Re: Use of Modsec variable in apache access log
homesh joshi <[email protected]> Wed, 21 Jun 2023 13:14:04 +0530
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <CAAjxK7sFWPtUCPm1r9jzZxUvNdL5OMGMaRKonrL6mZ5L=a7nmA@mail.gmail.com> |
--===============9199040742397786204== Content-Type: multipart/alternative; boundary="000000000000415ffc05fe9eef70" --000000000000415ffc05fe9eef70 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi All, With regards to my approach for logging the modsec variables in apache log has worked for me for almost a year now. However, today when I enabled "SecRuleEngine DetectionOnly" for one of my websites. What I notice is that the apache logs are missing the right variable data. e.g I tested SQL injection and i was not able to see the relevant information in apache log which I typically get when "SecRuleEngine On" sample log for "SecRuleEngine DetectionOnly" 49.36.106.185 - - [21/Jun/2023:06:39:53 +0000] 200 23125 GET "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/114.0" 3154 443 example.com ZJKbOUfg7dWT82qCkvNySAAAAEU TLSv1.3 TLS_AES_128_GCM_SHA256 0 4 L; "/" 15.24.15.205 39735 "" "" "" "/" 333762 "/?k=3D1%20or%201=3D1" here rule id log is 333762 which is not the signature for SQL injection So my conclusion is, in "SecRuleEngine On" rule evaluation stops when the first rule matches with the final action drop/block. Hence I am able to get the right rule ID and other variable data. But when "SecRuleEngine DetectionOnly" rule evaluation continues till the last rule and due to which my variable data gets changed as per the rules getting evaluated. Can I change this behaviour of modsecurity in Detectonly mode ? that it should stop the evaluation when it matches the first rule with final action of drop/block ( and not block/drop the transaction) ? Please suggest. Thanks, Homesh On Fri, Mar 25, 2022 at 4:08=E2=80=AFPM Christian Folini < [email protected]> wrote: > Thanks for the updates. I do not immediately see why it's not working > completely. But glad you have a working solution. > > Best, > > Christian > > On Fri, Mar 25, 2022 at 01:59:38PM +0530, homesh joshi wrote: > > Dear Christian, > > > > I added setvar:tx.rule=3D1 in each rule and then added the following ru= le, > > post which I am able to get 1 written in access logs ( via the %{waf} ) > for > > the transactions which got blocked by Modsec. for other transactions it > is > > missing and hence getting - in the logs. I was not able to directly set > the > > WAF=3D1 in the rules via setenv:waf=3D1 > > > > SecRule TX:rule "@eq 1" "phase:5,pass,setenv:waf=3D1,id:'9001'" > > > > Will test this any update incase I face any challenge. > > > > Thanks, > > Homesh > > > > > > On Thu, Mar 24, 2022 at 6:35 PM Christian Folini < > > [email protected]> wrote: > > > > > I suggest you add this to every rule that detects / blocks something. > > > Thus not a SecAction, but attach the setenv to your existing SecRules > > > where you want to see the flag. > > > > > > Alternatively, you can do a SecRule in phase 5 where you test the > > > HTTP status and if it's 403, then you set the env. > > > > > > Good luck! > > > > > > Christian > > > > > > On Thu, Mar 24, 2022 at 05:02:20PM +0530, homesh joshi wrote: > > > > Dear Christian, > > > > > > > > Thanks. I think this will work for me. However, can you please > explain > > > it a > > > > bit more on how this works. > > > > from your tutorial if i set up following rule > > > > > > > > # =3D=3D=3D ModSec performance calculations and variable export (id= s: > 90100 - > > > 90199) > > > > > > > > SecAction "id:90100,phase:5,pass,nolog,setenv:modsec=3D1" > > > > > > > > then for every access I see "1" in the access log. > > > > > > > > I think I will need to understand it more in order to use it. > > > > > > > > Kindly explain > > > > 1) the configuration required for setenv by modifying each rule > > > > > > > > 2) the configuration required for more complicated scheme which you > > > > are referring to > > > > > > > > Thanks, > > > > > > > > Homesh > > > > > > > > > > > > On