Next: 實機操作練習題 Up: SQL Injection 注入 Previous: 限制輸入字元 Contents DYWANG_HOME
mod_security 是 Apache 的一個模組，可以提供入侵偵測及防禦，如同 web 應用程式的防火牆，用來抵擋如 SQL injection attacks, cross-site scripting, path traversal attacks。
mod_security 模組時，injection.php 存在 sql injection 漏洞。
[root@kvm3 html]# curl -s http://kvm3/injection.php?"user='a'%20or%201" | sed 's/<br> */\n/g' HOST: 192.168.122.1 User: hosttest -------------------------------- HOST: localhost User: dywang -------------------------------- HOST: localhost User: mariadb.sys -------------------------------- HOST: localhost User: mysql -------------------------------- HOST: localhost User: root -------------------------------- Fetched data successfully
mod_security 模組在 epel-release 套件庫，必須先安裝 epel-release 套件以設定 epel-release 套件庫位置。
[root@kvm3 html]# dnf reinstall almalinux-repos-10.0-30.el10.x86_64 [root@kvm3 html]# dnf install epel-release-10-6.el10.noarch
mod_security 模組。
[root@kvm3 html]# dnf install mod_security Last metadata expiration check: 0:09:50 ago on Mon 22 Dec 2025 10:26:53 AM CST. Dependencies resolved. ================================================================================ Package Architecture Version Repository Size ================================================================================ Installing: mod_security x86_64 2.9.9-1.el10_1 epel 253 k Transaction Summary ================================================================================ Install 1 Package Total download size: 253 k Installed size: 796 k Is this ok [y/N]: y Downloading Packages: mod_security-2.9.9-1.el10_1.x86_64.rpm 618 kB/s | 253 kB 00:00 -------------------------------------------------------------------------------- Total 190 kB/s | 253 kB 00:01 Extra Packages for Enterprise Linux 10 - x86_64 1.6 MB/s | 1.6 kB 00:00 Importing GPG key 0xE37ED158: Userid : "Fedora (epel10) <epel@fedoraproject.org>" Fingerprint: 7D8D 15CB FC4E 6268 8591 FB26 33D9 8517 E37E D158 From : /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-10 Is this ok [y/N]: y Key imported successfully Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : mod_security-2.9.9-1.el10_1.x86_64 1/1 Running scriptlet: mod_security-2.9.9-1.el10_1.x86_64 1/1 Installed: mod_security-2.9.9-1.el10_1.x86_64 Complete!
mod_security 模組訊息，版本是 2.9.9。
Last metadata expiration check: 0:10:56 ago on Mon 22 Dec 2025 10:26:53 AM CST.
Installed Packages
Name : mod_security
Version : 2.9.9
Release : 1.el10_1
Architecture : x86_64
Size : 796 k
Source : mod_security-2.9.9-1.el10_1.src.rpm
Repository : @System
From repo : epel
Summary : Security module for the Apache HTTP Server
URL : http://www.modsecurity.org/
License : Apache-2.0
Description : ModSecurity is an open source intrusion detection and prevention
: engine for web applications. It operates embedded into the web
: server, acting as a powerful umbrella - shielding web
: applications from attacks.
mod_security 模組，rpm 安裝的檔案。
[root@kvm3 html]# rpm -ql mod_security /etc/httpd/conf.d/mod_security.conf /etc/httpd/conf.modules.d/10-mod_security.conf /etc/httpd/modsecurity.d /etc/httpd/modsecurity.d/activated_rules /etc/httpd/modsecurity.d/local_rules /etc/httpd/modsecurity.d/local_rules/modsecurity_localrules.conf /usr/lib/.build-id /usr/lib/.build-id/4e /usr/lib/.build-id/4e/390a4f48974f4a3c6e2756229bab26df66795a /usr/lib64/httpd/modules/mod_security2.so /usr/share/doc/mod_security /usr/share/doc/mod_security/CHANGES /usr/share/doc/mod_security/LICENSE /usr/share/doc/mod_security/NOTICE /usr/share/doc/mod_security/README.md /var/lib/mod_security
