Saturday, May 09, 2026 AM03:21:24 HKT

2026-05-09 03:21:32 +08:00
commit 41f17b127c
884 changed files with 263824 additions and 0 deletions
@@ -0,0 +1,147 @@
+# Basic Setup
+
+
+### Architecture of naxsi configuration
+
+  * **http {}** level : `include naxsi_core.rules`
+  * **server {}** level : 
+    * [Dynamic modifiers](runtime-modifiers.md)
+  * **location {}** level :
+    * [Enabled/Disabled directives](directives.md#secrulesenabled)
+    * [LearningMode-related directives](directives.md#learningmode)
+    * [Whitelists](whitelists-bnf.md)
+    * [CheckRules](checkrules-bnf.md)
+    * [RequestDenied](requestdenied-bnf.md)
+  * **location /RequestDenied**
+    * return HTTP error code, post-processing ...
+
+
+### Example configuration
+
+```
+#Only for nginx's version with modular support
+load_module /../modules/ngx_http_naxsi_module.so;
+events {
+ ...
+}
+http {
+ include /tmp/naxsi_ut/naxsi_core.rules;
+ ...
+ server {
+  listen ...;
+  server_name  ...;
+  location / {
+   #Enable naxsi
+   SecRulesEnabled;
+   #Enable learning mode
+   LearningMode;
+   #Define where blocked requests go
+   DeniedUrl "/50x.html"; 
+   #CheckRules, determining when naxsi needs to take action
+   CheckRule "$SQL >= 8" BLOCK;
+   CheckRule "$RFI >= 8" BLOCK;
+   CheckRule "$TRAVERSAL >= 4" BLOCK;
+   CheckRule "$EVADE >= 4" BLOCK;
+   CheckRule "$XSS >= 8" BLOCK;
+   #naxsi logs goes there
+   error_log /.../foo.log;
+   ...
+  }
+  error_page   500 502 503 504  /50x.html;
+  #This is where the blocked requests are going
+  location = /50x.html {
+  return 418; #I'm a teapot \o/
+  }
+ }
+}
+```
+
+### Next steps
+
+The next step is learning; however, before jumping there, ensure that you have:
+ * A nginx as a webserver or reverse proxy
+ * Naxsi installed and running in learning mode
+ * If you perform a request such as `curl 'http://127.0.0.1:4242/?a=<>'`, you should see a [NAXSI_FMT](naxsilogs.md#naxsi_fmt) in your logs :
+   `2016/07/12 13:27:04 [error] 14492#0: *1 NAXSI_FMT: ip=127.0.0.1&server=127.0.0.1&uri=/&learning=1&vers=0.55rc2&total_processed=1&total_blocked=1&block=1&cscore0=$XSS&score0=16&zone0=ARGS&id0=1302&var_name0=a&zone1=ARGS&id1=1303&var_name1=a, client: 127.0.0.1, server: localhost, request: "GET /?a=<> HTTP/1.1", host: "127.0.0.1:4242"`
+
+
+### Learning, log-injection, ElasticSearch, Kibana
+
+The ElasticSearch/Kibana part is optional but provides a great comfort and way to visualize "what's going on".
+
+![Global Workflow](Images/naxsi-workflow.png)
+
+
+### Components
+
+Nxtool setup can be found here:
+(_tl;dr: python setup.py install, or `./nxtool.py -c nxapi.json -x`_)
+  * [nxapi documentation](https://github.com/nbs-system/naxsi/tree/master/nxapi#prequisites)
+
+Kibana (v4 as of this writing) can be downloaded here:
+ * [kibana website](https://www.elastic.co/downloads/kibana)
+
+Once those two components are setup, you should be able to inject naxsi logs into ElasticSearch with NxTool.
+Here is an example of what it might look like in production:
+
+![Kibana Dashboard](Images/kibana.png)
+
+
+
+### Configuration - NXTOOL
+
+As stated in dedicated documentation, nxtool comes with a `json` file specifying ES location, index etc.
+
+```
+"elastic" : {
+ "host" : "127.0.0.1:9200",
+ "index" : "nxapi",
+ "doctype" : "events",
+ "default_ttl" : "7200",
+ "max_size" : "1000",
+ "version" : "2"
+},
+```
+
+Once configured and running on the same host as nginx, you can start injecting logs into ES:
+
+`nxtool.py --fifo /tmp/naxsi_pipe --no-timeout`
+_(here, nginx is being told to write logs to /tmp/naxsi_pipe which is a FIFO created by nxtool)_
+
+### Configuration - Kibana
+
+Now, you should be able to configure Kibana to setup a dashboard to visualize your naxsi data.
+
+This step is left as an exercise for the reader, see 
+[Creating Kibana Dashboard](https://www.elastic.co/guide/en/kibana/current/dashboard.html).
+
+
+
+### Configuration - DataDog
+
+Golden Setup 
+
+Blacklisting = mod_security
+
+WAF = naxsi
+
+https://gist.github.com/marcinguy/3a106991d3a84995efacc473f8db21a9
+
+You can get logs to DataDog very easily using this Grok rule:
+
+Grok Parser rule
+```
+myParsingrule %{date("yyyy/MM/dd HH:mm:ss"):connect_date} \[%{word:status}\] %{number:id}\#%{number:id2}: \*%{number:value} %{data::json}
+```
+
+Then you will see a nice Dashboard of Attacks
+
+[[https://user-images.githubusercontent.com/20355405/90318948-4c52a700-df34-11ea-8521-259551b5322e.png]]
+
+You can also send alerts to Slack:
+
+[[https://user-images.githubusercontent.com/20355405/92943641-52fd0d00-f453-11ea-99ee-411d9ea33105.png]]
+
+You just built an Open Source WAF solution with Alerts and Dashboard.
+
+