.Little Hann

ModSecurity web application firewall (WAF) Research

catalog

0. 引言
1. OWASP ModSecurity Core Rule Set (CRS) Project
2. Installation mod_security for Apache
3. Installation mod_security for nginx
4. Installation mod_security for IIS
5. mod_security Configuration Directives
6. Processing Phases
7. Variables
8. Transformation functions
9. Actions
10. Operators
11. A Recommended Base Configuration

0. 引言

ModSecurity is an open source, cross-platform web application firewall (WAF) module. Known as the "Swiss Army Knife" of WAFs, it enables web application defenders to gain visibility into HTTP(S) traffic and provides a power rules language and API to implement advanced protections.

0x1: Introduction

ModSecurity is a web application firewall (WAF). With over 70% of attacks now carried out over the web application level, organisations need all the help they can get in making their systems secure. WAFs are deployed to establish an increased external security layer to detect and/or prevent attacks before they reach web applications. ModSecurity provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring and real-time analysis with little or no changes to existing infrastructure.

0x2: HTTP Traffic Logging

Web servers are typically well-equipped to log traffic in a form useful for marketing analyses, but fall short logging traffic to web applications. In particular, most are not capable of logging the request bodies. Your adversaries know this, and that is why most attacks are now carried out via POST requests, rendering your systems blind. ModSecurity makes full HTTP transaction logging possible, allowing complete requests and responses to be logged. Its logging facilities also allow fine-grained decisions to be made about exactly what is logged and when, ensuring only the relevant data is recorded. As some of the request and/or response may contain sensitive data in certain fields, ModSecurity can be configured to mask these fields before they are written to the audit log.

0x3: Real-Time Monitoring and Attack Detection

In addition to providing logging facilities, ModSecurity can monitor the HTTP traffic in real time in order to detect attacks. In this case, ModSecurity operates as a web intrusion detection tool, allowing you to react to suspicious events that take place at your web systems.
modsecurity定制了一套rule规则格式，安全人员可以通过外部文件的方式灵活地修改防御规则

0x4: Attack Prevention and Virtual Patching

ModSecurity can also act immediately to prevent attacks from reaching your web applications. There are three commonly used approaches

1. Negative security model(black list)
A negative security model monitors requests for anomalies, unusual behaviour, and common web application attacks. It keeps anomaly scores for each request, IP addresses, application sessions, and user accounts. Requests with high anomaly scores are either logged or rejected altogether.

2. Positive security model(white list)
When a positive security model is deployed, only requests that are known to be valid are accepted, with everything else rejected. This model requires knownledge of the web applications you are protecting. Therefore a positive security model works best with applications that are heavily used but rarely updated so that maintenance of the model is minimized.

3. Known weaknesses and vulnerabilities(vul rule)
Its rule language makes ModSecurity an ideal external patching tool. External patching (sometimes referred to as Virtual Patching) is about reducing the window of opportunity. Time needed to patch application vulnerabilities often runs to weeks in many organisations. With ModSecurity, applications can be patched from the outside, without touching the application source code (and even without any access to it), making your systems secure until a proper patch is applied to the application.

0x5: Flexible Rule Engine

A flexible rule engine sits in the heart of ModSecurity. It implements the ModSecurity Rule Language, which is a specialised programming language designed to work with HTTP transaction data. The ModSecurity Rule Language is designed to be easy to use, yet flexible:

1. common operations are simple while complex operations are possible. 
2. Certified ModSecurity Rules, included with ModSecurity, contain a comprehensive set of rules that implement general-purpose hardening, protocol validation and detection of common web application security issues. 
3. Heavily commented, these rules can be used as a learning tool.

0x6: Embedded-mode Deployment

ModSecurity is an embeddable web application firewall, which means it can be deployed as part of your existing web server infrastructure provided your web servers are either Apache, IIS7 or Nginx. This deployment method has certain advantages:

1. No changes to existing network. It only takes a few minutes to add ModSecurity to your existing web servers. And because it was designed to be completely passive by default, you are free to deploy it incrementally and only use the features you need. It is equally easy to remove or deactivate it if required.

2. No single point of failure. Unlike with network-based deployments, you will not be introducing a new point of failure to your system.

3. Implicit load balancing and scaling. Because it works embedded in web servers, ModSecurity will automatically take advantage of the additional load balancing and scalability features. You will not need to think of load balancing and scaling unless your existing system needs them.

4. Minimal overhead. Because it works from inside the web server process there is no overhead for network communication and minimal overhead in parsing and data exchange.
No problem with encrypted or compressed content. Many IDS systems have difficulties analysing SSL traffic. This is not a problem for ModSecurity because it is positioned to work when the traffic is decrypted and decompressed.

Relevant Link:

https://www.modsecurity.org/download.html
http://www.onlamp.com/pub/a/onlamp/2005/06/09/wss_security.html

1. OWASP ModSecurity Core Rule Set (CRS) Project

0x1: Overview

ModSecurity is a web application firewall engine that provides very little protection on its own. In order to become useful, ModSecurity must be configured with rules. In order to enable users to take full advantage of ModSecurity out of the box, Trustwave's SpiderLabs created the OWASP ModSecurity Core Rule Set (CRS) Project. Unlike intrusion detection and prevention systems, which rely on signatures specific to known vulnerabilities, the CRS provide generic protection from unknown vulnerabilities often found in web applications, which are in most cases custom coded. The CRS is heavily commented to allow it to be used as a step-by-step deployment guide for ModSecurity.

0x2: Core Rules Content

In order to provide generic web applications protection, the CRS use some of the following example techniques:

1. HTTP protection - detecting violations of the HTTP protocol and a locally defined usage policy.
2. Common Web Attacks Protection - detecting common web application security attack.
3. Automation detection - Detecting bots, crawlers, scanners and other surface malicious activity.
4. Trojan Protection - Detecting access to Trojans horses.
5. Error Hiding - Disguising error messages sent by the server.

Relevant Link:

https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project

2. Installation mod_security for Apache

1. mkdir D:\wamp\bin\apache\apache2.4.9\modules\mod_security2
2. 下载mod_security二进制分发版本: http://www.apachelounge.com/download/VC14/modules/mod_security-2.9.0-win64-VC14.zip
3. 解压缩: modsecurity-2.9.0.tar.gz
4. copy mod_security2.so to D:\wamp\bin\apache\apache2.4.9\modules\mod_security2
5. 配置mod_security配置文件: modsecurity.conf
/*
# -- Rule engine initialization ----------------------------------------------

SecRuleEngine On
SecDefaultAction "deny,phase:2,status:403"

# -- Request body handling ---------------------------------------------------

# Allow ModSecurity to access request bodies. If you don't, ModSecurity
# won't be able to see any POST parameters, which opens a large security
# hole for attackers to exploit.
#
SecRequestBodyAccess On

# Enable XML request body parser.
# Initiate XML Processor in case of xml content-type
#
SecRule REQUEST_HEADERS:Content-Type "text/xml" \
"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"

# Enable JSON request body parser.
# Initiate JSON Processor in case of JSON content-type; change accordingly
# if your application does not use 'application/json'
#
SecRule REQUEST_HEADERS:Content-Type "application/json" \
"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"

# Maximum request body size we will accept for buffering. If you support
# file uploads then the value given on the first line has to be as large
# as the largest file you are willing to accept. The second value refers
# to the size of data, with files excluded. You want to keep that value as
# low as practical.
#
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072

# Store up to 128 KB of request body data in memory. When the multipart
# parser reachers this limit, it will start using your hard disk for
# storage. That is slow, but unavoidable.
#
SecRequestBodyInMemoryLimit 131072

# What do do if the request body size is above our configured limit.
# Keep in mind that this setting will automatically be set to ProcessPartial
# when SecRuleEngine is set to DetectionOnly mode in order to minimize
# disruptions when initially deploying ModSecurity.
#
SecRequestBodyLimitAction Reject

# Verify that we've correctly processed the request body.
# As a rule of thumb, when failing to process a request body
# you should reject the request (when deployed in blocking mode)
# or log a high-severity alert (when deployed in detection-only mode).
#
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"

# By default be strict with what we accept in the multipart/form-data
# request body. If the rule below proves to be too strict for your
# environment consider changing it to detection-only. You are encouraged
# _not_ to remove it altogether.
#
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:400, \
msg:'Multipart request body failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"

# Did we see anything that might be a boundary?
#
SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"

# PCRE Tuning
# We want to avoid a potential RegEx DoS condition
#
SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000

# Some internal errors will set flags in TX and we will need to look for these.
# All of these are prefixed with "MSC_". The following flags currently exist:
#
# MSC_PCRE_LIMITS_EXCEEDED: PCRE match limits were exceeded.
#
SecRule TX:/^MSC_/ "!@streq 0" \
"id:'200005',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"

# -- Response body handling --------------------------------------------------

# Allow ModSecurity to access response bodies.
# You should have this directive enabled in order to identify errors
# and data leakage issues.
#
# Do keep in mind that enabling this directive does increases both
# memory consumption and response latency.
#
SecResponseBodyAccess On

# Which response MIME types do you want to inspect? You should adjust the
# configuration below to catch documents but avoid static files
# (e.g., images and archives).
#
SecResponseBodyMimeType text/plain text/html text/xml

# Buffer response bodies of up to 512 KB in length.
SecResponseBodyLimit 524288
SecRule ARGS "\.\./" "t:normalisePathWin,id:99999,severity:4,msg:'Drive Access'"

# What happens when we encounter a response body larger than the configured
# limit? By default, we process what we have and let the rest through.
# That's somewhat less secure, but does not break any legitimate pages.
#
SecResponseBodyLimitAction ProcessPartial

# -- Filesystem configuration ------------------------------------------------

# The location where ModSecurity stores temporary files (for example, when
# it needs to handle a file upload that is larger than the configured limit).
#
# This default setting is chosen due to all systems have /tmp available however,
# this is less than ideal. It is recommended that you specify a location that's private.
#
SecTmpDir D:/wamp/bin/apache/apache2.4.9/logs/modsecurity/

# The location where ModSecurity will keep its persistent data. This default setting
# is chosen due to all systems have /tmp available however, it
# too should be updated to a place that other users can't access.
#
SecDataDir D:/wamp/bin/apache/apache2.4.9/logs/modsecurity/

# -- File uploads handling configuration -------------------------------------

# The location where ModSecurity stores intercepted uploaded files. This
# location must be private to ModSecurity. You don't want other users on
# the server to access the files, do you?
#
#SecUploadDir D:/wamp/bin/apache/apache2.4.9/logs/modsecurity/

# By default, only keep the files that were determined to be unusual
# in some way (by an external inspection script). For this to work you
# will also need at least one file inspection rule.
#
#SecUploadKeepFiles RelevantOnly

# -- Audit log configuration -------------------------------------------------

# Log the transactions that are marked by a rule, as well as those that
# trigger a server error (determined by a 5xx or 4xx, excluding 404,
# level response status codes).
#
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"

# Log everything we know about a transaction.
SecAuditLogParts ABIJDEFHZ

# Use a single file for logging. This is much easier to look at, but
# assumes that you will use the audit log only ocassionally.
#
SecAuditLogType Serial
SecAuditLog D:/wamp/bin/apache/apache2.4.9/logs/modsecurity/modsec_audit.log

# Specify the path for concurrent audit logging.
#SecAuditLogStorageDir D:/wamp/bin/apache/apache2.4.9/logs/modsecurity/

# 禁止url中出现"../"字符串
SecRule ARGS "\.\./" "t:normalizePathWin,id:50904,severity:4,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,msg:'Drive Access'"
*/

6. 配置httpd.conf
LoadModule unique_id_module modules/mod_unique_id.so
LoadModule security2_module modules/mod_security2.so
Include conf/modsecurity.conf

7. 重启apache
8. 访问: http://localhost/?abc=../..
9. Forbidden 403错误

访问其他url则正常运行

Relevant Link:

http://www.apachelounge.com/download/VC10/
http://www.zdbase.com/content/detail.aspx?OID=750334B5-4E24-49C2-9252-F7A1CCC9B955
http://mewbies.com/how_to_install_mod_security_for_apache_tutorial.htm 
https://sysengineers.wordpress.com/2008/12/17/enabling-mod_security-under-apache-2x-for-windows/
http://netsecurity.51cto.com/art/201409/452807_all.htm

