« previous next »
Pages: [1]

Author Topic: issues while switching from comodo waf to OWASP latest waf  (Read 37 times)

0 Members and 1 Guest are viewing this topic.

Offline
zeejdeej
*
issues while switching from comodo waf to OWASP latest waf
« on: Today at 12:33:20 AM »
hello,

when i select OWASP latest waf rules for mod security it only shows warning for threats seen in logs below , but when i choose comodo waf rules it blocks threats straight away ? where i can set OWASP rules to not only detect threats and give warning but blocks straight away ? where is this settings?

see the logs below :-

[Tue Sep 02 02:16:30.470800 2025] [:error] [pid 3863547:tid 3863552] [client 172.68.242.3:46086] [client 172.68.242.3] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||bedrive.sws.net.pk|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?test=%2Fetc%2Fhost"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bedrive.sws.net.pk"] [uri "/"] [unique_id "aLY3Xq8tK4SCYBVQOmR2VAAAAMM"]
[Tue Sep 02 02:05:50.982678 2025] [:error] [pid 3863547:tid 3863573] [client 172.71.124.61:61906] [client 172.71.124.61] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||bedrive.sws.net.pk|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?test=%2Fetc%2Fhost"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bedrive.sws.net.pk"] [uri "/"] [unique_id "aLY03q8tK4SCYBVQOmR1sgAAANg"]
[Tue Sep 02 02:04:17.831963 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){3})" at REQUEST_COOKIES:sbjs_session. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1560"] [id "942421"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)"] [data "Matched Data: =1|| found within REQUEST_COOKIES:sbjs_session: pgs=1|||cpg=https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/4"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831915 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){3})" at REQUEST_COOKIES:sbjs_udata. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1560"] [id "942421"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)"] [data "Matched Data: =1|| found within REQUEST_COOKIES:sbjs_udata: vst=1|||uip=(none)|||uag=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/4"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831837 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){3})" at REQUEST_COOKIES:sbjs_first. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1560"] [id "942421"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)"] [data "Matched Data: =typein|| found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)|||plt=(none)|||fmt=(none)|||tct=(none)"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/4"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831787 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){3})" at REQUEST_COOKIES:sbjs_current. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1560"] [id "942421"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)"] [data "Matched Data: =typein|| found within REQUEST_COOKIES:sbjs_current: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)|||plt=(none)|||fmt=(none)|||tct=(none)"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/4"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831733 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){3})" at REQUEST_COOKIES:sbjs_first_add. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1560"] [id "942421"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)"] [data "Matched Data: =2025-09- found within REQUEST_COOKIES:sbjs_first_add: fd=2025-09-02 00:04:12|||ep=https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com|||rf=(none)"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/4"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831671 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){3})" at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1560"] [id "942421"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)"] [data "Matched Data: =2025-09- found within REQUEST_COOKIES:sbjs_current_add: fd=2025-09-02 00:04:12|||ep=https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com|||rf=(none)"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/4"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831585 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){3})" at REQUEST_COOKIES:cf_clearance. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1560"] [id "942421"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)"] [data "Matched Data: -1756771434-1.2.1.1- found within REQUEST_COOKIES:cf_clearance: E4AZPOvWWFn9LaMl2sMYYsLsva7GlacW0uTj4ygxzpM-1756771434-1.2.1.1-fQtJQaEGGv_DFtXO7FTSU22Ad_KLVssWMNrweQ85LktxYvfqYPHaniQWL1yjQ9_rCVQXnD9b3gVBRk_UTN5o2B_8uiXoLlRQO5q.SWPn_wm.t.zD2Of_OYECae16l67oovKxUR7b6XMbK.b3cqZfPuobsZM..sm5qaWvzSLSc5vwFFLbw_LrqKnx8Z.XrgKHj4Ge7HZC6V4EpW9hYkSncup0fsahDpc9XzNdUYg3.qc"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/100 [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831472 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){8})" at REQUEST_COOKIES:sbjs_session. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1384"] [id "942420"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)"] [data "Matched Data: =1|||cpg=https://bedrive.sws.net.pk/?foo=http% found within REQUEST_COOKIES:sbjs_session: pgs=1|||cpg=https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/3"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831412 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){8})" at REQUEST_COOKIES:sbjs_udata. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1384"] [id "942420"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)"] [data "Matched Data: =1|||uip=(none)| found within REQUEST_COOKIES:sbjs_udata: vst=1|||uip=(none)|||uag=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/3"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831352 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){8})" at REQUEST_COOKIES:sbjs_first. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1384"] [id "942420"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)"] [data "Matched Data: =typein|||src=(direct)| found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)|||plt=(none)|||fmt=(none)|||tct=(none)"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/3"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831302 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){8})" at REQUEST_COOKIES:sbjs_current. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1384"] [id "942420"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)"] [data "Matched Data: =typein|||src=(direct)| found within REQUEST_COOKIES:sbjs_current: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)|||plt=(none)|||fmt=(none)|||tct=(none)"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/3"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831227 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){8})" at REQUEST_COOKIES:sbjs_first_add. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1384"] [id "942420"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)"] [data "Matched Data: =2025-09-02 00:04:12||| found within REQUEST_COOKIES:sbjs_first_add: fd=2025-09-02 00:04:12|||ep=https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com|||rf=(none)"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/3"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
[Tue Sep 02 02:04:17.831109 2025] [:error] [pid 3862841:tid 3862843] [client 172.71.82.121:44854] [client 172.71.82.121] ModSecurity: Warning. Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){8})" at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1384"] [id "942420"] [msg "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)"] [data "Matched Data: =2025-09-02 00:04:12||| found within REQUEST_COOKIES:sbjs_current_add: fd=2025-09-02 00:04:12|||ep=https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com|||rf=(none)"] [severity "WARNING"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/3"] [hostname "bedrive.sws.net.pk"] [uri "/wp-content/uploads/2023/05/spa-girl-5.png"] [unique_id "aLY0gUYRr8i8nLke5Yyl5wAAAMA"], referer: https://bedrive.sws.net.pk/?foo=http%3A%2F%2Fwww.example.com
« Last Edit: Today at 12:39:55 AM by zeejdeej »
Logged
Offline
overseer
*****
Re: issues while switching from comodo waf to OWASP latest waf
« Reply #1 on: Today at 12:56:56 AM »
Comodo's WAF ruleset is dead -- it hasn't been updated in a year and a half. Try the OWASP Old style ruleset, but follow Starburst's guide here how to update Mod Security to the latest compatible version and the ruleset to the latest version:
https://starburst.help/control-web-panel-cwp/modsecurity-running-with-control-web-panel/update-modsecurity-to-2-9-12-running-cwp-and-apache-on-almalinux-9/
https://starburst.help/control-web-panel-cwp/modsecurity-running-with-control-web-panel/update-owasp-crs-ruleset-running-cwp-and-apache-on-almalinux-9/
(tested on AlmaLinux 8 and 9)
Logged
Offline
zeejdeej
*
Re: issues while switching from comodo waf to OWASP latest waf
« Reply #2 on: Today at 08:02:17 AM »
how can i use the OWASP Latest (latest version with automatic updates) option in CWP mod security? i enabled it and its detecting threats means its triggering WAF rules but only showing warning in log file not blocking threats ? how to set it up for blocking threats which its already detecting and can be seen as warning in log file.
Logged
Pages: [1]
« previous next »