diff --git a/waf_patterns/attack.conf b/waf_patterns/attack.conf new file mode 100644 index 0000000..ffd9481 --- /dev/null +++ b/waf_patterns/attack.conf @@ -0,0 +1,4 @@ +@block_attack { + path_regexp attack "(?i)(@lt 1|@lt 1|@rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d|@rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w|@rx (?:bhttp/d|<(?:html|meta)b)|@rx [nr]|@rx [nr]|@rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:|@rx [nr]|@rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)|@rx ^[^sx0b,;]+[sx0b,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)|@rx unix:[^|]*||@lt 2|@lt 2|@rx [nr]|@rx ^[^sx0b,;]+[sx0b,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b|@lt 3|@lt 3|@gt 0|@rx .|@gt 1|@rx (][^]]+$|][^]]+[)|@lt 4|@lt 4|@rx [|!@eq 0|!@within %{tx.allowed_request_content_type_charset}|@rx ^content-types*:s*(.*)$|!@rx ^(?:(?:*|[^!|@rx content-transfer-encoding:(.*)|@rx [^x21-x7E][x21-x39x3B-x7E]*:)" +} +respond @block_attack 403 diff --git a/waf_patterns/correlation.conf b/waf_patterns/correlation.conf new file mode 100644 index 0000000..828c6cb --- /dev/null +++ b/waf_patterns/correlation.conf @@ -0,0 +1,4 @@ +@block_correlation { + path_regexp correlation "(?i)(@eq 0|@ge 5|@eq 0|@ge %{tx.inbound_anomaly_score_threshold}|@ge %{tx.outbound_anomaly_score_threshold}|@lt 2|@ge %{tx.inbound_anomaly_score_threshold}|@ge %{tx.outbound_anomaly_score_threshold}|@lt 3|@gt 0|@lt 4|@lt 1|@lt 1|@lt 2|@lt 2|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_correlation 403 diff --git a/waf_patterns/detection.conf b/waf_patterns/detection.conf new file mode 100644 index 0000000..3b0a193 --- /dev/null +++ b/waf_patterns/detection.conf @@ -0,0 +1,4 @@ +@block_detection { + path_regexp detection "(?i)(@lt 1|@lt 1|@pmFromFile scanners-user-agents.data|@lt 2|@lt 2|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_detection 403 diff --git a/waf_patterns/enforcement.conf b/waf_patterns/enforcement.conf new file mode 100644 index 0000000..22f82a7 --- /dev/null +++ b/waf_patterns/enforcement.conf @@ -0,0 +1,4 @@ +@block_enforcement { + path_regexp enforcement "(?i)(@lt 1|@lt 1|!@within %{tx.allowed_methods}|@lt 2|@lt 2|@lt 3|@lt 3|@lt 4|@lt 4|@lt 1|@lt 1|!@rx (?i)^(?:get /[^#?]*(?:?[^sx0b#]*)?(?:#[^sx0b]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sx0b]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sx0b#]*)?(?:#[^sx0b]*)?)[sx0b]+[.-9A-Z_a-z]+)$|!@rx (?i)^(?:&(?:(?:[acegilnorsuz]acut|[aeiou]grav|[aino]tild)e|[c-elnr-tz]caron|(?:[cgklnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^|!@rx ^d+$|@rx ^(?:GET|HEAD)$|!@rx ^0?$|@rx ^(?:GET|HEAD)$|!@eq 0|!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0|@streq POST|@eq 0|@eq 0|!@eq 0|!@eq 0|@rx (d+)-(d+)|@lt %{tx.1}|@rx b(?:keep-alive|close),s?(?:keep-alive|close)b|@rx x25|@rx ^(.*)/(?:[^?]+)?(?.*)?$|@validateUrlEncoding|!@rx ^.*%.*.[^sx0b.]+$|@validateUrlEncoding|@eq 1|@validateUtf8Encoding|@rx (?i)%uff[0-9a-f]{2}|@validateByteRange 1-255|@eq 0|@rx ^$|@rx ^$|!@rx ^OPTIONS$|!@pm AppleWebKit Android Business Enterprise Entreprise|@rx ^$|!@rx ^OPTIONS$|@eq 0|@rx ^$|!@rx ^0$|@eq 0|@rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)|@eq 1|@gt %{tx.max_num_args}|@eq 1|@gt %{tx.arg_name_length}|@eq 1|@gt %{tx.arg_length}|@eq 1|@gt %{tx.total_arg_length}|@eq 1|@rx ^(?i)multipart/form-data|@gt %{tx.max_file_size}|@eq 1|@gt %{tx.combined_file_sizes}|!@rx ^[w/.