text:
Difference between revisions of "Category:OWASP ModSecurity Core Rule Set Project"
(→Roadmap Items)
|Line 1,409:
|Line 1,409:
C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
== v3.0 ==
== v3.0 ==
This page documents the goals/ideas for the next major version of the CRS.
This page documents the goals/ideas for the next major version of the CRS.
Revision as of 17:53, 27 November 2012
| This project is part of the OWASP Defenders community.
Feel free to browse other projects within the Defenders, Builders, and Breakers communities.
- Home
- Download
- Bug Tracker
- Demo
- Contributors and Users
- Installation
- Documentation
- Presentations and Whitepapers
- Related Projects
- Release History
- Roadmap
ModSecurity™ is a web application firewall engine that provides very little protection on its own. In order to become useful, ModSecurity™ must be configured with rules. In order to enable users to take full advantage of ModSecurity™ out of the box, Trustwave's SpiderLabs is sponsoring and maintaining a free certified rule set for the community. Unlike intrusion detection and prevention systems, which rely on signatures specific to known vulnerabilities, the Core Rules provide generic protection from unknown vulnerabilities often found in web applications, which are in most cases custom coded. The Core Rules are heavily commented to allow it to be used as a step-by-step deployment guide for ModSecurity™. <paypal>ModSecurity Core Rule Set Project</paypal>
Core Rules Content
In order to provide generic web applications protection, the Core Rules use the following techniques:
Let's talk here
Further development of ModSecurity and the Core Rule Set occurs through mailing list discussions and occasional workshops, and suggestions for improvement are welcome. For more information, please contact us.
Want to help?
The CRS project is always on the lookout for volunteers who are interested in contributing. We need help in the following areas:
Related resources
GitHub Repository is here:
Download TAR/GZ Archive: https://github.com/SpiderLabs/owasp-modsecurity-crs/tarball/master
Download ZIP Archive: https://github.com/SpiderLabs/owasp-modsecurity-crs/zipball/master
GitHub Issues:
ModSecurity CRS Demonstration/Smoketest page:
Project Leader
Project Contributors
Josh Zlatin
Brian Rectanus
Roberto Salgado
Project Users
WASC Distributed Web Honeypot Project uses the Core Rule Set - http://projects.webappsec.org/Distributed-Web-Honeypots
Akamai's WAF Service is based on a previous version of the Core Rule Set - http://www.akamai.com/html/about/press/releases/2009/press_121409.html
Varnish Web Cache/Accelerator uses a converted version of the CRS - https://github.com/comotion/security.vcl
Quick Start
Core Rule Set Quick Setup
To activate the rules for your web server installation:
1) The modsecurity_crs_10_config.conf includes management rules and directives that can control important CRS functions. Pay attention to the SecRuleEngine setting (On by default) and that the SecDefaultAction directive is set to "pass". The 49 inbound blocking and 59 outbound blocking rules files use the "block" action which inherits this setting. The effectively means that you can toggle the SecDefaultAction setting to decide if you would like to deny on an anomaly scoring/correlation match.
Update the PARANOID_MODE variable setting if you want to become more aggressive in your detection. Caution - this will cause more false positives.
Should also update the appropriate anomaly scoring levels that will be propagated to the inbound/outbound blocking files.
Update the TX policy settings for allowed Request Methods, File Extensions, etc...
2) Add the following line to your httpd.conf (assuming you've placed the rule files into conf/modsecurity_crs/):
<IfModule security2_module> Include conf/modsecurity_crs/*.conf Include conf/modsecurity_crs/base_rules/*.conf </IfModule>
3) Restart web server.
4) Make sure your web sites are still running fine.
5) Simulate an attack against the web server. Then check the attack was correctly logged in the Apache error log, ModSecurity debug log (if you enabled it) and ModSecurity audit log (if you enabled it).
ModSecurity Blog Posts
- ModSecurity Advanced Topic of the Week: Traditional vs. Anomaly Scoring Detection Modes
- ModSecurity Advanced Topic of the Week: Exception Handling
Rule Documentation Template
Each ModSecurity Rule in the CRS has an individual rule description page based on the following template file:
- Project participants are encouraged to copy this template and create landing pages for each CRS rule
- Use this template and create a new page using the following format - http://www.owasp.org/index.php?title=ModSecurity_CRS_RuleID-XXXXX (where XXXXX is the CRS ruleID)
ModSecurity Core Rule Set (CRS)
The ModSecurity Core Rule Set is provided to you under the terms and conditions of GPL version 2
This directory contains the files for Core ModSecurity Rule Set The rules are compatible with ModSecurity 2.5 (as of version 1.4.3)
Using ModSecurity requires rules. In order to enable users to take full advantage of ModSecurity immediately, Trustwave is providing a free Core rule set. Unlike intrusion detection and prevention systems which rely on signature specific to known vulnerabilities, the Core Rule Set provides generic protection from unknown vulnerabilities often found in web application that are in most cases custom coded. This is what we call "Attack Payload Detection."
Keep in mind that a predefined rule set is only part of the work required to protect your web site. We strongly urge you to consult Ivan Ristic's book, "ModSecurity Handbook" http://store.feistyduck.com/products/modsecurity-handbook and the ModSecurity Reference Manual - http://www.modsecurity.org/documentation/. The CRS is heavily commented to allow it to be used as a step-by-step deployment guide for ModSecurity.
For more information refer to the OWASP Core Rule Set Project page at http://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
Core Rules Mail-list - Suscribe here: https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set Archive: https://lists.owasp.org/pipermail/owasp-modsecurity-core-rule-set/
CRS 2.0 Design Concepts
CRS < 2.0 - Self-Contained Rules
Older (<2.0) CRS used individual, "self-contained" actions in rules
- If a rule triggered, it would either deny or pass and log - No intelligence was shared between rules
Not optimal from a rules management perspective (handling false positives/exceptions)
- Editing the regex could blow it up - Typical method was to copy/paste rules into custom rules files and then edit rule logic and disable core rule ID. - Heavily customized rules were less likely to be updated by the user
Not optimal from a security perspective
- Not every site had the same risk tolerance - Lower severity alerts were largely ignored - Individual low severity alerts are not important but several low severity events in the same transaction are.
CRS 2.0 - Collaborative Detection
Rules - Detection and Management
Rules logic has changed by decoupling the inspection/detection from the blocking functionality
- Rules log.pass and set transactional variables (tx) to track anomaly scores and to store meta-data about the rule match - This TX rule match data can be used by other 3rd party rules (converter Emerging Threats Snort web attack rules) to more accurately correlate identified attacks with their attack vector locations. - TX data of previous strong rule matches can also be used to conditionally apply weaker signatures that normally would have a high fasle positive rate. - Rules also increase anomaly scores for both the attack category and global score which allows users to set a threshold that is appropriate for them. - This also allows several low severity events to trigger alerts while individual ones are suppressed. - Exceptions may be handled by either increasing the overall anomaly score threshold, or by adding rules to a local custom exceptions file where TX data of previous rule matches may be inspected and anomaly scores re-adjusted based on the false positive criteria.
User can now globally update which variables to inspect and the anomaly score settings in the modsecurity_crs_10_config.conf file.
- PARANOID_MODE setting which will apply rules to locations that have a higher false positive rate - INBOUND_ANOMALY_SCORE setting will be populated in the inbound blocking file and if a transaction score at the end of phase:2 is equal to or greater than this number, it will be denied. - OUTBOUND_ANOMALY_SCORE setting will be populated in the outbound blocking file and it a transaction score at the end of phase:4 is equal to or greater than this number, it will be denied.
Inbound/Outbound Blocking
The CRS rules themselves are configured with the pass action, which allows all the rules to be processed and for the proposed anomaly scoring/collaborative detection concept to work. The inbound/outbound anomaly score levels may be set in the modsecurity_crs_10_config.conf file. These scores will be evaluated in the modsecurity_crs_49_inbound_blocking.conf and modsecurity_crs_59_outbound_blocking.conf files.
One of the top feedback items we have heard is that the CRS events in the Apache error_log file were very chatty. This was due to each rule triggering its own error_log entry. What most people wanted was for 1 correlated event to be generated that would give the user a higher level determination as to what the event category was.
To that end- each CRS rule will generate an audit log event Message entry but they will not log to the error_log on their own. These rules are now considered basic or reference events and may be reviewed in the audit log if the user wants to see what individual events contributed to the overall anomaly score and event designation.
Inbound/Outbound Correlation
After the transaction has completed (in the logging phase), the rules in the base_rules/modsecurity_crs_60_correlation.conf file will conduct further post-processing by analyzing any inbound events with any outbound events in order to provide a more intelligent/priority correlated event.
- Was there an inbound attack? - Was there an HTTP Status Code Error (4xx/5xx level)? - Was there an application information leak?
If an inbound attack was detected and either an outbound application status code error or infolead was detected, then the overall event severity is raised -
- 0: Emergency - is generated from correlation where there is an inbound attack and an outbound leakage. - 1: Alert - is generated from correlation where there is an inbound attack and an outbound application level error.
Core Rule Set Content
In order to provide generic web applications protection, the Core Rule Set uses the following techniques:
HTTP Protocol Validation and Protection
Detecting violations of the HTTP protocol and a locally defined usage policy. This first line of protection ensures that all abnormal HTTP requests are detected. This line of defense eliminates a large number of automated and non targeted attacks as well as protects the web server itself.
