Archive | Webservers

Block XSS on Apache or Nginx

By admin on April 16, 2015 in Apache, Nginx

Here are some handy Apache rewrite rules for blocking cross site scripting (XSS) attacks:

RewriteCond %{REQUEST_URI} base64_encode.*\(.*\) [OR]
RewriteCond %{REQUEST_URI} (\<|<).*script.*(\>|>) [NC,OR]
RewriteCond %{REQUEST_URI} (\<|<).*iframe.*(\>|>) [NC,OR]
RewriteCond %{REQUEST_URI} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{REQUEST_URI} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ 404.php [F,L]

RewriteCond %{REQUEST_URI} base64_encode.*$.*$ [OR]

RewriteCond %{REQUEST_URI} (\<|<).*script.*(\>|>) [NC,OR]

RewriteCond %{REQUEST_URI} (\<|<).*iframe.*(\>|>) [NC,OR]

RewriteCond %{REQUEST_URI} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

RewriteCond %{REQUEST_URI} _REQUEST(=|\[|\%[0-9A-Z]{0,2})

RewriteRule ^(.*)$ 404.php [F,L]

And here are similar rules for Nginx:

set $block_xss 0;
if ($query_string ~ "base64_(en|de)code\(.*\)") {
	set $block_xss 1;
}
if ($request_uri ~ "base64_(en|de)code\(.*\)") {
	set $block_xss 1;
}
if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
	set $block_xss 1;
}
if ($request_uri ~ "(<|%3C).*script.*(>|%3E)") {
	set $block_xss 1;
}
if ($query_string ~ "(<|%3C).*iframe.*(>|%3E)") {
	set $block_xss 1;
}
if ($request_uri ~ "(<|%3C).*iframe.*(>|%3E)") {
	set $block_xss 1;
}
if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
        set $block_xss 1;
}
if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
        set $block_xss 1;
}
if ($block_xss = 1) {
	return 403;
}

set $block_xss 0;

if ($query_string ~ "base64_(en|de)code$.*$") {

set $block_xss 1;

}

if ($request_uri ~ "base64_(en|de)code$.*$") {

set $block_xss 1;

}

if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {

set $block_xss 1;

}

if ($request_uri ~ "(<|%3C).*script.*(>|%3E)") {

set $block_xss 1;

}

if ($query_string ~ "(<|%3C).*iframe.*(>|%3E)") {

set $block_xss 1;

}

if ($request_uri ~ "(<|%3C).*iframe.*(>|%3E)") {

set $block_xss 1;

}

if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {

set $block_xss 1;

}

if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {

set $block_xss 1;

}

if ($block_xss = 1) {

return 403;

}

We gathered these rules from several sources around the net so they are not original but it’s handy to have them all in one place with both the Apache and Nginx versions.

Apache2 With mod_fcgid On CentOS 6.2

By admin on March 23, 2015 in Apache, PHP

Need mod_fcgid on a CentOS 6.2 or similar server? Check out this great how-to:

https://www.howtoforge.com/how-to-set-up-apache2-with-mod_fcgid-and-php5-on-centos-6.2

I especially like the use of suexec.

This howto worked on the first try! There are not many actual working mod_fcgid howtos!

One issue that I did run into is the default MaxRequestLen is 131768 which is way to low so had to add this line:

FcgidMaxRequestLen 20971520

1	FcgidMaxRequestLen 20971520

to /etc/httpd/conf.d/fcgid.conf.

Disable PHP zlib.output_compression

By admin on January 25, 2015 in Apache, PHP

If you need to disable zlib output compression from the .htaccess file, then just add the following line to the top of the file:

php_flag zlib.output_compression off

1	php_flag zlib.output_compression off

Redirect HTTP to HTTPS on IIS

By admin on July 9, 2014 in IIS

If you need to force HTTPS on the entire site then add the following to the web.config file:

<rewrite>
 <rules>
  <rule name="HTTP to HTTPS redirect" stopProcessing="true">
  <match url="[SOURCE]$" />
  <conditions>
   <add input="{HTTPS}" pattern="off" ignoreCase="true" />
  </conditions>
  <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/[DESTINATION]" />
  </rule>
 </rules>
</rewrite>

<rules>

</conditions>

</rule>

</rules>

</rewrite>

If you want to force HTTPS on a specific URL, then use this instead:

<rewrite>
 <rules>
  <rule name="HTTP to HTTPS redirect" stopProcessing="true">
   <match url="(.*)" />
   <conditions>
    <add input="{HTTPS}" pattern="off" ignoreCase="true" />
   </conditions>
   <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" />
  </rule>
 </rules>
</rewrite>

<rules>

</conditions>

</rule>

</rules>

</rewrite>

Redirect HTTPS to HTTP

By admin on June 26, 2014 in Apache

If you want to redirect all HTTPS traffic to HTTP then add the following to your .htaccess file:

RewriteCond %{SERVER_PORT} ^443$ [OR]
RewriteCond %{HTTPS} =on
RewriteRule ^(.*)$ http://%{SERVER_NAME}/$1 [R=301,L]

RewriteCond %{SERVER_PORT} ^443$ [OR]

RewriteCond %{HTTPS} =on

RewriteRule ^(.*)$ http://%{SERVER_NAME}/$1 [R=301,L]

← Previous 1 … 4 5 6 … 23 Next →

Top Nav

Navigation

Archive | Webservers

Block XSS on Apache or Nginx

Apache2 With mod_fcgid On CentOS 6.2

Disable PHP zlib.output_compression

Redirect HTTP to HTTPS on IIS

Redirect HTTPS to HTTP