Re: Parsing SQL injection messages

Hey Mattia,

Welcome to Modsec.

Parsing the audit log can be annoying and the JSON support is fairly limited.

Personally, I concentrate on the error log that carries the alert message with
the malicious parameters that you are looking for.

I extract all the infos I need with the help of a set of aliases that are part
of the series of ModSecurity tutorials that I host at https://netnea.com.

It should be simple to extract it that or in a similar way and feed that into
logstash.

Best,

Christian



On Wed, Aug 21, 2019 at 10:16:49AM +0200, mattia conversano wrote:
> Hi team,
> 
> Thanks for the tool.
> I’m new with Modsexurity; my goal is to extract code used  for SQLi.
> I have activated logging with JSON format and i’m trying to extract malicious parameter’s value used to injection using Logstash.
> But i failed because i don’t find a pattern in audit_data.messages.
> 
> There is a way to set Modsecurity to parse in a better way logs?
> 
> Sorry for the inconvenience and thanks for yourk work,
> Mattia


> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/



_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/