+*-]+(?:s?;s*(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['|@rx ^[^;s]+|!@within %{tx.allowed_request_content_type}|@rx charsets*=s*[|!@within %{tx.allowed_request_content_type_charset}|@rx charset.*?charset|!@within %{tx.allowed_http_versions}|@rx .([^.]+)$|@within %{tx.restricted_extensions}|@rx .[^.~]+~(?:/.*|)$|@rx ^.*$|@within %{tx.restricted_headers_basic}|@gt 100|!@rx ^(?:(?:*|[^!|!@streq JSON|@rx (?i)x5cu[0-9a-f]{4}|@contains #|@gt 1|@lt 2|@lt 2|@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}|!@endsWith .pdf|@endsWith .pdf|@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}|@rx %[0-9a-fA-F]{2}|@validateByteRange 9,10,13,32-126,128-255|@eq 0|@rx ['|!@rx ^0$|@eq 0|@rx ^.*$|@within %{tx.restricted_headers_extended}|@rx ^(?i)application/x-www-form-urlencoded|@rx x25|@validateUrlEncoding|@lt 3|@lt 3|@validateByteRange 32-36,38-126|@eq 0|!@rx ^(?:OPTIONS|CONNECT)$|!@pm AppleWebKit Android|@ge 1|@rx ^(?i)up|@gt 0|!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$|!@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)|@lt 4|@lt 4|@endsWith .pdf|@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}|@validateByteRange 38,44-46,48-58,61,65-90,95,97-122|@validateByteRange 32,34,38,42-59,61,65-90,95,97-122|!@rx ^(?:?[01])?$|@rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789])" +} +respond @block_enforcement 403 diff --git a/waf_patterns/evaluation.conf b/waf_patterns/evaluation.conf new file mode 100644 index 0000000..4fb8968 --- /dev/null +++ b/waf_patterns/evaluation.conf @@ -0,0 +1,4 @@ +@block_evaluation { + path_regexp evaluation "(?i)(@ge 1|@ge 1|@ge 2|@ge 2|@ge 3|@ge 3|@ge 4|@ge 4|@ge 1|@ge 1|@ge 2|@ge 2|@ge 3|@ge 3|@ge 4|@ge 4|@ge %{tx.inbound_anomaly_score_threshold}|@eq 1|@ge %{tx.inbound_anomaly_score_threshold}|@lt 1|@lt 1|@lt 2|@lt 2|@lt 3|@lt 3|@lt 4|@lt 4|@ge 1|@ge 1|@ge 2|@ge 2|@ge 3|@ge 3|@ge 4|@ge 4|@ge 1|@ge 1|@ge 2|@ge 2|@ge 3|@ge 3|@ge 4|@ge 4|@ge %{tx.outbound_anomaly_score_threshold}|@eq 1|@ge %{tx.outbound_anomaly_score_threshold}|@lt 1|@lt 1|@lt 2|@lt 2|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_evaluation 403 diff --git a/waf_patterns/exceptions.conf b/waf_patterns/exceptions.conf new file mode 100644 index 0000000..d3a1d1f --- /dev/null +++ b/waf_patterns/exceptions.conf @@ -0,0 +1,4 @@ +@block_exceptions { + path_regexp exceptions "(?i)(@streq GET /|@ipMatch 127.0.0.1,::1|@ipMatch 127.0.0.1,::1|@endsWith (internal dummy connection)|@rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$)" +} +respond @block_exceptions 403 diff --git a/waf_patterns/fixation.conf b/waf_patterns/fixation.conf new file mode 100644 index 0000000..c2f2dd2 --- /dev/null +++ b/waf_patterns/fixation.conf @@ -0,0 +1,4 @@ +@block_fixation { + path_regexp fixation "(?i)(@lt 1|@lt 1|@rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)|@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$|@rx ^(?:ht|f)tps?://(.*?)/|!@endsWith %{request_headers.host}|@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$|@eq 0|@lt 2|@lt 2|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_fixation 403 diff --git a/waf_patterns/generic.conf b/waf_patterns/generic.conf new file mode 100644 index 0000000..11755fd --- /dev/null +++ b/waf_patterns/generic.conf @@ -0,0 +1,4 @@ +@block_generic { + path_regexp generic "(?i)(@lt 1|@lt 1|@rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sx0b]+Function[sx0b]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sx0b]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sx0b]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[[|@pmFromFile ssrf.data|@rx (?:__proto__|constructors*(?:.