External/patterns
1
0
Fork 0
mirror of https://github.com/fabriziosalmi/patterns.git synced 2025-12-29 16:15:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update: [Sun Dec 22 00:28:28 UTC 2024]

Browse Source
This commit is contained in:
github-actions[bot]
2024-12-22 00:28:28 +00:00
parent b05a7d87c2
commit 1e4bb70b5d
50 changed files with 428 additions and 577 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
waf_patterns/nginx/shells.conf
View File

@@ -2,10 +2,6 @@
location / {
set $attack_detected 0;
if ($request_uri ~* "@pm gzip compress deflate br zstd") {
set $attack_detected 1;
}
if ($request_uri ~* "@lt 1") {
set $attack_detected 1;
}
@@ -18,11 +14,11 @@ location / {
set $attack_detected 1;
}
if ($request_uri ~* "@rx <title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>") {
if ($request_uri ~* "@rx (<title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>)") {
set $attack_detected 1;
}
if ($request_uri ~* "@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=(?:Windows-1251|UTF-8)?'><title>.*?(?: -)? W[Ss][Oo] [0-9.]+</title>") {
if ($request_uri ~* "@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=Windows-1251'><title>.*? - WSO [0-9.]+</title>") {
set $attack_detected 1;
}
@@ -78,7 +74,7 @@ location / {
set $attack_detected 1;
}
if ($request_uri ~* "@rx ^<html>n<head>n<title>Ru24PostWebShell") {
if ($request_uri ~* "@rx ^<html>n<head>n<title>Ru24PostWebShell -") {
set $attack_detected 1;
}