Protocol vulnerabilities such as Response Splitting, Request Smuggling, Premature URL ending
- Content length only for non GET/HEAD methods - Non ASCII characters or encoding in headers - Valid use of headers (for example, content length is numerical) - Proxy Access
Attack requests are different due to automation
- Missing headers such as Host, Accept, User-Agent - Host is an IP address (common worm propagation method)
Policy is usually application specific
- Some restrictions can usually be applied generically - White lists can be build for specific environments Limitations on Sizes - Request size, Upload size - # of parameters, length of parameter
Items that can be allowed or restricted
- Methods - Allow or restrict WebDAV, block abused methods such as CONNECT, TRACE or DEBUG - File extensions – backup files, database files, ini files - Content-Types (and to some extent other headers)
Automation Detection
Automated clients are both a security risk and a commercial risk. Automated crawlers collect information from your site, consume bandwidth and might also search for vulnerabilities on the web site. Automation detection is especially useful for generic detection of comments spam.
Detecting bots, crawlers, scanners and other surface malicious activity. Not aimed against targeted attacks, but against general malicious internet activity
- Offloads a lot of cyberspace junk & noise - Effective against comment spam - Reduce event count
Detection of Malicious Robots
- Unique request attributes: User-Agent header, URL, Headers - RBL Check of IP addresses - Detection of security scanners - Blocking can confuse security testing software (WAFW00f)
This rules file is only relevant if you are concerned about comment SPAM attacks. The rules file will run an RBL check against the source IP address at SPAMHAUS and will cache the response for 1 day. If the client sends subsequent requests, it will be denied without having to re-run an RBL check.
This file will also look for comment SPAM posting attacks which submit URL links.
Common Web Attacks Protection
Common Web Attacks Protection Rules on the second level address the common web application security attack methods. These are the issues that can appear in any web application. Some of the issues addressed are:
- SQL Injection - Cross-Site Scripting (XSS) - OS Command execution - Remote code inclusion - LDAP Injection - SSI Injection - Information leak - Buffer overflows - File disclosure
- OS command injection and remote command access - Remote file inclusion - Session Fixation
The rules in this file are considered BETA quality as they have not been rigorously tested. They attempt to address advanced attacks such as HTTP Parameter Pollution or use new rule features or techniques.
This rules file attempts to identify all directory traversal variations. It is prone to a high level of false positives so set PARANOID_MODE if you want to run these rules.
- SQL injection and blind SQL injection
- Cross site scripting (XSS)
Trojan Protection
ModSecurity Core Rule Set detects access to back doors installed on a web server. This feature is very important in a hosting environment when some of this backdoors may be uploaded in a legitimate way and used maliciously. In addition the Core Rule Set includes a hook for adding an Anti-Virus program such as ClamAV for checking file uploads.
- Check uploading of http backdoor page - Access detection - Known signatures (x_key header) - Generic file management output (gid, uid, drwx, c:\)
If all fails, the Core Rule Set will detect errors sent by the web server. Detecting and blocking errors prevents attackers from collecting reconnaissance information about the web application and also server as a last line of defense in case an attack was not detected eariler.
- HTTP Error Response Status Codes - SQL Information Leakage - Stack Dumps - Source Code Leakage
Request Header Tagging
This concept is similar to anti-SPAM SMTP apps that will add additional mime headers to emails providing the SPAM detection analysis information. The CRS is attempting to mimic this concept at the HTTP layer by adding additional request headers that provide insight into any ModSecurity events that may have triggered during processing. The advantage of this approach is that it allows a WAF to be in a detection-only mode while still providing attack data to the destination application server. The recieving app server may then inspect the WAF request headers and make a determination whether or not to process the transaction. This concept is valuable in distributed web environments and hosting architectures where a determination to block may only be appropriate at the destination app server.
This rules file will take all of the TX attack variable data and populate Apache ENV variables that Apache can then use to add X-WAF-Event request header data to the request.
Example showing the consolidated X-WAF-Events and X-WAF-Score data -
GET /path/to/foo.php?test=1%27%20or%20%272%27=%272%27;-- HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:220.127.116.11) Gecko/20091109 Ubuntu/9.10 (karmic) Firefox/3.5.5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 X-WAF-Events: TX: / 999935-Detects common comment types-WEB_ATTACK/INJECTION-ARGS:test, TX:999923-Detects JavaScript location/document property access and window access obfuscation-WEB_ATTACK/INJECTION-REQUEST_URI_RAW, TX:950001- WEB_ATTACK/SQL_INJECTION-ARGS:test X-WAF-Score: Total=48; sqli=2; xss= Connection: Keep-Alive
Current CRS v2 [[1]] presented at AppSec DC 2010.
Ryan Barnett Presenting on the OWASP CRS v2 at AppSec DC 2010 - http://player.vimeo.com/play_redirect?quality=sd&codecs=h264&clip_id=20166971&time=1348856471&sig=6c81604ac26dec6f6e1ae034af18c817&type=html5_desktop_local
OWASP ModSecurity Core Rule Set (CRS) JIRA CHANGELOG
Version 2.2.6 - 09/14/2012
- Started rule formatting update for better readability
- Added maturity and accuracy action data to each rule
- Updated rule revision (rev) action
- Added rule version (ver) action
- Added more regression tests (util/regression_tests/)
- Modified Rule ID 960342 to block large file attachments in phase:1
- Removed all PARANOID rule checks
- Added new Session Fixation rules
Bug Fixes:
- Fixed missing ending double-quotes in XSS rules file
- Moved SecDefaultAction setting from phase:2 to phase:1
- Fixed Session Hijacking SessionID Regex
- Changed the variable listing for many generic attack rules to exclude REQUEST_FILENAME
Version 2.2.5 - 06/14/2012
- Renamed main config file to modsecurity_crs_10_setup.conf
- Updated the rule IDs to start from CRS reserved range: 900000
- Updated rule formatting for readibility
- Updated the CSRF rules to use UNIQUE_ID as the token source
- Added the zap2modsec.pl script to the /util directory which converts
OWASP ZAP Scanner XML data into ModSecurity Virtual Patches
- Updated the Directory Traversal Signatures to include more obfuscated data
- Added Arachni Scanner Integration Lua script/rules files
Bug Fixes:
- Added forceRequestBodyVariable action to rule ID 960904
- Updated the anomaly scoring value for rule ID 960000 to critical
(Identified by Qualys Vulnerability & Malware Research Labs (VMRL))
- Updated Content-Type check to fix possible evasion with @within
(Identified by Qualys Vulnerability & Malware Research Labs (VMRL))
Version 2.2.4 - 03/14/2012
- Added Location and Set-Cookie checks to Response Splitting rule ID 950910
- Added a README file to the activated_rules directory
- Consolidate a number of SQL Injection rules into optimized regexs
- Removed multiMatch and replaceComments from SQL Injection rules
- Updated the SQLi regexs for greediness
- Updated the SQLi setvar anomaly score values to use macro expansion
- Removed PARANOID mode rules
Bug Fixes:
- Fixed missing comma before severity action in rules 958291, 958230 and 958231
- Fixed duplidate rule IDs
Version 2.2.3 - 12/19/2011
- Added Watcher Cookie Checks to optional_rules/modsecurity_crs_55_appication_defects.conf file
- Added Watcher Charset Checks to optional_rules/modsecurity_crs_55_application_defects.conf file
- Added Watcher Header Checks to optional_rules/modsecurity_crs_55_application_defects.conf file
Bug Fixes:
- Fixed Content-Type evasion issue by adding ctl:forceRequestBodyVariable action to
rule ID 960010. (Identified by Andrew Wilson of Trustwave SpiderLabs).
- Updated the regex and added tags for RFI rules.
Version 2.2.2 - 09/28/2011
- Updated the AppSensor Profiling (to use Lua scripts) for Request Exceptions Detection Points
- Added new Range header detection checks to prevent Apache DoS
- Added new Security Scanner User-Agent strings
- Added example script to the /util directory to convert Arachni DAST scanner
XML data into ModSecurity virtual patching rules.
- Updated the SQLi Character Anomaly Detection Rules
- Added Host header info to the RESOURCE collection key for AppSensor profiling rules
Bug Fixes:
- Fixed action list for XSS rules (replaced pass,nolog,auditlog with block)
- Fixed Request Limit rules by removing & from variables
- Fixed Session Hijacking IP/UA hash captures
- Updated the SQLi regex for rule ID 981242
Version 2.2.1 - 07/20/2011
- Extensive SQL Injection signature updates as a result of the SQLi Challenge
- Updated the SQL Error message detection in reponse bodies
- Updated SQL Injection signatures to include more DB functions
- Updated the WEAK SQL Injection signatures
- Added tag AppSensor/RE8 to rule ID 960018
Bug Fixes:
- Fixed Bad Robot logic for rule ID 990012 to further qualify User-Agent matches
- Fixed Session Hijacking rules to properly capture IP address network hashes.
- Added the multiMatch action to the SQLi rules
- Fixed a false negative logic flaw within the advanced_filter_converter.lua script
- Fixed missing : in id action in DoS ruleset.
- Updated rule ID 971150 signature to remove ;
Version 2.2.0 - 05/26/2011
- Changed Licensing from GPLv2 to Apache Software License v2 (ASLv2)
- Created new INSTALL file outlining quick config setup
- Added a new rule regression testing framework to the /util directory
- Added new activated_rules directory which will allow users to place symlinks pointing
to files they want to run. This allows for easier Apache Include wild-carding
- Adding in new RULE_MATURITY and RULE_ACCURACY tags
- Adding in a check for X-Forwarded-For source IP when creating IP collection
- Added new Application Defect checks (55 app defect file) from Watcher tool (Check Charset)
- Added new AppSensor rules to experimental_dir
- Added new Generic Malicious JS checks in outbound content
- Added experimental IP Forensic rules to gather Client hostname/whois info
- Added support for Mozilla's Content Security Policy (CSP) to the experimental_rules
- Global collection in the 10 file now uses the Host Request Header as the collection key.