3. Installation mod_security for nginx

0x1: 技术方案

1. 安装基础库
yum install -y gcc make automake autoconf libtool
yum install -y pcre pcre-devel libxml2 libxml2-devel curl curl-devel httpd-devel

2. 查看当前nginx的编译参数
/usr/local/nginx1/sbin/nginx -V
nginx version: nginx/1.2.3
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-54)
configure arguments: --prefix=/usr/local/nginx1 --sbin-path=/usr/local/nginx1/sbin/nginx --conf-path=/usr/local/nginx1/conf/nginx.conf --error-log-path=/usr/local/nginx1/logs/error.log --http-log-path=/usr/local/nginx1/logs/access.log --pid-path=/usr/local/nginx1/var/nginx.pid --lock-path=/usr/local/nginx1/var/nginx.lock --user=www --group=www --without-select_module --without-poll_module --with-http_realip_module --with-http_sub_module --with-http_gzip_static_module --with-http_stub_status_module --without-http_ssi_module --without-http_userid_module --without-http_geo_module --without-http_memcached_module --without-http_map_module --without-mail_pop3_module --without-mail_imap_module --without-mail_smtp_module --add-module=module

3. 编译、安装mod_security
cd /usr/local/
git clone https://github.com/SpiderLabs/ModSecurity.git mod_security
cd mod_security
./autogen.sh
./configure --enable-standalone-module
make

4. 重新编译nginx、附加mod_security模块
cd /usr/local/nginx/nginx-master
./auto/configure --add-module=/usr/local/mod_security/nginx/modsecurity
make
make install

5. 向nginx配置文件中增加mod_security配置
The ModSecurity configuration file must be definded at nginx.conf file
cp /usr/local/mod_security/modsecurity.conf-recommended /usr/local/nginx/conf/modsecurity.conf
/*
# -- Rule engine initialization ----------------------------------------------

# Enable ModSecurity, attaching it to every transaction. Use detection
# only to start with, because that minimises the chances of post-installation
# disruption.
#
SecRuleEngine On
SecDefaultAction "deny,phase:2,status:403"

# -- Request body handling ---------------------------------------------------

# Did we see anything that might be a boundary?
#
SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"

# PCRE Tuning
# We want to avoid a potential RegEx DoS condition
#
SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000

# -- Response body handling --------------------------------------------------

# Buffer response bodies of up to 512 KB in length.
SecResponseBodyLimit 524288

# -- Filesystem configuration ------------------------------------------------

# -- File uploads handling configuration -------------------------------------

# Uploaded files are by default created with permissions that do not allow
# any other user to access them. You may need to relax that if you want to
# interface ModSecurity to an external program (e.g., an anti-virus).
#
#SecUploadFileMode 0600

# -- Debug log configuration -------------------------------------------------

# The default debug log configuration is to duplicate the error, warning
# and notice messages from the error log.
#
#SecDebugLog /opt/modsecurity/var/log/debug.log
#SecDebugLogLevel 3

# -- Audit log configuration -------------------------------------------------

# Log everything we know about a transaction.
SecAuditLogParts ABIJDEFHZ

# Use a single file for logging. This is much easier to look at, but
# assumes that you will use the audit log only ocassionally.
#
SecAuditLogType Serial
SecAuditLog /var/log/modsec_audit.log

# Specify the path for concurrent audit logging.
#SecAuditLogStorageDir /opt/modsecurity/var/audit/

# -- Miscellaneous -----------------------------------------------------------

# Use the most commonly used application/x-www-form-urlencoded parameter
# separator. There's probably only one application somewhere that uses
# something else so don't expect to change this value.
#
SecArgumentSeparator &

# Settle on version 0 (zero) cookies, as that is what most applications
# use. Using an incorrect cookie version may open your installation to
# evasion attacks (against the rules that examine named cookies).
#
SecCookieFormat 0

# Improve the quality of ModSecurity by sharing information about your
# current ModSecurity version and dependencies versions.
# The following information will be shared: ModSecurity version,
# Web Server version, APR version, PCRE version, Lua version, Libxml2
# version, Anonymous unique id for host.
SecStatusEngine On
*/
vim /usr/local/nginx/conf/nginx.conf
//编译增加(如果已存在location /则添加下列内容到原始的location{}内)
http{
..
server {
..
ModSecurityEnabled on;
ModSecurityConfig modsecurity.conf;
..
location / {
include modsecurity_crs_41_sql_injection_attacks.conf
}
}
}6. 重启nginx
/usr/local/nginx/sbin/nginx -s stop
/usr/local/nginx/sbin/nginx

0x2: 在不中断业务的情况下配置nginx增加mod_security支持

1. 准备一个标准纯净编译环境
http://112.124.110.206/ 
Linux iZ236zqeepwZ 2.6.18-308.el5 #1 SMP Tue Feb 21 20:06:06 EST 2012 x86_64 x86_64 x86_64 GNU/Linux
CentOS release 5.8 (Final)
//考虑到Glibc的向下兼容性，编译环境尽量使用低版本的glibc、gcc进行编译，这样编译得到的各种版本的binary在各种linux分发版本上都能得到尽可能高的兼容性

2. 初始化基础库环境
yum install -y gcc make automake autoconf libtool httpd-dev apr-util-devel apr-devel
yum install -y pcre pcre-devel libxml2 libxml2-devel curl curl-devel httpd-devel 
yum -y install gcc gcc-c++ autoconf libjpeg libjpeg-devel libpng libpng-devel freetype freetype-devel libxml2 libxml2-devel zlib zlib-devel glibc glibc-devel glib2 glib2-devel bzip2 bzip2-devel ncurses ncurses-devel curl curl-devel e2fsprogs e2fsprogs-devel krb5 krb5-devel libidn libidn-devel openssl openssl-devel openldap openldap-devel nss_ldap openldap-clients openldap-servers cmake

3. 编译mod_security
cd /usr/local/
git clone https://github.com/SpiderLabs/ModSecurity.git mod_security
cd mod_security
./autogen.sh
./configure --enable-standalone-module
make
/*
如果在centos5.8等低版本linux分发版本中使用autoconf、automake失败，可以尝试使用源码编译的方式
yum install libxml2-devel
yum install httpd-devel
yum -y install python-devel
wget ftp://xmlsoft.org/libxml2/libxml2-2.9.2.tar.gz
tar -xzvf libxml2-2.9.2.tar.gz
cd libxml2-2.9.2
./configure --prefix=/usr/local/libxml2
make 
make install

wget 'https://www.modsecurity.org/tarball/2.8.0/modsecurity-2.8.0.tar.gz'
tar -zxvf modsecurity-2.8.0.tar.gz
cd modsecurity-2.8.0
./configure --enable-standalone-module --disable-mlogc
make
*/

4. 查看目标服务器上运行中的nginx的编译参数
/usr/local/nginx1/sbin/nginx -V
nginx version: nginx/1.2.3
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-54)
configure arguments: --prefix=/usr/local/nginx1 --sbin-path=/usr/local/nginx1/sbin/nginx --conf-path=/usr/local/nginx1/conf/nginx.conf --error-log-path=/usr/local/nginx1/logs/error.log --http-log-path=/usr/local/nginx1/logs/access.log --pid-path=/usr/local/nginx1/var/nginx.pid --lock-path=/usr/local/nginx1/var/nginx.lock --user=www --group=www --without-select_module --without-poll_module --with-http_realip_module --with-http_sub_module --with-http_gzip_static_module --with-http_stub_status_module --without-http_ssi_module --without-http_userid_module --without-http_geo_module --without-http_memcached_module --without-http_map_module --without-mail_pop3_module --without-mail_imap_module --without-mail_smtp_module
//最安全稳定的做法是根据每个目标服务器nginx相同的编译参数，在编译机上进行重编译，这样不容易产生业务中断风险

5. 重新编译nginx、附加mod_security模块(基于目标服务器上ningx的原始编译参数)(包括主、次版本号都必须一样)
cd /tmp
mkdir nginx
cd nginx
wget http://nginx.org/download/nginx-1.2.3.tar.gz
tar -zvxf nginx-1.2.3.tar.gz
cd nginx-1.2.3 
./configure --prefix=/usr/local/nginx1 --sbin-path=/usr/local/nginx1/sbin/nginx --conf-path=/usr/local/nginx1/conf/nginx.conf --error-log-path=/usr/local/nginx1/logs/error.log --http-log-path=/usr/local/nginx1/logs/access.log --pid-path=/usr/local/nginx1/var/nginx.pid --lock-path=/usr/local/nginx1/var/nginx.lock --user=www --group=www --without-select_module --without-poll_module --with-http_realip_module --with-http_sub_module --with-http_gzip_static_module --with-http_stub_status_module --without-http_ssi_module --without-http_userid_module --without-http_geo_module --without-http_memcached_module --without-http_map_module --without-mail_pop3_module --without-mail_imap_module --without-mail_smtp_module --add-module=/usr/local/mod_security/nginx/modsecurity 
make
make install
//这样编译得到的nginx是可以直接替换目标服务器上正在运行的nginx的 

6. 将编译得到的nginx、配置文件、以及规则文件提供下载
cp objs/nginx /var/www/html/nginx
http://112.124.110.206/nginx
http://112.124.110.206/modsecurity.conf
http://112.124.110.206/modsecurity_crs_20_protocol_violations.conf
http://112.124.110.206/modsecurity_crs_21_protocol_anomalies.conf
http://112.124.110.206/modsecurity_crs_23_request_limits.conf
http://112.124.110.206/modsecurity_crs_30_http_policy.conf
http://112.124.110.206/modsecurity_crs_35_bad_robots.conf
http://112.124.110.206/modsecurity_crs_40_generic_attacks.conf
http://112.124.110.206/modsecurity_crs_41_sql_injection_attacks.conf
http://112.124.110.206/modsecurity_crs_41_xss_attacks.conf
http://112.124.110.206/modsecurity_crs_42_tight_security.conf
http://112.124.110.206/modsecurity_crs_45_trojans.conf
http://112.124.110.206/modsecurity_crs_47_common_exceptions.conf
http://112.124.110.206/modsecurity_crs_49_inbound_blocking.conf
http://112.124.110.206/modsecurity_crs_50_outbound.conf
http://112.124.110.206/modsecurity_crs_59_outbound_blocking.conf
http://112.124.110.206/modsecurity_crs_60_correlation.conf

7. 在目标服务器上进行nginx替换 
cd /tmp/nginx
wget http://112.124.110.206/nginx
/usr/local/nginx1/sbin/nginx -s stop;chmod 755 ./nginx;cp ./nginx /usr/local/nginx1/sbin/nginx;/usr/local/nginx1/sbin/nginx

8. 回滚方案
cp ./nginx_bak_20151020 /usr/local/nginx1/sbin/nginx;/usr/local/nginx1/sbin/nginx

9. 配置目标服务器mod_security开关
vim /usr/local/nginx1/conf/nginx.conf
//编译增加(如果已存在location /则添加下列内容到原始的location{}内)
http{
    ..
    server {
        ..
        ModSecurityEnabled on;
        ModSecurityConfig modsecurity.conf;
        ..
        location / { 
            include modsecurity_crs_20_protocol_violations.conf
            include modsecurity_crs_20_protocol_violations.conf
            include modsecurity_crs_21_protocol_anomalies.conf
            include modsecurity_crs_23_request_limits.conf
            include modsecurity_crs_30_http_policy.conf
            include modsecurity_crs_35_bad_robots.conf
            include modsecurity_crs_40_generic_attacks.conf
            include modsecurity_crs_41_sql_injection_attacks.conf
            include modsecurity_crs_41_xss_attacks.conf
            include modsecurity_crs_42_tight_security.conf
            include modsecurity_crs_45_trojans.conf
            include modsecurity_crs_47_common_exceptions.conf
            include modsecurity_crs_49_inbound_blocking.conf
            include modsecurity_crs_50_outbound.conf
            include modsecurity_crs_59_outbound_blocking.conf
            include modsecurity_crs_60_correlation.conf
        }
    }
}

