ModSecurity Log Viewer — revizioni panel WAF

ModSecurity WAF

Keš: 11:52:25 Osveži

ModSecurity Aktivna

Danas

2523

Blokirano

151

Ukupno u uzorku

2523

Jedinstvenih IP

Sva aktivna pravila

Lista pravila nije dostupna — ažurirajte omotač monitor-modsec dodavanjem sekcije ---RULES--- (vidi FAQ).

Tipovi napada

LFI/Path Traversal

RCE

XSS

Scanner

Protocol Attack

SQL Injection

Najčešći napadački IP-ovi

IP	Događaji
`198.51.100.31`	6
`198.51.100.15`	6
`198.51.100.35`	4
`198.51.100.25`	4
`198.51.100.28`	4
`198.51.100.23`	3
`198.51.100.30`	3
`198.51.100.34`	3
`198.51.100.24`	3
`198.51.100.26`	2

Najčešći ciljni URL-ovi

URI	Događaji
`/.env`	10
`/xmlrpc.php`	9
`/wp-login.php`	8
`/api/v1/login`	8
`/index.php?id=1`	7
`/admin/`	6
`/?q=../../etc/passwd`	4

Najčešće aktivirana pravila

ID pravila	Aktiviranja
`942100` SQL Injection via libinjection	14
`930100` Path Traversal (/../)	12
`913100` Security scanner — User-Agent	9
`932100` RCE — Unix commands	9
`941100` XSS via libinjection	8