This allows for per-site global collections.
- Added new SpiderLabs Research (SLR) rules directory (slr_rules) for known vulnerabilties.
This includes both converted web rules from Emerging Threats (ET) and from SLR Team.
- Added new SLR rule packs for known application vulns for WordPress, Joomla and phpBB
- Added experimental rules for detecting Open Proxy Abuse
- Added experimental Passive Vulnerability Scanning ruleset using OSVDB and Lua API
- Added additional URI Request Validation rule to the 20 protocol violations file (Rule ID - 981227)
- Added new SQLi detection rules (959070, 959071 and 959072)
- Added "Toata dragostea mea pentru diavola" to the malicious User-Agent data
Bug Fixes:
- Assigned IDs to all active SecRules/SecActions
- Removed rule inversion (!) from rule ID 960902
- Fixed false negative issue in Response Splitting Rule
- Fixed false negative issue with @validateByteRange check
- Updated the TARGETS lising for rule ID 950908
- Updated TX data for REQBODY processing
- Changed the pass action to block in the RFI rules in the 40 generic file
- Updated RFI regex to catch IP address usage in hostname
- Changed REQUEST_URI_RAW variable to REQUEST_LINE in SLR rules to allow matches on request methods.
- Updated the RFI rules in the 40 generic attacks conf file to remove explicit logging actions.
They will now inherit the settings from the SecDefaultAction
Version 2.1.2 - 02/17/2011
- Added experimental real-time application profiling ruleset.
- Added experimental Lua script for profiling the # of page scripts, iframes, etc..
which will help to identify successful XSS attacks and planting of malware links.
- Added new CSRF detection rule which will trigger if a subsequent request comes too
quickly (need to use the Ignore Static Content rules).
Bug Fixes:
- Added missing " in the skipAfter SecAction in the CC Detection rule set
Version 2.1.1 - 12/30/2010
Bug Fixes:
- Updated the 10 config conf file to add in pass action to User-Agent rule
- Updated the CSRF ruleset to conditionally do content injection - if the
csrf token was created by the session hijacking conf file
- Updated the session hijacking conf file to only enforce rules if a SessionID
Cookie was submitted
- Fixed macro expansion setvar bug in the restricted file extension rule
- Moved the comment spam data file into the optional_rules directory
Version 2.1.0 - 12/29/2010
- Added Experimental Lua Converter script to normalize payloads. Based on
PHPIDS Converter code and it used with the advanced filters conf file.
- Changed the name of PHPIDS converted rules to Advanced Filters
- Added Ignore Static Content (Performance enhancement) rule set
- Added XML Enabler (Web Services) rule set which will parse XML data
- Added Authorized Vulnerability Scanning (AVS) Whitelist rule set
- Added Denial of Service (DoS) Protection rule set
- Added Slow HTTP DoS (Connection Consumption) Protection rule set
- Added Brute Force Attack Protection rule set
- Added Session Hijacking Detection rule set
- Added Username Tracking rule set
- Added Authentication Tracking rule set
- Added Anti-Virus Scanning of File Attachments rule set
- Added AV Scanning program to /util directory
- Added Credit Card Usage Tracking/Leakage Prevention rule set
- Added experimental CC Track/PAN Leakage Prevention rule set
- Added an experimental_rules directory to hold new BETA rules
- Moved the local exceptions conf file back into base_rules dirctory however
it has a ".example" extension to prevent overwriting customized versions when upgrading
- Separated out HTTP Parameter Pollution and Restricted Character Anomaly Detection rules to
the experimental_rules directory
- Adding the REQUEST_HEADERS:User-Agent macro data to the initcol in 10 config file, which will
help to make collections a bit more unique
Version 2.0.10 - 11/29/2010
- Commented out the Anomaly Scoring Blocking Mode TX variable since, by default, the CRS
is running in traditional mode.
Bug Fixes:
- Moved all skipAfter actions in chained rules to chain starter SecRules
- Changed phases on several rules in the 20 protocol anomaly rules file to phase:1 to avoid FNs
Version 2.0.9 - 11/17/2010
- Changed the name of the main config file to modsecurity_crs_10_config.conf.example so that
it will not overwrite existing config settings. Users should rename this file to activate it.
- Traditional detection mode is now the current default
- Users can now more easily toggle between traditional/standard mode vs. anomaly scoring mode
by editing the modsecurity_crs_10_config.conf file
- Updated the disruptive actions in most rules to use "block" action instead of "pass". This
is to allow for the toggling between traditional vs. anomaly scoring modes.
- Removed logging actions from most rules so that it can be controlled from the SecDefaultAction
setting in the modsecurity_crs_10_config.conf file
- Updated the anomaly scores in the modsecurity_crs_10_config.conf file to more closely match
what is used in the PHPIDS rules. These still have the same factor of severity even though the numbers themselves are smaller.
- Updated the 49 and 59 blocking rules to include the matched logdata
- Updated the TAG data to further classify attack/vuln categories.
- Updated the SQL Injection filters to detect more boolean logic attacks
- Moved some files to optional_rules directory (phpids, Emerging Threats rules)
Bug Fixes:
- Fixed Rule ID 960023 in optional_rules/modsecurity_crs_40_experimental.conf is missing 1 single quote
- Moved all skipAfter actions in chained rules to the rule starter line (must have ModSec v2.5.13 or higher)
- Fixed restricted file extension bug with macro expansion
- Updated the SQLI TX variable macro expansion data in the 49 and 60 files so that
it matches what is being set in the sql injection conf file
- Fixed typo in SQL Injection regexs - missing backslash for word boundary (b)
Version 2.0.8 - 08/27/2010
- Updated the PHPIDS filters
- Updated the SQL Injection filters to detect boolean attacks (1<2, foo == bar, etc..)
- Updated the SQL Injection fitlers to account for different quotes
- Added UTF-8 encoding validation support to the modsecurity_crs_10_config.conf file
- Added Rule ID 950109 to detect multiple URL encodings
- Added two experimental rules to detect anomalous use of special characters
Bug Fixes:
- Fixed Encoding Detection RegEx (950107 and 950108)
- Fixed rules-updater.pl script to better handle whitespace
- Fixed missing pass action bug in modsecurity_crs_21_protocol_anomalies.conf
- Fixed the anomaly scoring in the modsecurity_crs_41_phpids_filters.conf file
- Updated XSS rule id 958001 to improve the .cookie regex to reduce false postives
Version 2.0.7 - 06/4/2010
- Added CSRF Protection Ruleset which will use Content Injection to add javascript to
specific outbound data and then validate the csrf token on subsequent requests.
- Added new Application Defect Ruleset which will identify/fix missing HTTPOnly cookie
- Added Experimental XSS/Missing Output Escaping Ruleset which looks for user supplied
data being echoed back to user unchanged.
- Added rules-updater.pl script and configuration file to allow users to automatically
download CRS rules from the CRS rules repository.
- Added new SQLi keyword for ciel() and reverse() functions.
- Updated the PHPIDS filters
Bug Fixes:
- Fixed false positives for Request Header Name matching in the 30 file by
adding boundary characters.
- Added missing pass actions to @pmFromFile prequalifier rules
- Added backslash to SQLi regex
- Fixed hard coded anomaly score in PHPIDS filter file
- Fixed restricted_extension false positive by adding boundary characters
Version 2.0.6 - 02/26/2010
Bug Fixes:
- Added missing transformation functions to SQLi rules.
- Fixed duplicate rule IDs.
- Fixed typo in @pmFromFile in the Comment SPAM rules
- Added macro expansion to Restricted Headers rule
- Fixed misspelled SecMarker
- Fixed missing chain action in Content-Type header check
- Update phpids filters to use pass action instead of block
Version 2.0.5 - 02/01/2010
- Removed previous 10 config files as they may conflict with local customized Mod configs.
- Added a new 10 config file that allows the user to globally set TX variables to turn on/off
PARANOID_MODE inspection, set anomaly score levels and http policies. Must have ModSecurity 2.5.12 to use the macro expansion in numeric operators.
- Added Rule Logic and Reference links to rules descriptions.
- Added Rule IDs to all rules.
- Added tag data mapping to new OWASP Top 10 and AppSensor Projects, WASC Threat Classification
- Removed Apache limit directives from the 23 file
- Added macro expansion to 23 file checks.
- Added @pmFromFile check to 35 bad robots file
- Added malicious UA strings to 35 bad robots check
- Created an experimental rules file
- Updated HTTP Parameter Pollution (HPP) rule logic to concat data into a TX variable for inspection
- Removed TX inspections for generic attacks and reverted to standard ARGS inspection
- Updated the variable list for standard inspections (ARGS|ARGS_NAMES|XML:/*) and moved the other
variables to the PARANOID list (REQUEST_URI|REQUEST_BODY|REQUEST_HEADERS|TX:HPP_DATA)
- Moved converted ET Snort rules to the /optional_rules directory
- Created a new Header Tagging ruleset (optional_rules) that will add matched rule data to the
request headers.
- Updated Inbound blocking conf file to use macro expansion from the 10 config file settings
- Added separate anomaly scores for inbound, outbound and total to be evaluated for blocking.
- Updated the regex logic in the (1=1) rule to factor in quotes and other logical operators.
- Updated the SPAMMER RBL check rules logic to only check once per IP/Day.
- Added new outbound malware link detection rules.
