ModSecurity

购买 Self-Hosted Protection
Live
Demo
ModSecurity WAF
缓存: 11:14:50 刷新
ModSecurity 运行中
今天
2592
已拦截
209
样本总数
2592
唯一 IP 数
10
所有已启用规则
规则列表不可用 —— 请更新 monitor-modsec 包装脚本，添加 ---RULES--- 部分（见 FAQ）。
攻击类型
XSS
11
LFI/Path Traversal
11
Scanner
11
SQL Injection
8
Protocol Attack
7
RCE
5
攻击 IP 排行
IP事件
198.51.100.275
198.51.100.225
198.51.100.354
198.51.100.284
198.51.100.183
198.51.100.323
198.51.100.163
198.51.100.143
198.51.100.302
198.51.100.152
目标 URL 排行
URI事件
/.env12
/?q=../../etc/passwd9
/index.php?id=18
/admin/8
/api/v1/login6
/wp-login.php6
/xmlrpc.php4
触发规则排行
规则 ID触发次数
913100
Security scanner — User-Agent		 15
942100
SQL Injection via libinjection		 11
941100
XSS via libinjection		 10
930100
Path Traversal (/../)		 9
932100
RCE — Unix commands		 8
最近事件 53 条记录
时间IPURI类型规则操作
2026-10-12 11:14:50 198.51.100.18 /api/v1/login Protocol Attack 932100
RCE — Unix commands		 已拦截
2026-10-12 10:50:10 198.51.100.35 /index.php?id=1 SQL Injection 913100
Security scanner — User-Agent		 已拦截
2026-10-12 10:32:30 198.51.100.27 /?q=../../etc/passwd XSS 932100
RCE — Unix commands		 已检测
2026-10-12 09:49:59 198.51.100.32 /wp-login.php RCE 930100
Path Traversal (/../)		 已拦截
2026-10-12 10:15:22 198.51.100.16 /wp-login.php XSS 930100
Path Traversal (/../)		 已拦截
2026-10-12 08:33:25 198.51.100.23 /admin/ LFI/Path Traversal 941100
XSS via libinjection		 已检测
2026-10-12 10:04:44 198.51.100.16 /index.php?id=1 SQL Injection 913100
Security scanner — User-Agent		 已拦截
2026-10-12 08:54:50 198.51.100.30 /xmlrpc.php XSS 941100
XSS via libinjection		 已检测
2026-10-12 09:45:22 198.51.100.15 /admin/ SQL Injection 942100
SQL Injection via libinjection		 已检测
2026-10-12 08:55:02 198.51.100.29 /?q=../../etc/passwd LFI/Path Traversal 942100
SQL Injection via libinjection		 已检测
2026-10-12 06:53:10 198.51.100.11 /index.php?id=1 XSS 942100
SQL Injection via libinjection		 已检测
2026-10-12 05:34:12 198.51.100.22 /admin/ RCE 932100
RCE — Unix commands		 已检测
2026-10-12 08:43:14 198.51.100.22 /wp-login.php LFI/Path Traversal 942100
SQL Injection via libinjection		 已检测
2026-10-12 06:03:42 198.51.100.32 /?q=../../etc/passwd LFI/Path Traversal 942100
SQL Injection via libinjection		 已检测
2026-10-12 05:44:12 198.51.100.24 /.env Scanner 930100
Path Traversal (/../)		 已检测
2026-10-12 07:25:05 198.51.100.18 /api/v1/login Scanner 942100
SQL Injection via libinjection		 已拦截
2026-10-12 06:08:26 198.51.100.27 /index.php?id=1 LFI/Path Traversal 913100
Security scanner — User-Agent		 已检测
2026-10-12 02:51:04 198.51.100.14 /.env Scanner 930100
Path Traversal (/../)		 已检测
2026-10-12 03:05:50 198.51.100.18 /?q=../../etc/passwd LFI/Path Traversal 941100
XSS via libinjection		 已检测
2026-10-12 02:36:27 198.51.100.28 /.env XSS 941100
XSS via libinjection		 已检测
2026-10-12 09:09:30 198.51.100.12 /.env SQL Injection 941100
XSS via libinjection		 已检测
2026-10-12 09:56:26 198.51.100.35 /.env Protocol Attack 942100
SQL Injection via libinjection		 已检测
2026-10-12 08:36:04 198.51.100.28 /xmlrpc.php XSS 942100
SQL Injection via libinjection		 已检测
2026-10-12 03:55:09 198.51.100.28 /.env XSS 932100
RCE — Unix commands		 已检测
2026-10-12 07:47:14 198.51.100.16 /api/v1/login Scanner 932100
