Define Custom Rule to allow traffic based on queryString value

priya natarajan 0
Viewed 18

In nginx, I have few owasp rules disabled for my ingress as below

Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf SecRuleEngine On SecRuleRemoveById 920210 920230 920420 920440 920350 930120 930100 930110 941331 941130 941150 941160 941340 942370 942360 942330 942340 942260 942200 942120 942110 942430 942190 942380 942440 932100 931130

I would now want to allow a traffic if the queryString contains a value - say 'qwerty'. How do i achieve this .

nginx-ingress
1 Answers

If you want to create some kind of a firewall bypass (for example for testing purposes), you can use a rule similar to this:

SecRule ARGS_GET:password "@streq secret_password" \
    "id:100,\
    phase:1,\
    pass,\
    t:none,\
    msg:'Bypassing firewall for %{REMOTE_ADDR}',\
    ctl:ruleEngine=Off"

Replace secret_password with your password and use like

https://example.com/?a=/etc/passwd&password=secret_password
azurit0
Related