ModSecurity:MediaWiki Rules - Revision history

Kangtain at 13:38, 1 November 2025

2025-11-01T13:38:19Z

← Older revision		Revision as of 20:38, 1 November 2025
Line 8:		Line 8:

	*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>		*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>
	~~<syntaxhighlight lang="shell">~~
	vim RESPONSE-959-BLOCKING-EVALUATION.conf		vim RESPONSE-959-BLOCKING-EVALUATION.conf
	~~</syntaxhighlight>~~
	*Pada log error terdapat ID rules yang memblokir yaitu ID 959100		*Pada log error terdapat ID rules yang memblokir yaitu ID 959100
	*Ganti baris pada baris deny ke allow		*Ganti baris pada baris deny ke allow
	~~<syntaxhighlight lang="nginx">~~		SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \
	SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \		"id:959100,\
	"id:959100,\		phase:4,\
	phase:4,\		allow,\
	allow,\		t:none,\
	t:none,\		msg:'Outbound Anomaly Score Exceeded (Total Score: %{TX.OUTBOUND_ANOMALY_SCORE})',\
	msg:'Outbound Anomaly Score Exceeded (Total Score: %{TX.OUTBOUND_ANOMALY_SCORE})',\		tag:'anomaly-evaluation',\
	tag:'anomaly-evaluation',\		ver:'OWASP_CRS/3.4.0-dev',\
	ver:'OWASP_CRS/3.4.0-dev',\		setvar:'tx.anomaly_score=+%{tx.outbound_anomaly_score}'"
	setvar:'tx.anomaly_score=+%{tx.outbound_anomaly_score}'"
	~~</syntaxhighlight>~~
	*Setelah itu buka file selanjutnya di <code>REQUEST-949-BLOCKING-EVALUATION.conf</code>, dengan cara yang sama		*Setelah itu buka file selanjutnya di <code>REQUEST-949-BLOCKING-EVALUATION.conf</code>, dengan cara yang sama
	~~<syntaxhighlight lang="shell">~~
	vim REQUEST-949-BLOCKING-EVALUATION.conf		vim REQUEST-949-BLOCKING-EVALUATION.conf
	~~</syntaxhighlight><syntaxhighlight lang="nginx">~~
	SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \		SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \
	"id:949110,\		"id:949110,\
	phase:2,\		phase:2,\
	allow,\		allow,\
	t:none,\		t:none,\
	msg:'Inbound Anomaly Score Exceeded (Total Score: %{TX.ANOMALY_SCORE})',\		msg:'Inbound Anomaly Score Exceeded (Total Score: %{TX.ANOMALY_SCORE})',\
	tag:'application-multi',\		tag:'application-multi',\
	tag:'language-multi',\		tag:'language-multi',\
	tag:'platform-multi',\		tag:'platform-multi',\
	tag:'attack-generic',\		tag:'attack-generic',\
	ver:'OWASP_CRS/3.4.0-dev',\		ver:'OWASP_CRS/3.4.0-dev',\
	severity:'CRITICAL',\		severity:'CRITICAL',\
	setvar:'tx.inbound_anomaly_score=%{tx.anomaly_score}'"		setvar:'tx.inbound_anomaly_score=%{tx.anomaly_score}'"
	~~</syntaxhighlight>~~
	*Setelah dirubah cek kembali server nginx dan restart		*Setelah dirubah cek kembali server nginx dan restart
	~~<syntaxhighlight lang="shell">~~
	sudo nginx -t		sudo nginx -t
	~~</syntaxhighlight><syntaxhighlight lang="shell">~~
	systemctl restart nginx		systemctl restart nginx
	~~</syntaxhighlight>~~
	[[Category:Security]]		[[Category:Security]]
	[[Category:Server]]		[[Category:Server]]
	[[Category:ModSecurity]]		[[Category:ModSecurity]]

Kangtain at 13:36, 1 November 2025

2025-11-01T13:36:18Z

← Older revision		Revision as of 20:36, 1 November 2025
Line 4:		Line 4:

	*Pindah ke directory <code>/usr/local/modsecurity-crs/rules/</code>		*Pindah ke directory <code>/usr/local/modsecurity-crs/rules/</code>
	~~<syntaxhighlight lang="shell">~~
	cd /usr/local/modsecurity-crs/rules/		cd /usr/local/modsecurity-crs/rules/
	~~</syntaxhighlight>~~
	*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>		*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>
	<syntaxhighlight lang="shell">		<syntaxhighlight lang="shell">