Thu, Mar 24, 2022 at 11:52 AM Christian Folini < > > > > [email protected]> wrote: > > > > > > > > > Hi there, > > > > > > > > > > On Thu, Mar 24, 2022 at 08:37:51AM +0530, homesh joshi wrote: > > > > > > Thanks for the clarification. > > > > > > I have already gone through excellent netnea.com tutorials. I > have > > > > > already > > > > > > used some of the configuration from tutorial.I do not use crs. > > > > > > > > > > Thank you very much. > > > > > > > > > > > My objective here is that I want to get a flag in access log > line if > > > > > modsec > > > > > > has taken any action on the transaction say simply it can be a > field > > > like > > > > > > modsec=3D1 or modsec=3D0. This wi help me in separating transac= tions > > > which > > > > > are > > > > > > allowed.(modsec=3D0) So then it is easy to show these transacti= ons > in > > > the > > > > > > reporting system. > > > > > > > > > > I'd do a setenv then in the rules. > > > > > > > > > > ... "setenv:modsec=3D1" > > > > > > > > > > Similar to the way I set th various env variables in phase 5. You > can > > > > > simply > > > > > add this to every rule you have. Or you set up a more complicated > > > scheme > > > > > and do it in the end in phase 5. > > > > > > > > > > Best, > > > > > > > > > > Christian > > > > > > > > > > > > > > > > > Kindly suggest. > > > > > > > > > > > > Thanks, > > > > > > Homesh > > > > > > > > > > > > On Thu, 24 Mar, 2022, 12:04 am Christian Folini, < > > > > > > [email protected]> wrote: > > > > > > > > > > > > > HelloHomesh, > > > > > > > > > > > > > > Unfortunately, this is not how this works. > > > > > > > > > > > > > > A ModSecuriy variable is not automatically an environment > variable. > > > > > > > And on top, the ModSec variable "rule" is only available > during the > > > > > > > execution of the very rule (and there might be many, many > rules). > > > > > > > > > > > > > > I suggest you read up on my free tutorials published at > netnea.com > > > . > > > > > > > The one on logging and the ones on the Core Rule Set are > proposing > > > > > > > ways to achieve something along these lines. > > > > > > > > > > > > > > Best, > > > > > > > > > > > > > > Christian > > > > > > > > > > > > > > > > > > > > > On Wed, Mar 23, 2022 at 11:12:58PM +0530, homesh joshi wrote: > > > > > > > > Hi All, > > > > > > > > > > > > > > > > Hope you all are well. > > > > > > > > > > > > > > > > I want to add the modsecurity variable e.g "rule.id"in the > > > apache > > > > > access > > > > > > > > log via the extended format. > > > > > > > > I set the following line in /etc/apache2/apache.conf > > > > > > > > > > > > > > > > LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" > > > > > \"%{User-Agent}i\" > > > > > > > > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{rule.id}e" extended > > > > > > > > > > > > > > > > However I am not getting the rule.id value in the access lo= g > > > line. > > > > > > > > > > > > > > > > Kindly suggest. > > > > > > > > > > > > > > > > Thanks, > > > > > > > > Homesh > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > mod-security-users mailing list > > > > > > > > [email protected] > > > > > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > > > > Commercial ModSecurity Rules and Support from Trustwave's > > > SpiderLabs: > > > > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > mod-security-users mailing list > > > > > > > [email protected] > > > > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > > > Commercial ModSecurity Rules and Support from Trustwave's > > > SpiderLabs: > > > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > mod-security-users mailing list > > > > > > [email protected] > > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > > Commercial ModSecurity Rules and Support from Trustwave's > SpiderLabs: > > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > mod-security-users mailing list > > > > > [email protected] > > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > > Commercial ModSecurity Rules and Support from Trustwave's > SpiderLabs: > > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > > > > _______________________________________________ > > > > mod-security-users mailing list > > > > [email protected] > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLab= s: > > > > http://www.modsecurity.org/projects/commercial/rules/ > > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > > > > > > _______________________________________________ > > > mod-security-users mailing list > > > [email protected] > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > > http://www.modsecurity.org/projects/commercial/rules/ > > > http://www.modsecurity.org/projects/commercial/support/ > > > > > > > _______________________________________________ > > mod-security-users mailing list > > [email protected] > > https://lists.sourceforge.net/lists/listinfo/mod-security-users > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > > http://www.modsecurity.org/projects/commercial/rules/ > > http://www.modsecurity.org/projects/commercial/support/ > > > > _______________________________________________ > mod-security-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > --000000000000415ffc05fe9eef70 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Hi All,</div><div><br></div><div>With regards to my a= pproach for logging the modsec variables in apache log has worked for me fo= r almost a year now.</div><div>However, today when I enabled "SecRuleE= ngine DetectionOnly" for one of my websites. What I notice is that the= apache logs are missing the right variable data.</div><div>e.g I tested SQ= L injection and i was not able to see the relevant information in apache lo= g which I typically get when "SecRuleEngine On"</div><div>sample = log for "SecRuleEngine DetectionOnly"</div><div>49.36.106.185 - = - [21/Jun/2023:06:39:53 +0000] 200 23125 GET "-"=20 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/2010010= 1=20 Firefox/114.0" 3154 443 <a href=3D"http://example.com">example.com</a>= ZJKbOUfg7dWT82qCkvNySAAAAEU TLSv1.3 TLS_AES_128_GCM_SHA256 0 4 L; "/" 15.24.15.205 39735 ""= ; "" "" "/"=20 333762 "/?k=3D1%20or%201=3D1" <br></div><div><br></div><div>here = rule id log is 333762 which is not the signature for SQL injection</div><di= v><br></div><div>So my conclusion is, in "SecRuleEngine On" rule = evaluation stops when the first rule matches with the final action drop/blo= ck. Hence I am able to get the right rule ID and other variable data. But w= hen "SecRuleEngine DetectionOnly" rule evaluation continues till = the last rule and due to which my variable data gets changed as per the rul= es getting evaluated. Can I change this behaviour of modsecurity in Detecto= nly mode ? that it should stop the evaluation when it matches the first rul= e with final action of drop/block ( and not block/drop the transaction) ? <= br></div><div><br></div><div>Please suggest.</div><div><br></div><div>Thank= s,</div><div>Homesh<br></div><div><br></div></div><br><div class=3D"gmail_q= uote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Mar 25, 2022 at 4:08=E2= =80=AFPM Christian Folini <<a href=3D"mailto:[email protected]= ">[email protected]</a>> wrote:<br></div><blockquote class=3D"= gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(20= 4,204,204);padding-left:1ex">Thanks for the updates. I do not immediately s= ee why it's not working<br> completely. But glad you have a working solution.<br> <br> Best,<br> <br> Christian<br> <br> On Fri, Mar 25, 2022 at 01:59:38PM +0530, homesh joshi wrote:<br> > Dear Christian,<br> > <br> > I added setvar:tx.rule=3D1 in each rule and then added the following r= ule,<br> > post which I am able to get 1 written in access logs ( via the %{waf} = ) for<br> > the transactions which got blocked by Modsec. for other transactions i= t is<br> > missing and hence getting - in the logs. I was not able to directly se= t the<br> > WAF=3D1 in the rules via setenv:waf=3D1<br> > <br> > SecRule TX:rule "@eq 1" "phase:5,pass,setenv:waf=3D1,id= :'9001'"<br> > <br> > Will test this any update incase I face any challenge.<br> > <br> > Thanks,<br> > Homesh<br> > <br> > <br> > On Thu, Mar 24, 2022 at 6:35 PM Christian Folini <<br> > <a href=3D"mailto:[email protected]" target=3D"_blank">chris= [email protected]</a>> wrote:<br> > <br> > > I suggest you add this to every rule that detects / blocks someth= ing.<br> > > Thus not a SecAction, but attach the setenv to your existing SecR= ules<br> > > where you want to see the flag.<br> > ><br> > > Alternatively, you can do a SecRule in phase 5 where you test the= <br> > > HTTP status and if it's 403, then you set the env.<br> > ><br> > > Good luck!<br> > ><br> > > Christian<br> > ><br> > > On Thu, Mar 24, 2022 at 05:02:20PM +0530, homesh joshi wrote:<br> > > > Dear Christian,<br> > > ><br> > > > Thanks. I think this will work for me. However, can you plea= se explain<br> > > it a<br> > > > bit more on how this works.<br> > > > from your tutorial if i set up following rule<br> > > ><br> > > > # =3D=3D=3D ModSec performance calculations and variable exp= ort (ids: 90100 -<br> > > 90199)<br> > > ><br> > > > SecAction "id:90100,phase:5,pass,nolog,setenv:modsec=3D= 1"<br> > > ><br> > > > then for every access I see "1" in the access log.= <br> > > ><br> > > > I think I will need to understand it more in order to use it= .<br> > > ><br> > > > Kindly explain<br> > > > 1) the configuration required for setenv by modifying each r= ule<br> > > ><br> > > > 2) the configuration required for more complicated scheme wh= ich you<br> > > > are referring to<br> > > ><br> > > > Thanks,<br> > > ><br> > > > Homesh<br> > > ><br> > > ><br> > > > On Thu, Mar 24, 2022 at 11:52 AM Christian Folini <<br> > > > <a href=3D"mailto:[email protected]" target=3D"_bl= ank">[email protected]</a>> wrote:<br> > > ><br> > > > > Hi there,<br> > > > ><br> > > > > On Thu, Mar 24, 2022 at 08:37:51AM +0530, homesh joshi = wrote:<br> > > > > > Thanks for the clarification.<br> > > > > > I have already gone through excellent <a href=3D"h= ttp://netnea.com" rel=3D"noreferrer" target=3D"_blank">netnea.com</a> tutor= ials. I have<br> > > > > already<br> > > > > > used some of the configuration from tutorial.I do = not use crs.<br> > > > ><br> > > > > Thank you very much.<br> > > > ><br> > > > > > My objective here is that I want to get a flag in = access log line if<br> > > > > modsec<br> > > > > > has taken any action on the transaction say simply= it can be a field<br> > > like<br> > > > > > modsec=3D1 or modsec=3D0. This wi help me in separ= ating transactions<br> > > which<br> > > > > are<br> > > > > > allowed.(modsec=3D0) So then it is easy to show th= ese transactions in<br> > > the<br> > > > > > reporting system.<br> > > > ><br> > > > > I'd do a setenv then in the rules.<br> > > > ><br> > > > > ... "setenv:modsec=3D1"<br> > > > ><br> > > > > Similar to the way I set th various env variables in ph= ase 5. You can<br> > > > > simply<br> > > > > add this to every rule you have. Or you set up a more c= omplicated<br> > > scheme<br> > > > > and do it in the end in phase 5.<br> > > > ><br> > > > > Best,<br> > > > ><br> > > > > Christian<br> > > > ><br> > > > > ><br> > > > > > Kindly suggest.<br> > > > > ><br> > > > > > Thanks,<br> > > > > > Homesh<br> > > > > ><br> > > > > > On Thu, 24 Mar, 2022, 12:04 am Christian Folini, &= lt;<br> > > > > > <a href=3D"mailto:[email protected]" tar= get=3D"_blank">[email protected]</a>> wrote:<br> > > > > ><br> > > > > > > HelloHomesh,<br> > > > > > ><br> > > > > > > Unfortunately, this is not how this works.<br= > > > > > > ><br> > > > > > > A ModSecuriy variable is not automatically an= environment variable.<br> > > > > > > And on top, the ModSec variable "rule&qu= ot; is only available during the<br> > > > > > > execution of the very rule (and there might b= e many, many rules).<br> > > > > > ><br> > > > > > > I suggest you read up on my free tutorials pu= blished at <a href=3D"http://netnea.com" rel=3D"noreferrer" target=3D"_blan= k">netnea.com</a><br> > > .<br> > > > > > > The one on logging and the ones on the Core R= ule Set are proposing<br> > > > > > > ways to achieve something along these lines.