- Added PHP "call_user_func" to blacklist
Identified by SOGETI ESEC R&D
Bug Fixes:
- Removed Non-numeric Rule IDs
- Updated the variable list on SQLi rules.
- Fixed outbound @pmFromFile action from allow to skipAfter to allow for outbound anomaly scoring
and blocking
Version 2.0.4 - 11/30/2009
- Updated converted PHPIDS signatures (https://svn.php-ids.org/svn/trunk/lib/IDS/default_filter.xml)
- Updated PHPIDS rules logic to first search for payloads in ARGS and then if there is no match found
then search more generically in request_body|request_uri_raw
- Updated PHPIDS rules logic to only set TX variables and to not log. This allows for more clean
exceptions in the 48 file which can then expire/delete false positive TX matches and adjust the anomaly scores. These rules will then inspect for any TX variables in phase:5 and create appropriate alerts for any variable matches that exist.
Bug Fixes:
- Added Anomaly Score check to the 60 correlation file to recheck the anomaly score at the end of
phase:4 which would allow for blocking based on information leakage issues.
Version 2.0.3 - 11/05/2009
- Updated converted PHPIDS signatures (https://svn.php-ids.org/svn/trunk/lib/IDS/default_filter.xml)
- Create a new PHPIDS Converter rules file (https://svn.php-ids.org/svn/trunk/lib/IDS/Converter.php)
- Added new rules to identify multipart/form-data bypass attempts
- Increased anomaly scoring (+100) for REQBODY_PROCESSOR_ERROR alerts
Bug Fixes:
- Added t:urlDecodeUni transformation function to phpids rules to fix both false positives/negatives
- Added new variable locations to the phpids filters
- Use of transformation functions can cause false negatives - added multiMatch action to phpids rules
- Fixed multipart parsing evasion issues by adding strict parsing rules
- Fixed typo in xss rules (missing |)
- Fixed regex text in IE8 XSS filters (changed to lowercase)
Version 2.0.2 - 09/11/2009
- Added converted PHPIDS signatures (https://svn.php-ids.org/svn/trunk/lib/IDS/default_filter.xml)
Bug Fixes:
- Rule 958297 - Fixed Comment SPAM UA false positive that triggered only on mozilla.
Version 2.0.1 - 08/07/2009
- Updated the transformation functions used in the XSS/SQLi rules to improve performance
- Updated the variable/target list in the XSS rules
- Added XSS Filters from IE8
Bug Fixes:
- Rule 958297 - Fixed unescaped double-quote issue in Comment SPAM UA rule.
Version 2.0.0 - 07/29/2009
New Rules & Features:
- Fine Grained Policy
The rules have been split to having one signature per rule instead of having all signatures combined into one optimized regular expression. This should allow you to modify/disable events based on specific patterns instead of having to deal with the whole rule.
- Converted Snort Rules
Emerging Threat web attack rules have been converted. http://www.emergingthreats.net/
- Anomaly Scoring Mode Option
The rules have been updated to include anomaly scoring variables which allow you to evaluate the score at the end of phase:2 and phase:5 and decide on what logging and disruptive actions to take based on the score.
- Correlated Events
There are rules in phase:5 that will provide some correlation between inbound events and outbound events and will provide a result of successful atttack or attempted attack.
- Updated Severity Ratings
The severity ratings in the rules have been updated to the following: - 0: Emergency - is generated from correlation where there is an inbound attack and an outbound leakage. - 1: Alert - is generated from correlation where there is an inbound attack and an outbound application level error. - 2: Critical - is the highest severity level possible without correlation. It is normally generated by the web attack rules (40 level files). - 3: Error - is generated mostly from outbound leakabe rules (50 level files). - 4: Warning - is generated by malicious client rules (35 level files). - 5: Notice - is generated by the Protocol policy and anomaly files. - 6: Info - is generated by the search engine clients (55 marketing file).
- Updated Comment SPAM Protections
Updated rules to include RBL lookups and client fingerprinting concepts from Bad Behavior (www.bad-behavior.ioerror.us)
- Creation of Global Collection
Automatically create a Global collection in the *10* config file. Other rules can then access it.
- Use of Block Action
Updated the rules to use the "block" action. This allows the Admin to globally set the desired block action once with SecDefaultAction in the *10* config file rather than having to edit the disruptive actions in all of the rules or for the need to have multiple versions of the rules (blocking vs. non-blocking).
- "Possible HTTP Parameter Pollution Attack: Multiple Parameters with the same Name."
- Added new generic RFI detection rules.
- "Possibly malicious iframe tag in output" (Rules 981001,981002)
Planting invisible iframes in a site can be used by attackers to point users from the victim site to their malicious site. This is actually as if the user was visiting the attacker's site himself, causing the user's browser to process the content in the attacker's site.
New Events:
- Rule 960019 - Expect Header Not Allowed.
- Rule 960020 - Pragma Header Requires Cache-Control Header
- Rule 958290 - Invalid Character in Request - Browsers should not send the (#) character
as it is reserved for use as a fragment identifier within the html page.
- Rule 958291 - Range: field exists and begins with 0.
- Rule 958292 - Invalid Request Header Found.
- Rule 958293 - Lowercase Via Request Header Found.
- Rule 958294 - Common SPAM Proxies found in Via Request Header.
- Rule 958295 - Multiple/Conflicting Connection Header Data Found.
- Rule 958296 - Request Indicates a SPAM client accessed the Site.
- Rule 958297 - Common SPAM/Email Harvester crawler.
- Rule 958298 - Common SPAM/Email Harvester crawler
Bug Fixes:
- Rule 950107 - Split the rule into 2 separate rules to factor in the
Content-Type when inspecting the REQUEST_BODY variable.
- Rule 960017 - Bug fix for when having port in the host header.
- Rule 960014 - Bug fix to correlate the SERVER_NAME variable.
- Rule 950801 - Increased the logic so that the rule will only run if the web site
uses UTF-8 Encoding.
- Rules 999210,999211 - Bug fix to move ctl actions to last rule, add OPTIONS and
allow the IPv6 loopback address
- Rule 950117 - Updated the RFI logic to factor in both a trailing "?" in the ARG
and to identify offsite hosts by comparing the ARG URI to the Host header. Due to this rule now being stronger, moved it from optional tight security rule to *40* generic attacks file.
Other Fixes:
- Added more HTTP Protocol violations to *20* file.
- Set the SecDefaultAction in the *10* config file to log/pass (This was the
default setting, however this sets it explicitly.
- Added SecResponseBodyLimitAction ProcessPartial to the *10* config file. This
was added so that when running the SecRuleEngine in DetectionOnly mode, it will not deny response bodies that go over the size restrictions.
- Changed SecServerSignature to "Apache/1.3.28"
- Fixed the use of SkipAfter and SecMarkers to make it consistent. Now have
BEGIN and END SecMarkers for rule groups to more accurately allow moving to proper locations.
- Fixed the @pm/@pmFromFile pre-qualifier logic to allow for operator inversion.
This removes the need for some SecAction/SkipAfter rules.
- Updated rule formatting to easily show rule containers (SecMarkers, pre-qualifier
rules and chained rules).
Version 1.6.1 - 2008/04/22
- Fixed a bug where phases and transformations where not specified explicitly
in rules. The issue affected a significant number of rules, and we strongly recommend to upgrade.
Version 1.6.0 - 2008/02/19
New Rulesets & Features:
- 42 - Tight Security
This ruleset contains currently 2 rules which are considered highly prone to FPs. They take care of Path Traversal attacks, and RFI attacks. This ruleset is included in the optional_rulesets dir
- 42 - Comment Spam
Comment Spam is used by the spammers to increase their rating in search engines by posting links to their site in other sites that allow posting of comments and messages. The rules in this ruleset will work against that. (Requires ModSecurity 2.5)
- Tags
A single type of attack is often detected by multiple rules. The new alert classification tags solve this issue by providing an alternative alert type indication and can serve for filtering and analysis of audit logs. The classification tags are hierarchical with slashes separating levels. Usually there are two levels with the top level describing the alert group and the lower level denoting the alert type itself, for example: WEB_ATTACK/SQL_INJECTION.
False Positives Fixes:
- Rule 960903 - Moved to phase 4 instead of 5 to avoid FPs
- Rule 950107 - Will look for invalid url decoding in variables that are not
automatically url decoded
Additional rules logic:
- Using the new "logdata" action for logging the matched signature in rules
- When logging an event once, init the collection only if the alert needs to log
- Using the new operator @pm as a qualifier before large rules to enhance
performance (Requires ModSecurity 2.5)
- SQL injection - A smarter regexp is used to detect 1=1,2=2,etc.. and not
only 1=1. (Thanks to Marc Stern for the idea)
- New XSS signatures - iframe & flash XSS
Version 1.5.1 - 2007/12/6
False Positives Fixes:
- Protocol Anomalies (file 21) - exception for Apache SSL pinger (Request: GET /)
New Events:
- 960019 - Detect HTTP/0.9 Requests
HTTP/0.9 request are not common these days. This rule will log by default, and block in the blocking version of file 21
Other Fixes:
- File 40, Rules 950004,950005 - Repaired the correction for the double
url decoding problem
- File 55 contained empty regular expressions. Fixed.
Version 1.5 - 2007/11/23
New Rulesets:
- 23 - Request Limits
"Judging by appearances". This rulesets contains rules blocking based on the size of the request, for example, a request with too many arguments will be denied.
