Demo code for the talk Hands-On ModSecurity and Logging. This is insecure and generally bad code only use it for demos and education on what not to do.
' or true --and a random password to skip the login form.
sqlmap --url "https://xeraa.wtf/read.php?id=1" --purge. This assumes you have installed sqlmap (for example with Homebrew), otherwise download and run it with
;INSERT INTO employees (name) VALUES ('Bad Actor')to https://xeraa.wtf/read.php?id=1.
;INSERT INTO employees (name) VALUES ('<script>alert("Hello Friend")</script>')will add more fun to the demo.
application : "app".
DROPdata for example with
;DROP TABLE employees, which doesn't work since our connection only allows
sqlmap --url "https://xeraa.wtf:8080/read.php?id=1" --purge, which results in
403 (Forbidden) - 134 times.
application : "mod_security"and point out that JSON logging is the important configuration here as well as the
Shay Banonor just
Shayand show the log message.
'(Or)1=1()still allows you to skip the login form.
Make sure you have run this before the demo.
AWS_SECRET_ACCESS_KEY. Protip: Use https://awesomeopensource.com/project/sorah/envchain to keep your environment variables safe.
elastic_versionand set the environment variables with the values for
ELASTICSEARCH_PASSWORD, as well as
TF_VAR_zone_id. If you haven't created the Hosted Zone yet, you should set it up in the AWS Console first and then set the environment variable.
terraform initfirst. Then create the keypair, DNS settings, and instances with
ansible-playbook configure.ymland then deploy with
When you are done, remove the instances, DNS settings, and key with