10. 下载mod_security配置、规则文件
cd /usr/local/nginx1/conf
wget http://112.124.110.206/modsecurity.conf
wget http://112.124.110.206/modsecurity_crs_20_protocol_violations.conf
wget http://112.124.110.206/modsecurity_crs_21_protocol_anomalies.conf
wget http://112.124.110.206/modsecurity_crs_23_request_limits.conf
wget http://112.124.110.206/modsecurity_crs_30_http_policy.conf
wget http://112.124.110.206/modsecurity_crs_35_bad_robots.conf
wget http://112.124.110.206/modsecurity_crs_40_generic_attacks.conf
wget http://112.124.110.206/modsecurity_crs_41_sql_injection_attacks.conf
wget http://112.124.110.206/modsecurity_crs_41_xss_attacks.conf
wget http://112.124.110.206/modsecurity_crs_42_tight_security.conf
wget http://112.124.110.206/modsecurity_crs_45_trojans.conf
wget http://112.124.110.206/modsecurity_crs_47_common_exceptions.conf
wget http://112.124.110.206/modsecurity_crs_49_inbound_blocking.conf
wget http://112.124.110.206/modsecurity_crs_50_outbound.conf
wget http://112.124.110.206/modsecurity_crs_59_outbound_blocking.conf
wget http://112.124.110.206/modsecurity_crs_60_correlation.conf

由于modsecurity是一个较新的服务器扩展模块，在centos5.8(nginx+mod_security)下编译很困难，会遇到很多库依赖方面的问题，在contos6下则基本没问题

Relevant Link:

http://www.yunwei8.com/lnmp201210 
http://www.nginxtips.com/how-to-install-mod_security-on-nginx/
http://nginx.org/download/

4. Installation mod_security for IIS

Relevant Link:

https://github.com/SpiderLabs/ModSecurity/wiki/IIS-Troubleshooting
http://jesscoburn.com/archives/2013/05/14/installing-modsecurity-on-iis7-x/
http://blogs.technet.com/b/srd/archive/2012/07/26/announcing-the-availability-of-modsecurity-extension-for-iis.aspx
https://cyberoperations.wordpress.com/class-archives/2013-class/07-iis-7-5-on-windows-2008-r2-with-modsecurity-2-7-2/

5. mod_security Configuration Directives

在完成了mod_security的配置、以及实现了最简单的规则配置之后，我们接下来深入学习OWASP的mod_security core rule，逐步了解如何将一个漏洞分解为mod的规则格式

0x1: SecAction

1. Description: Unconditionally processes the action list it receives as the first and only parameter. The syntax of the parameter is identical to that of the third parameter of SecRule.
2. Syntax: SecAction "action1,action2,action3,...“
3. Scope: Any
4. Version: 2.0.0
//This directive is commonly used to set variables and initialize persistent collections using the initcol action. 
5. For example: SecAction nolog,phase:1,initcol:RESOURCE=%{REQUEST_FILENAME}

0x2: SecArgumentSeparator

1. Description: Specifies which character to use as the separator for application/x-www-form- urlencoded content.
2. Syntax: SecArgumentSeparator character
3. Default: &
4. Scope: Main(
5. Version: 2.0.0
//This directive is needed if a backend web application is using a nonstandard argument separator. Applications are sometimes (very rarely) written to use a semicolon separator. You should not change the default setting unless you establish that the application you are working with requires a different separator. If this directive is not set properly for each web application, then ModSecurity will not be able to parse the arguments appropriately and the effectiveness of the rule matching will be significantly decreased.

0x3: SecAuditEngine

1. Description: Configures the audit logging engine.
2. Syntax: SecAuditEngine RelevantOnly
3. Default: Off
4. Scope: Any
5. Version: 2.0.0
The SecAuditEngine directive is used to configure the audit engine, which logs complete transactions. ModSecurity is currently able to log most, but not all transactions. Transactions involving errors (e.g., 400 and 404 transactions) use a different execution path, which ModSecurity does not support.
The possible values for the audit log engine are as follows:
    1) On: log all transactions
    2) Off: do not log any transactions
    3) RelevantOnly: only the log transactions that have triggered a warning or an error, or have a status code that is considered to be relevant (as determined by the SecAuditLogRelevantStatus directive)
Note : If you need to change the audit log engine configuration on a per-transaction basis (e.g., in response to some transaction data), use the ctl action.
The following example demonstrates how SecAuditEngine is used:
/*
SecAuditEngine RelevantOnly
SecAuditLog logs/audit/audit.log
SecAuditLogParts ABCFHZ 
SecAuditLogType concurrent 
SecAuditLogStorageDir logs/audit 
SecAuditLogRelevantStatus ^(?:5|4(?!04))
*/

0x4: SecAuditLog

1. Description: Defines the path to the main audit log file (serial logging format) or the concurrent logging index file (concurrent logging format). When used in combination with mlogc (only possible with concurrent logging), this directive defines the mlogc location and command line.
2. Syntax: SecAuditLog /path/to/audit.log
3. Scope: Any Version: 2.0.0
This file will be used to store the audit log entries if serial audit logging format is used. If concurrent audit logging format is used this file will be used as an index, and contain a record of all audit log files created. If you are planning to use concurrent audit logging to send your audit log data off to a remote server you will need to deploy the ModSecurity Log Collector (mlogc), like this:
/*
SecAuditLog "|/path/to/mlogc /path/to/mlogc.conf"
Note : This audit log file is opened on startup when the server typically still runs as root. You should not allow non-root users to have write privileges for this file or for the directory.
*/

0x5: SecAuditLogDirMode

1. Description: Configures the mode (permissions) of any directories created for the concurrent audit logs, using an octal mode value as parameter (as used in chmod).
2. Syntax: SecAuditLogDirMode octal_mode|"default"
3. Default: 0600
4. Scope: Any
5. Version: 2.5.10
The default mode for new audit log directories (0600) only grants read/write access to the owner (typically the account under which Apache is running, for example apache). If access from other accounts is needed (e.g., for use with mpm-itk), then you may use this directive to grant additional read and/or write privileges. You should use this directive with caution to avoid exposing potentially sensitive data to unauthorized users. Using the value default as parameter reverts the configuration back to the default setting. This feature is not available on operating systems not supporting octal file modes.
5. Example: SecAuditLogDirMode 02750

0x6: SecAuditLogFileMode

1. Description: Configures the mode (permissions) of any files created for concurrent audit logs using an octal mode (as used in chmod). See SecAuditLogDirMode for controlling the mode of created audit log directories.
2. Syntax: SecAuditLogFileMode octal_mode|"default"
3. Default: 0600
4. Scope: Any
5. Version: 2.5.10
6. Example Usage: SecAuditLogFileMode 00640
//This feature is not available on operating systems not supporting octal file modes. The default mode (0600) only grants read/write access to the account writing the file. If access from another account is needed (using mpm-itk is a good example), then this directive may be required. However, use this directive with caution to avoid exposing potentially sensitive data to unauthorized users. Using the value “default” will revert back to the default setting.

0x7: SecAuditLogParts

1. Description: Defines which parts of each transaction are going to be recorded in the audit log. Each part is assigned a single letter; when a letter appears in the list then the equivalent part will be recorded. See below for the list of all parts.
2. Syntax: SecAuditLogParts PARTLETTERS
3. Example Usage: SecAuditLogParts ABCFHZ
4. Scope: Any Version: 2.0.0
5. Default: ABCFHZ Note
The format of the audit log format is documented in detail in the Audit Log Data Format Documentation.
Available audit log parts:
/*
A: Audit log header (mandatory).
B: Request headers.
C: Request body (present only if the request body exists and ModSecurity is configured to intercept it).
D: Reserved for intermediary response headers; not implemented yet.
E: Intermediary response body (present only if ModSecurity is configured to intercept response bodies, and if the audit log engine is configured to record it). Intermediary response body is the same as the actual response body unless ModSecurity intercepts the intermediary response body, in which case the actual response body will contain the error message (either the Apache default error message, or the ErrorDocument page).
F: Final response headers (excluding the Date and Server headers, which are always added by Apache in the late stage of content delivery).
G: Reserved for the actual response body; not implemented yet.
H: Audit log trailer.
I: This part is a replacement for part C. It will log the same data as C in all cases except when multipart/form-data encoding in used. In this case, it will log a fake application/x-www-form-urlencoded body that contains the information about parameters but not about the files. This is handy if you don’t want to have (often large) files stored in your audit logs.
J: This part contains information about the files uploaded using multipart/form-data encoding.
K: This part contains a full list of every rule that matched (one per line) in the order they were matched. The rules are fully qualified and will thus show inherited actions and default operators. Supported as of v2.5.0.
Z: Final boundary, signifies the end of the entry (mandatory).
*/

0x8: SecAuditLogRelevantStatus

1. Description: Configures which response status code is to be considered relevant for the purpose of audit logging.
2. Syntax: SecAuditLogRelevantStatus REGEX
3. Example Usage: SecAuditLogRelevantStatus "^(?:5|4(?!04))"
4. Scope: Any
5. Version: 2.0.0

Dependencies/Notes: Must have SecAuditEngine set to RelevantOnly. Additionally, the auditlog action is present by default in rules, this will make the engine bypass the 'SecAuditLogRelevantStatus' and send rule matches to the audit log regardless of status. You must specify noauditlog in the rules manually or set it in SecDefaultAction.
The main purpose of this directive is to allow you to configure audit logging for only the transactions that have the status code that matches the supplied regular expression. The example provided would log all 5xx and 4xx level status codes, except for 404s. Although you could achieve the same effect with a rule in phase 5, SecAuditLogRelevantStatus is sometimes better, because it continues to work even when SecRuleEngine is disabled.

0x9: SecAuditLogStorageDir

1. Description: Configures the directory where concurrent audit log entries are to be stored.
2. Syntax: SecAuditLogStorageDir /path/to/storage/dir
3. Example Usage: SecAuditLogStorageDir /usr/local/apache/logs/audit 
4. Scope: Any
5. Version: 2.0.0

This directive is only needed when concurrent audit logging is used. The directory must already exist and must be writable by the web server user. Audit log entries are created at runtime, after Apache switches to a non-root account. As with all logging mechanisms, ensure that you specify a file system location that has adequate disk space and is not on the main system partition.

0x10: SecAuditLogType

1. Description: Configures the type of audit logging mechanism to be used.
2. Syntax: SecAuditLogType Serial|Concurrent 
3. Example Usage: SecAuditLogType Serial
4. Scope: Any
5. Version: 2.0.0
The possible values are:
    1) Serial : Audit log entries will be stored in a single file, specified by SecAuditLog. This is convenient for casual use, but it can slow down the server, because only one audit log entry can be written to the file at any one time.
    2) Concurrent: One file per transaction is used for audit logging. This approach is more scalable when heavy logging is required (multiple transactions can be recorded in parallel). It is also the only choice if you need to use remote logging.

0x11: SecDefaultAction

1. Description: Defines the default list of actions, which will be inherited by the rules in the same configuration context.
2. Syntax: SecDefaultAction "action1,action2,action3“ 
3. Example Usage: SecDefaultAction "phase:2,log,auditlog,deny,status:403,tag:'SLA 24/7'“ 
4. Scope: Any
5. Version: 2.0.0
6. Default: phase:2,log,auditlog,pass
//Every rule following a previous SecDefaultAction directive in the same configuration context will inherit its settings unless more specific actions are used. Every SecDefaultAction directive must specify a disruptive action and a processing phase and cannot contain metadata actions.

0x12: SecRequestBodyAccess

1. Description: Configures whether request bodies will be buffered and processed by ModSecurity.
2. Syntax: SecRequestBodyAccess On|Off 
3. Example Usage: SecRequestBodyAccess On
4. Scope: Any
5. Version: 2.0.0
//This directive is required if you want to inspect the data transported request bodies (e.g., POST parameters). Request buffering is also required in order to make reliable blocking possible. The possible values are:
    1) On: buffer request bodies
    2) Off: do not buffer request bodies

0x13: SecRequestBodyInMemoryLimit

1. Description: Configures the maximum request body size that ModSecurity will store in memory.
2. Syntax: SecRequestBodyInMemoryLimit LIMIT_IN_BYTES 
3. Example Usage: SecRequestBodyInMemoryLimit 131072 
4. Scope: Any
5. Version: 2.0.0
6. Default: 131072 (128 KB)
//When a multipart/form-data request is being processed, once the in-memory limit is reached, the request body will start to be streamed into a temporary file on disk.

