Hands-On ModSecurity and Logging
summary
A deliberately vulnerable PHP app accepts raw IDs and an automated SQLMap automated injection proves a blind and UNION injection, then an Apache instance with ModSecurity returns 403 134 times while the same code on nginx is exploitable. Logs ship with Filebeat multiline pattern into Elasticsearch, parsed by the Elasticsearch ingest node geoip pipeline, visualized in Kibana, and used to spot injected SQL, tail live events, and decide which ModSecurity rules to tune before enabling blocking.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:43Why WTF
- 4:42Basic Problem
- 8:31Elastic Data Store
- 10:54Log Stash
- 13:57File Bit
- 18:21Filebits
- 18:59Dashboard
- 23:07Data Extraction
- 24:20ModSecurity
- 27:27ModSecurity Logging
- 31:52Custom Rules
- 33:42Rights Rules
- 35:17Wrapup
- 37:04Questions
- 38:27Passing the rules
- 43:42Alerting
related talks
35mHands-On ModSecurity and Logging
22mSecure Your Code — Injections and Logging
22mIntegrating Security Measures Throughout Development
55mWeb Application Security: Winning When The Odds Are Against You
40mHow to hack a node app?
43mTop Security Flaws Hiding in Your Code Right Now – and How to Fix Them
35mPHP is evil (Defensive programming)
30mHow to hack a web app?