Ubuntu (Mod Security)

// You Commands / Content is below all this junk, but you should read this junk if you support me! <3

// Codexual @ NuLLocK.com
// YouTube.com/Codexual
// Twitter.com/Codexual
// Facebook.com/Codexual
// Instagram.com/Codexual
// Snapchat.com/add/Codexual
// Twitch.tv/Codexual
// Mixer.com/Codexual
//
// Gaming
// https://steamcommunity.com/id/Codexual
// Xbox - Codexual
// PS4 - Codexual
//
// Hey Viewer, I would like to thank you. Speaking of being thankful, if you truly support my work, or just wanna be a good sport. // All I all of you is to follow me on my social media, like my content on all social media if you see me post something, and share // my content when you see me post something. Everything does help out, thank you again!
//
// Every Saturday I do a Q/A video, so if you have a question you may ask me at http://nullock.com/askme - Look for the Q/A video on
// my YouTube Channel! (:

sudo apt-get update
sudo apt-get install libapache2-mod-security2 -y
//sudo apachectl -M | grep --color security2
sudo mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
sudo service apache2 reload

//Config Mod_Security
sudo sed -i "s/SecRuleEngine DetectionOnly/SecRuleEngine On/" /etc/modsecurity/modsecurity.conf
sudo sed -i "s/SecResponseBodyAccess On/SecResponseBodyAccess Off/" /etc/modsecurity/modsecurity.conf
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072

//Testing an SQL Injection
mysql -u root -p
>    create database sample;
>    connect sample;

>    create table users(username VARCHAR(100),password VARCHAR(100));
>    insert into users values('sammy','password');
>   quit;

sudo nano /var/www/html/login.php

' or true --

//Enable CRS
sudo nano /etc/apache2/mods-enabled/security2.conf

        IncludeOptional "/usr/share/modsecurity-crs/*.conf"
        IncludeOptional "/usr/share/modsecurity-crs/activated_rules/*.conf"


cd /usr/share/modsecurity-crs/activated_rules/
sudo ln -s ../base_rules/modsecurity_crs_41_sql_injection_attacks.conf .
sudo service apache2 reload
sudo rm /var/www/html/login.php

//Writing Your Own Rules
sudo nano /var/www/html/form.php

sudo nano /etc/modsecurity/modsecurity_custom_rules.conf

SecRule REQUEST_FILENAME "form.php" "id:'400001',chain,deny,log,msg:'Spam detected'"
SecRule REQUEST_METHOD "POST" chain
SecRule REQUEST_BODY "@rx (?i:(blockedword1|blockedword2))"

sudo service apache2 reload

sudo rm /var/www/html/form.php