ModSecurity Handbook cover

The second edition of the definitive guide to ModSecurity, by Christian Folini and Ivan Ristić

This book will teach you how to monitor activity on your web sites and protect them from attack. Situated between web sites and the world, web application firewalls provide an additional security layer, monitoring everything that comes in and everything that goes out. They enable you to perform many advanced activities, such as access control, virtual patching, HTTP traffic logging, continuous passive security assessment, and web application hardening. This book covers ModSecurity 2.x.

Buy Ebook   £24
Amazon rating

What's In The Book

Table of Contents

Part I: User Guide
  • 1. Introduction
  • 2. Installation
  • 3. Configuration
  • 4. Logging
  • 5. Rule Language Overview
  • 6. Rule Language Tutorial
  • 7. Rule Configuration
  • 8. Persistent Storage
  • 9. Practical Rule Writing
  • 10. Performance
  • 11. Content Injection
  • 12. Writing Rules in Lua
  • 13. Handling XML
  • 14. Extending Rule Language
Part II: Reference Manual
Last Update: July 2017
First Edition: March 2010
Digital formats: PDF, EPUB (no DRM) Print Length: 454 pages
ISBN: 978-1907117077

This book exists to document every single aspect of ModSecurity and to teach you how to use it. It’s as simple as that. ModSecurity is a fantastic tool, but it’s let down by the poor quality of the documentation. As a result, the adoption is not as good as it could be; application security is difficult on its own, and you don’t really want to struggle with poorly documented tools too.

The first edition of ModSecurity Handbook was written by Ivan Ristić, who is also the original author of ModSecurity. He left the web application firewall field in 2010 and made this book his parting gift to the community. Christian Folini, a core member of the OWASP ModSecurity Core Rules project, picked up the book later and updated it for the second edition in 2017, with Ivan still involved, but in the technical editor role.

So what's in this book? Once you move past the first chapter, which is the introduction to the world of ModSecurity, the rest of the book consists of roughly four parts. In the first part (chapters two through four), you learn how to install and configure ModSecurity. In the second part (chapters five through nine), you learn how to write rules. The third part contains a series of chapters dealing with some advanced topics, each chapter dedicated to one important aspect of ModSecurity. The book ends with a reference manual, which was forked from the official documentation in 2010 and heavily modified and improved since.

And there you have it. If you're interested in ModSecurity 2.x, this book will tell you everything you need to know.

Testimonials

“I'm very new to ModSecurity and I found the guide to be very useful as a beginner. The books pacing is very good, starting with basics, not assuming the reader to be an expert and slowly going to great depths and advanced levels.

Emre Sevinç, on Amazon.com

“I used this book to build a FIPS 140-2 WAF with ModSecurity and Nginx. This book greatly accelerated the development of my abilities with ModSecurity. Worth the money all day.

Ryan, on Amazon.com

“This book is a must have for anyone tasked with protecting web apps with ModSecurity. While there are many tutorials and various hints and tricks scattered throught the internet, this book will take you from a complete beginner to ModSecurity ninja level status by the time you're done.

Joshua Zlatin, on Amazon.com

“I learnt some new tips, even after 15 years using ModSecurity!

Marc Stern, Cyber Security Consulting Director at Approach Belgium

“Complete and authoritative

Rich Bowen, on Amazon.com

“Anyone who has used, or attempted to use, ModSecurity web application firewall on their own knows how time consuming—and frustrating—it can be. This book serves as a brotherly guide to installing, configuring and running ModSecurity effectively with less pain.

Tin Zaw, on Amazon.com

“Finally, there is a concise overview of ModSecurity from the main developer of the module. The official documentation of ModSecurity falls short in the rule writing area. And this is where this book excels.

dune73, on Amazon.com

“As the Sr. Product Manager of a service provider that is leveraging ModSecurity for its WAF solution, I advise that if you are at all serious about deploying ModSecurity, then this book is you should own.

Andrew Ward, on Amazon.com

“This book is now my first reference point for any queries regarding ModSecurity configuration, optimization and rule writing. Over the years, there are many tips and useful information scattered through blogs and mailing lists, but it's good to have the best of those pulled together into a single reference document.

Colin Watson, on Amazon.com

“All you need to harden your web presence with ModSecurity is at your fingertips with the ModSecurity Handbook.

Russ McRee, on Amazon.com

“I'm a penetration tester and regularly come in contact with WAF's, including ModSecurity. This book has all necessary information not only to setup ModSecurity as a defender, but also provides a deep dive into the ruleset and how it works.

Dobin Rutishauser, on Amazon.com

“This is a nerdy reference book.

Kludged, on Amazon.com

About the Author

Ivan Ristic

Dr. Christian Folini is a partner at netnea AG in Berne, Switzerland. He holds a PhD in medieval history and enjoys defending castles across Europe. Unfortunately, defending medieval castles is no big business anymore and Christian turned to defending web servers which he thinks equally challenging. With his background in humanities, Christian is able to bridge the gap between techies and non-techies. He brings more than ten years' experience in this role, specialising in Apache / ModSecurity configuration, threat modeling and security of voting systems.

Christian is a Co-Lead of the OWASP ModSecurity Core Rule Set project and the program chair of the Swiss Cyber Storm conference. Christian is a frequent speaker at conferences where he tries to use his background in the humanities to explain hardcore technical topics to audiences of different backgrounds.

Christian also offers ModSecurity training via the netnea website.

About the Author

Ivan Ristic

Ivan Ristić writes computer security books and builds security products. His book Bulletproof TLS and PKI, the result of more than a decade of research and study, is widely recognised as the de facto SSL/TLS and PKI reference manual. His work on SSL Labs made millions of web sites more secure. Before that, he created ModSecurity, a leading open-source web application firewall.

More recently, Ivan founded Hardenize—now part of Red Sift—as a platform for continuous discovery and monitoring of network infrastructure. He now works as Chief Scientist at Red Sift.