<= br> > > > > > ><br> > > > > > > Best,<br> > > > > > ><br> > > > > > > Christian<br> > > > > > ><br> > > > > > ><br> > > > > > > On Wed, Mar 23, 2022 at 11:12:58PM +0530, hom= esh joshi wrote:<br> > > > > > > > Hi All,<br> > > > > > > ><br> > > > > > > > Hope you all are well.<br> > > > > > > ><br> > > > > > > > I want to add the modsecurity variable e= .g "<a href=3D"http://rule.id" rel=3D"noreferrer" target=3D"_blank">ru= le.id</a>"in the<br> > > apache<br> > > > > access<br> > > > > > > > log via the extended format.<br> > > > > > > > I set the following line in /etc/apache2= /apache.conf<br> > > > > > > ><br> > > > > > > > LogFormat "%h %l %u %t \"%r\&q= uot; %>s %O \"%{Referer}i\"<br> > > > > \"%{User-Agent}i\"<br> > > > > > > > %{ms}T %p %{Host}i %{UNIQUE_ID}e %{<a hr= ef=3D"http://rule.id" rel=3D"noreferrer" target=3D"_blank">rule.id</a>}e&qu= ot; extended<br> > > > > > > ><br> > > > > > > > However I am not getting the <a href=3D"= http://rule.id" rel=3D"noreferrer" target=3D"_blank">rule.id</a> value in t= he access log<br> > > line.<br> > > > > > > ><br> > > > > > > > Kindly suggest.<br> > > > > > > ><br> > > > > > > > Thanks,<br> > > > > > > > Homesh<br> > > > > > ><br> > > > > > ><br> > > > > > > > ________________________________________= _______<br> > > > > > > > mod-security-users mailing list<br> > > > > > > > <a href=3D"mailto:mod-security-users@lis= ts.sourceforge.net" target=3D"_blank">[email protected].= net</a><br> > > > > > > > <a href=3D"https://lists.sourceforge.net= /lists/listinfo/mod-security-users" rel=3D"noreferrer" target=3D"_blank">ht= tps://lists.sourceforge.net/lists/listinfo/mod-security-users</a><br> > > > > > > > Commercial ModSecurity Rules and Support= from Trustwave's<br> > > SpiderLabs:<br> > > > > > > > <a href=3D"http://www.modsecurity.org/pr= ojects/commercial/rules/" rel=3D"noreferrer" target=3D"_blank">http://www.m= odsecurity.org/projects/commercial/rules/</a><br> > > > > > > > <a href=3D"http://www.modsecurity.org/pr= ojects/commercial/support/" rel=3D"noreferrer" target=3D"_blank">http://www= .modsecurity.org/projects/commercial/support/</a><br> > > > > > ><br> > > > > > ><br> > > > > > ><br> > > > > > > _____________________________________________= __<br> > > > > > > mod-security-users mailing list<br> > > > > > > <a href=3D"mailto:[email protected]= urceforge.net" target=3D"_blank">[email protected]</= a><br> > > > > > > <a href=3D"https://lists.sourceforge.net/list= s/listinfo/mod-security-users" rel=3D"noreferrer" target=3D"_blank">https:/= /lists.sourceforge.net/lists/listinfo/mod-security-users</a><br> > > > > > > Commercial ModSecurity Rules and Support from= Trustwave's<br> > > SpiderLabs:<br> > > > > > > <a href=3D"http://www.modsecurity.org/project= s/commercial/rules/" rel=3D"noreferrer" target=3D"_blank">http://www.modsec= urity.org/projects/commercial/rules/</a><br> > > > > > > <a href=3D"http://www.modsecurity.org/project= s/commercial/support/" rel=3D"noreferrer" target=3D"_blank">http://www.mods= ecurity.org/projects/commercial/support/</a><br> > > > > > ><br> > > > ><br> > > > ><br> > > > > > _______________________________________________<br= > > > > > > mod-security-users mailing list<br> > > > > > <a href=3D"mailto:[email protected]= orge.net" target=3D"_blank">[email protected]</a><br= > > > > > > <a href=3D"https://lists.sourceforge.net/lists/lis= tinfo/mod-security-users" rel=3D"noreferrer" target=3D"_blank">https://list= s.sourceforge.net/lists/listinfo/mod-security-users</a><br> > > > > > Commercial ModSecurity Rules and Support from Trus= twave's SpiderLabs:<br> > > > > > <a href=3D"http://www.modsecurity.org/projects/com= mercial/rules/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity= .org/projects/commercial/rules/</a><br> > > > > > <a href=3D"http://www.modsecurity.org/projects/com= mercial/support/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecuri= ty.org/projects/commercial/support/</a><br> > > > ><br> > > > ><br> > > > ><br> > > > > _______________________________________________<br> > > > > mod-security-users mailing list<br> > > > > <a href=3D"mailto:[email protected].