0x14: SecResponseBodyMimeType

1. Description: Configures which MIME types are to be considered for response body buffering.
2. Syntax: SecResponseBodyMimeType MIMETYPE MIMETYPE ... 
3. Example Usage: SecResponseBodyMimeType text/plain text/html text/xml
4. Scope: Any
5. Version: 2.0.0
6. Default: text/plain text/html
//Multiple SecResponseBodyMimeType directives can be used to add MIME types. Use SecResponseBodyMimeTypesClear to clear previously configured MIME types and start over.

这个指令可以用来进行"网站敏感静态资源防泄漏"的防护，类似安全狗的静态资源保护功能

0x15: SecRule

1. Description: Creates a rule that will analyze the selected variables using the selected operator.
2. Syntax: SecRule VARIABLES OPERATOR [ACTIONS] (AXTIONS代表按照此顺序去应用规则，Mod的HTTP生命周期)
3. Example Usage: SecRule ARGS "@rx attack" "phase:1,log,deny,id:1" 
4. Scope: Any
5 Version: 2.0.0
//Every rule must provide one or more variables along with the operator that should be used to inspect them. If no actions are provided, the default list will be used. (There is always a default list, even if one was not explicitly set with SecDefaultAction.) If there are actions specified in a rule, they will be merged with the default list to form the final actions that will be used. (The actions in the rule will overwrite those in the default list.)

这个规则指令是mod_security的核心，所有的WAF防护能力都通过这个指令实现

Relevant Link:

https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#ModSecurityreg_Reference_Manual

6. Processing Phases

ModSecurity 2.x allows rules to be placed in one of the following five phases of the Apache request cycle:

1. phase1: Request headers (REQUEST_HEADERS)
2. phase2: Request body (REQUEST_BODY)
3. phase3: Response headers (RESPONSE_HEADERS)
4. phase4: Response body (RESPONSE_BODY)
5. phase5: Logging (LOGGING)

In order to select the phase a rule executes during, use the phase action either directly in the rule or in using the SecDefaultAction directive:

SecDefaultAction "log,pass,phase:2,id:4"
//or
SecRule REQUEST_HEADERS:Host "!^$" "deny,phase:1,id:5"

Note : The data available in each phase is cumulative. This means that as you move onto later phases, you have access to more and more data from the transaction.
Note : Keep in mind that rules are executed according to phases, so even if two rules are adjacent in a configuration file, but are set to execute in different phases, they would not happen one after the other. The order of rules in the configuration file is important only within the rules of each phase. This is especially important when using the skip and skipAfter actions.
apache 2.0后的模块扩展机制已经充分考虑了第三方扩展的灵活性，在整个HTTP处理声明周期中都暴露了Hook点(类似Netfilter)

/* 1. Connection processing hooks */
ap_hook_process_connection(hook_connection_early, NULL, NULL, APR_HOOK_FIRST);

/* 2. Transaction processing hooks (Phase Request Headers) */
ap_hook_post_read_request(hook_request_early, postread_beforeme_list, postread_afterme_list, APR_HOOK_REALLY_FIRST);
ap_hook_fixups(hook_request_late, fixups_beforeme_list, NULL, APR_HOOK_REALLY_FIRST);

/* 3. Logging */
ap_hook_error_log(hook_error_log, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_log_transaction(hook_log_transaction, NULL, transaction_afterme_list, APR_HOOK_MIDDLE);

/* 4. Filter hooks */
ap_hook_insert_filter(hook_insert_filter, NULL, NULL, APR_HOOK_FIRST);
ap_hook_insert_error_filter(hook_insert_error_filter, NULL, NULL, APR_HOOK_FIRST);

//5. 
ap_register_input_filter("MODSECURITY_IN", input_filter, NULL, AP_FTYPE_CONTENT_SET);

/* Ensure that the output filter runs before other modules so that
* we get a request that has a better chance of not being modified:
*
* Currently:
*   mod_expires = -2
*   mod_cache   = -1
*   mod_deflate = -1
*   mod_headers =  0
*/
//6. 
ap_register_output_filter("MODSECURITY_OUT", output_filter, NULL, AP_FTYPE_CONTENT_SET - 3);

0x1: Phase Request Headers

Rules in this phase are processed immediately after Apache completes reading the request headers (post-read-request phase). At this point the request body has not been read yet, meaning not all request arguments are available.
Rules should be placed in this phase if you need to have them run early (before Apache does something with the request), to do something before the request body has been read, determine whether or not the request body should be buffered, or decide how you want the request body to be processed (e.g. whether to parse it as XML or not).

0x2: Phase Request Body

This is the general-purpose input analysis phase. Most of the application-oriented rules should go here. In this phase you are guaranteed to have received the request arguments (provided the request body has been read). ModSecurity supports three encoding types for the request body phase:

1. application/x-www-form-urlencoded - used to transfer form data
2. multipart/form-data - used for file transfers
3. text/xml - used for passing XML data
4. Other encodings are not used by most web applications.
//Note : In order to access the Request Body phase data, you must have SecRequestBodyAccess set to On.

0x3: Phase Response Headers

This phase takes place just before response headers are sent back to the client.
Run here if you want to observe the response before that happens, and if you want to use the response headers to determine if you want to buffer the response body.
Note that some response status codes (such as 404) are handled earlier in the request cycle by Apache and my not be able to be triggered as expected. Additionally, there are some response headers that are added by Apache at a later hook (such as Date, Server and Connection) that we would not be able to trigger on or sanitize. This should work appropriately in a proxy setup or within phase:5 (logging).

0x4: Phase Response Body

This is the general-purpose output analysis phase. At this point you can run rules against the response body (provided it was buffered, of course). This is the phase where you would want to inspect the outbound HTML for information disclosure, error messages or failed authentication text.
//Note : In order to access the Response Body phase data, you must have SecResponseBodyAccess set to On

0x5: Phase Logging

This phase is run just before logging takes place. The rules placed into this phase can only affect how the logging is performed. This phase can be used to inspect the error messages logged by Apache. You cannot deny/block connections in this phase as it is too late. This phase also allows for inspection of other response headers that weren't available during phase:3 or phase:4. Note that you must be careful not to inherit a disruptive action into a rule in this phase as this is a configuration error in ModSecurity 2.5.0 and later versions

Relevant Link:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#ModSecurityreg_Reference_Manual

7. Variables

0x1: ARGS

ARGS is a collection and can be used on its own (means all arguments including the POST Payload), with a static parameter (matches arguments with that name), or with a regular expression (matches all arguments with name that matches the regular expression).

SecRule ARGS "dirty" "t:normalisePathWin,id:99998,severity:4,msg:'Drive Access'"

Sometimes, however, you will want to look only at parts of a collection. This can be achieved with the help of the selection operator(colon). The following example will only look at the arguments named p (do note that, in general, requests can contain multiple arguments with the same name):

SecRule ARGS:p dirty "t:normalisePathWin,id:99998,severity:4,msg:'Drive Access'"

It is also possible to specify exclusions. The following will examine all request arguments for the word dirty, except the ones named z

SecRule ARGS|!ARGS:z dirty "t:normalisePathWin,id:99998,severity:4,msg:'Drive Access'"

There is a special operator that allows you to count how many variables there are in a collection. The following rule will trigger if there is more than zero arguments in the request

SecRule &ARGS !^0$ "t:normalisePathWin,id:99998,severity:4,msg:'Drive Access'"

And sometimes you need to look at an array of parameters(id[0]=xx、id[1]..), each with a slightly different name. In this case you can specify a regular expression in the selection operator itself. The following rule will look into all arguments whose names begin with id_:

SecRule ARGS:/^id_/ dirty "t:normalisePathWin,id:99998,severity:4,msg:'Drive Access'"

0x2: ARGS_COMBINED_SIZE

Contains the combined size of all request parameters. Files are excluded from the calculation. This variable can be useful, for example, to create a rule to ensure that the total size of the argument data is below a certain threshold. The following rule detects a request whose para- meters are more than 2500 bytes long:

SecRule ARGS_COMBINED_SIZE "@gt 2500" "id:12"

0x3: ARGS_GET

RGS_GET is similar to ARGS, but contains only query string parameters.

0x4: ARGS_GET_NAMES

ARGS_GET_NAMES is similar to ARGS_NAMES, but contains only the names of query string parameters.

0x5: ARGS_NAMES

Contains all request parameter names. You can search for specific parameter names that you want to inspect. In a positive policy scenario, you can also whitelist (using an inverted rule with the exclamation mark) only the authorized argument names. This example rule allows only two argument names: p and a:

SecRule ARGS_NAMES "!^(p|a)$" "t:normalisePathWin,id:99998,severity:4,msg:'Drive Access'"

0x6: ARGS_POST

ARGS_POST is similar to ARGS, but only contains arguments from the POST body.

0x7: AUTH_TYPE

This variable holds the authentication method used to validate a user, if any of the methods built into HTTP are used. In a reverse-proxy deployment, this information will not be available if the authentication is handled in the backend web server.

SecRule AUTH_TYPE "Basic" "id:14"

0x8: FILES

Contains a collection of original file names (as they were called on the remote user’s filesys- tem). Available only on inspected multipart/form-data requests.

SecRule FILES "@rx \.conf$" "id:17"

0x9: FILES_NAMES

Contains a list of form fields that were used for file upload. Available only on inspected multipart/form-data requests.

SecRule FILES_NAMES "^upfile$" "id:19"

0x10: FULL_REQUEST

Contains the complete request: Request line, Request headers and Request body (if any). The last available only if SecRequestBodyAccess was set to On. Note that all properties of SecRequestBodyAccess will be respected here, such as: SecRequestBodyLimit.

SecRule FULL_REQUEST "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" "t:normalisePathWin,id:99998,severity:4,msg:'Drive Access'"

0x11: PATH_INFO

Contains the extra request URI information, also known as path info. (For example, in the URI /index.php/123, /123 is the path info.) Available only in embedded deployments.

SecRule PATH_INFO "^/(bin|etc|sbin|opt|usr)" "t:normalisePathWin,id:99998,severity:4,msg:'Drive Access'"

0x12: QUERY_STRING

Contains the query string part of a request URI. The value in QUERY_STRING is always provided raw, without URL decoding taking place.(取自未规范化、未解码前的URL请求数据)

SecRule QUERY_STRING "attack" "id:34"

0x13: REQUEST_BASENAME

This variable holds just the filename part of REQUEST_FILENAME (e.g., index.php).

SecRule REQUEST_BASENAME "^login\.php$" phase:2,id:42,t:none,t:lowercase

0x14: REQUEST_BODY

Holds the raw request body. This variable is available only if the URLENCODED request body processor was used, which will occur by default when the application/x-www-form-urlencoded content type is detected, or if the use of the URLENCODED request body parser was forced.

SecRule REQUEST_BODY "^username=\w{25,}\&password=\w{25,}\&Submit\=login$" "id:43"

0x15: REQUEST_COOKIES

This variable is a collection of all of request cookies (values only). Example: the following example is using the Ampersand special operator to count how many variables are in the collection. In this rule, it would trigger if the request does not include any Cookie headers.

ecRule &REQUEST_COOKIES "@eq 0" "id:44"

0x16: REQUEST_LINE

This variable holds the complete request line sent to the server (including the request method and HTTP version information).

# Allow only POST, GET and HEAD request methods, as well as only
# the valid protocol versions 
SecRule REQUEST_LINE "!(^((?:(?:POS|GE)T|HEAD))|HTTP/(0\.9|1\.0|1\.1)$)" "phase:1,id:49,log,block,t:none"

0x17: REQUEST_METHOD

This variable holds the request method used in the transaction.

SecRule REQUEST_METHOD "^(?:CONNECT|TRACE)$" "id:50,t:none"

0x18: REQUEST_PROTOCOL

This variable holds the request protocol version information.

SecRule REQUEST_PROTOCOL "!^HTTP/(0\.9|1\.0|1\.1)$" "id:51"

0x19: REQUEST_URI

This variable holds the full request URL including the query string data (e.g., /index.php? p=X). However, it will never contain a domain name, even if it was provided on the request line.

SecRule REQUEST_URI "attack" "phase:1,id:52,t:none,t:urlDecode,t:lowercase,t:normalizePath"

0x20: REQUEST_URI_RAW

Same as REQUEST_URI but will contain the domain name if it was provided on the request line (e.g., http://www.example.com/index.php?p=X).