Default policy changes:
- XML protection off by default
- BLOCKING dir renamed to optional_rules
- Ruleset 55 (marketing) is now optional (added to the optional_rules dir)
- Ruleset 21 - The exception for apache internal monitor will not log anymore
New Events:
- 960912 - Invalid request body
Malformed content will not be parsed by modsecurity, but still there might be applications that will parse it, ignoring the errors.
- 960913 - Invalid Request
Will trigger a security event when request was rejected by apache with code 400, without going through ModSecurity rules.
Additional rules logic:
- 950001 - New signature: delete from
- 950007 - New signature: waitfor delay
False Positives Fixes:
- 950006 - Will not be looking for /cc pattern in User-Agent header
- 950002 - "Internet Explorer" signature removed
- Double decoding bug used to cause FPs. Some of the parameters are already
url-decoded by apache. This caused FPs when the rule performed another url-decoding transformation. The rules have been split so that parameters already decoded by apache will not be decoded by the rules anymore.
- 960911 - Expression is much more permissive now
- 950801 - Commented out entirely. NOTE: If your system uses UTF8 encoding,
then you should uncomment this rule (in file 20)
version 1.4.3 - 2007/07/21
New Events:
- 950012 - HTTP Request Smuggling
For more info on this attack: http://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf
- 960912 - Invalid request body
Malformed content will not be parsed by modsecurity, but still there might be applications that will parse it, ignoring the errors.
- 960913 - Invalid Request
Will trigger a security event when request was rejected by apache with code 400, without going through ModSecurity rules.
False Positives Fixes:
- 950107 - Will allow a % sign in the middle of a string as well
- 960911 - A more accurate expression based on the rfc:
- 950015 - Will not look for http/ pattern in the request headers
Additional rules logic:
- Since Apache applies scope directives only after ModSecurity phase 1
this directives cannot be used to exclude phase 1 rules. Therefore we moved all inspection rules to phase 2.
version 1.4 build 2 - 2007/05/17
New Feature:
- Search for signatures in XML content
XML Content will be parsed and ispected for signatures
New Events:
- 950116 - Unicode Full/Half Width Abuse Attack Attempt
Full-width unicode can by used to bypass content inspection. Such encoding will be forbidden http://www.kb.cert.org/vuls/id/739224
- 960911 - Invalid HTTP request line
Enforce request line to be valid, i.e.: <METHOD> <path> <HTTP version>
- 960904 - Request Missing Content-Type (when there is content)
When a request contains content, the content-type must be specified. If not, the content will not be inspected
- 970018 - IIS installed in default location (any drive)
Log once if IIS in installed in the /Inetpub directory (on any drive, not only C)
- 950019 - Email Injection
Web forms used for sending mail (such as "tell a friend") are often manipulated by spammers for sending anonymous emails
Regular expressions fixes:
- Further optimization of some regular expressions (using the non-greediness operator)
The non-greediness operator, <?>, prevents excessive backtracking
FP fixes:
- Rule 950107 - Will allow a parameter to end in a % sign from now on
version 1.4 - 2007/05/02
New Events:
- 970021 - WebLogic information disclosure
Matching of "<title>JSP compile error</title>" in the response body, will trigger this rule, with severity 4 (Warning)
- 950015,950910,950911 - HTTP Response Splitting
Looking for HTTP Response Splitting patterns as described in Amit Klein's excellent white paper: http://www.packetstormsecurity.org/papers/general/whitepaper_httpresponse.pdf
ModSecurity does not support compressed content at the moment. Thus, the following rules have been added:
- 960902 - Content-Encoding in request not supported
Any incoming compressed request will be denied
- 960903 - Content-Encoding in response not suppoted
An outgoing compressed response will be logged to alert, but ONLY ONCE.
False Positives Fixes:
- Removed <.exe>,<.shtml> from restricted extensions
- Will not be looking for SQL Injection signatures <root@>,<coalesce> in the Via request header
- Excluded Referer header from SQL injection, XSS and command injection rules
- Excluded X-OS-Prefs header from command injection rule
- Will be looking for command injection signatures in
REQUEST_COOKIES|REQUEST_COOKIES_NAMES instead of REQUEST_HEADERS:Cookie.
- Allowing charset specification in the <application/x-www-form-urlencoded> Content-Type
Additional rules logic:
- Corrected match of OPTIONS method in event 960015
- Changed location for event 960014 (proxy access) to REQUEST_URI_RAW
- Moved all rules apart from method inspection from phase 1 to phase 2 -
This will enable viewing content if such a rule triggers as well as setting exceptions using Apache scope tags.
- Added match for double quote in addition to single quote for <or x=x> signature (SQL Injection)
- Added 1=1 signature (SQL Injection)
version 1.3.2 build 4 2007/01/17
Fixed apache 2.4 dummy requests exclusion Added persistent PDF UXSS detection rule
Version 1.3.2 build 3 2007/01/10
Fixed regular expression in rule 960010 (file #30) to allow multipart form data content
Version 1.3.2 - 2006/12/27
New events:
- 960037 Directory is restricted by policy
- 960038 HTTP header is restricted by policy
Regular expressions fixes:
- Regular expressions with @ at end of beginning (for example "@import)
- Regular expressions with un-escaped "."
- Command Injections now always require certain characters both before and after the command. Important since many are common English words (finger, mail)
- The command injection wget is not searched in the UA header as it has different meaning there.
- LDAP Fixed to reduce FPs:
+ More accurate regular expressions + high bit characters not accpeted between signature tokens.
- Do not detect <?xml as a PHP tag in both PHP injection and PHP source leakage
- Removed Java from automation UA
- When validating encoding, added regexp based chained rule that accepts both %xx and %uxxxxx encoding bypassing a limitation of "@validateUrlEncoding"
Additional rules logic:
- Checks for empty headers in addition to missing ones (Host, Accept and User-Agent)
- OPTIONS method does not require an accept header.
- Apache keep alive request exception.
- PROPFIND and OPTIONS can be used without content-encoding (like HEAD and GET)
- Validate byte range checks by default only that no NULL char exists.
- Added CSS to allowed extensions in strict rule sets.
- Changed default action in file #50 to pass instead of deny.
- Moved IP host header from protocol violations to protocol anomalies.
Modified descriptions:
- 950107: URL Encoding Abuse Attack Attempt
- 950801: UTF8 Encoding Abuse Attack Attempt
- Added matched pattern in many events using capture and %{TX.0}
- Added ctl:auditLogParts=+E for outbound events and attacks to collect response.
Version 1.2 - 2006/11/19
Changes: + Move all events to the range of events allocated to Thinking Stone, now Breach by prefixing all event IDs with "9". + Reverse severities to follow the Syslog format used by ModSecurity, now 1 is the highest and 5 the lowest.
Bug fixes: + Removed quotes from list of mime types inspected on exit (directive SecResponseBodyMimeType) + Corrected "cd .." signature. Now the periods are escaped. + Too many FPs with events 950903 & 950905. Commented them out until fixed.
Version 1.1 - 2006/10/18
Initial version
Roadmap Items
The OWASP ModSecurity Core Rule Set (CRS) Project provides a base set of attack detection rules for the popular open source web application firewall (http://www.modsecurity.org/).
Create "Sniffer-Mode" ModSecurity
Brief explanation:
The ModSecurity code includes a "standalone" version that wraps a light weight Apache/APR around the ModSecurity code. This is used as the basis for the ports to the IIS/Nginx web server platforms. The goal for this project task is to extend this standalone version so that it can accept a data feed of network traffic (e.g. libpcap) data as input and apply the ModSecurity CRS rules. One possible solution would be create a ModSecurity "plugin" for the Snort IDS.
Expected results:
This new sniffer mode would allow organizations to run ModSecurity/OWASP ModSecurity CRS in an out of line mode as they do IDS systems.
Knowledge Prerequisite:
C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
ModSecurity for Java
Brief explanation:
The goal is to have a ModSecurity version that can be used within Java servers (e.g. Tomcat). There may be methods to use JNI to call the standalone code from a filter in Tomcat.
Expected results:
This new version allow organizations to run ModSecurity/OWASP ModSecurity CRS in Java web servers.
Knowledge Prerequisite:
C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
Implement libinjection Code
Brief explanation: https://www.modsecurity.org/tracker/browse/MODSEC-327
libinjection (https://github.com/client9/libinjection) is a C library that detects SQLi attacks in user input. It is designed to be embedded in existing or new applications:
- Fast > 100k inspections per second
- No memory allocation
- No threads
- Stable memory usage (approximately 500 bytes on stack)
- 500 lines of C code (plus a few kiobytes of data)
It is based on lexical analysis of SQL and SQLi attempts and does not use regular expressions.
Expected results:
The new C code in ModSecurity will allow us to add new SQL Injection detection methods to the OWASP ModSecurity CRS.
Knowledge Prerequisite:
C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
Implement DoS Prevention Code
Brief explanation: https://www.modsecurity.org/tracker/browse/MODSEC-265
Implement a request velocity learning engine to identify dynamic DoS thresholds for both the site and for the particular URL.
Expected results:
The new C code in ModSecurity will allow us to add new DoS Protection methods to the OWASP ModSecurity CRS.
Knowledge Prerequisite:
C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
Create a Positive Learning/Profile Engine
Brief explanation:
ModSecurity needs a profiling engine that implements the various AppSensor Detection Points - http://blog.spiderlabs.com/2011/08/implementing-appsensor-detection-points-in-modsecurity.html.
Expected results:
The new engine will implement more detection points to detect abnormal request attributes.
Knowledge Prerequisite:
C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
Create an Engine to Detect Application Flow Anomalies
Brief explanation:
Need an engine that can track normal application flow paths (click-flows) for business logic transactions - such as transferring money from accounts. After profiling normal application path flows, we want to then be able to alert to anomalies. This type of logic can help to prevent Banking Trojan attacks.
Expected results:
The engine will be able to alert on anomalous application flows.
Knowledge Prerequisite:
C programming and ModSecurity Development Guidelines - http://www.modsecurity.org/developers/.
v3.0 Detection Concepts
This page documents the goals/ideas for the next major version of the CRS.
These are not listed in any particular order.
- Add New Detection Logic
- Fraud Detection (Session Hijacking/CSRF/Banking Trojans)
- User Profiling (GeoIP/Browser Fingerprinting)
- HoneyTraps
- Increase Rule Accuracy
- Reduce False Positives - many users complain about the number of false positives and the negative impacts (breaking functionality) when in blocking mode
- Reduce False Negatives - we need to constantly improve detection so that we don't miss attacks (http://blog.spiderlabs.com/2011/07/modsecurity-sql-injection-challenge-lessons-learned.html)
- Increase Performance/Reduce Latency
- Utilize set-based pattern matching (@pm/@pmf) for pre-qualification of regular expression checks
- Optimize individual @rx SecRules into less optimized versions
- Review all regular expression rules for performance (non-capturing/greediness).
- Improve Rule Management
- Make it easier for user to enable/disable the desired rules for their platform
- Update rule formatting for easier readability
- Reorder/Regroup rule into new file names
Detection Logic/Flow Concepts
This section outlines the processing flow and associated points of detection and actions taken.
- IP Reputation
- Data inspected: REMOTE_ADDR
- Use @rbl to check against remote RBLs
- Use @pmf to check a local file if bad IPs
- Use GeoIP Data to assign fraud scores
- Actions
- Deny
- Increase TX anomaly score
- Tag client as "suspicious" in IP collection
- Request Method Analysis
- Data inspected: REQUEST_METHOD
- Compare the REQUEST_METHOD specified against:
- Allowed global methods set by the admin in the modsecurity_crs_10_setup.conf file
- Request methods allowed per-resource (GET vs. POST)
- Actions
- Deny
- Increase TX anomaly score
- Tag client as "suspicious" in IP collection
- Request Header Analysis
- Data inspected: REQUESTE_HEADERS
- Check for existence of malicious headers (User-Agent of scanners, etc..)
- Check for the absence of required headers (Host, User-Agent, Accept)
- Request Header Ordering Anomalies detects non-browsers/bots
- Actions
- Deny
- Increase TX anomaly score
- Tag client as "suspicious" in IP collection
Project About
What does this OWASP project offer you?
What releases are available for this project?
The CRS is an open source rule set licensed under ASLv2. ModSecurity Core Rule Set works with ModSecurity 2.5 and above.
Pages in category "OWASP ModSecurity Core Rule Set Project"
The following 16 pages are in this category, out of 16 total.
- OWASP ModSec CRS Paranoia Mode
- OWASP ModSec CRS Paranoia Mode Sibling 950001
- OWASP ModSec CRS Paranoia Mode Sibling 950907
- OWASP ModSec CRS Paranoia Mode Sibling 958977
- OWASP ModSec CRS Paranoia Mode Sibling 958980
- OWASP ModSec CRS Paranoia Mode Sibling 960901
- OWASP ModSec CRS Paranoia Mode Sibling 970003
- OWASP ModSec CRS Paranoia Mode Sibling 981049
- OWASP ModSec CRS Paranoia Mode Sibling 981172
- OWASP ModSec CRS Paranoia Mode Sibling 981173
- OWASP ModSecurity rule evaluation framework


text:
Best Kids Parties: Alvin & The Chipmunks
Name: Lyle
Location: Medford Lakes, NJ
Last summer, Lyle had an Alvin & the Chipmunks birthday party. It was before the release of the movie 'Chipwrecked' and there were not a lot of party resources/inspiration to be found.
All of the balloons and tableware were based on the colors that the Chipmunks wear. We had a red Alvin table, a blue Simon table and a green Theodore table. For games, I made a Put-The-Glasses-On-Simon game (in the tradition of Pin-The-Tail-On-The-Donkey) and a Feed Theodore game which was like a bean bag toss except the kids threw plastic, fake food (a huge hit!).
We served red, blue and green fruits and juices and, of course, the Chipmunk favorites of toaster waffles and cheeseballs! Cupcakes were in red, green and blue papers and I made picks using Chipmunk images from the internet. Party guests received a plane that loops the loop and a hula hoop!
Thanks Danielle! Readers find Danielle at her shop, Homemade Pop, or business, Galafont.
(Images: reader Danielle)

subset: commoncrawl


text:
Afternoon Eye Candy: A Gorgeous Kitchen in Stockholm
What is it about Swedes and their impeccable taste? Every day while lazily scrolling through my reader searching for kitchen inspiration, I'm inevitably stopped by photos of a gorgeous, design-savvy yet functional-looking kitchen...and upon closer inspection, it's usually a kitchen in Sweden. And so it was today.
This kitchen, found via Fantastic Frank, is located just north of Stockholm. Besides the gorgeous photography, which certainly accounts for at least part of my drooling, I love the layout - the work surfaces on both sides of the kitchen, the compact , integrated appliances, the tall cabinets, the shimmery mother-of-pearl tile, the warm wood in the dining room. Simply stunning!
P.S. The house is currently on sale for a cool half million, should you be in the market.
Related: Sweetness & Light: 7 Kitchens from Dos Visits in Sweden
(Images: Fantastic Frank)


text:
Granvelle, Antoine Perrenot de (1517-1586)
Antoine Perrenot de Granvelle (Grandvelle), Lord of Granvelle (b. 20 August 1517, d. 21 September 1586), Roman Catholic bishop of Utrecht 1567, Archbishop of Mechelen and a cardinal, was one of the most influential advisers of Margaret, Duchess of Parma, since 1559 Regent of the Netherlands (both the present Netherlands and Belgium). He was an opponent of William of Orange and an ardent fighter of "heretics," both Calvinists and Anabaptists, and influenced the regent to maintain the imperial decrees and to take to drastic action. In a letter of 1566 he wrote: "If we should give freedom . . . to everyone to believe whatever he wishes, we would have not only 'Hugenots' (Calvinists) . . . but also several kinds of Anabaptists, whose intentions are very pernicious for the Republic (common cause) as one might see by what has happened during our memory at Münster and Amsterdam, and a hundred thousand other monstrous sects."
Bessern, P. Edits de Persecution contre les Anabaptistes des Pays-Bas . . . Bern-Neuchatel-Buenos Aires, n. d.: 25-27.
Schelven, A. A. van. Willem van Oranje. Haarlem, 1933: 67-99.
|Nanne van der Zijpp
|Date Published
Cite This Article
MLA style
van der Zijpp, Nanne. "Granvelle, Antoine Perrenot de (1517-1586)." Global Anabaptist Mennonite Encyclopedia Online. 1957. Web. 18 Dec 2018. http://gameo.org/index.php?title=Granvelle,_Antoine_Perrenot_de_(1517-1586)&oldid=64588.
APA style
van der Zijpp, Nanne. (1957). Granvelle, Antoine Perrenot de (1517-1586). Global Anabaptist Mennonite Encyclopedia Online. Retrieved 18 December 2018, from http://gameo.org/index.php?title=Granvelle,_Antoine_Perrenot_de_(1517-1586)&oldid=64588.
Adapted by permission of Herald Press, Harrisonburg, Virginia, from Mennonite Encyclopedia, Vol. 2, p. 564. All rights reserved.
©1996-2018 by the Global Anabaptist Mennonite Encyclopedia Online. All rights reserved.


text:
Great Cartooning, Draftsmanship and Design Combined
That blog is amazing! How did you find it? It's astounding how there are still so many great blogs and resources that I don't know about. I just added it as one of my bookmarks right now.
"It's hard to believe how high the standards in popular arts were just a few decades ago."
It's also hard to believe how you saw those standards crumble to the ground. That must have been hard to endure.
Wow! That Hirschfeld street scene is amazing!
Hirschfeld was truly a god amongst men. His line work is practically unmatchable. Thanks for the link, John.
Something like "Out of this World" is missing nowadays. I love that kind of drawing.
I check that blog every day, especially since it drifted away from it's stated topic.
"It's hard to believe how high the standards in popular arts were just a few decades ago."
And I don't think they've dropped because of a lack of talent--I think it's more due to the opposing forces of "the cult of the artist," and the lack of art directors/editors/movie and TV producers who don't know how to set and hold creative people to standards.
I'm so glad you found this blog! I stumbled upon it a ways back after seeing a link to some of those great, pulp covers and then ended up loving it more just because it covers so many different other styles that I like.
For anyone interested, another good one I've found is:
For the most part, great images of backgrounds and concept art from the older Disney movies (Bambi, Pinocchio, Snow White, etc.) and sometimes some WB.
This post was interesting in particular, how the backgrounds for Bambi developed:
what happend to art like this?
do you blame filmation ,disney ,upa or some other company?
John K
What do you think of the illustrations in Dickens? Instead of drawing the people in a "realistic" manner, the characters appear as sketches and for me are quite appealing.
For example, it can be seen the illustrator had fun with Fagin.
this type of work is what i DID NOT SEE on display at the school of visual arts.i did see this type of work at the SOCIETY OF ILLUSTRATORS, take the kids out of class at the school of visual arts, walk them down to the society of illustrators, then, for homework,make them copy everything they see posted on your blog.solution!
You people wanna blame someone for humanity's artistic decay?
Blame capitalism.
It's that simple.
Photoshop effectively killed the world of illustration.
I really like Al Hirshfeld's paintings, his ink works too.
This beautiful illustrations is something i see nowhere in today's society. And John A is right, softwares like Photoshop (Tough i use more for the colouring) and Paint Tool SAI morphed peoples to anarchic imitations of good illustrations and cartoonings nowadays.
Once again some fine examples keep this blog humming right along!
BTW, JK and others, did you know the video game industry still expects submissions of __storyboards__ for game title proposals? That's right folks, game companies are not interested in illustrated radio like network/cable TV - they require honest to gawd illustrations (MS in particular)!
JK, you might seriously look into that arena as games with story (such as the recently released and successful psycho thriller "Alan Wake") are growing in popularity. The cut scenes or story setup scenes can sometimes last several minutes!
Also, some consoles such as MS's Kinect (formerly project Natal) will recognize body/face language - imagine George Liquor or Ren/Stimpy being able to respond to a player's smile/smirk/gesture, etc?
Hey John! Have you seen Ole Jensen caricatures? I think they are great!
Ole Jensen
Comic shop clerks of North America= sheer brilliance.
Shucks John. I honestly think incorporating subject matter is a great way to encourage people to get better at drawing and animation in general. Not that I'm a master drawer by any means, but I am a teacher, and I have been recently been teaching my preschool class about stop motion animation. They are 4 years old. Four. Not even old enough to read yet. And how did I get them to understand how animation works? By asking them what they are into and making a stop motion cartoon about that subject. It happened that they were really into Star Wars, so I had them make "Star Wars ships" out of legos and move them around frame by frame while I took digital pictures. Not only did this teach them about how animation works, but it also taught them to be passionate about animation. Passion. Something we can both agree is lacking in cartoons today.
I guess my previous coment was too long; or wasn´t well writed, well sorry for that. Anyway, I thought I was being respectful.
well if you are into that stuff
i think most of the examples you gave are simply appalling
especially the one with the ship...
it's a complete mass of details
and although i like the cheesiness of pulp fiction magazine covers... i would hardly consider them as good
if any thing i prefer the classical illustrators of the 19th century like Gustave Dore and the guy that illustrated Alice in wonderland
ASIFA got some pretty nice examples some good classical illustrators
Check the work of Olaf Gulbransson, Hirschfield's inspiration.
Oscar, I'm a big fan of Gulbarnsson, as well as Heine, Paul and especially Rudolf Wilke. I'll be posting a lot of their caricatures at the archive site soon.
Another big influence on Hirschfeld... Covarrubias
You haven't published yet my comment on Gulbransson but I would like to tell you HOW MUCH I LOVE WILKE'S WORK!!! What a shame he died aged 35!
His art sends shivers down my spine.
Here is his obituary (In German)
Drew Friedman's comic shop clerks are freakin' fantastic. I had my Drew books stolen some time ago and Drew's brother Josh gave me copies of first editions, what a mensch! Drew is so amazing as an illustrator it's both funny and deadly, this is the guy Robert Crumb is in awe of.
Speaking of high standards. Saw this today and wondered how well the artist did based on your critique.
So much eye candy.


text:
City of London Photography
Westland Place Studios
Event Details
2 Hour Tour
Day: Saturdays
Times: 11:30am & 1:30pm
The City of London was established almost 2000 years ago in 43AD by the Romans. It's original name was Londinium.
On this 2 hour tour, you will be led by a professional photographer around the commercial heart of Britain. The constantly evolving Square Mile is rich in architectural history, whilst also giving us a glimpse of the city of the future. You will not only be guided in terms of technical photographic skill, but will also discover fascinating insights into some of the most unique and astounding glass and steel structures in the world today.
You will learn how to capture the most interesting and intriguing aspects of The City whilst discovering the architectural achievements that put London on the map.
From the Monument to the Gherkin, this course will enable you to understand how to create captivating images and further your understanding of urban and architectural photography.
Course requirements: You will need a digital camera, ideally with a wide angle lens. Please note that this active day involves a fair amount of walking.
View Full course details: http://www.westlandplacestudios.com/course/city-of-london-photography/
Before booking a place on any of our courses please ensure that you have read our booking policy.
Save This Event
Event Saved
When & Where
Monument to the Great Fire of London
Fish Street Hill
EC3R 8AH London
United Kingdom
Westland Place Studios
Creative Courses in Design, Web & Digital Photography.
Westland Place Studios, one of the oldest established art and design studios in Hoxton, London. All of our tutors have professional experience within the creative industries, many have taught at leading art and design institutions including the Royal College of Art.
Our clients include: The BBC, Publicis, NBCUniversal, Giorgio Armani & Sony.
• Learn from creative industry professionals
• Courses led by award winning photographers
• A unique and truly creative learning environment
• Fully equipped digital training studio
• Conveniently located near Old Street tube station
Visit: www.westlandplacestudios.com


text:
Jayson Waller, 32President and CEOISI AlarmsMooresville, N.C.
How did you get into the security industry?
CONCORD, N.C.—ISI Alarms, a super-regional based here, is relocating its headquarters and call center to a new community and a much larger space, and is planning to hire as many as 200 additional employees over the next two years, according to company officials.
© 2018 United Publications Inc. ALL RIGHTS RESERVED.


text:
Former Pakistan captain Ramiz Raja has rubbished the match-fixing claims made by British journalist Ed Hawkins in his yet to be released book.
A British newspaper had published extracts of the book by Hawkins in which he has claimed that an Indian bookmaker had accurately predicted what would happen in Pakistan's innings against their arch-rivals.
"I don't think we need to give any importance to the book or claims by the journalist. I don't but any of his claims. I can say with certainty the World Cup semi final was not fixed," The Nation quoted Ramiz, as saying.
Hawkins had said that the bookmaker, Parthiv, sent him a Twitter message during the Indian innings correctly calling that when Pakistan batted, they would reach 100 easily then lose two wickets quickly, reach 150 with five down and lose by more than 20 runs.
India won the match by 29 runs to book their place in the final where they beat Sri Lanka to claim their second World Cup.
Hawkins did not make any specific allegation of match-fixing but cited a statistician as saying the odds of the bookmaker predicting the outcome in such detail purely by chance would be 405 to one against. (ANI)


text:
We are expanding to 12 teams from 10 for next year. This is a very competitive league that you must keep up with all season. There will be an expansion draft for the new owners. There is a $3 Hanely Ramierz, $5 McCann, $1 Hawpe, $1 James and a $6 Uggla with many others to choose from. This is a live draft in the Charlotte NC area, YOU MUST attend. If you are interested let me know. We pay 3 places in a 11 man or 4 in a 12 man. 50%,30%,15%,5% or 50%,30%,20%. If you are interested contact me at both emails. We have 6 returning owners and have added 2 already. Draft day is set for the 24th of March. $1000 goes to the winner!
mailto:email@example.com and/or mailto:firstname.lastname@example.com
May be a few minor changes but here are the rules;
Player Pool: NL Players.
Players traded out of league's player pool do not accumulate stats.
Positions: C, 1B, 2B, 3B, SS, MI, CI, OF, U and P.
Eligibility: Players are eligible at their primary position, plus positions they've played 20 games last year or 5 games this year.
Transactions: � Lineups are set once for the start of each period.
Deadline is 30 minutes before gametime on the first day of the period.
� Owners may set lineups and change players' positions.
� Only players who are on the disabled list may be placed into Injured status.
� Add/drops must be approved by the commissioner.
� Owners may do trades.
� No trades can be made after the trade deadline of 11:59 PM ET 8/27/06.
(Click Here to set a reminder)
� Owners may make trades during the offseason.
Schedule: Weekly scoring periods, starting on Mondays.
Min/Max: Min AB: 4250
Min IP: 900
� Teams not meeting the minimums will receive 0 points in categories using AB or IP (e.g., BA or ERA)
Fees: League Entry Fee: 190
Scoring: Rotisserie System.
Scoring for Batting Categories
BA - Batting Average
HR - Home Runs
R - Runs
RBI - Runs Batted In
SB - Stolen Bases
Scoring for Pitching Categories
ERA - Earned Run Average
K - Strikeouts (Pitcher)
S - Saves
W - Wins
WHIP - Walks + Hits / Inning
If your interested in the league I can e-mail the constitution to you.


text:
A BlankTV Premiere Presentation:
Stone Iris - "Taste of Fame"
Artist Bio:
Southern Rock from the true north... Reggae music from a cold dark place.
Stone Iris is a brotherhood of like-minded musicians. Playing music everyday and touring are what they live and breathe for. From humble beginnings in Edmonton, Canada, their initial brand of music, a fusion of blues rock with a hint of reggae was created. From there, a common dream was followed and Stone Iris has been blazing their own trail ever since.
Consistent touring, busking, jamming and writing, have allowed the undeniable, yet un-classifiable spectacle known as Stone Iris to fearlessly pursue their craft and passion. With a love for performing, their live show is as honest and original, as it is part of who and what they are. Driven by groove, it makes you move.
Much is in store for Stone Iris in the coming year; including extensive touring, two full length albums and plenty of video footage, so keep your eyes and ears open!
>> Get music by Stone Iris on iTunes and Bandcamp NOW! <<
|< Prev
|Next >


text:
Style # 207111
With glossy leather sleeves and contrast suede collar detail, this bebe leather jacket is sure to lend your winter wardrobe an undeniably glamorous polish.
