[WEB SECURITY] Announcement - ModSecurity Core Rule Set Demo Testing Page

[Ryan Barnett <rcbarnett@xxxxxxxxx>]

Greetings everyone,
It is my pleasure to announce that we have *finally* (reference this previous 
email thread from earlier this year - 
http://www.webappsec.org/lists/websecurity/archive/2009-02/msg00021.html) 
gotten an demo/smoketest page up and running to test out ModSecurity and the 
OWASP Core Rule Set (CRS).  Here is the link -

http://www.modsecurity.org/demo/

What I think is really cool about the demo page is that it is actually a joint 
effort between the ModSecurity and PHPIDS teams (special thanks to Mario).  
What we have done is setup our demo page so that the community can send attack 
payloads to our CRS install on the modsecurity site.  Our rules then inspect 
the payloads and then we proxy the live traffic to the outstanding phpids 
smoketest page here - http://demo.php-ids.org/.  We then inspect the response 
data from phpids and present the user with information related to if/when/how 
ModSecurity + CRS/PHPIDS identified malicious payloads.  So, if you come to our 
demo page you get a "2 for 1 deal" of testing out both CRS and PHPIDS :)

If anyone finds any evasion issues, we have provided links to our JIRA 
ticketing system or optionally they can notify us on the owasp modsecurity 
core rule set mail-list - https://lists.owasp.org/mailman/listinfo/owasp-
modsecurity-core-rule-set

There is already a thread started over at sla.ckers - 
http://sla.ckers.org/forum/read.php?12,32282.  Looks like both David and 
Gareth are off and running... :)

We hope that this will help us to make ModSecurity and the CRS a much more 
valuable tool for the community.

Cheers.

--
Ryan C. Barnett
WASC Distributed Open Proxy Honeypot Project Leader
OWASP ModSecurity Core Rule Set Project Leader
Tactical Web Application Security
http://tacticalwebappsec.blogspot.com


----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA