Directory Traversal

 Weaker signature

 Validate request line

 HTTP Request Smuggling

 Block request with malformed content.
 ModSecurity will not inspect these, but the server application might do so

 Accept only digits in content length

 Do not accept GET or HEAD requests with bodies
 HTTP standard allows GET requests to have a body but this
 feature is not used in real life. Attackers could try to force
 a request body on an unsuspecting web applications.

 Require Content-Length to be provided with every POST request.

 Don't accept transfer encodings we know we don't know how to handle
 NOTE ModSecurity does not support chunked transfer encodings at
      this time. You MUST reject all such requests.

 Check encodings

 Proxy access attempt
 NOTE Apache blocks such access by default if not set as a proxy. The rule is
      included in case Apache proxy is misconfigured.

 Restrict type of characters sent
 NOTE In order to be broad and support localized applications this rule
      only validates that NULL Is not used.
	   The strict policy version also validates that protocol and application
	   generated fields are limited to printable ASCII.
 TODO If your application use the range 32-126 for parameters.

 Exception for Apache internal dummy connection

 Detect HTTP/0.9 Requests

 Check that the host header is not an IP address

 Maximum number of arguments in request limited

 allow request methods
 TODO Most applications only use GET, HEAD, and POST request
      methods. If that is not the case with your environment, you are advised
      to edit the line or uncomment it.

 Restrict which content-types we accept.
 TODO Most applications support only two types for request bodies
      because that is all browsers know how to produce. If you are using
      automated tools to talk to the application you may be using other
      content types and would want to change the list of supported types.
      Note though that ModSecurity parses only three content types:
      application/x-www-form-urlencoded, multipart/form-data request and
      text/xml. The protection provided for any other type is inferior.
 TODO There are many applications that are not using multipart/form-data
      types (typically only used for file uploads). This content type
      can be disabled if not used.
 NOTE We allow any content type to be specified with GET or HEAD
      because some tools incorrectly supply content type information
      even when the body is not present. There is a rule further in
      the file to prevent GET and HEAD requests to have bodies to we're
      safe in that respect.
 NOTE Use of WebDAV requires "text/xml" content type.
 NOTE Philippe Bourcier (pbourcier AT citali DOT com) reports
      applications running on the PocketPC and AvantGo platforms use
      non-standard content types:
      M-Business iAnywhere      application/x-mal-client-data
      UltraLite iAnywhere       application/octet-stream

 Restrict protocol versions.
 TODO All modern browsers use HTTP version 1.1. For tight security, allow only
      this version.
 NOTE Automation programs, both malicious and non malicious many times use
      other HTTP versions. If you want to allow a specific automated program
      to use your site, try to create a narrower expection and not allow any
      client to send HTTP requests in a version lower than 1.1

 Restrict file extension
 TODO the list of file extensions below are virtually always considered unsafe
      and not in use in any valid program. If your application uses one of
      these extensions, please remove it from the list of blocked extensions.
      You may need to use ModSecurity Core Rule Set Templates to do so, otherwise
      comment the whole rule.

 Restricted HTTP headers
 TODO the list of HTTP headers below are considered unsafe for your environment.
      If your application uses one of these directories, please remove it from
      the list of blocked extensions. You may need to use ModSecurity Core Rule
      Set Templates to do so, otherwise comment the whole rule.

 Restricted Content Encodings
 ModSecurity does not support compressed content. Therefore, the following
 action will be taken:
   - Inbound compressed content will be denied
   - Outbound compressed content will be logged once, to alert the user
 Deny inbound compressed content

 Session fixation

 Blind SQL injection

 SQL injection

 XSS

 File Injection

 Command access

 Command injection

 Coldfusion injection

 LDAP injection

 SSI injection

 PHP injection

 UPDF XSS

 Email Injection

 HTTP Response Splitting

 File or Directory Names Leakage

 Prequalifier. Look for <http> first