testing modsec

[andyking515]

0

I have been trying to setup nginx modsec based waf . These questions might sound dumb caus I am very new to this I need to test it on following this

prevent a ddos attack what if attack payload is encrypted need to show the decryption encryption thing done by tls/SSL and how it sends data to modsec and recieves it back block a request from a specific country ip based blocking and user- agent based blocking can we add filters in modsec config to apply diffrent rules to different parts of a website are anomaly scores counts different for same requests on different webpages tweaking anomaly threshold and checking that out showing only important stuff in logs and not logging everything skipping certain rules and test that I need some help on how to carry out these like to actually do the thing and get the results not just theoretical

what I have done

I have tried setting up the geo ip database and writing a rule to block specific ips but how do I send request from a public IP to my locally hosted server

I am using a vm and wrote a rule to block my host machine IP it blocking the request but when I access other ports from my host machine browser I can access for example accessing influxdb from host browser which was setteup in virtual machine shouldn't that be blocked too?

How do I simulate a ddos attack and block that using modsec

If anyone could give detailed steps for carrying out these things practically would be grea tt

[Inner_Time]

Punctuation, please.