- 100% leather
- Center back to hem: 18" (46 cm)
- Sleeve length: 25" (64 cm)
- Twill lining
- Sleeve zipper
- Lightweight
- Clean by leather professionals only
- Imported
- Model is 5'9" and is wearing a US size S
Drape Collar Leather Jacket is rated out of 5 by 3.
Rated 5 out of 5 by Tria721 from Lovely jacket This is a great jacket. Easy transition from day to night
Date published: 2013-04-04
Rated 5 out of 5 by Prettyyp29 from Great! Great!! Fits nice, love the material in the front gives it a very classy look.
Date published: 2013-03-23
Rated 5 out of 5 by Chitowngee from Beautifully Made As it is getter increasingly difficult to find real leather jackets, this is an absolute beauty! The suede and leather are both great quality, which allows it to drape nicely. Very pleased with my purchase!
Date published: 2013-02-06


text:
Anyone who lived in Norway for sometime and became familiar with the Norwegian traditions, habits and customs, knows about the obsession which many Norwegians have with reading crime stories and know that many of them spend the whole week of Easter vacation going through such violent literature and watching movies that have bloody content. That obsession can be explained by the fact that the life in Norway is so calm and peaceful and the crime ratio here is one of the lowest in the world and that make any crime -no matter what it is- that may take place anywhere in the country, presented intensively in the news headlines as if it is a highly important and worth to be covered and discussed widely. They feel that their life is enough boring that they are in need to bring some sort of excitement into it, and the crime stories and bloody movies are the best thing that can kick the boredness out of their life with no serious side effects!
But that obsession also can explain the way that most Norwegians look at and treat those who have some foreign origins and live among them in the country, particularly those who escape poverty, war or political-religious persecution and came here aiming to have a new bright start.
The structure of any crime story depends mainly on three basic characters that can be considered the main elements which no crime story can stand lacking one of it, those characters are : a criminal or a suspect, a victim and an inspector/policeman/savior (sort of hero).
The criminal is always representing the evil side and the policeman/inspector/savior is always representing the good side, while the victims are remaining neutral mostly and it doesn't matter whether they are good or bad, they are supposed to stick to their roles as victims and even if they show any positive signs like being brave, doing their best trying to defeat the evil, this will not make them equal to the eyes of those who are obsessed with such literature as the absolute hero who is of course, the one who saved the victim from the "bad guy" who were chased by "the hero" that will finally manage to neutralize, kill him or end up putting him under arrest.
Immigrants who came from outside this continent, especially those who came as refugees are expected to resemble one of just two crime story's roles in the Norwegian mentality, so they expected either to be "the retarded bloody tough criminal" who chase his "poor helpless victim" and kill, steal or rape "her" (mostly taking as men chasing women) without any sense of mercy, or they are expected to be those poor helpless victims who are waiting for "The brave courageous white tall smart blond handsome muscular young man" to save them and such glorious role is just exclusive for white Norwegians to play!
Many Norwegians consider those who came to their country as refugees, role models who are here to fulfil their fantasies and to give their lives sort of excitement and they are expecting them to stick to one of their tiny stupid roles or swing between the two but with no real ambition to get out of this circle and have a normal life which they-refugees- came here dreaming of.
I remember this guy I met right after I landed in Bergen's airport the first time I came to Norway, who told me that he is originally from an Arab country and that he has been living long enough here and how he manages to get the Norwegian citizenship. He told me that getting the citizenship doesn't make you Norwegian citizen as someone who were "native" or born here. The society and the Norwegian system have a different look at immigrants and treat them quite differently regardless how long they've lived here. At that time, I was just new here, full of positive feelings toward the country, as I was under the spell of the media propaganda which presented the living in the Scandinavian countries meant the access to freedom, to equal opportunities, to prosperities and to transparency and that made me ignore what that guy said to me. Since I have enough amount of hate and negativity toward Arabs and Muslims fed by my bad experiences that I had back in Egypt, it was easy for me to omit all what he said and think that he is probably hiding some conservative ideas and views that made him unable to adapt and enjoy the freedom and other great values that supposed to form this society and its system and that might make him feel that he doesn't belong here.
Later when I get more and more into the Norwegian society and system I started feeling that there is something wrong. The Norwegian system when it comes to its written laws and rules is close to be one perfect systems; it guarantees equal opportunities for everyone regardless their ethnic or religious backgrounds. However, the system isn't run by robots, it is run by the society, by people! Even if people are trying to stick to the written laws that they are supposed to apply and follow, their personal views and ideas are not neutral and it can influence the way they look and deal with different people. Then the influence which crime story's roles have over Norwegians and the way they categorize people interfere and damage such amazing system and discrimination start taking place.
When it comes to the Norwegian society, most people don't look at immigrants as they are people who represent themselves by their good or bad acts or habits, but they are representing something they like to refer to as a "culture"! This so-called "culture" is always a set of customs, traditions, beliefs, food, drinks, habits, actions and many other things. Basically and in Norwegian thoughts, belonging to a certain "culture" means that you have to fit into "The cultural box", which means you'd represent all the customs and socio-cultural background of the country you came from, no chance that you are maybe different of the image their imagination has already drawn. Usually, when I meet someone for the first time and the he or she start asking where I came from an alarm tickle inside my mind telling me this is another stupid person trying to figure out in which cultural tiny box he or she can place me!
Anyhow people here don't need to know much about our backgrounds in order to define us "culturally", it's obvious from our skin, eye and hair colors that we are foreigners, so they can just classify us, in their minds, to one of those two roles, and since I am biologically a male, their mind can't think of any better role for me than the bad one to play in their deep fantasies.
Even if people tried to present themselves differently and show the fact that the so-called "culture" of the country where they came from doesn't represent them at all, that will not change anything, not because they don't believe them, but because they don't want to drop their own fantasies by placing people outside such boxes and giving them different roles to play.
And for the sake of such fantasies, they also help immigrants especially those who came from Muslim countries to switch between the roles by turning them from being helpless victims to Islamic extremists that are ready to commit violence- crimes and terrorism at any given opportunity just by being exposed to a huge economic and social pressure that make them look back to their religion that many of them were not paying much attention to it before. Getting them into extreme circles which exist in the mosques they built for them and as Norwegians didn't experience any tragic bloody Islamic terrorist attacks in Norway before, think that everything is under control!
In the Norwegian law all citizens are equal, but to their eyes and in their minds of the vast majority of white Norwegians, equality is just a myth. They don't have to say that frankly, as do openly racist and discriminatory views and attitudes are not mostly welcomed in the society but such views and attitudes can be hided under some masks that make it more attractive and acceptable.
Every Time I was expressing my anti-Islam ideas and views through my social media posts and my media interviews, many of my Norwegian acquaintances were showing that they are unhappy with it and some of them were gossiping about me and saying that I am giving a hand to the Norwegian right wing by expressing myself freely. Later, I realized that their anger was not about my views, but it was actually against me as a person who give them sort of confusion by staying out of the cultural box they put me in already, for them I shouldn't be anything but a violent retarded Muslim who is just pretending he's normal.
The bad influence that Norwegian society have over the Norwegian system can also justify the crime story's theory in understanding the Norwegian mentality. According to the Norwegian mentality or way of thinking, white Norwegians are the smartest, even if their IQ is one of the lowest, and "the others" are the most retarded, even if they are actually smart! That can explain things like why many immigrants have to take the basic high school Norwegian subjects regardless their education level, graduated or not it is means nothing here. In a matter of fact, criminals and victims should always be considered less smart than the brave white hero!
The same thing goes to the work market where immigrants are considered unqualified for most of jobs except for jobs such cleaning and helping oldies (if they managed to get it actually). Because their names don't include the special Norwegian letters Æ, Ø and Å, they have to obey the advice of their blonde Norwegian language teacher who ask them to change their names into Norwegian ones hopefully they will get the honor of being called to a job interview, that can be considered as a proof that the society is trying to fit immigrants to the two roles I already mentioned. Indeed, an immigrant is supposed to be either a drug dealer or a prostitute otherwise, they have to stay home pretending that they are applying for a job that they will never get, in order to convince their "saksbehandler" that they are "aktiv arbeidssøkere" to get their monthly social help paid! Criminals or victims living by the social sidelines, nothing more there to be expected!
I am aware that I am disappointing my dear Norwegian acquaintances by not being able to play the evil role they think it fits me perfectly. The fact that I am human who is identified as a male, and that I was born, grew up and spent the biggest part of my life in the shithole which people referring to as Egypt and that I was brought up by my alleged biological family who happened to be conservative violent Muslim with extreme violent and bloody ideas and views concerning women and non Muslims. Furthermore, I look for most of you ugly and scary that some women runaway in front of me when I am walking in the street, for no obvious reason, despite all these things that you might think should identify me as the best role model to ever exists, who can pop up in your scary nightmares, I am really sorry that I can't fulfill your fantasies and play the evil role in the fairytales and crimes stories you've been reading during your lifetime, because simply I have never been like that. I am the one who always was bullied and beaten at school by my colleagues and teachers when I was young. I grew up as an introvert person who avoid social life and has no friends and never played any kind of sports that can make me tough and violent, and in my early adulthood I started feeling disgust toward my family violent ideas and views that are inspired from their religion and I took strong stand against it that led me to be socially rejected and sent me to jail for four years at the age of 22. Unfortunately, all my personal history and living make of me the worst role model who can fulfill your fantasies by just being the bad guy who kill, steal and rape. I am really sorry to disappoint you, that nothing not even the discriminative treatment you're showing or you will continue too will make me fit. So at the end and while you're reading this article, where I am presenting myself as a helpless victim, I hope you can find some satisfaction and same excitement you may experience when you're reading your crime-story books!