Update README.md

2017-12-30 01:17:15 +01:00
parent ffe903487f
commit a876bc8f7f
1 changed files with 52 additions and 0 deletions
@@ -8,3 +8,55 @@ Ubuntu 14.04 in you VM/VPS/DEDICATED so
 2. **`cd The-World-Is-Yours/; chmod +x *`**
 3. **`./install`**
 # Check.
 1. L7 (Cookie Based Protection) => https://github.com/theraw/The-World-Is-Yours/blob/master/static/nginx.conf#L19-L301
 2. Naxsi Rules Included         => https://github.com/theraw/The-World-Is-Yours/blob/master/static/nginx.conf#L392
 3. ModSecurity is not loaded. However you need to set it up by yourself. you have a folder `/nginx/modsecurity/`
 where its stored open `/nginx/modsecurity/modsecurity.conf` add those
 ```bash
 Include crs-setup.conf
 Include rules/*.conf
 ```
 ModSecurity is by default enabled as "detect only" you can turn it on always by doing this
 ```bash
 SecRuleEngine On
 ```
 Using modSecurity for your site
 ```bash
 server { 
     ..... 
        modsecurity on;
        modsecurity_rules_file /nginx/modsecurity/modsecurity.conf; 
        location / { 
     ..... 
        } 
 }
 ```
 **Careful** Using modsec rules like
 ```
   location / { 
       modsecurity_rules_file /nginx/modsecurity/modsecurity.conf; 
   } 
 ```
 it means that's enabled just for your main place `/` not for other dirs in your site ex `/admin/` (:
 Test it!
 `curl 'http://localhost/?q="><script>wanna hack</script>'`
 ```bash
 <html>
 <head><title>403 Forbidden</title></head>
 <body bgcolor="white">
 <center><h1>403 Forbidden</h1></center>
 <hr><center>nginx</center>
 </body>
 </html>
 ```