2023-03-17|閱讀時間 ‧ 約 12 分鐘

[NGINX] ModSecurity #2 安裝OWASP CRS 並測試是否生效

OWASP( Open Web Application Security Project) 專案維護核心規則集 Core Rule Set 縮寫 CRS 能抗衡一般類別的漏洞攻擊手法 CRS 在ModSecurity 官網免費釋出當然也有需付費的規則集。

Download the latest OWASP CRS from GitHub and extract the rules into /usr/local or another location of your choice.

$ cd /tmp

$ wget https://github.com/SpiderLabs/owasp-modsecurity-crs/archive/v3.0.2.tar.gz

$ tar -xzvf v3.0.2.tar.gz

$ sudo mv owasp-modsecurity-crs-3.0.2 /etc/nginx

2. Create the crs‑setup.conf file as a copy of crs‑setup.conf.example.

$ cd /etc/nginx/owasp-modsecurity-crs-3.0.2

$ sudo cp crs-setup.conf.example crs-setup.conf



$ cd /etc/nginx/owasp-modsecurity-crs-3.0.2/rules

$ cp REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf

$ cp RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

$ cp /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/*.data /etc/nginx/modsec

3. 修改 /etc/nginx/modsec/main.conf

# 往下加入以下規則

# OWASP CRS v3 rules

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/crs-setup.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-901-INITIALIZATION.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-905-COMMON-EXCEPTIONS.conf

#這個conf再自已需求加入 Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-910-IP-REPUTATION.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-911-METHOD-ENFORCEMENT.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-912-DOS-PROTECTION.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-913-SCANNER-DETECTION.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-921-PROTOCOL-ATTACK.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/REQUEST-949-BLOCKING-EVALUATION.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-950-DATA-LEAKAGES.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-959-BLOCKING-EVALUATION.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-980-CORRELATION.conf

Include /etc/nginx/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

4. 重啟nginx，在Terminal輸入下列指令

$ systemctl reload nginx

5. 測試OWASP CRS是否生效，在Terminal輸入下列指令

$ curl -v http://127.0.0.1/?exec=/bin/bash 

or

$ curl -D - http://localhost/?id='1 and 1=1'  # 測試SQL注入

or 

$ curl -D - http://localhost/?input='<script>alert(/xss/)</script>' # 測試XSS

7. Terminal都會出現下面訊息

* About to connect() to 127.0.0.1 port 80 (#0)

*   Trying 127.0.0.1...

* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0)

> GET /?exec=/bin/bash HTTP/1.1

> User-Agent: curl/7.29.0

> Host: 127.0.0.1

> Accept: */*

> 

< HTTP/1.1 308 Permanent Redirect

< Server: nginx/1.21.4

< Date: Fri, 10 Mar 2023 07:44:52 GMT

< Content-Type: text/html; charset=utf-8

< Content-Length: 171

< Connection: keep-alive

< Location: https://127.0.0.1/?exec=/bin/bash

< X-XSS-Protection: 1; mode=block

< X-Content-Type-Options: nosniff

< X-Frame-Options: SAMEORIGIN

< Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'

< 

<html>

<head><title>308 Permanent Redirect</title></head>

<body>

<center><h1>308 Permanent Redirect</h1></center>

<hr><center>nginx/1.21.4</center>

</body>

</html>

* Connection #0 to host 127.0.0.1 left intact

You have new mail in /var/spool/mail/root