ModSecurity: Instalasi Ubuntu 22.04 - Revision history

Unknown user: /* Testing SQL Injection */

2024-01-23T02:21:37Z

Testing SQL Injection

← Older revision		Revision as of 02:21, 23 January 2024
Line 229:		Line 229:
	Jika password root MySQL adalah 123456, maka isinya		Jika password root MySQL adalah 123456, maka isinya

			<!DOCTYPE html>
	<html>		<html>
	<body>		<body>

	<?php		<?php
	if(isset($_POST['login']))		if (isset($_POST['login'])) {
	{		$username = $_POST['username'];
	$username = $_POST['username'];		$password = $_POST['password'];
	$password = $_POST['password'];		$con = mysqli_connect('localhost', 'root', '123456', 'sample');
	$con = mysqli_connect('localhost','root','123456','sample');
	~~$result = mysqli_query~~($con~~, "SELECT * FROM `users` WHERE username='$username' AND password='$password'"~~);		if (!$con) {
	if(~~mysqli_num_rows($result) == 0)~~		die('Error connecting to the database');
	~~echo~~ '~~Invalid username or password';~~
	~~else~~
	~~echo 'Logged in - A Secret for you....~~';
	}		}
	else
	{		$result = mysqli_query($con, "SELECT * FROM `users` WHERE username='$username' AND password='$password'");

			if (mysqli_num_rows($result) == 0) {
			echo 'Invalid username or password';
			} else {
			echo 'Logged in - A Secret for you....';
			}

			mysqli_close($con);
			} else {
	?>		?>
	<form action="" method="post">
	Username: <input type="text" name="username"~~/><br~~ />		<form action="" method="post">
	Password: <input type="password" name="password"~~/><br~~ />		Username: <input type="text" name="username"/>
	<input type="submit" name="login" value="Login"/>		Password: <input type="password" name="password"/>
	</form>		<input type="submit" name="login" value="Login"/>
			</form>

	<?php		<?php
	}		}
	?>		?>

	</body>		</body>
	</html>		</html>

Unknown user: /* Verifikasi modsecurity */

2024-01-22T22:19:04Z

Verifikasi modsecurity

← Older revision		Revision as of 22:19, 22 January 2024
Line 141:		Line 141:

	==Verifikasi modsecurity==		==Verifikasi modsecurity==

			Lakukan ini di server yang kita install modsecurity.

	Ketik,		Ketik,

Unknown user: /* Install OWASP Core Rule Set */

2024-01-22T22:18:02Z

Install OWASP Core Rule Set

← Older revision		Revision as of 22:18, 22 January 2024
Line 138:		Line 138:
	apache2ctl -t		apache2ctl -t
	systemctl restart apache2		systemctl restart apache2
			systemctl status apache2

	==Verifikasi modsecurity==		==Verifikasi modsecurity==

Unknown user: /* Install OWASP Core Rule Set */

2024-01-22T22:17:03Z

Install OWASP Core Rule Set

← Older revision		Revision as of 22:17, 22 January 2024
Line 113:		Line 113:
	==Install OWASP Core Rule Set==		==Install OWASP Core Rule Set==

	Download		Download dan Install

	cd /usr/local/src		cd /usr/local/src
Line 119:		Line 119:

	tar xvf v3.3.5.tar.gz		tar xvf v3.3.5.tar.gz

	mkdir /etc/apache2/modsecurity-crs/		mkdir /etc/apache2/modsecurity-crs/
	mv coreruleset-3.3.5/ /etc/apache2/modsecurity-crs		mv coreruleset-3.3.5/ /etc/apache2/modsecurity-crs

	cd /etc/apache2/modsecurity-crs/coreruleset-3.3.5/		cd /etc/apache2/modsecurity-crs/coreruleset-3.3.5/
	mv crs-setup.conf.example crs-setup.conf		mv crs-setup.conf.example crs-setup.conf

Unknown user: /* Konfigurasi mod_security */

2024-01-22T22:10:31Z

Konfigurasi mod_security

← Older revision		Revision as of 22:10, 22 January 2024
Line 61:		Line 61:
	Agar modsecurity bereaksi saat terjadi serangan, kita dapat ubah dengan mengedit file modsecurity.conf:		Agar modsecurity bereaksi saat terjadi serangan, kita dapat ubah dengan mengedit file modsecurity.conf:

	~~nano~~ /etc/modsecurity/modsecurity.conf		vi /etc/modsecurity/modsecurity.conf

	Temukan kalimat ini		Temukan kalimat ini

Unknown user: /* Konfigurasi mod_security */

2024-01-22T22:09:41Z

Konfigurasi mod_security

← Older revision		Revision as of 22:09, 22 January 2024
Line 57:		Line 57:
	==Konfigurasi mod_security==		==Konfigurasi mod_security==

	~~Apa adanya~~, ModSecurity tidak melakukan apa-apa karena kebutuhan aturan untuk bekerja. File konfigurasi default diset ke DetectionOnly yang mencatat permintaan sesuai dengan aturan yang cocok dan tidak memblokir apa-apa. ~~Hal ini~~ dapat ~~diubah~~ dengan mengedit file modsecurity.conf:		Secara default, ModSecurity tidak melakukan apa-apa karena kebutuhan aturan untuk bekerja. File konfigurasi default diset ke DetectionOnly yang mencatat permintaan sesuai dengan aturan yang cocok dan tidak memblokir apa-apa.

			Agar modsecurity bereaksi saat terjadi serangan, kita dapat ubah dengan mengedit file modsecurity.conf:

	nano /etc/modsecurity/modsecurity.conf		nano /etc/modsecurity/modsecurity.conf

Unknown user: /* Install OWASP Core Rule Set */

2024-01-22T22:08:23Z

Install OWASP Core Rule Set

← Older revision		Revision as of 22:08, 22 January 2024
Line 126:		Line 126:
	Edit,		Edit,

	~~nano~~ /etc/apache2/mods-enabled/security2.conf		vi /etc/apache2/mods-enabled/security2.conf

	Tambahkan,		Tambahkan / Uncomment,

			IncludeOptional /etc/modsecurity/*.conf
	IncludeOptional /etc/apache2/modsecurity-crs/coreruleset-3.3.5/crs-setup.conf		IncludeOptional /etc/apache2/modsecurity-crs/coreruleset-3.3.5/crs-setup.conf
	IncludeOptional /etc/apache2/modsecurity-crs/coreruleset-3.3.5/rules/*.conf		IncludeOptional /etc/apache2/modsecurity-crs/coreruleset-3.3.5/rules/*.conf

Unknown user: /* Konfigurasi mod_security */

2024-01-22T22:07:42Z

Konfigurasi mod_security

← Older revision		Revision as of 22:07, 22 January 2024
Line 60:		Line 60:

	nano /etc/modsecurity/modsecurity.conf		nano /etc/modsecurity/modsecurity.conf

	~~Uncomment,~~

	~~IncludeOptional /etc/modsecurity/*.conf~~

	Temukan kalimat ini		Temukan kalimat ini

Unknown user: /* Instalasi mod_security */

2024-01-22T22:05:19Z

Instalasi mod_security

← Older revision		Revision as of 22:05, 22 January 2024
Line 33:		Line 33:

	sudo su		sudo su
	apt -y install libapache2-mod-security2 modsecurity-crs		sudo apt -y install libapache2-mod-security2 modsecurity-crs

	Periksa apakah modul mod_security dimuat.		Periksa apakah modul mod_security dimuat.

Unknown user: /* Kebutuhan */

2024-01-22T22:04:50Z

Kebutuhan

← Older revision		Revision as of 22:04, 22 January 2024
Line 22:		Line 22:

	sudo apt -y install apache2 php php-xmlrpc php-mysql php-gd php-cli \		sudo apt -y install apache2 php php-xmlrpc php-mysql php-gd php-cli \
	php-curl ~~mysql-client~~ php-mysql php-mbstring \		php-curl php-mysql php-mbstring php-xdebug libapache2-mod-php
	php-xdebug libapache2-mod-php

	Install mariadb kadang masalah di dependency jadi agak2 susah,		Install mariadb kadang masalah di dependency jadi agak2 susah,

	sudo apt -y install mariadb-server		sudo apt -y install mariadb-server mariadb-client

	==Instalasi mod_security==		==Instalasi mod_security==