SecRule REQUEST_URI_RAW "http:/" "t:normalisePathWin,id:99998,severity:4,msg:'Drive Access'"

0x21: RESPONSE_BODY

This variable holds the data for the response body, but only when response body buffering is enabled.

0x22: SCRIPT_BASENAME

This variable holds just the local filename part of SCRIPT_FILENAME.

SecRule SCRIPT_BASENAME "^login\.php$" "id:60"

0x23: STREAM_INPUT_BODY

This variable give access to the raw request body content. This variable is best used for two use-cases:

1. For fast pattern matching - using @pm/@pmf to prequalify large text strings against any kind of content-type data. This is more performant vs. using REQUEST_BODY/ARGS_POST/ARGS_POST_NAMES as it happens before ModSecurity parsing in phase:2 variable population.

2. For data substitution - using @rsub against this variable allows you to manipulate live request body data. Example - to remove offending payloads or to substitute benign data.

0x24: TX

This is the transient transaction collection, which is used to store pieces of data, create a transaction anomaly score, and so on. The variables placed into this collection are available only until the transaction is complete.

# Increment transaction attack score on attack 
SecRule ARGS attack "phase:2,id:82,nolog,pass,setvar:TX.score=+5"

# Block the transactions whose scores are too high 
SecRule TX:SCORE "@gt 20" "phase:2,id:83,log,deny"

Some variable names in the TX collection are reserved and cannot be used:

1. TX:0: the matching value when using the @rx or @pm operator with the capture action
2. TX:1-TX:9: the captured subexpression value when using the @rx operator with capturing parens and the capture action
3. TX:MSC_.*: ModSecurity processing flags
4. MSC_PCRE_LIMITS_EXCEEDED: Set to nonzero if PCRE match limits are exceeded. See SecPcreMatchLimit and SecPcreMatchLimitRecursion for more information.

Relevant Link:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#ModSecurityreg_Reference_Manual

8. Transformation functions

Transformation functions are used to alter input data before it is used in matching. The input data is never modified, actually—whenever you request a transformation function to be used, ModSecurity will create a copy of the data, transform it, and then run the operator against the result. mod_security虽然是串行在apache的处理流程中，但是从数据层面上来说，mod_security是通过镜像了一份HTTP流量，以此为数据基础进行规则检测的
In the following example, the request parameter values are converted to lowercase before matching:

SecRule ARGS "xp_cmdshell" "t:lowercase,severity:4,msg:'Drive Access',id:99998"

Multiple transformation actions can be used in the same rule, forming a transformation pipeline. The transformations will be performed in the order in which they appear in the rule.
In most cases, the order in which transformations are performed is very important. In the following example, a series of transformation functions is performed to counter evasion. Performing the transformations in any other order would allow a skillful attacker to evade detection:

SecRule ARGS "(asfunction|javascript|vbscript|data|mocha|livescript):" "id:92,t:none,t:htmlEntityDecode,t:lowercase,t:removeNulls,t:removeWhitespace"

0x1: base64Decode

Decodes a Base64-encoded string.

SecRule REQUEST_HEADERS:Authorization "^Basic ([a-zA-Z0-9]+=*)$" "phase:1,id:93,capture,chain,logdata:%{TX.1}"
  SecRule TX:1 ^(\w+): t:base64Decode,capture,chain
    SecRule TX:1 ^(admin|root|backup)$

0x2: sqlHexDecode

Decode sql hex data. Example (0x414243) will be decoded to (ABC).

0x3: cmdLine

In Windows and Unix, commands may be escaped by different means, such as:

1. c^ommand /c ...
2. "command" /c ...
3. command,/c ...
4. backslash in the middle of a Unix command

The cmdLine transformation function avoids this problem by manipulating the variable contend in the following ways:

1. deleting all backslashes [\]
2. deleting all double quotes ["]
3. deleting all sigle quotes [']
4. deleting all carets [^]
5. deleting spaces before a slash /
6. deleting spaces before an open parentesis [(]
7. replacing all commas [,] and semicolon [;] into a space
8. replacing all multiple spaces (including tab, newline, etc.) into one space
9. transform all characters to lowercase

Example Usage:

SecRule ARGS "(?:command(?:.com)?|cmd(?:.exe)?)(?:/.*)?/[ck]" "phase:2,id:94,t:none, t:cmdLine"

0x4: compressWhitespace

Converts any of the whitespace characters (0x20, \f, \t, \n, \r, \v, 0xa0) to spaces (ASCII 0x20), compressing multiple consecutive space characters into one.

0x5: escapeSeqDecode

Decodes ANSI C escape sequences: \a, \b, \f, \n, \r, \t, \v, \\, \?, \', \", \xHH (hexadecimal), \0OOO (octal). Invalid encodings are left in the output.

0x6: htmlEntityDecode

Decodes the characters encoded as HTML entities. The following variants are supported:

1. HH and HH; (where H is any hexadecimal number)
2. DDD and DDD; (where D is any decimal number)
3. &quotand"
4. &nbspand 
5. &ltand<
6. &gtand>
//This function always converts one HTML entity into one byte, possibly resulting in a loss of information (if the entity refers to a character that cannot be represented with the single byte). It is thus useful to uncover bytes that would otherwise not need to be encoded, but it cannot do anything meaningful with the characters from the range above 0xff.

0x7: lowercase

Converts all characters to lowercase using the current C locale.

0x8: normalisePath

Removes multiple slashes, directory self-references, and directory back-references (except when at the beginning of the input) from input string.

0x9: normalisePathWin

Same as normalisePath, but first converts backslash characters to forward slashes.

0x10: removeNulls

Removes all NUL bytes from input

0x11: removeCommentsChar

Removes common comments chars (/*, */, --, #).

0x12: removeComments

Removes each occurrence of comment (/* ... */, --, #). Multiple consecutive occurrences of which will not be compressed.

0x13: trim

Removes whitespace from both the left and right sides of the input string.

Relevant Link:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#ModSecurityreg_Reference_Manual

9. Actions

Each action belongs to one of five groups:

1. Disruptive actions - Cause ModSecurity to do something. In many cases something means block transaction, but not in all. For example, the allow action is classified as a disruptive action, but it does the opposite of blocking. There can only be one disruptive action per rule (if there are multiple disruptive actions present, or inherited, only the last one will take effect), or rule chain (in a chain, a disruptive action can only appear in the first rule).

2. Non-disruptive actions - Do something, but that something does not and cannot affect the rule processing flow. Setting a variable, or changing its value is an example of a non-disruptive action. Non-disruptive action can appear in any rule, including each rule belonging to a chain.

3. Flow actions - These actions affect the rule flow, for example 
    1) skip
    2) skipAfter 

4. Meta-data actions - Meta-data actions are used to provide more information about rules. Examples include 
    1) id
    2) rev
    3) severity
    4) msg.

5. Data actions - Not really actions, these are mere containers that hold data used by other actions. For example, the status action holds the status that will be used for blocking (if it takes place).

0x1: accuracy

1. Description: Specifies the relative accuracy level of the rule related to false positives/negatives. The value is a string based on a numeric scale (1-9 where 9 is very strong and 1 has many false positives).
2. Action Group: Meta-data
3. Version: 2.7
4. Example:
SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bgetparentfolder\b" \
    "phase:2,ver:'CRS/2.2.4,accuracy:'9',maturity:'9',capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,msg:'Cross-site Scripting (XSS) Attack',id:'958016',tag:'WEB_ATTACK/XSS',tag:'WASCTC/WASC-8',tag:'WASCTC/WASC-22',tag:'OWASP_TOP_10/A2',tag:'OWASP_AppSensor/IE1',tag:'PCI/6.5.1',logdata:'% \
{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.xss_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}"

0x2: allow

1. Description: Stops rule processing on a successful match and allows the transaction to proceed.
2. Action Group: Disruptive
3 Example:
# Allow unrestricted access from 192.168.1.100 
SecRule REMOTE_ADDR "^192\.168\.1\.100$" phase:1,id:95,nolog,allow

Prior to ModSecurity 2.5 the allow action would only affect the current phase. An allow in phase 1 would skip processing the remaining rules in phase 1 but the rules from phase 2 would execute. Starting with v2.5.0 allow was enhanced to allow for fine-grained control of what is done. The following rules now apply:

1. If used one its own, like in the example above, allow will affect the entire transaction, stopping processing of the current phase but also skipping over all other phases apart from the logging phase. (The logging phase is special; it is designed to always execute.)
2. If used with parameter "phase", allow will cause the engine to stop processing the current phase. Other phases will continue as normal.
3. If used with parameter "request", allow will cause the engine to stop processing the current phase. The next phase to be processed will be phase RESPONSE_HEADERS.

Examples:

# Do not process request but process response.
SecAction phase:1,allow:request,id:96

# Do not process transaction (request and response).
SecAction phase:1,allow,id:97
If you want to allow a response through, put a rule in phase RESPONSE_HEADERS and simply use allow on its own:

# Allow response through.
SecAction phase:3,allow,id:98

0x3: append

1. Description: Appends text given as parameter to the end of response body. Content injection must be enabled (using the SecContentInjection directive). No content type checks are made, which means that before using any of the content injection actions, you must check whether the content type of the response is adequate for injection.
2. Action Group: Non-disruptive
3. Processing Phases: 3 and 4.
4. Example:
SecRule RESPONSE_CONTENT_TYPE "^text/html" "nolog,id:99,pass,append:'<hr>Footer'"

0x4: auditlog

1. Description: Marks the transaction for logging in the audit log.
2. Action Group: Non-disruptive
3. Example:
SecRule REMOTE_ADDR "^192\.168\.1\.100$" auditlog,phase:1,id:100,allow

0x5: block

1. Description: Performs the disruptive action defined by the previous SecDefaultAction.
2. Action Group: Disruptive
//This action is essentially a placeholder that is intended to be used by rule writers to request a blocking action, but without specifying how the blocking is to be done. The idea is that such decisions are best left to rule users, as well as to allow users, to override blocking if they so desire. In future versions of ModSecurity, more control and functionality will be added to define "how" to block.
3. Examples:
# Specify how blocking is to be done 
SecDefaultAction phase:2,deny,id:101,status:403,log,auditlog

# Detect attacks where we want to block 
SecRule ARGS attack1 phase:2,block,id:102

# Detect attacks where we want only to warn 
SecRule ARGS attack2 phase:2,pass,id:103

It is possible to use the SecRuleUpdateActionById directive to override how a rule handles blocking. This is useful in three cases:

1. If a rule has blocking hard-coded, and you want it to use the policy you determine
2. If a rule was written to block, but you want it to only warn
3. If a rule was written to only warn, but you want it to block

The following example demonstrates the first case, in which the hard-coded block is removed in favor of the user-controllable block:

# Specify how blocking is to be done 
SecDefaultAction phase:2,deny,status:403,log,auditlog,id:104

# Detect attacks and block 
SecRule ARGS attack phase:2,id:99998,deny

# Change how rule ID 1 blocks 
SecRuleUpdateActionById 1 block

0x6: capture

1. Description: When used together with the regular expression operator (@rx), the capture action will create copies of the regular expression captures and place them into the transaction variable collection.
2. Action Group: Non-disruptive
3. Example:
SecRule REQUEST_BODY "^username=(\w{25,})" phase:2,capture,t:none,chain,id:105
  SecRule TX:1 "(?:(?:a(dmin|nonymous)))"
Up to 10 captures will be copied on a successful pattern match, each with a name consisting of a digit from 0 to 9. The TX.0 variable always contains the entire area that the regular expression matched. All the other variables contain the captured values, in the order in which the capturing parentheses appear in the regular expression.

0x7: chain

1. Description: Chains the current rule with the rule that immediately follows it, creating a rule chain. Chained rules allow for more complex processing logic.
2. Action Group: Flow
3. Example:
# Refuse to accept POST requests that do not contain Content-Length header. 
# (Do note that this rule should be preceded by a rule 
# that verifies only valid request methods are used.) 
SecRule REQUEST_METHOD "^POST$" phase:1,chain,t:none,id:105
  SecRule &REQUEST_HEADERS:Content-Length "@eq 0" t:none

The following directives can be used in rule chains:

1. SecAction
2. SecRule
3. SecRuleScript

Special rules control the usage of actions in chained rules:

1. Any actions that affect the rule flow (i.e., the disruptive actions, skip and skipAfter) can be used only in the chain starter. They will be executed only if the entire chain matches.
2. Non-disruptive rules can be used in any rule; they will be executed if the rule that contains them matches and not only when the entire chain matches.
3. The metadata actions (e.g., id, rev, msg) can be used only in the chain starter.

