Search code examples
securitymod-security2

ModSecurity WAF RESPONSE_BODY note working

Im new to Web Application Firewalls and im trying to get modsecurity to work.

Im testing out some config this is what i got so far. 

SecResponseBodyAccess On
SecResponseBodyMimeType text/plain text/html
SecResponseBodyLimit 524288
SecResponseBodyLimitAction ProcessPartial
SecRule RESPONSE_BODY "<script>" "phase:4,log,deny,id:101"
SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|REQUEST_HEADERS_NAMES "<script>" "phase:2,log,deny,id:101"

I just cant get the response body with a script tag to be blocked.

Solution

  • Have you turned ModSecurity on with the following config?:

    SecRuleEngine On

    You can also turn on debugging which will show you more info as each rule is processed:

    SecDebugLog /path/to/modsec-debug.log
SecDebugLogLevel 9