Senior LevelWeb Security & Cyber Defense
How do you write custom ModSecurity / Coraza WAF rules using SecRule syntax?
❓ Interview Prompt: Explain ModSecurity / Coraza WAF rule engine, `SecRule` syntax, variables (`ARGS`, `REQUEST_HEADERS`), operators (`@rx`), and actions (`deny`, `status:403`).
Writing custom Web Application Firewall rules using ModSecurity / Coraza 'SecRule' syntax to block zero-day attack vectors:
SecRule Anatomy:
'SecRule VARIABLES "OPERATOR" "ACTIONS"'
•
Variables: 'REQUEST_URI', 'ARGS:search', 'REQUEST_HEADERS:User-Agent'.
•
Operators: '@rx' (regular expression), '@pm' (phrase match), '@eq' (numeric equality).
•
Actions: 'deny, status:403, log, id:100001, msg:'Custom Attack Blocked''.
Code Implementation Example
json
# ModSecurity SecRule Syntax Example:
# SecRule ARGS:user "@rx (?i)<script[^>]*>" "id:100001,phase:2,deny,status:403,log,msg:'Custom XSS Rule Triggered'"💡Custom ModSecurity WAF rule inspecting request arguments for XSS script tags.
🎯 Interview Key Takeaway
Write custom ModSecurity/Coraza WAF rules to block zero-day exploits before application patches are deployed.
#ModSecurity#WAF Rules#Coraza#Senior
Back to all Web Security & Cyber Defense Questions→