0x8: deny

1. Description: Stops rule processing and intercepts transaction.
2. Action Group: Disruptive
3. Example: SecRule REQUEST_HEADERS:User-Agent "nikto" "log,deny,id:107,msg:'Nikto Scanners Identified'"

0x9: msg

1. Description: Assigns a custom message to the rule or chain in which it appears. The message will be logged along with every alert.
2. Action Group: Meta-data
3. Example: SecRule &REQUEST_HEADERS:Host "@eq 0" "log,id:60008,severity:2,msg:'Request Missing a Host Header'"

0x10: phase

1. Description: Places the rule or chain into one of five available processing phases. It can also be used in SecDefaultAction to establish the rule defaults.
2. Action Group: Meta-data
3. Example:
# Initialize IP address tracking in phase 1
SecAction phase:1,nolog,pass,id:126,initcol:IP=%{REMOTE_ADDR}

Starting in ModSecurity version v2.7 there are aliases for some phase numbers:

2 - request
4 - response
5 - logging
Example: SecRule REQUEST_HEADERS:User-Agent "Test" "phase:request,log,deny,id:127"

0x11: severity

1. Description: Assigns severity to the rule in which it is used.
2. Action Group: Meta-data
3. Example:
SecRule REQUEST_METHOD "^PUT$" "id:340002,rev:1,severity:CRITICAL,msg:'Restricted HTTP function'"

Severity values in ModSecurity follows the numeric scale of syslog (where 0 is the most severe). The data below is used by the OWASP ModSecurity Core Rule Set (CRS):

0 - EMERGENCY: is generated from correlation of anomaly scoring data where there is an inbound attack and an outbound leakage.
1 - ALERT: is generated from correlation where there is an inbound attack and an outbound application level error.
2 - CRITICAL: Anomaly Score of 5. Is the highest severity level possible without correlation. It is normally generated by the web attack rules (40 level files).
3 - ERROR: Error - Anomaly Score of 4. Is generated mostly from outbound leakage rules (50 level files).
4 - WARNING: Anomaly Score of 3. Is generated by malicious client rules (35 level files).
5 - NOTICE: Anomaly Score of 2. Is generated by the Protocol policy and anomaly files.
6 - INFO
7 - DEBUG
//It is possible to specify severity levels using either the numerical values or the text values, but you should always specify severity levels using the text values, because it is difficult to remember what a number stands for. The use of the numerical values is deprecated as of version 2.5.0 and may be removed in one of the subsequent major updates.

0x12: t

1. Description: This action is used to specify the transformation pipeline to use to transform the value of each variable used in the rule before matching.
2. Action Group: Non-disruptive
3. Example:
SecRule ARGS "(asfunction|javascript|vbscript|data|mocha|livescript):" "id:146,t:none,t:htmlEntityDecode,t:lowercase,t:removeNulls,t:removeWhitespace"
//Any transformation functions that you specify in a SecRule will be added to the previous ones specified in SecDefaultAction. It is recommended that you always use t:none in your rules, which prevents them depending on the default configuration.

Relevant Link:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#ModSecurityreg_Reference_Manual

10. Operators

0x1: beginsWith

1. Description: Returns true if the parameter string is found at the beginning of the input. Macro expansion is performed on the parameter string before comparison.
2. Example:
# Detect request line that does not begin with "GET" 
SecRule REQUEST_LINE "!@beginsWith GET" "id:99998,deny"

0x2: contains

1. Description: Returns true if the parameter string is found anywhere in the input. Macro expansion is performed on the parameter string before comparison.
2. Example:
# Detect ".php" anywhere in the request line 
SecRule REQUEST_LINE "@contains .php" "id:99998,deny"

0x3: detectSQLi

1. Description: Returns true if SQL injection payload is found. This operator uses LibInjection to detect SQLi attacks.
2. Example:
# Detect SQL Injection inside request uri data" 
SecRule REQUEST_URI "@detectSQLi" "id:99998,deny"

0x4: detectXSS

1. Description: Returns true if XSS injection is found. This operator uses LibInjection to detect XSS attacks.
2. Version: 2.8.0
3. Example:
# Detect XSS Injection inside request body 
SecRule REQUEST_BODY "\@detectXSS" "id:12345,log,deny"

0x5: fuzzyHash

1. Description: The fuzzyHash operator uses the ssdeep, which is a program for computing context triggered piecewise hashes (CTPH). Also called fuzzy hashes, CTPH can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length.
//For further information on ssdeep, visit its site: http://ssdeep.sourceforge.net/
2. Version: v2.9.0-RC1+
3. Example:
SecRule REQUEST_BODY "\@fuzzyHash /path/to/ssdeep/hashes.txt 6" "id:192372,log,deny"

0x6: eq

1. Description: Performs numerical comparison and returns true if the input value is equal to the provided parameter. Macro expansion is performed on the parameter string before comparison.
2. Example:
# Detect exactly 15 request headers 
SecRule &REQUEST_HEADERS_NAMES "@eq 15" "id:153"

0x7: ge

1. Description: Performs numerical comparison and returns true if the input value is greater than or equal to the provided parameter. Macro expansion is performed on the parameter string before comparison.
2. Example:
# Detect 15 or more request headers 
SecRule &REQUEST_HEADERS_NAMES "@ge 15" "id:154"

0x8: pm

1. Description: Performs a case-insensitive match of the provided phrases against the desired input value. The operator uses a set-based matching algorithm (Aho-Corasick), which means that it will match any number of keywords in parallel. When matching of a large number of keywords is needed, this operator performs much better than a regular expression.
2. Example:
# Detect suspicious client by looking at the user agent identification 
SecRule REQUEST_HEADERS:User-Agent "@pm WebZIP WebCopier Webster WebStripper ... SiteSnagger ProWebWalker CheeseBot" "id:166"

0x9: rx

1. Description: Performs a regular expression match of the pattern provided as parameter. This is the default operator; the rules that do not explicitly specify an operator default to @rx.
2. Examples:
# Detect Nikto 
SecRule REQUEST_HEADERS:User-Agent "@rx nikto" phase:1,id:173,t:lowercase

# Detect Nikto with a case-insensitive pattern 
SecRule REQUEST_HEADERS:User-Agent "@rx (?i)nikto" phase:1,id:174,t:none

# Detect Nikto with a case-insensitive pattern 
SecRule REQUEST_HEADERS:User-Agent "(?i)nikto" "id:175"

Relevant Link:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#ModSecurityreg_Reference_Manual

11. A Recommended Base Configuration

0x1: Impedance Mismatch(避免误拦截)

Web application firewalls have a difficult job trying to make sense of data that passes by, without any knowledge of the application and its business logic. The protection they provide comes from having an independent layer of security on the outside. Because data validation is done twice, security can be increased without having to touch the application. In some cases, however, the fact that everything is done twice brings problems. Problems can arise in the areas where the communication protocols are not well specified, or where either the device or the application do things that are not in the specification. In such cases it may be possible to design payload that will be interpreted in one way by one device and in another by the other device. This problem is better known as Impedance Mismatch. It can be exploited to evade the security devices.
While we will continue to enhance ModSecurity to deal with various evasion techniques the problem can only be minimized, but never solved. With so many different application backend chances are some will always do something completely unexpected. The only solution is to be aware of the technologies in the backend when writing rules, adapting the rules to remove the mismatch.

0x2: Impedance Mismatch with PHP Apps

When writing rules to protect PHP applications you need to pay attention to the following facts:

1. When "register_globals" is set to "On" request parameters are automatically converted to script variables. In some PHP versions it is even possible to override the $GLOBALS array.
2. Whitespace at the beginning of parameter names is ignored. (This is very dangerous if you are writing rules to target specific named variables.)
3. The remaining whitespace (in parameter names) is converted to underscores. The same applies to dots and to a "["]if the variable name does not contain a matching closing bracket. (Meaning that if you want to exploit a script through a variable that contains an underscore in the name you can send a parameter with a whitespace or a dot instead.)
4. Cookies can be treated as request parameters.
5. The discussion about variable names applies equally to the cookie names.
6. The order in which parameters are taken from the request and the environment is EGPCS (environment, GET, POST, Cookies, built-in variables). This means that a POST parameter will overwrite the parameters transported on the request line (in QUERY_STRING).
7. When "magic_quotes_gpc" is set to "On" PHP will use backslash to escape the following characters: single quote, double quote, backslash, and the nul byte.
8. If "magic_quotes_sybase" is set to "On" only the single quote will be escaped using another single quote. In this case the "magic_quotes_gpc" setting becomes irrelevant. The "magic_quotes_sybase" setting completely overrides the "magic_quotes_gpc" behaviour but "magic_quotes_gpc" still must be set to "On" for the Sybase-specific quoting to be work.
9. PHP will also automatically create nested arrays for you. For example "p[x][y]=1" results in a total of three variables.

Relevant Link:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#ModSecurityreg_Reference_Manual

你可能感兴趣的:(ModSecurity web application firewall (WAF) Research)