= net" target=3D"_blank">[email protected]</a><br> > > > > <a href=3D"https://lists.sourceforge.net/lists/listinfo= /mod-security-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sou= rceforge.net/lists/listinfo/mod-security-users</a><br> > > > > Commercial ModSecurity Rules and Support from Trustwave= 's SpiderLabs:<br> > > > > <a href=3D"http://www.modsecurity.org/projects/commerci= al/rules/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/= projects/commercial/rules/</a><br> > > > > <a href=3D"http://www.modsecurity.org/projects/commerci= al/support/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.or= g/projects/commercial/support/</a><br> > > > ><br> > ><br> > ><br> > > > _______________________________________________<br> > > > mod-security-users mailing list<br> > > > <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br> > > > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-= security-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sourcefo= rge.net/lists/listinfo/mod-security-users</a><br> > > > Commercial ModSecurity Rules and Support from Trustwave'= s SpiderLabs:<br> > > > <a href=3D"http://www.modsecurity.org/projects/commercial/ru= les/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/proje= cts/commercial/rules/</a><br> > > > <a href=3D"http://www.modsecurity.org/projects/commercial/su= pport/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/pro= jects/commercial/support/</a><br> > ><br> > ><br> > ><br> > > _______________________________________________<br> > > mod-security-users mailing list<br> > > <a href=3D"mailto:[email protected]" targe= t=3D"_blank">[email protected]</a><br> > > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-secur= ity-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.n= et/lists/listinfo/mod-security-users</a><br> > > Commercial ModSecurity Rules and Support from Trustwave's Spi= derLabs:<br> > > <a href=3D"http://www.modsecurity.org/projects/commercial/rules/"= rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/c= ommercial/rules/</a><br> > > <a href=3D"http://www.modsecurity.org/projects/commercial/support= /" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects= /commercial/support/</a><br> > ><br> <br> <br> > _______________________________________________<br> > mod-security-users mailing list<br> > <a href=3D"mailto:[email protected]" target=3D"= _blank">[email protected]</a><br> > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-u= sers" rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/li= sts/listinfo/mod-security-users</a><br> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLa= bs:<br> > <a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel= =3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/comme= rcial/rules/</a><br> > <a href=3D"http://www.modsecurity.org/projects/commercial/support/" re= l=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/comm= ercial/support/</a><br> <br> <br> <br> _______________________________________________<br> mod-security-users mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blan= k">[email protected]</a><br> <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-users"= rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/l= istinfo/mod-security-users</a><br> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:<b= r> <a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel=3D"no= referrer" target=3D"_blank">http://www.modsecurity.org/projects/commercial/= rules/</a><br> <a href=3D"http://www.modsecurity.org/projects/commercial/support/" rel=3D"= noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/commercia= l/support/</a><br> </blockquote></div> --000000000000415ffc05fe9eef70-- --===============9199040742397786204== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============9199040742397786204== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ --===============9199040742397786204==--