Hands-On ModSecurity and Logging
summary
A live demo shows a deliberately vulnerable PHP shop that is exploited with sqlmap to add fake employees, logs full SQL queries to a file, and centralizes those logs with Elastic Stack for central logging (Filebeat → Elasticsearch → Kibana). A side-by-side Apache instance runs ModSecurity blocks SQLi patterns in blocking mode and successfully returns HTTP 403 for injections. Packetbeat is used for network-level visibility as Packetbeat for network visibility. All components are deployed via Ansible and work end-to-end.
AI-written summary · about
chapters (4)
related talks
50mHands-On ModSecurity and Logging
22mSecure Your Code — Injections and Logging
22mIntegrating Security Measures Throughout Development
45mAdvanced Security Operations with Elastic Security
44mMonitor Your PHP Applications with Logs, Metrics, Pings, and Traces
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
31mWeb Application Honeypot Threat Intelligence