理解Gunicorn：Python WSGI服务器的基石范范0825 ipython linux 运维
理解Gunicorn：PythonWSGI服务器的基石介绍Gunicorn，全称GreenUnicorn，是一个为PythonWSGI（WebServerGatewayInterface）应用设计的高效、轻量级HTTP服务器。作为PythonWeb应用部署的常用工具，Gunicorn以其高性能和易用性著称。本文将介绍Gunicorn的基本概念、安装和配置，帮助初学者快速上手。1.什么是Gunico
Linux下QT开发的动态库界面弹出操作（SDL2） 13jjyao QT类 qt 开发语言 sdl2 linux
需求：操作系统为linux，开发框架为qt，做成需带界面的qt动态库，调用方为java等非qt程序难点：调用方为java等非qt程序，也就是说调用方肯定不带QApplication::exec()，缺少了这个，QTimer等事件和QT创建的窗口将不能弹出(包括opencv也是不能弹出)；这与qt调用本身qt库是有本质的区别的思路：1.调用方缺QApplication::exec()，那么我们在接口
Google earth studio 简介陟彼高冈yu 旅游
GoogleEarthStudio是一个基于Web的动画工具，专为创作使用GoogleEarth数据的动画和视频而设计。它利用了GoogleEarth强大的三维地图和卫星影像数据库，使用户能够轻松地创建逼真的地球动画、航拍视频和动态地图可视化。网址为https://www.google.com/earth/studio/。GoogleEarthStudio是一个基于Web的动画工具，专为创作使用G
PHP环境搭建详细教程好看资源平台前端 php
PHP是一个流行的服务器端脚本语言，广泛用于Web开发。为了使PHP能够在本地或服务器上运行，我们需要搭建一个合适的PHP环境。本教程将结合最新资料，介绍在不同操作系统上搭建PHP开发环境的多种方法，包括Windows、macOS和Linux系统的安装步骤，以及本地和Docker环境的配置。1.PHP环境搭建概述PHP环境的搭建主要分为以下几类：集成开发环境：例如XAMPP、WAMP、MAMP，这
DIV+CSS+JavaScript技术制作网页（旅游主题网页设计与制作）云南大理 STU学生网页设计网页设计期末网页作业 html静态网页 html5期末大作业网页设计 web大作业
️精彩专栏推荐作者主页:【进入主页—获取更多源码】web前端期末大作业：【HTML5网页期末作业(1000套)】程序员有趣的告白方式：【HTML七夕情人节表白网页制作(110套)】文章目录二、网站介绍三、网站效果▶️1.视频演示2.图片演示四、网站代码HTML结构代码CSS样式代码五、更多源码二、网站介绍网站布局方面：计划采用目前主流的、能兼容各大主流浏览器、显示效果稳定的浮动网页布局结构。网站程
使用Faiss进行高效相似度搜索 llzwxh888 faiss python
在现代AI应用中，快速和高效的相似度搜索是至关重要的。Faiss（FacebookAISimilaritySearch）是一个专门用于快速相似度搜索和聚类的库，特别适用于高维向量。本文将介绍如何使用Faiss来进行相似度搜索，并结合Python代码演示其基本用法。什么是Faiss？Faiss是一个由FacebookAIResearch团队开发的开源库，主要用于高维向量的相似性搜索和聚类。Faiss
关于城市旅游的HTML网页设计——(旅游风景云南 5页)HTML+CSS+JavaScript 二挡起步 web前端期末大作业 javascript html css 旅游风景
⛵源码获取文末联系✈Web前端开发技术描述网页设计题材，DIV+CSS布局制作,HTML+CSS网页设计期末课程大作业|游景点介绍|旅游风景区|家乡介绍|等网站的设计与制作|HTML期末大学生网页设计作业，Web大学生网页HTML：结构CSS：样式在操作方面上运用了html5和css3，采用了div+css结构、表单、超链接、浮动、绝对定位、相对定位、字体样式、引用视频等基础知识JavaScrip
HTML网页设计制作大作业（div+css）云南我的家乡旅游景点带文字滚动二挡起步 web前端期末大作业 web设计网页规划与设计 html css javascript dreamweaver 前端
Web前端开发技术描述网页设计题材，DIV+CSS布局制作,HTML+CSS网页设计期末课程大作业游景点介绍|旅游风景区|家乡介绍|等网站的设计与制作HTML期末大学生网页设计作业HTML：结构CSS：样式在操作方面上运用了html5和css3，采用了div+css结构、表单、超链接、浮动、绝对定位、相对定位、字体样式、引用视频等基础知识JavaScript：做与用户的交互行为文章目录前端学习路线
git - Webhook让部署自动化大猪大猪
我们现在有一个需求，将项目打包上传到gitlab或者github后，程序能自动部署，不用手动地去服务器中进行项目更新并运行，如何做到？这里我们可以使用gitlab与github的挂钩，挂钩的原理就是，每当我们有请求到gitlab与github服务器时，这时他俩会根据我们配置的挂钩地扯进行访问，webhook挂钩程序会一直监听着某个端口请求，一但收到他们发过来的请求，这时就知道用户有请求提交了，这时
webpack图片等资源的处理 dmengmeng
需要的loaderfile-loader（让我们可以引入这些资源文件）url-loader（其实是file-loader的二次封装）img-loader（处理图片所需要的）在没有使用任何处理图片的loader之前，比如说css中用到了背景图片，那么最后打包会报错的，因为他没办法处理图片。其实你只想能够使用图片的话。只加一个file-loader就可以，打开网页能准确看到图片。{test:/\.(p
Faiss Tips：高效向量搜索与聚类的利器焦习娜Samantha
FaissTips：高效向量搜索与聚类的利器faiss_tipsSomeusefultipsforfaiss项目地址:https://gitcode.com/gh_mirrors/fa/faiss_tips项目介绍Faiss是由FacebookAIResearch开发的一个用于高效相似性搜索和密集向量聚类的库。它支持多种硬件平台，包括CPU和GPU，能够在海量数据集上实现快速的近似最近邻搜索（AN
Faiss：高效相似性搜索与聚类的利器网络·魚大数据 faiss
Faiss是一个针对大规模向量集合的相似性搜索库，由FacebookAIResearch开发。它提供了一系列高效的算法和数据结构，用于加速向量之间的相似性搜索，特别是在大规模数据集上。本文将介绍Faiss的原理、核心功能以及如何在实际项目中使用它。Faiss原理：近似最近邻搜索：Faiss的核心功能之一是近似最近邻搜索，它能够高效地在大规模数据集中找到与给定查询向量最相似的向量。这种搜索是近似的，
「豆包Marscode体验官」 | 云端 IDE 启动 & Rust 体验张风捷特烈 ide rust 开发语言后端
theme:cyanosis我正在参加「豆包MarsCode初体验」征文活动MarsCode可以看作一个运行在服务端的远程VSCode开发环境。对于我这种想要学习体验某些语言，但不想在电脑里装环境的人来说非常友好。本文就来介绍一下在MarsCode里，我的体验rust开发体验。一、MarsCode是什么它的本质是:提供代码助手和云端IDE服务的web网站，可通过下面的链接访问https://www
Python神器！WEB自动化测试集成工具 DrissionPage 亚丁号 python 开发语言
一、前言用requests做数据采集面对要登录的网站时，要分析数据包、JS源码，构造复杂的请求，往往还要应付验证码、JS混淆、签名参数等反爬手段，门槛较高。若数据是由JS计算生成的，还须重现计算过程，体验不好，开发效率不高。使用浏览器，可以很大程度上绕过这些坑，但浏览器运行效率不高。因此，这个库设计初衷，是将它们合而为一，能够在不同须要时切换相应模式，并提供一种人性化的使用方法，提高开发和运行效率
Java爬虫框架（一）--架构设计狼图腾-狼之传说 java 框架 java 任务 html解析器存储电子商务
一、架构图那里搜网络爬虫框架主要针对电子商务网站进行数据爬取，分析，存储，索引。爬虫：爬虫负责爬取，解析，处理电子商务网站的网页的内容数据库：存储商品信息索引：商品的全文搜索索引Task队列：需要爬取的网页列表Visited表：已经爬取过的网页列表爬虫监控平台：web平台可以启动，停止爬虫，管理爬虫，task队列，visited表。二、爬虫1.流程1)Scheduler启动爬虫器，TaskMast
Java：爬虫框架 dingcho Java java 爬虫
一、ApacheNutch2【参考地址】Nutch是一个开源Java实现的搜索引擎。它提供了我们运行自己的搜索引擎所需的全部工具。包括全文搜索和Web爬虫。Nutch致力于让每个人能很容易,同时花费很少就可以配置世界一流的Web搜索引擎.为了完成这一宏伟的目标,Nutch必须能够做到:每个月取几十亿网页为这些网页维护一个索引对索引文件进行每秒上千次的搜索提供高质量的搜索结果简单来说Nutch支持分
MongoDB知识概括 GeorgeLin98 持久层 mongodb
MongoDB知识概括MongoDB相关概念单机部署基本常用命令索引-IndexSpirngDataMongoDB集成副本集分片集群安全认证MongoDB相关概念业务应用场景：传统的关系型数据库（如MySQL），在数据操作的“三高”需求以及应对Web2.0的网站需求面前，显得力不从心。解释：“三高”需求：①Highperformance-对数据库高并发读写的需求。②HugeStorage-对海量数
Python实现下载当前年份的谷歌影像 sand&wich python 开发语言
在GIS项目和地图应用中，获取最新的地理影像数据是非常重要的。本文将介绍如何使用Python代码从Google地图自动下载当前年份的影像数据，并将其保存为高分辨率的TIFF格式文件。这个过程涉及地理坐标转换、多线程下载和图像处理。关键功能该脚本的核心功能包括：坐标转换：支持WGS-84与WebMercator投影之间转换，以及处理中国GCJ-02偏移。自动化下载：多线程下载地图瓦片，提高效率。图像
Spring MVC 全面指南：从入门到精通的详细解析一杯梅子酱技术栈学习 spring mvc java
引言：SpringMVC，作为Spring框架的一个重要模块，为构建Web应用提供了强大的功能和灵活性。无论是初学者还是有一定经验的开发者，掌握SpringMVC都将显著提升你的Web开发技能。本文旨在为初学者提供一个全面且易于理解的学习路径，通过详细的知识点分析和实际案例，帮助你快速上手SpringMVC，让学习过程既深刻又高效。一、SpringMVC简介1.1什么是SpringMVC？Spri
Spring Boot中实现跨域请求 BABA8891 spring boot 后端 java
在SpringBoot中实现跨域请求（CORS，Cross-OriginResourceSharing）可以通过多种方式，以下是几种常见的方法：1.使用@CrossOrigin注解在SpringBoot中，你可以在控制器或者具体的请求处理方法上使用@CrossOrigin注解来允许跨域请求。在控制器上应用：importorg.springframework.web.bind.annotation.
WebMagic：强大的Java爬虫框架解析与实战 Aaron_945 Java java 爬虫开发语言
文章目录引言官网链接WebMagic原理概述基础使用1.添加依赖2.编写PageProcessor高级使用1.自定义Pipeline2.分布式抓取优点结论引言在大数据时代，网络爬虫作为数据收集的重要工具，扮演着不可或缺的角色。Java作为一门广泛使用的编程语言，在爬虫开发领域也有其独特的优势。WebMagic是一个开源的Java爬虫框架，它提供了简单灵活的API，支持多线程、分布式抓取，以及丰富的
博客网站制作教程 2401_85194651 java maven
首先就是技术框架：后端：Java+SpringBoot数据库：MySQL前端：Vue.js数据库连接：JPA(JavaPersistenceAPI)1.项目结构blog-app/├──backend/│├──src/main/java/com/example/blogapp/││├──BlogApplication.java││├──config/│││└──DatabaseConfig.java
00. 这里整理了最全的爬虫框架（Java + Python）有一只柴犬爬虫系列爬虫 java python
目录1、前言2、什么是网络爬虫3、常见的爬虫框架3.1、java框架3.1.1、WebMagic3.1.2、Jsoup3.1.3、HttpClient3.1.4、Crawler4j3.1.5、HtmlUnit3.1.6、Selenium3.2、Python框架3.2.1、Scrapy3.2.2、BeautifulSoup+Requests3.2.3、Selenium3.2.4、PyQuery3.2
RabbitMQ生产者重复机制与确认机制 java炒饭小能手 java-rabbitmq rabbitmq java
重复机制生产者发送消息时，出现了网络故障，导致与MQ的连接中断。为了解决这个问题，SpringAMQP提供的消息发送时的重试机制。即：当RabbitTemplate与MQ连接超时后，多次重试。需要修该发送端模块的application.yaml文件，添加下面的内容：spring:rabbitmq:connection-timeout:1s#设置MQ的连接超时时间template:retry:ena
最简单将静态网页挂载到服务器上(不用nginx) 全能全知者服务器 nginx 运维前端 html 笔记
最简单将静态网页挂载到服务器上(不用nginx)如果随便弄个静态网页挂在服务器都要用nignx就太麻烦了，所以直接使用Apache来搭建一些简单前端静态网页会相对方便很多检查Web服务器服务状态：sudosystemctlstatushttpd#ApacheWeb服务器如果发现没有安装web服务器：安装Apache：sudoyuminstallhttpd启动Apache：sudosystemctl
uniapp使用内置地图选择插件，实现地址选择并在地图上标点神夜大侠 Uniapp vue.js uniapp
uniapp使用内置地图选择插件，实现地址选择并在地图上标点代码如下：page{background:#F4F5F6;}::-webkit-scrollbar{width:0;height:0;color:transparent;}page{height:100%;width:100%;font-size:24rpx;}image,view,input,textarea,label,text,na
【Golang】实现 Excel 文件下载功能 RumIV Golang golang excel 开发语言
在当今的网络应用开发中，提供数据导出功能是一项常见的需求。Excel作为一种广泛使用的电子表格格式，通常是数据导出的首选格式之一。在本教程中，我们将学习如何使用Go语言和GinWeb框架来创建一个Excel文件，并允许用户通过HTTP请求下载该文件。准备工作在开始之前，请确保您的开发环境中已经安装了Go语言和相关的开发工具。此外，您还需要安装GinWeb框架和excelize包，这两个包都将用于我
VUE3 + xterm + nestjs实现web远程终端或连接开启SSH登录的路由器和交换机。焚木灵 node.js vue
