# WEB_Basic-Фадеев_Александр-Практика-4

### Установка nginx и Modsecurity на ubuntu

Install one of the following PPA’s with the following command:

install Nginx with the following:

Add Nginx Source Code to Repository


Download Nginx Source


Install libmodsecurity3 for ModSecurity

Clone ModSecurity Repsoitory from Github

Install libmodsecurity3 Dependencies



Building the ModSecurity Environment


Compiling the ModSecurity Source Code

make -j 1

Install ModSecurity-nginx Connector


Load and Configure ModSecurity-nginx Connector with Nginx

add the line to the file near the top

Now add the following code under the HTTP {} section as follows:

modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/modsec-config.conf;

Create and Configure Directory and Files for ModSecurity


Change the line to this to enable ModSecurity:
SecRuleEngine DetectionOnly -> SecRuleEngine On


we need to change the line 224
`SecAuditLogParts ABCEFHJKZ`(this is correct version)




Install OWASP Core Rule Set for ModSecurity









### Провести 3 атаки из списка OWASP top 10 и продемонстрировать работоспособность WAF (должны быть сработки правил WAF)

- XSS



- path traversal


- CSRF