|[)s*prototype)|@rx Process[sx0b]*.[sx0b]*spawn[sx0b]*(|@rx while[sx0b]*([sx0b(]*(?:!+(?:false|null|undefined|NaN|[+-]?0||@rx ^data:(?:(?:*|[^!|@lt 2|@lt 2|@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sx0b]*(|@rx (?i)(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][-.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sx0b]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][-.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+)|@rx ^(?:[^@]|@[^{])*@+{.*}|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_generic 403 diff --git a/waf_patterns/iis.conf b/waf_patterns/iis.conf new file mode 100644 index 0000000..cfb18d5 --- /dev/null +++ b/waf_patterns/iis.conf @@ -0,0 +1,4 @@ +@block_iis { + path_regexp iis "(?i)(@pm gzip compress deflate br zstd|@lt 1|@lt 1|@rx [a-z]:x5cinetpubb|@rx (?:Microsoft OLE DB Provider for SQL Server(?:.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)
Timeout expired
)|

internal server error

.*?

part of the server has crashed or it has a configuration error.

|cannot connect to the server: timed out)|@pmFromFile iis-errors.data|!@rx ^404$|@rx bServer Error in.{0,50}?bApplicationb|@lt 2|@lt 2|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_iis 403 diff --git a/waf_patterns/initialization.conf b/waf_patterns/initialization.conf new file mode 100644 index 0000000..4273b69 --- /dev/null +++ b/waf_patterns/initialization.conf @@ -0,0 +1,4 @@ +@block_initialization { + path_regexp initialization "(?i)(@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 0|@eq 1|@unconditionalMatch|!@rx (?:URLENCODED|MULTIPART|XML|JSON)|@eq 1|!@rx (?:URLENCODED|MULTIPART|XML|JSON)|@eq 100|@rx ^[a-f]*([0-9])[a-f]*([0-9])|nolog|!@lt %{tx.sampling_percentage}|@lt %{tx.blocking_paranoia_level})" +} +respond @block_initialization 403 diff --git a/waf_patterns/java.conf b/waf_patterns/java.conf new file mode 100644 index 0000000..5eb8d20 --- /dev/null +++ b/waf_patterns/java.conf @@ -0,0 +1,4 @@ +@block_java { + path_regexp java "(?i)(@lt 1|@lt 1|@rx java.lang.(?:runtime|processbuilder)|@rx (?:runtime|processbuilder)|@rx (?i)(?:unmarshaller|base64data|java.)|@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)|@rx (?:runtime|processbuilder)|@pmFromFile java-classes.data|@rx .*.(?:jsp|jspx).*$|@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|$?)(?:{|&l(?:brace|cub);?)|jndi|ctx)|@lt 2|@lt 2|@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|$?)(?:{|&l(?:brace|cub);?)|jndi|ctx)|@rx xacxedx00x05|@rx (?:rO0ABQ|KztAAU|Cs7QAF)|@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)|@rx javab.+(?:runtime|processbuilder)|@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)|@lt 3|@lt 3|@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)|@lt 4|@lt 4|@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)|@pm gzip compress deflate br zstd|@lt 1|@lt 1|@pmFromFile java-code-leakages.data|@pmFromFile java-errors.data|@lt 2|@lt 2|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_java 403 diff --git a/waf_patterns/leakages.conf b/waf_patterns/leakages.conf new file mode 100644 index 0000000..4f19e79 --- /dev/null +++ b/waf_patterns/leakages.conf @@ -0,0 +1,4 @@ +@block_leakages { + path_regexp leakages "(?i)(@eq 1|@pm gzip compress deflate br zstd|@lt 1|@lt 1|@rx (?:<(?:TITLE>Index of.*?Index of.*?Index of|>[To Parent Directory]
