised as a collection but it can seem that way. This is the
case with the XML collection, which takes an XPath expression as a (mandatory) parameter
and allows you to extract values out of an XML file.
Persistent collections
Some collections can be stored and retrieved later. This feature allows you to adopt a
wider view of your systems, for example tracking access per IP address or per session,
or per user account.
1、一个简单的规则
在rule/目录下创建myruls.conf
添加规则
SecRule ARGS "(testwwd)+" \
"msg:'wwd22 test',\
id:,\
phase:request,\
deny,\
status:"
nginx reload
测试:http://nginxip:nginxport/?test=testwwd
503拦截
2、针对struts漏洞
3、lua脚本
4、白名单、黑名单
6、自定义评分
最新文章
- 关于[super dealloc]
- AngularJS小知识点一
- FreeBSD_11 - 系统管理——{ Part_5 - ZFS }
- 【MPI学习4】MPI并行程序设计模式:非阻塞通信MPI程序设计
- stm32学习笔记——外部中断的使用
- oracle日期函数2!
- map遍历测试结果
- localtime()方法的疑惑
- CSS清除浮动_清除float浮动
- 【线段树】【3-21个人赛】【同样的problemB】
- 安装eclipse时跳转到网页提示JRE Missing
- 学习 Spring (一) Spring 介绍
- 【CH6802】车的放置
- Django 基于类的通用视图
- Maven 的41种骨架功能介绍(转)
- 学习笔记GAN002:DCGAN
- 2018 AICCSA Programming Contest
- aapt 命令可应用于查看apk包名、主activity、版本等很多信息
- Parity game---poj1733
- [IIS] 配置PHP的过程与坑
热门文章
- HDU-2204- Eddy’s爱好 (容斥原理)
- poj1284 && caioj 1159 欧拉函数1:原根
- 紫书 例题8-19 UVa 12265 (扫描法+单调栈)
- window下搭建Python3.7+selenium3.1.1+pycharm环境
- 配置 IntelliJ IDEA VM options
- caffe 训练測试自己的数据集
- android 反编译和代码解读
- nyoj--1170--最大的数(数学技巧)
- codeforces 544 D Destroying Roads 【最短路】
- MySQL服务启动:某些服务在未由其他服务或程序使用时将自动停止