ModSecurity VS wpscan

First of all, if you have any experience with Traefik, I'd suggest you to do the reverse proxy stuff with it and install the Crowdsec instance along it. As I didn't have experience using Traefik I went with NPM but now I guess it would have been easier considering the research I had to do... Another reason is, I wanted to implement a geo block and/or another security layer by using ModSecurity (https://github.com/SpiderLabs/ModSecurity ) besides Crowdsec too. Afaik Traefik has a plugin that integrates ModSecurity easily - unless NPM.

I don't know about Blackboard, but Moodle will allow quizzes to be run in popups that block most extensions from working; lockdown browsers will block such extensions; and, if you have access to the server, a modified firewall (e.g., ModSecurity) may\* allow blocking this and similar extensions.

> ModSecurity for WAF: https://github.com/SpiderLabs/ModSecurity

This might be of interest to some: https://www.modsecurity.org/

> Trustwave is announcing the End-of-Life (EOL) of our support for ModSecurity effective July 1, 2024. We will then hand over the maintenance of ModSecurity code back to the open-source community.

Probably not too big of a deal, though.

Also, this might be useful: https://owasp.org/www-project-modsecurity-core-rule-set/

Though there has been some critique of ModSecurity and that ruleset in the past, as something dated and with false positives.

Anyone have any good alternatives?

Is there a reason no one hasn't made a Docker template for OWASP Coraza (https://github.com/corazawaf/coraza) or ModSecurity (https://github.com/SpiderLabs/ModSecurity) for the use of a reverse proxy?

Since Nginx has different use cases, protecting your application depends on how and where you use it. It's recommended that you have a reliable WAF solution since they block most harmful requests in the first place. In this article, you'll compare three tools—ModSecurity, F5 Nginx App Protect, and open-appsec—based on their active development, advanced security features, and open source commitment to help you figure out which tool is right for you.

I'm currently erring toward ModSecurity & the Nginx connector now that it's been de-Apache'd.

Is anyone on HN doing WordPress administration? I recently 'inherited' a webshop built on WP/WooCommerce, and all the conflicting security advice in the WP space is making my head spin.

There are a dozen competing 'security' plugins, with some saying 'you don't need any of them, WP is secure enough by default', and others saying 'you actually need ModSecurity [1] / Jeff Starr's nG firewall [2]'.

The agency that (shoddily...) built the webshop installed Wordfence Free [3], so I've just kept that for now, though I feel it's kind of slow (but that might just be caused by the bottom-of-barrel performance of the shared webhost it's currently running on).

[1] https://github.com/SpiderLabs/ModSecurity

[2] https://perishablepress.com/7g-firewall/

[3] https://www.wordfence.com/

By Web Firewall did you mean smth like this ?

Or you could just run WPScan, a simple open source CLI Wordpress pen testing tool which will scan for 30k+ known WP vulnerabilities. It certainly isn't as comprehensive as hiring a Red Team to attack the site but it can provide baseline assurance that no gaping holes exist in your security config, This should be part of your security hardening workflow if is isnt already.

source: https://wpscan.com/wordpress-security-scanner

Finally, you can use a service like WPScan to fix WordPress issues by scanning your website for plugins and themes that have known security vulnerabilities.

WP is fun but likely has to be running older versions to exploit it, check out and run WPScan against it, https://github.com/wpscanteam/wpscan

You could also run your own scan. There are tools for it. For example, https://github.com/wpscanteam/wpscan

After our initial port scan, we might do more scans depending on what we find. In order to be as effective as possible, and to gather as much information as possible, pentesters are often running multiple scans simultaneously on a target. There are hundreds of tools out there for every service imaginable. Some of the tools worth mentioning are wpscan (https://wpscan.com/wordpress-security-scanner) for Wordpress sites or sqlmap (https://sqlmap.org/) for automatic SQL injection. For a more extensive list of tools check out https://0xcybery.github.io/ehtk/ or https://github.com/enaqx/awesome-pentest

So the website is using Wordpress. Having said that, we are going to use WPScan. But before that, make sure that you have already acquired your API token before using WPScan or you will never be able to utilize the scanner. You can get your own API token by signing up on their website.