[root@kvm3 html]# dnf install git [root@kvm3 hrml]# dnf install git Last metadata expiration check: 0:12:08 ago on Mon 22 Dec 2025 10:26:53 AM CST. Dependencies resolved. ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: git x86_64 2.47.3-1.el10_0 appstream 50 k Installing dependencies: git-core x86_64 2.47.3-1.el10_0 appstream 4.8 M git-core-doc noarch 2.47.3-1.el10_0 appstream 2.8 M perl-Error noarch 1:0.17029-18.el10 appstream 45 k perl-File-Find noarch 1.44-512.2.el10_0 appstream 25 k perl-Git noarch 2.47.3-1.el10_0 appstream 37 k perl-TermReadKey x86_64 2.38-24.el10 appstream 35 k perl-lib x86_64 0.65-512.2.el10_0 appstream 15 k Transaction Summary ================================================================================ Install 8 Packages Total download size: 7.8 M Installed size: 37 M Is this ok [y/N]: y Downloading Packages: (1/8): git-2.47.3-1.el10_0.x86_64.rpm 733 kB/s | 50 kB 00:00 (2/8): perl-Error-0.17029-18.el10.noarch.rpm 1.1 MB/s | 45 kB 00:00 (3/8): perl-File-Find-1.44-512.2.el10_0.noarch. 867 kB/s | 25 kB 00:00 (4/8): perl-Git-2.47.3-1.el10_0.noarch.rpm 826 kB/s | 37 kB 00:00 (5/8): perl-TermReadKey-2.38-24.el10.x86_64.rpm 1.2 MB/s | 35 kB 00:00 (6/8): perl-lib-0.65-512.2.el10_0.x86_64.rpm 692 kB/s | 15 kB 00:00 (7/8): git-core-2.47.3-1.el10_0.x86_64.rpm 13 MB/s | 4.8 MB 00:00 (8/8): git-core-doc-2.47.3-1.el10_0.noarch.rpm 7.2 MB/s | 2.8 MB 00:00 -------------------------------------------------------------------------------- Total 6.3 MB/s | 7.8 MB 00:01 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : git-core-2.47.3-1.el10_0.x86_64 1/8 Installing : git-core-doc-2.47.3-1.el10_0.noarch 2/8 Installing : perl-lib-0.65-512.2.el10_0.x86_64 3/8 Installing : perl-TermReadKey-2.38-24.el10.x86_64 4/8 Installing : perl-File-Find-1.44-512.2.el10_0.noarch 5/8 Installing : perl-Error-1:0.17029-18.el10.noarch 6/8 Installing : perl-Git-2.47.3-1.el10_0.noarch 7/8 Installing : git-2.47.3-1.el10_0.x86_64 8/8 Running scriptlet: git-2.47.3-1.el10_0.x86_64 8/8 Installed: git-2.47.3-1.el10_0.x86_64 git-core-2.47.3-1.el10_0.x86_64 git-core-doc-2.47.3-1.el10_0.noarch perl-Error-1:0.17029-18.el10.noarch perl-File-Find-1.44-512.2.el10_0.noarch perl-Git-2.47.3-1.el10_0.noarch perl-TermReadKey-2.38-24.el10.x86_64 perl-lib-0.65-512.2.el10_0.x86_64 Complete!
[root@kvm3 html]# cd /usr/src/ [root@kvm3 src]# git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git Cloning into 'owasp-modsecurity-crs'... remote: Enumerating objects: 10486, done. remote: Total 10486 (delta 0), reused 0 (delta 0), pack-reused 10486 (from 1) Receiving objects: 100% (10486/10486), 3.33 MiB | 5.93 MiB/s, done. Resolving deltas: 100% (7687/7687), done.
[root@kvm3 src]# cd owasp-modsecurity-crs/ [root@kvm3 owasp-modsecurity-crs]# cp crs-setup.conf.example \ /etc/httpd/conf.d/crs-setup.conf
[root@kvm3 owasp-modsecurity-crs]# cp -a rules /etc/httpd/modsecurity.d/
/etc/httpd/conf.d/mod_security.conf，將規則目錄 modsecurity.d/rules/ 中的所 *.conf 規則檔加入模組。
[root@kvm3 owasp-modsecurity-crs]# vi /etc/httpd/conf.d/mod_security.conf [root@kvm3 owasp-modsecurity-crs]# grep rules /etc/httpd/conf.d/mod_security.conf IncludeOptional modsecurity.d/activated_rules/*.conf IncludeOptional modsecurity.d/local_rules/*.conf IncludeOptional modsecurity.d/rules/*.conf ### 增加這一行 ####
[root@kvm3 owasp-modsecurity-crs]# restorecon -rv /etc/httpd/modsecurity.d/ Relabeled /etc/httpd/modsecurity.d/rules from unconfined_u:object_r:usr_t:s0 to unconfined_u:object_r:httpd_config_t:s0 Relabeled /etc/httpd/modsecurity.d/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf from unconfined_u:object_r:usr_t:s0 to unconfined_u:object_r:httpd_config_t:s0 ..................................................................
[root@kvm3 owasp-modsecurity-crs]# systemctl restart httpd.service
[root@kvm3 owasp-modsecurity-crs]# curl http://kvm3/injection.php?"user='a'%20or%201" <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> </body></html>