29 lines
1.6 KiB
Plaintext
29 lines
1.6 KiB
Plaintext
# ---------------------------------------------------------------
|
|
# Core ModSecurity Rule Set ver.2.2.9
|
|
# Copyright (C) 2006-2012 Trustwave All rights reserved.
|
|
#
|
|
# The OWASP ModSecurity Core Rule Set is distributed under
|
|
# Apache Software License (ASL) version 2
|
|
# Please see the enclosed LICENCE file for full details.
|
|
# ---------------------------------------------------------------
|
|
|
|
|
|
#
|
|
# Rule set for detecting Open Proxy Abuse/Chaining.
|
|
#
|
|
# http://blog.spiderlabs.com/2011/03/detecting-malice-with-modsecurity-open-proxy-abuse.html
|
|
#
|
|
|
|
#
|
|
# You must first download the MaxMind GeoIP Lite City DB -
|
|
#
|
|
# http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
|
|
#
|
|
# You then need to define the proper path for the SecGeoLookupDb directive
|
|
#
|
|
SecGeoLookupDb /usr/local/apache/conf/modsec/GeoLiteCity.dat
|
|
SecRule REQUEST_HEADERS:X-Forwarded-For "^\b\d{1,3}(?<!192|127|10)\.\d{1,3}\.\d{1,3}\.\d{1,3}\b" "chain,phase:1,id:'981050',t:none,capture,block,rev:'2.2.9',msg:'Potential Open Proxy Abuse - GeoIP Country Code Mismatch of X-Forwarded-For Request Header and Client REMOTE_ADDR',logdata:'IP Country is: %{geo.country_code} and X-Forwarded-For is: %{tx.geo_x-forwarded-for}'"
|
|
SecRule TX:0 "@geoLookup" "chain,setvar:tx.geo_x-forwarded-for=%{geo.country_code}"
|
|
SecRule REMOTE_ADDR "@geoLookup" "chain,t:none"
|
|
SecRule GEO:COUNTRY_CODE "!@streq %{tx.geo_x-forwarded-for}" "setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},setvar:tx.automation_score=+%{tx.warning_anomaly_score},setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var}"
|