Challenge 2: Which Control Actually Applies to a SQLi Payload on
/search — Solution Walkthrough

Which control is relevant:

mod_security (with the OWASP Core Rule Set) is the relevant control
here, not the Require ip restriction.

Why Require ip doesn't apply to this request at all:

The Require ip rule in this scenario is scoped specifically to the
/admin/ path -- it's an access-control rule tied to a particular
Directory/Location context. The attacker's request is going to
/search, a completely different path that was never covered by that
restriction in the first place. Require directives only ever apply to
the specific context (Directory/Location/.htaccess) they're actually
configured inside -- being outside the office IP range is irrelevant
here because the path being attacked was never IP-restricted to begin
with.

Why mod_security is the one that matters:

Per this chapter's own distinction, mod_security inspects WHAT is
being sent, regardless of who's sending it or which path they're
hitting (assuming it's applied site-wide, as described). A SQL
injection payload in the request to /search is exactly the kind of
attack-pattern content mod_security and the Core Rule Set are designed
to detect and block, independent of the attacker's IP address or
whether any authentication was involved at all -- this request was
never going to be stopped by an IP allowlist that was never applied to
this path, but it's squarely mod_security's job to catch.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader understands access-control rules
(Require) are scoped to specific paths and check identity/origin, while
mod_security is content-based and can apply broadly -- and can
correctly reason about why a path-scoped control simply doesn't
activate for a request outside its scope, rather than assuming any
security control on the site is automatically relevant to any attack.