)|@rx ^#!s?/|@lt 2|@lt 2|@rx ^5d{2}$|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_leakages 403 diff --git a/waf_patterns/lfi.conf b/waf_patterns/lfi.conf new file mode 100644 index 0000000..ea5f36f --- /dev/null +++ b/waf_patterns/lfi.conf @@ -0,0 +1,4 @@ +@block_lfi { + path_regexp lfi "(?i)(@lt 1|@lt 1|@rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[56]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[01]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[256aef]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[56]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))|@rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))|@pmFromFile lfi-os-files.data|@pmFromFile restricted-files.data|@lt 2|@lt 2|@pmFromFile lfi-os-files.data|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_lfi 403 diff --git a/waf_patterns/php.conf b/waf_patterns/php.conf new file mode 100644 index 0000000..0d05479 --- /dev/null +++ b/waf_patterns/php.conf @@ -0,0 +1,4 @@ +@block_php { + path_regexp php "(?i)(@lt 1|@lt 1|@rx (?i)|@rx (?:((?:.+)(?:[|@lt 4|@lt 4|@pm gzip compress deflate br zstd|@lt 1|@lt 1|@pmFromFile php-errors.data|@rx (?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b|@rx (?i)](.*)|/[0-9A-Z_a-z]*[!?.+]|@rx b(?:for(?:/[dflr].*)? %+[^ ]+ in(.*)[sx0b]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)b|[ (].*(?:b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))b|==)))|@rx ~(?:[+-](?:$|[sx0b0-9]+)|[0-9]+)|@rx (?i)(?:^|b[|@rx (?i)(?:^|b[|@rx !-d|@pmFromFile unix-shell.data|@rx ^(s*)s+{|@rx ^(s*)s+{|@rx ba[|@pmFromFile restricted-upload.data|@rx (?i)(?:[nr;`{]|||?|&&?)[sx0b]*[sx0b|@rx (?i)(?:[nr;`{]|||?|&&?)[sx0b]*[sx0b|@lt 2|@lt 2|@rx (?:b[|@rx $(?:((?:.*|(.*)))|{.*}|[.*])|[<>](.*)|/[0-9A-Z_a-z]*[!?.+]|@rx ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#$(*-0-9?-[_a-{]|@rx /|@rx s|@rx ^[^#]+|@rx ^[^.]+.[^;?]+[;?](.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#$(*-0-9?-[_a-{]))|@rx /|@rx s|@rx ^[^.]*?(?:['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#$(*-0-9?-[_a-{])|@rx /|@rx s|@rx (?i).|(?:[sx0b]*|b[|@rx (?i)[-0-9_a-z]+(?:[sx0b]*[|!@rx [0-9]s*'s*[0-9]|@rx ;[sx0b]*.[sx0b]*[|@rx rn.*?b(?:E(?:HLO [-.A-Za-zx17fx212a]{1,255}|XPN .{1,64})|HELO [-.A-Za-zx17fx212a]{1,255}|MAIL FROM:<.{1,64}@.{1,255}>|R(?:CPT TO:(?:<.{1,64}@.{1,255}>| )?<.{1,64}>|SETb)|VRFY .{1,64}(?: <.{1,64}@.{1,255}>|@.{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20} (?:(?:[+/-9A-Z_a-zx17fx212a]{4})*(?:[+/-9A-Z_a-zx17fx212a]{2}=|[+/-9A-Z_a-zx17fx212a]{3}))?=|STARTTLSb|NOOPb(?: .{1,255})?)|@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:A(?:PPEND (?:[|@rx (?is)rn.*?b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9_a-z]{1,20} (?:(?:[+/-9A-Z_a-z]{4})*(?:[+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=))|@rx (?i)(?:^|b[|@rx (?i)(?:^|b[|@pmFromFile unix-shell.data|@lt 3|@lt 3|@rx (?:b[|@rx (?i)b(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sx0b&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine)|xel)[sx0b&)<>|]|pt(?:(?:itude)?[sx0b&)<>|]|-get)|r(?:[sx0b&)<>j|]|(?:p|ch)[sx0b&)<>|]|ia2c)|s(?:h?