Kangtain at 10:46, 24 August 2022

2022-08-24T10:46:25Z

← Older revision		Revision as of 17:46, 24 August 2022
Line 13:		Line 13:
	*Pada log error terdapat ID rules yang memblokir yaitu ID 959100		*Pada log error terdapat ID rules yang memblokir yaitu ID 959100
	*Ganti baris pada baris deny ke allow		*Ganti baris pada baris deny ke allow
	SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \		<syntaxhighlight lang="nginx">
	"id:959100,\		SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \
	phase:4,\		"id:959100,\
	~~'''~~allow,\~~'''~~		phase:4,\
	t:none,\		allow,\
	msg:'Outbound Anomaly Score Exceeded (Total Score: %{TX.OUTBOUND_ANOMALY_SCORE})',\		t:none,\
	tag:'anomaly-evaluation',\		msg:'Outbound Anomaly Score Exceeded (Total Score: %{TX.OUTBOUND_ANOMALY_SCORE})',\
	ver:'OWASP_CRS/3.4.0-dev',\		tag:'anomaly-evaluation',\
	setvar:'tx.anomaly_score=+%{tx.outbound_anomaly_score}'"		ver:'OWASP_CRS/3.4.0-dev',\
			setvar:'tx.anomaly_score=+%{tx.outbound_anomaly_score}'"
			</syntaxhighlight>
	*Setelah itu buka file selanjutnya di <code>REQUEST-949-BLOCKING-EVALUATION.conf</code>, dengan cara yang sama		*Setelah itu buka file selanjutnya di <code>REQUEST-949-BLOCKING-EVALUATION.conf</code>, dengan cara yang sama
			<syntaxhighlight lang="shell">
	vim REQUEST-949-BLOCKING-EVALUATION.conf		vim REQUEST-949-BLOCKING-EVALUATION.conf
			</syntaxhighlight><syntaxhighlight lang="nginx">
	SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \		SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \
	"id:949110,\		"id:949110,\
	phase:2,\		phase:2,\
	~~'''~~allow,\~~'''~~		allow,\
	t:none,\		t:none,\
	msg:'Inbound Anomaly Score Exceeded (Total Score: %{TX.ANOMALY_SCORE})',\		msg:'Inbound Anomaly Score Exceeded (Total Score: %{TX.ANOMALY_SCORE})',\
	tag:'application-multi',\		tag:'application-multi',\
	tag:'language-multi',\		tag:'language-multi',\
	tag:'platform-multi',\		tag:'platform-multi',\
	tag:'attack-generic',\		tag:'attack-generic',\
	ver:'OWASP_CRS/3.4.0-dev',\		ver:'OWASP_CRS/3.4.0-dev',\
	severity:'CRITICAL',\		severity:'CRITICAL',\
	setvar:'tx.inbound_anomaly_score=%{tx.anomaly_score}'"		setvar:'tx.inbound_anomaly_score=%{tx.anomaly_score}'"
			</syntaxhighlight>
	*Setelah dirubah cek kembali server nginx dan restart		*Setelah dirubah cek kembali server nginx dan restart
	sudo nginx -t		<syntaxhighlight lang="shell">
			sudo nginx -t
	systemctl restart nginx		</syntaxhighlight><syntaxhighlight lang="shell">
			systemctl restart nginx
			</syntaxhighlight>
	[[Category:Security]]		[[Category:Security]]
	[[Category:Server]]		[[Category:Server]]
	[[Category:ModSecurity]]		[[Category:ModSecurity]]

Kangtain at 10:43, 24 August 2022

2022-08-24T10:43:55Z

← Older revision		Revision as of 17:43, 24 August 2022
Line 4:		Line 4:

	*Pindah ke directory <code>/usr/local/modsecurity-crs/rules/</code>		*Pindah ke directory <code>/usr/local/modsecurity-crs/rules/</code>
	cd /usr/local/modsecurity-crs/rules/		<syntaxhighlight lang="shell">
			cd /usr/local/modsecurity-crs/rules/
			</syntaxhighlight>
	*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>		*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>
	vim RESPONSE-959-BLOCKING-EVALUATION.conf		<syntaxhighlight lang="shell">
			vim RESPONSE-959-BLOCKING-EVALUATION.conf
			</syntaxhighlight>
	*Pada log error terdapat ID rules yang memblokir yaitu ID 959100		*Pada log error terdapat ID rules yang memblokir yaitu ID 959100
	*Ganti baris pada baris deny ke allow		*Ganti baris pada baris deny ke allow

Kangtain at 06:31, 25 February 2022

2022-02-25T06:31:05Z

← Older revision		Revision as of 13:31, 25 February 2022
Line 7:		Line 7:

	*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>		*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>

	vim RESPONSE-959-BLOCKING-EVALUATION.conf		vim RESPONSE-959-BLOCKING-EVALUATION.conf

Kangtain at 04:39, 18 February 2022

2022-02-18T04:39:06Z

← Older revision		Revision as of 11:39, 18 February 2022
Line 12:		Line 12:
	*Pada log error terdapat ID rules yang memblokir yaitu ID 959100		*Pada log error terdapat ID rules yang memblokir yaitu ID 959100
	*Ganti baris pada baris deny ke allow		*Ganti baris pada baris deny ke allow

	SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \		SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \
	"id:959100,\		"id:959100,\

Kangtain at 12:31, 27 January 2022

2022-01-27T12:31:37Z

← Older revision		Revision as of 19:31, 27 January 2022
Line 8:		Line 8:
	*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>		*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>

	~~nano~~ RESPONSE-959-BLOCKING-EVALUATION.conf		vim RESPONSE-959-BLOCKING-EVALUATION.conf

	*Pada log error terdapat ID rules yang memblokir yaitu ID 959100		*Pada log error terdapat ID rules yang memblokir yaitu ID 959100
Line 24:		Line 24:

	*Setelah itu buka file selanjutnya di <code>REQUEST-949-BLOCKING-EVALUATION.conf</code>, dengan cara yang sama		*Setelah itu buka file selanjutnya di <code>REQUEST-949-BLOCKING-EVALUATION.conf</code>, dengan cara yang sama

			vim REQUEST-949-BLOCKING-EVALUATION.conf

	SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \		SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \

Kangtain at 13:14, 5 January 2022

2022-01-05T13:14:08Z

← Older revision		Revision as of 20:14, 5 January 2022
Line 7:		Line 7:

	*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>		*Lalu buka <code>RESPONSE-959-BLOCKING-EVALUATION.conf</code>

	nano RESPONSE-959-BLOCKING-EVALUATION.conf		nano RESPONSE-959-BLOCKING-EVALUATION.conf

Kangtain at 12:07, 28 December 2021

2021-12-28T12:07:36Z

← Older revision		Revision as of 19:07, 28 December 2021
Line 42:		Line 42:

	systemctl restart nginx		systemctl restart nginx

			[[Category:Security]]
			[[Category:Server]]
			[[Category:ModSecurity]]

Kangtain at 10:01, 5 December 2021

2021-12-05T10:01:29Z

← Older revision		Revision as of 17:01, 5 December 2021
Line 21:		Line 21:
	ver:'OWASP_CRS/3.4.0-dev',\		ver:'OWASP_CRS/3.4.0-dev',\
	setvar:'tx.anomaly_score=+%{tx.outbound_anomaly_score}'"		setvar:'tx.anomaly_score=+%{tx.outbound_anomaly_score}'"

			*Setelah itu buka file selanjutnya di <code>REQUEST-949-BLOCKING-EVALUATION.conf</code>, dengan cara yang sama

			SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \
			"id:949110,\
			phase:2,\
			'''allow,\'''
			t:none,\
			msg:'Inbound Anomaly Score Exceeded (Total Score: %{TX.ANOMALY_SCORE})',\
			tag:'application-multi',\
			tag:'language-multi',\
			tag:'platform-multi',\
			tag:'attack-generic',\
			ver:'OWASP_CRS/3.4.0-dev',\
			severity:'CRITICAL',\
			setvar:'tx.inbound_anomaly_score=%{tx.anomaly_score}'"

			*Setelah dirubah cek kembali server nginx dan restart
			sudo nginx -t

			systemctl restart nginx