Esempi per la verifica del funzionamento di 
mod_anti_tamper.


Create a directory in apache root directory.

#mkdir /var/www/html/test

Copy test.php and redirected.html in test/

cp test.php /var/www/html/test
cp redirected.html /var/www/html/test
cd /var/www/html/test

now create .htaccess file in test dir

cat >.htaccess <<_EOF

<IfModule mod_anti_tamper.c>
  <Files "./test.php" >
  ATHmacCookie Off
  ATHmacUrl Off
  ATRedirect_url redirected.html
  </Files>
</IfModule>
_EOF

and browse to

http://127.0.0.1/test/test.php
 
You'll see a link and cookies test.php sent to your browser
displayed with a simple javascript

Now let's test mod_anti_tamper functionalities.

1. Testing URL tampering.
Click on "Test Link" and you'll have a resume of  your request.


On the address bar you will see something like  this:

http://127.0.0.1/test.php?id=2&_auth=1c1bb845e43b8449c1cbc83ec8e19f3c15986fd7

Now try to change 'id' variable value and press enter.
The request will be taken as usual and computed by test.php script.

Let's set our .htaccess to:

  ATHmacUrl On

If we change 'id' value will be redirected to 'redirected.html' because
our request is no more signed by '_auth' value!


2. Testing Cookie tampering.

Try to click on 'admin' link.
A popup window will be displayed by a javascript command.
You can now change the value of your cookie.
Set 'admin' to 1.

The new cookie will be sent to test.php application and elaborated, giving you (virtually) 
admin privileges.

Try now to set our  .htaccess to:

  ATHmacCookie On

Cookie filter is now active and cookies aren't allowed to be tampered.

Try again the previous procedure and you'll see mod_anti_tamper won't accept it
and will discard it without sending it to test.php.