[sx0b&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sx0b&)<>|]|obm)|dd(?:group|user)|getty|nsible)|b(?:z(?:z[sx0b&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sx0b&)<>|]|c))|h[sx0b&)<>|])|tch[sx0b&)<>|])|lkid|pftrace|r(?:eaksw|idge[sx0b&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sx0b&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[89]9|(?:a(?:t|ncel|psh)|c)[sx0b&)<>|]|mp|p(?:[sx0b&)<>|]|io|ulimit)|s(?:h|cli[sx0b&)<>|]|plit|vtool)|u(?:t[sx0b&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sx0b&)<>|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f[sx0b&)-<>|])|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sx0b&)<>|]|++)|o(?:(?:b|pro)c|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[sx0b&)<>|]|w(?:say|think))|r(?:ash[sx0b&)<>|]|on(?:[sx0b&)<>|]|tab)))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sx0b&)<>|]|n?f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sx0b&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sx0b&)<>|]|n(?:v(?:[sx0b&)<>|]|-update)|d(?:if|sw))|qn|s(?:[sx0b&)<>h|]|ac)|x(?:(?:ec)?[sx0b&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sx0b&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sx0b&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sx0b&)<>|]|le(?:[sx0b&)<>|]|test))|mt|tp(?:[sx0b&)<>|]|stats|who)|acter|o(?:ld[sx0b&)<>|]|reach)|ping)|g(?:c(?:c[^sx0b]|ore)|db|e(?:(?:m|tfacl)[sx0b&)<>|]|ni(?:e[sx0b&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sx0b&)<>|]|nsh)|(?:o|awk)[sx0b&)<>|]|pg|r(?:c|ep[sx0b&)<>|]|oup(?:[sx0b&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sx0b&)<>|]|e(?:ad[sx0b&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sx0b&)<>|]|onice|spell)|j(?:js|q|ava[sx0b&)<>|]|exec|o(?:(?:bs|in)[sx0b&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sx0b&)<>|]|all)|nife[sx0b&)<>|])|l(?:d(?:d?[sx0b&)<>|]|config)|(?:[np]|ynx)[sx0b&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sx0b&)<>|]|(?:la)?tex)|z(?:[sx0b&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[ef]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sx0b&)<>|]|comm|log(?:in)?)|tex[sx0b&)<>|])|ess(?:[sx0b&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sx0b&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sx0b&)<>|]|il(?:[sx0b&)<>q|]|x[sx0b&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sx0b&)<>|]|k(?:dir[sx0b&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sx0b&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sx0b&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sx0b&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sx0b&)<>|]|m(?:[sx0b&)<>|]|ap)|p(?:m[sx0b&)<>|]|ing)|a(?:no[sx0b&)<>|]|sm|wk)|o(?:de[sx0b&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sx0b&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|cman|rted|tch)[sx0b&)<>|]|s(?:swd|te[sx0b&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sx0b&)<>|]|tp)|g(?:[sx0b&)<>|]|rep)|hp(?:[sx0b&)57<>|]|-cgi)|i(?:(?:co?|ng)[sx0b&)<>|]|p[^sx0b]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sx0b&)<>|]|int(?:env|f[sx0b&)<>|]))|s(?:[sx0b&)<>|]|ed|ftp|ql)?|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:(?:f|ms)[sx0b&)<>|]|l(?:[sx0b&)5<>|]|sh))|opd|u(?:ppet[sx0b&)<>|]|shd)|y(?:thon[23]|3?versions))|r(?:a(?:r[sx0b&)<>|]|k(?:e[sx0b&)<>|]|u))|c(?:p[sx0b&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sx0b&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sx0b&)<>|]|user)|pm(?:[sx0b&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sx0b&)<>|]|sync|u(?:by[^sx0b]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|(?:hed|r(?:een|ipt))[sx0b&)<>|])|e(?:(?:d|lf|rvice)[sx0b&)<>|]|t(?:(?:facl)?