[Owasp-modsecurity-core-rule-set] Lots of troubles with rules and shared hosting

turgut kalfaoğlu turgut at kalfaoglu.com
Mon Jan 11 15:31:45 EST 2010


Sorry I should have mentioned that "I downloaded the latest rules, and 
applied only the base rules, not the optional ones.."
Regards, -turgut


On 01/11/2010 10:24 PM, turgut kalfaoğlu wrote:
> I recently upgraded the modsecurity 2.something to the latest version.
>
> But these two rulesets are giving me much headache:
>
> modsecurity_crs_41_phpids_converter.conf
> modsecurity_crs_41_phpids_filters.conf
>
> For example, a plain HTML web site, but the JPG files are oddly named:
> http://www.learningpracticalturkish.com/yasemin-unlu--movie-cover--koylu-kizi150x147.jpg 
>
>
> Dumps over a page of "Messages:" in the audit file, talking about 
> probably a dozen rules or so that are broken.
>
> The following dynamic site, is likewise:
> http://noroloji.biz/index.php?option=com_content&view=article&id=46&Itemid=97 
>
> ... belches pages and pages of code, even at debug level 3.
>
> The web server has over 300 hostings - Joomla, PhpNuke, Wordpress, 
> homebrew, and plain HTML.
>
> I spent two whole days editing out the core rules, but finally had to 
> give up on the "phpids" rulesets altogether.
>
> Was there a better way?
>
> Thanks!
>  -turgut
>
>
> _______________________________________________
> Owasp-modsecurity-core-rule-set mailing list
> Owasp-modsecurity-core-rule-set at lists.owasp.org
> https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
>    

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.owasp.org/pipermail/owasp-modsecurity-core-rule-set/attachments/20100111/592b6cac/attachment.html 


More information about the Owasp-modsecurity-core-rule-set mailing list