sspilchin/httpd-modsecurity repository overview

httpd version 2.4 with WAF (Web Application Firewall)

• ModSecurity Version 2.9.3
• OWASP CRS ( ModSecurity Core Rule Set ) Version 3

Usually ModSecurity comes as a module which you have to compile and install. If you can’t afford a commercial web application firewall, this would be an excellent choice to go for it.

To provide generic web applications protection, the Core Rules use the following techniques:

• HTTP Protection – detecting violations of the HTTP protocol and a locally defined usage policy
• Real-time Blacklist Lookups – utilizes 3rd Party IP Reputation
• Web-based Malware Detection – identifies malicious web content by check against the Google Safe Browsing API.
• HTTP Denial of Service Protections – defense against HTTP Flooding and Slow HTTP DoS Attacks.
• Common Web Attacks Protection – detecting common web application security attack
• Automation Detection – Detecting bots, crawlers, scanners, and another malicious surface activity
• Integration with AV Scanning for File Uploads – identifies malicious files uploaded through the web application.
• Tracking Sensitive Data – Tracks Credit Card usage and blocks leakages.
• Trojan Protection – Detecting access to Trojans horses.
• Identification of Application Defects – alerts on application misconfigurations.
• Error Detection and Hiding – Disguising error messages sent by the server.

OWASP CRS ( ModSecurity Core Rule Set)

The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.