可远程连接系统终端或开启SSH登录的路由器和交换机。相关资料：xtermjs/xterm.js:Aterminalfortheweb(github.com)后端实现(NestJS)：1、安装依赖：npminstallnode-ssh@nestjs/websockets@nestjs/platform-socket.io2、我们将创建一个名为RemoteControlModule的NestJS模块，
metaRTC8.0，一个全新架构的webRTC SDK库 metaRTC webrtc 音视频
概述metaRTC8.0是metaRTC开源以来架构变化最大的一个版本，是metaIPC3.0等高性能的基础。metaRTC8.0是一个全新架构版本，并非在metaRTC7.0版本上简单升级，在QOS/语音对讲/内存占用/视频文件录制读取等方面新增多个模块，在弱网对抗/语音对讲/内存优化等效果上有显著提升。metaRTC8.0在一年多的开发中进行了近200次迭代，metaRTC8.0社区版计划在2
metaRTC/webRTC QOS 方案与实践 metaRTC metaRTC 解决方案 webrtc qos
概述质量服务(QOS/QualityofService)是指利用各种技术方案提高网络通信质量的技术，网络通信质量需要解决下面两个问题：网络问题：UDP/不稳定网络/弱网下的丢包/延时/乱序/抖动数据量问题：发送数据量超带宽负载和平滑发送拥塞控制是各种技术方案的数据基础，丢包恢复解决丢包问题，抗乱序抖动解决网络乱序抖动问题，流量控制解决平滑发送数据/数据超带宽负载/延时问题。拥塞控制(Congest
Spring中@Value注解，需要注意的地方无量 spring bean @Value xml
Spring 3以后,支持@Value注解的方式获取properties文件中的配置值，简化了读取配置文件的复杂操作 1、在applicationContext.xml文件(或引用文件中)中配置properties文件 <bean id="appProperty" class="org.springframework.beans.fac
mongoDB 分片开窍的石头 mongodb
mongoDB的分片。要mongos查询数据时候先查询configsvr看数据在那台shard上，configsvr上边放的是metar信息，指的是那条数据在那个片上。由此可以看出mongo在做分片的时候咱们至少要有一个configsvr,和两个以上的shard（片）信息。第一步启动两台以上的mongo服务 &nb
OVER(PARTITION BY)函数用法 0624chenhong oracle
这篇写得很好，引自 http://www.cnblogs.com/lanzi/archive/2010/10/26/1861338.html OVER(PARTITION BY)函数用法 2010年10月26日 OVER(PARTITION BY)函数介绍开窗函数 &nb
Android开发中，ADB server didn't ACK 解决方法一炮送你回车库 Android开发
首先通知：凡是安装360、豌豆荚、腾讯管家的全部卸载，然后再尝试。一直没搞明白这个问题咋出现的，但今天看到一个方法，搞定了！原来是豌豆荚占用了 5037 端口导致。参见原文章：一个豌豆荚引发的血案——关于ADB server didn't ACK的问题简单来讲，首先将Windows任务进程中的豌豆荚干掉，如果还是不行，再继续按下列步骤排查。 &nb
canvas中的像素绘制问题换个号韩国红果果 JavaScript canvas
pixl的绘制，1.如果绘制点正处于相邻像素交叉线，绘制x像素的线宽，则从交叉线分别向前向后绘制x/2个像素，如果x/2是整数，则刚好填满x个像素，如果是小数，则先把整数格填满，再去绘制剩下的小数部分，绘制时，是将小数部分的颜色用来除以一个像素的宽度，颜色会变淡。所以要用整数坐标来画的话（即绘制点正处于相邻像素交叉线时），线宽必须是2的整数倍。否则会出现不饱满的像素。 2.如果绘制点为一个像素的
编码乱码问题灵静志远 java jvm jsp 编码
1、JVM中单个字符占用的字节长度跟编码方式有关，而默认编码方式又跟平台是一一对应的或说平台决定了默认字符编码方式；2、对于单个字符：ISO-8859-1单字节编码，GBK双字节编码，UTF-8三字节编码；因此中文平台(中文平台默认字符集编码GBK)下一个中文字符占2个字节，而英文平台(英文平台默认字符集编码Cp1252(类似于ISO-8859-1))。 3、getBytes()、getByte
java 求几个月后的日期 darkranger calendar getinstance
Date plandate = planDate.toDate(); SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd"); Calendar cal = Calendar.getInstance(); cal.setTime(plandate); // 取得三个月后时间 cal.add(Calendar.M
数据库设计的三大范式（通俗易懂） aijuans 数据库复习
关系数据库中的关系必须满足一定的要求。满足不同程度要求的为不同范式。数据库的设计范式是数据库设计所需要满足的规范。只有理解数据库的设计范式，才能设计出高效率、优雅的数据库，否则可能会设计出错误的数据库. 目前，主要有六种范式：第一范式、第二范式、第三范式、BC范式、第四范式和第五范式。满足最低要求的叫第一范式，简称1NF。在第一范式基础上进一步满足一些要求的为第二范式，简称2NF。其余依此类推。
想学工作流怎么入手 atongyeye jbpm
工作流在工作中变得越来越重要，很多朋友想学工作流却不知如何入手。很多朋友习惯性的这看一点，那了解一点，既不系统，也容易半途而废。好比学武功，最好的办法是有一本武功秘籍。研究明白，则犹如打通任督二脉。系统学习工作流，很重要的一本书《JBPM工作流开发指南》。本人苦苦学习两个月，基本上可以解决大部分流程问题。整理一下学习思路，有兴趣的朋友可以参考下。 1 首先要
Context和SQLiteOpenHelper创建数据库百合不是茶 android Context创建数据库
一直以为安卓数据库的创建就是使用SQLiteOpenHelper创建,但是最近在android的一本书上看到了Context也可以创建数据库,下面我们一起分析这两种方式创建数据库的方式和区别,重点在SQLiteOpenHelper 一:SQLiteOpenHelper创建数据库: 1,SQLi
浅谈group by和distinct bijian1013 oracle 数据库 group by distinct
group by和distinct只了去重意义一样，但是group by应用范围更广泛些，如分组汇总或者从聚合函数里筛选数据等。譬如：统计每id数并且只显示数大于3 select id ,count(id) from ta
vi opertion 征客丶 mac opration vi
进入 command mode （命令行模式）按 esc 键再按 shift + 冒号注：以下命令中带 $ 【在命令行模式下进行】，不带 $ 【在非命令行模式下进行】一、文件操作 1.1、强制退出不保存 $ q! 1.2、保存 $ w 1.3、保存并退出 $ wq 1.4、刷新或重新加载已打开的文件 $ e 二、光标移动 2.1、跳到指定行数字
【Spark十四】深入Spark RDD第三部分RDD基本API bit1129 spark
对于K/V类型的RDD,如下操作是什么含义？ val rdd = sc.parallelize(List(("A",3),("C",6),("A",1),("B",5)) rdd.reduceByKey(_+_).collect reduceByKey在这里的操作，是把
java类加载机制 BlueSkator java 虚拟机
java类加载机制 1.java类加载器的树状结构引导类加载器 ^ | 扩展类加载器 ^ | 系统类加载器 java使用代理模式来完成类加载，java的类加载器也有类似于继承的关系，引导类是最顶层的加载器，它是所有类的根加载器，它负责加载java核心库。当一个类加载器接到装载类到虚拟机的请求时，通常会代理给父类加载器，若已经是根加载器了，就自己完成加载。虚拟机区分一个Cla
动态添加文本框 BreakingBad 文本框
<script> var num=1; function AddInput() { var str=""; str+="<input
读《研磨设计模式》-代码笔记-单例模式 bylijinnan java 设计模式
声明：本文只为方便我个人查阅和理解，详细的分析以及源代码请移步原作者的博客http://chjavach.iteye.com/ public class Singleton { } /* * 懒汉模式。注意，getInstance如果在多线程环境中调用，需要加上synchronized，否则存在线程不安全问题 */ class LazySingleton
iOS应用打包发布常见问题 chenhbc ios iOS发布 iOS上传 iOS打包
这个月公司安排我一个人做iOS客户端开发，由于急着用，我先发布一个版本，由于第一次发布iOS应用，期间出了不少问题，记录于此。 1、使用Application Loader 发布时报错：Communication error.please use diagnostic mode to check connectivity.you need to have outbound acc
工作流复杂拓扑结构处理新思路 comsci 设计模式工作算法企业应用 OO
我们走的设计路线和国外的产品不太一样，不一样在哪里呢？国外的流程的设计思路是通过事先定义一整套规则(类似XPDL)来约束和控制流程图的复杂度(我对国外的产品了解不够多，仅仅是在有限的了解程度上面提出这样的看法)，从而避免在流程引擎中处理这些复杂的图的问题，而我们却没有通过事先定义这样的复杂的规则来约束和降低用户自定义流程图的灵活性，这样一来，在引擎和流程流转控制这一个层面就会遇到很
oracle 11g新特性Flashback data archive daizj oracle
1. 什么是flashback data archive Flashback data archive是oracle 11g中引入的一个新特性。Flashback archive是一个新的数据库对象，用于存储一个或多表的历史数据。Flashback archive是一个逻辑对象，概念上类似于表空间。实际上flashback archive可以看作是存储一个或多个表的所有事务变化的逻辑空间。
多叉树:2-3-4树 dieslrae 树
平衡树多叉树,每个节点最多有4个子节点和3个数据项,2,3,4的含义是指一个节点可能含有的子节点的个数,效率比红黑树稍差.一般不允许出现重复关键字值.2-3-4树有以下特征: 1、有一个数据项的节点总是有2个子节点(称为2-节点) 2、有两个数据项的节点总是有3个子节点(称为3-节
C语言学习七动态分配 malloc的使用 dcj3sjt126com c language malloc
/* 2013年3月15日15:16:24 malloc 就memory(内存) allocate(分配)的缩写本程序没有实际含义，只是理解使用 */ # include <stdio.h> # include <malloc.h> int main(void) { int i = 5; //分配了4个字节静态分配 int * p
Objective-C编码规范[译] dcj3sjt126com 代码规范
原文链接 : The official raywenderlich.com Objective-C style guide 原文作者 : raywenderlich.com Team 译文出自 : raywenderlich.com Objective-C编码规范译者 : Sam Lau
0.性能优化-目录 frank1234 性能优化
从今天开始笔者陆续发表一些性能测试相关的文章，主要是对自己前段时间学习的总结，由于水平有限，性能测试领域很深，本人理解的也比较浅，欢迎各位大咖批评指正。主要内容包括：一、性能测试指标吞吐量、TPS、响应时间、负载、可扩展性、PV、思考时间 http://frank1234.iteye.com/blog/2180305 二、性能测试策略生产环境相同基准测试预热等 htt
Java父类取得子类传递的泛型参数Class类型 happyqing java 泛型父类子类 Class
import java.lang.reflect.ParameterizedType; import java.lang.reflect.Type; import org.junit.Test; abstract class BaseDao<T> { public void getType() { //Class<E> clazz =
跟我学SpringMVC目录汇总贴、PDF下载、源码下载 jinnianshilongnian springMVC
----广告-------------------------------------------------------------- 网站核心商详页开发掌握Java技术，掌握并发/异步工具使用，熟悉spring、ibatis框架；掌握数据库技术，表设计和索引优化，分库分表/读写分离；了解缓存技术，熟练使用如Redis/Memcached等主流技术；了解Ngin
the HTTP rewrite module requires the PCRE library 流浪鱼 rewrite
./configure: error: the HTTP rewrite module requires the PCRE library. 模块依赖性Nginx需要依赖下面3个包 1. gzip 模块需要 zlib 库 ( 下载: http://www.zlib.net/ ) 2. rewrite 模块需要 pcre 库 ( 下载: http://www.pcre.org/ ) 3. s
第12章 Ajax（中） onestopweb Ajax
index.html <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/
Optimize query with Query Stripping in Web Intelligence blueoxygen BO
http://wiki.sdn.sap.com/wiki/display/BOBJ/Optimize+query+with+Query+Stripping+in+Web+Intelligence and a very straightfoward video http://www.sdn.sap.com/irj/scn/events?rid=/library/uuid/40ec3a0c-936
Java开发者写SQL时常犯的10个错误 tomcat_oracle java sql
1、不用PreparedStatements 　　有意思的是，在JDBC出现了许多年后的今天，这个错误依然出现在博客、论坛和邮件列表中，即便要记住和理解它是一件很简单的事。开发者不使用PreparedStatements的原因可能有如下几个：　　他们对PreparedStatements不了解　　他们认为使用PreparedStatements太慢了　　他们认为写Prepar
世纪互联与结盟有感阿尔萨斯
10月10日，世纪互联与（Foxcon）签约成立合资公司，有感。全球电子制造业巨头（全球500强企业）与世纪互联共同看好IDC、云计算等业务在中国的增长空间，双方迅速果断出手，在资本层面上达成合作，此举体现了全球电子制造业巨头对世纪互联IDC业务的欣赏与信任，另一方面反映出世纪互联目前良好的运营状况与广阔的发展前景。众所周知，精于电子产品制造（世界第一），对于世纪互联而言，能够与结盟