yoda
yoda copied to clipboard
YDA-5984 add mod-evasive to Ubuntu and Alma 9
Added mod-evasive to prevent from large amount of simultaneous Fuzzing requests. Tests have been performed:
- Install and overwrite existing mod-evasive config (ubuntu) -> Done
- Install mod-evasive in a new and clean VM (ubuntu)-> Done.
- Install and overwrite existing mod-evasive config (Alma 9) -> DOing
- Install mod-evasive in a new and clean VM (Alma 9)-> Done.
How to test with FFUF fuzzing
- Install FFUF fuzzing, and prepare a wordlist.txt (example: download from https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/common.txt )
- Run with
./ffuf/ffuf -u https://portal.yoda.test/FUZZ -w ./wordlist.txt -of html -o ./outputfile.html -mc 200,204,301,302,307,401,403,308 -rate 60 -t 100whererate> 50 should cause Sever Denials in Apache LOg.
Update:
- Per the discussion within YODA team, the mod_evasive will not be used in production env of yoda. And we'll create new Spike and stories to investigate alternatives.