Poslednji događaji 52 unosa

Vreme	IP	URI	Tip	Pravilo	Radnja
2026-10-13 11:52:25	`198.51.100.31`	`/xmlrpc.php`	LFI/Path Traversal	930100 Path Traversal (/../)	Otkriveno
2026-10-13 11:32:26	`198.51.100.15`	`/.env`	Scanner	930100 Path Traversal (/../)	Otkriveno
2026-10-13 11:24:35	`198.51.100.35`	`/xmlrpc.php`	RCE	913100 Security scanner — User-Agent	Otkriveno
2026-10-13 11:31:58	`198.51.100.25`	`/?q=../../etc/passwd`	Scanner	930100 Path Traversal (/../)	Otkriveno
2026-10-13 10:18:49	`198.51.100.28`	`/wp-login.php`	XSS	942100 SQL Injection via libinjection	Otkriveno
2026-10-13 10:32:35	`198.51.100.23`	`/index.php?id=1`	Scanner	942100 SQL Injection via libinjection	Otkriveno
2026-10-13 10:02:37	`198.51.100.26`	`/?q=../../etc/passwd`	XSS	932100 RCE — Unix commands	Blokirano
2026-10-13 08:43:53	`198.51.100.30`	`/xmlrpc.php`	SQL Injection	942100 SQL Injection via libinjection	Otkriveno
2026-10-13 07:27:37	`198.51.100.13`	`/.env`	SQL Injection	942100 SQL Injection via libinjection	Otkriveno
2026-10-13 09:16:43	`198.51.100.15`	`/index.php?id=1`	Protocol Attack	942100 SQL Injection via libinjection	Otkriveno
2026-10-13 09:22:25	`198.51.100.32`	`/.env`	XSS	942100 SQL Injection via libinjection	Otkriveno
2026-10-13 08:11:30	`198.51.100.31`	`/.env`	LFI/Path Traversal	941100 XSS via libinjection	Blokirano
2026-10-13 05:22:37	`198.51.100.23`	`/xmlrpc.php`	RCE	942100 SQL Injection via libinjection	Blokirano
2026-10-13 09:51:05	`198.51.100.34`	`/index.php?id=1`	Protocol Attack	913100 Security scanner — User-Agent	Otkriveno
2026-10-13 08:54:51	`198.51.100.33`	`/index.php?id=1`	XSS	932100 RCE — Unix commands	Blokirano
2026-10-13 10:23:25	`198.51.100.35`	`/.env`	LFI/Path Traversal	942100 SQL Injection via libinjection	Otkriveno
2026-10-13 10:26:17	`198.51.100.28`	`/.env`	LFI/Path Traversal	913100 Security scanner — User-Agent	Otkriveno
2026-10-13 03:12:47	`198.51.100.24`	`/admin/`	Protocol Attack	930100 Path Traversal (/../)	Otkriveno
2026-10-13 05:48:49	`198.51.100.31`	`/admin/`	RCE	930100 Path Traversal (/../)	Otkriveno
2026-10-13 06:57:55	`198.51.100.26`	`/api/v1/login`	XSS	942100 SQL Injection via libinjection	Otkriveno
2026-10-13 07:40:45	`198.51.100.30`	`/xmlrpc.php`	SQL Injection	941100 XSS via libinjection	Otkriveno
2026-10-13 06:31:49	`198.51.100.21`	`/.env`	LFI/Path Traversal	941100 XSS via libinjection	Otkriveno
2026-10-13 02:58:33	`198.51.100.32`	`/api/v1/login`	SQL Injection	941100 XSS via libinjection	Blokirano
2026-10-13 08:28:52	`198.51.100.24`	`/.env`	Protocol Attack	932100 RCE — Unix commands	Blokirano
2026-10-13 08:41:13	`198.51.100.35`	`/xmlrpc.php`	RCE	942100 SQL Injection via libinjection	Blokirano
2026-10-12 22:57:50	`198.51.100.35`	`/wp-login.php`	LFI/Path Traversal	930100 Path Traversal (/../)	Otkriveno
2026-10-13 06:45:11	`198.51.100.11`	`/admin/`	Protocol Attack	930100 Path Traversal (/../)	Blokirano
2026-10-13 00:59:01	`198.51.100.24`	`/xmlrpc.php`	Scanner	941100 XSS via libinjection	Otkriveno
2026-10-13 02:37:05	`198.51.100.20`	`/xmlrpc.php`	Scanner	941100 XSS via libinjection	Blokirano
2026-10-13 03:06:04	`198.51.100.25`	`/api/v1/login`	XSS	930100 Path Traversal (/../)	Blokirano
2026-10-12 20:55:25	`198.51.100.31`	`/wp-login.php`	LFI/Path Traversal	930100 Path Traversal (/../)	Otkriveno
2026-10-13 01:13:49	`198.51.100.15`	`/.env`	SQL Injection	913100 Security scanner — User-Agent	Otkriveno
2026-10-13 09:10:17	`198.51.100.30`	`/api/v1/login`	RCE	913100 Security scanner — User-Agent	Blokirano
2026-10-13 09:04:40	`198.51.100.25`	`/index.php?id=1`	Scanner	913100 Security scanner — User-Agent	Blokirano
2026-10-13 02:43:53	`198.51.100.20`	`/api/v1/login`	LFI/Path Traversal	913100 Security scanner — User-Agent	Otkriveno
2026-10-12 19:48:45	`198.51.100.28`	`/index.php?id=1`	RCE	941100 XSS via libinjection	Otkriveno
2026-10-13 00:44:01	`198.51.100.15`	`/?q=../../etc/passwd`	LFI/Path Traversal	932100 RCE — Unix commands	Otkriveno
2026-10-13 00:03:15	`198.51.100.31`	`/xmlrpc.php`	RCE	942100 SQL Injection via libinjection	Otkriveno
2026-10-13 00:26:31	`198.51.100.34`	`/admin/`	RCE	913100 Security scanner — User-Agent	Otkriveno
2026-10-12 14:46:13	`198.51.100.29`	`/wp-login.php`	XSS	932100 RCE — Unix commands	Otkriveno
2026-10-13 02:13:05	`198.51.100.34`	`/wp-login.php`	LFI/Path Traversal	932100 RCE — Unix commands	Otkriveno
2026-10-13 04:00:14	`198.51.100.15`	`/admin/`	Protocol Attack	930100 Path Traversal (/../)	Otkriveno
2026-10-12 16:29:43	`198.51.100.31`	`/api/v1/login`	LFI/Path Traversal	930100 Path Traversal (/../)	Otkriveno
2026-10-13 05:14:40	`198.51.100.14`	`/index.php?id=1`	XSS	941100 XSS via libinjection	Otkriveno
2026-10-13 04:17:45	`198.51.100.15`	`/?q=../../etc/passwd`	Scanner	932100 RCE — Unix commands	Otkriveno
2026-10-13 01:28:25	`198.51.100.17`	`/wp-login.php`	Scanner	942100 SQL Injection via libinjection	Blokirano
2026-10-12 18:55:03	`198.51.100.28`	`/.env`	XSS	930100 Path Traversal (/../)	Otkriveno
2026-10-13 05:32:30	`198.51.100.17`	`/api/v1/login`	LFI/Path Traversal	932100 RCE — Unix commands	Blokirano
2026-10-12 14:45:13	`198.51.100.25`	`/admin/`	Protocol Attack	932100 RCE — Unix commands	Blokirano
2026-10-12 14:52:18	`198.51.100.23`	`/wp-login.php`	RCE	913100 Security scanner — User-Agent	Otkriveno
2026-10-12 22:31:35	`198.51.100.21`	`/wp-login.php`	Protocol Attack	942100 SQL Injection via libinjection	Blokirano
2026-10-12 15:29:16	`198.51.100.16`	`/api/v1/login`	SQL Injection	942100 SQL Injection via libinjection	Blokirano

ModSecurity log viewer za revizioni zapis

ModSecurity sa OWASP Core Rule Set blokira izuzetno mnogo i o skoro svemu tome piše u revizioni zapis čiji je format napravljen za mašine. Ova stranica ga pretvara u nešto čitljivo: koji zahtevi su blokirani, koje pravilo se aktiviralo, koliki je bio rezultat anomalije i odakle je zahtev došao.

Razlog da se ovde redovno svrati jesu lažno pozitivni nalazi. Core Rule Set je namerno strog i na podrazumevanom nivou paranoje blokira legitiman saobraćaj u većini stvarnih aplikacija: slanje datoteka, uređivači formatiranog teksta i sve što šalje oznake ili niske nalik SQL-u uobičajene su žrtve. Obrazac koji treba prepoznati jeste isti identifikator pravila koji se iznova aktivira na istoj krajnjoj tački sa mnogo različitih adresa. To nije napad, to se hvata vaša sopstvena aplikacija.

Kada takav slučaj nađete, držite izuzetak uskim: isključite baš to pravilo za baš taj parametar na baš toj putanji, nikada celo pravilo, a još manje celu kategoriju. Stranica takođe navodi aktivan skup pravila, da posle izmene potvrdite šta je zaista učitano.

ModSecurity WAF

ModSecurity log viewer za revizioni zapis

Demo režim