[sx0b&)<>|]|arch|env|sid)|ndmail)|(?:g|ash)[sx0b&)<>|]|h(?:(?:adow|ells)?[sx0b&)<>|]|.distrib|u(?:f|tdown[sx0b&)<>|]))|s(?:[sx0b&)<>|]|h(?:[sx0b&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sx0b&)<>|]|do)|vn|diff|ftp|l(?:eep[sx0b&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sx0b&)<>|])|p(?:lit[sx0b&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sx0b&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sx0b&)<>|]|il[sx0b&)<>f|]|sk(?:[sx0b&)<>|]|set))|bl|c(?:p(?:[sx0b&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sx0b&)<>|]|lnet)|i(?:c[sx0b&)<>|]|me(?:(?:out)?[sx0b&)<>|]|datectl))|o(?:p|uch[sx0b&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sx0b&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sx0b&)<>|]|expand|iq|l(?:ink[sx0b&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sx0b&)<>|]|std))|p(?:2date[sx0b&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:ew)?[sx0b&)<>|]|m(?:[sx0b&)<>|]|diff)|gr|pw|rsh|sudo)|algrind|olatility[sx0b&)<>|])|w(?:[sx0b&)<>c|]|h(?:o(?:[sx0b&)<>|]|ami|is)?|iptail[sx0b&)<>|])|a(?:ll|tch)[sx0b&)<>|]|i(?:reshark|sh[sx0b&)<>|]))|x(?:(?:x|pa)d|z(?:[sx0b&)<>|]|c(?:at|mp)|d(?:ec|iff)|[ef]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sx0b&)<>|]|um)|z(?:ip(?:[sx0b&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sx0b&)<>|])|f?grep|less|more|run|ypper))(?:b|[^0-9A-Z_a-z])|@rx (?i)(?:^|b[|@rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)|@rx rn.*?b(?:DATA|QUIT|HELP(?: .{1,255})?)|@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:C(?:(?:REATE|OPY [*,0-:]+) [|@rx rn.*?b(?:(?:QUI|STA|RSE)T|NOOP|CAPA)|@rx !(?:d|!)|@lt 4|@lt 4)" +} +respond @block_rce 403 diff --git a/waf_patterns/rfi.conf b/waf_patterns/rfi.conf new file mode 100644 index 0000000..2e5529d --- /dev/null +++ b/waf_patterns/rfi.conf @@ -0,0 +1,4 @@ +@block_rfi { + path_regexp rfi "(?i)(@lt 1|@lt 1|@rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})|@rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://|@rx ^(?i:file|ftps?|https?).*??+$|@lt 2|@lt 2|@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)|!@endsWith .%{request_headers.host}|@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)|!@endsWith .%{request_headers.host}|@lt 3|@lt 3|@lt 4|@lt 4)" +} +respond @block_rfi 403 diff --git a/waf_patterns/shells.conf b/waf_patterns/shells.conf new file mode 100644 index 0000000..eda0174 --- /dev/null +++ b/waf_patterns/shells.conf @@ -0,0 +1,4 @@ +@block_shells { + path_regexp shells "(?i)(@pm gzip compress deflate br zstd|@lt 1|@lt 1|@pmFromFile web-shells-php.data|@rx r57 Shell Version [0-9.]+|r57 shell|@rx ^.*?(?: -)? W[Ss][Oo] [0-9.]+|@rx B4TM4N SH3LL.*|@rx Mini Shell.*Developed By LameHacker|@rx .:: .* ~ Ashiyane V [0-9.]+ ::.|@rx Symlink_Sa [0-9.]+|@rx CasuS [0-9.]+ by MafiABoY|@rx ^rnrnGRP WebShell [0-9.]+|@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>n$|@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ -|@rx ^<!DOCTYPE html>n<html>n<!-- By Artyum .*<title>Web Shell|@rx lama's'hell v. [0-9.]+|@rx ^ *n[ ]+n[ ]+lostDC -|@rx ^<title>PHP Web Shellrnrnrn |@rx ^nn
nnRu24PostWebShell|@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King|@rx ^rnrnnnnng00nshell v[0-9.]+|@contains <title>punkholicshell|@rx ^n n azrail [0-9.]+ by C-W-M|@rx >SmEvK_PaThAn Shell v[0-9]+ coded by n.*? ~ Shell Inn