RCE — Unix commands		 已检测
2026-10-12 00:38:35 198.51.100.34 /?q=../../etc/passwd Scanner 913100
Security scanner — User-Agent		 已检测
2026-10-12 00:48:40 198.51.100.13 /.env Scanner 913100
Security scanner — User-Agent		 已检测
2026-10-11 22:38:50 198.51.100.35 /wp-login.php Scanner 932100
RCE — Unix commands		 已检测
2026-10-12 06:48:50 198.51.100.35 /.env LFI/Path Traversal 941100
XSS via libinjection		 已拦截
2026-10-12 01:29:31 198.51.100.27 /api/v1/login LFI/Path Traversal 941100
XSS via libinjection		 已拦截
2026-10-11 20:55:20 198.51.100.27 /index.php?id=1 Protocol Attack 913100
Security scanner — User-Agent		 已检测
2026-10-12 04:40:37 198.51.100.21 /wp-login.php XSS 941100
XSS via libinjection		 已检测
2026-10-11 22:09:14 198.51.100.32 /admin/ SQL Injection 932100
RCE — Unix commands		 已检测
2026-10-12 05:40:59 198.51.100.22 /admin/ LFI/Path Traversal 913100
Security scanner — User-Agent		 已检测
2026-10-11 23:09:30 198.51.100.22 /?q=../../etc/passwd SQL Injection 930100
Path Traversal (/../)		 已检测
2026-10-11 17:51:15 198.51.100.20 /.env Protocol Attack 913100
Security scanner — User-Agent		 已检测
2026-10-11 16:49:38 198.51.100.17 /index.php?id=1 Scanner 930100
Path Traversal (/../)		 已检测
2026-10-11 23:17:39 198.51.100.30 /admin/ Scanner 942100
SQL Injection via libinjection		 已检测
2026-10-11 17:10:34 198.51.100.17 /xmlrpc.php Protocol Attack 941100
XSS via libinjection		 已检测
2026-10-12 01:29:11 198.51.100.26 /index.php?id=1 Protocol Attack 930100
Path Traversal (/../)		 已拦截
2026-10-11 20:46:50 198.51.100.20 /.env SQL Injection 913100
Security scanner — User-Agent		 已检测
2026-10-12 08:57:29 198.51.100.21 /.env XSS 930100
Path Traversal (/../)		 已拦截
2026-10-11 23:54:26 198.51.100.14 /wp-login.php RCE 930100
Path Traversal (/../)		 已检测
2026-10-11 21:51:27 198.51.100.26 /admin/ LFI/Path Traversal 942100
SQL Injection via libinjection		 已检测
2026-10-11 14:00:18 198.51.100.14 /api/v1/login Scanner 932100
RCE — Unix commands		 已检测
2026-10-12 03:50:50 198.51.100.34 /api/v1/login Scanner 913100
Security scanner — User-Agent		 已拦截
2026-10-11 14:35:54 198.51.100.27 /?q=../../etc/passwd RCE 941100
XSS via libinjection		 已检测
2026-10-12 06:47:43 198.51.100.25 /?q=../../etc/passwd SQL Injection 913100
Security scanner — User-Agent		 已检测
2026-10-11 09:12:26 198.51.100.19 /index.php?id=1 XSS 913100
Security scanner — User-Agent		 已拦截
2026-10-12 04:07:43 198.51.100.13 /.env XSS 913100
Security scanner — User-Agent		 已检测
2026-10-11 15:24:00 198.51.100.15 /admin/ RCE 913100
Security scanner — User-Agent		 已检测
2026-10-12 02:03:11 198.51.100.28 /xmlrpc.php Protocol Attack 942100
SQL Injection via libinjection		 已检测
2026-10-11 20:54:14 198.51.100.22 /?q=../../etc/passwd LFI/Path Traversal 913100
Security scanner — User-Agent		 已拦截

为审计日志准备的 ModSecurity log viewer

ModSecurity 配上 OWASP Core Rule Set 会拦下大量东西，并把其中几乎所有内容写进一份格式为机器而设的审计日志。这一页把它变成人能读的东西：哪些请求被拦、哪条规则触发、异常分是多少，以及请求来自何处。

定期来看这一页的理由是误报。核心规则集是刻意严格的，在默认的偏执等级下，它会在大多数真实应用中拦下合法流量：文件上传、富文本编辑器，以及一切会提交标记或类 SQL 字符串的东西，都是常见的受害者。需要认出的模式是：同一个规则编号在同一个接口上、从许多不同地址反复触发。那不是攻击，那是你自己的应用被抓住了。

找到这种情形时，把例外范围收窄：只排除那一条规则、针对那一个参数、在那一条路径上——绝不要排除整条规则，更不要排除整个类别。这一页同时列出当前生效的规则集，方便你在改动之后确认到底加载了什么。