mirror of
https://github.com/fabriziosalmi/patterns.git
synced 2025-12-17 09:45:34 +00:00
Update: [Sun Feb 23 00:28:29 UTC 2025]
This commit is contained in:
github-actions[bot]
parent
1968c16e46
commit
2c1fbc2853
2372
owasp_rules.json
2372
owasp_rules.json
File diff suppressed because it is too large
Load Diff
@ -1,16 +1,148 @@
|
||||
# HAProxy WAF ACL rules
|
||||
|
||||
acl block_initialization hdr_sub(User-Agent) -i ^\.*$
|
||||
http-request deny if block_initialization
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_initialization hdr_sub(User-Agent) -i !(URLENCODED|MULTIPART|XML|JSON)
|
||||
http-request deny if block_initialization
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle\.*Driver|Warning\.*oci_\.*|Warning\.*ora_\.*)
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_initialization hdr_sub(User-Agent) -i ^[a-f]*([0-9])[a-f]*([0-9])
|
||||
http-request deny if block_initialization
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_lfi hdr_sub(User-Agent) -i ((^|[x5c/;])\.{2,3}[x5c/;]|[x5c/;]\.{2,3}([x5c/;]|$))
|
||||
http-request deny if block_lfi
|
||||
acl block_sql hdr_sub(User-Agent) -i Dynamic SQL Error
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i Exception (condition )?d+\. Transaction rollback\.
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i org.hsqldb.jdbc
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception\.*Informix)
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:Warning\.*ingres_|Ingres SQLSTATE|IngresW\.*Driver)
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:SQL error\.*POS[0-9]+\.*|Warning\.*maxdb\.*)
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function \.* expects parameter|Unclosed quotation mark before the character string|Syntax error \.* in query expression|Data type mismatch in criteria expression\.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB\.*SQL Server|Warning\.*mssql_\.*|Driver\.*SQL[ _-]*Server|SQL Server\.*Driver|SQL Server\.*[0-9a-fA-F]{8}|Exception\.*WSystem.Data.SqlClient\.|Conversion failed when converting the varchar value \.*? to data type int\.)
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (Warning\.*sqlite_\.*|Warning\.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (Sybase message:|Warning\.{2,20}sybase|Sybase\.*Server message\.*)
|
||||
http-request deny if block_sql
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i @detectSQLi
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (?i:sleep(s*?d*?s*?)|benchmark(\.*?,\.*?))
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i alter[sv]*?[0-9A-Z_a-z]+\.*?char(acter)?[sv]+set[sv]+[0-9A-Z_a-z]+|["'`](;*?[sv]*?waitfor[sv]+(time|delay)[sv]+["'`]|;\.*?:[sv]*?goto)
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i union\.*?select\.*?from
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i select[sv]*?pg_sleep|waitfor[sv]*?delay[sv]?["'`]+[sv]?[0-9]|;[sv]*?shutdown[sv]*?([#;{]|/*|--)
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i create[sv]+function[sv]\.+[sv]returns|;[sv]*?(alter|((cre|trunc|upd)at|renam)e|d(e(lete|sc)|rop)|(inser|selec)t|load)b[sv]*?[([]?[0-9A-Z_a-z]{2,}
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^([^']*'|[^"]*"|[^`]*`)[sv]*;
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i 1.e[(-),]
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (^s*["'`;]+|["'`]+s*$)
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i [sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(=|<=>|(sounds[sv]+)?like|glob|r(like|egexp))[sv"'-)`]*?b([0-9A-Z_a-z]+)b
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i @streq %{TX.2}
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i [sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(like|r(like|egexp)))[sv"'-)`]*?b([0-9A-Z_a-z]+)b
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i !@streq %{TX.2}
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ["'`][sv]*?((and|n(and|ot)|(xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?["'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+["'`]|like[sv]*?["'`]%|select[sv]+?[sv"'-),-.0-9A-[]_-z]+from[sv]+
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ["'`][sv]*?b(x?or|div|like|between|and)b[sv]*?["'`]?[0-9]|x5cx(2[37]|3d)|^(\.?["'`]$|["'x5c`]*?(["'0-9`]+|[^"'`]+["'`])[sv]*?b(and|n(and|ot)|(xx?)?or|div|like|between||||&&)b[sv]*?["'0-9A-Z_-z][!&(-)+-\.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?["'`][sv]*?[0-9A-Z_a-z]|@([0-9A-Z_a-z]+[sv]+(and|x?or|div|like|between)b[sv]*?["'0-9`]+|[-0-9A-Z_a-z]+[sv](and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?["'`]\.|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (?i:^[Wd]+s*?(alter|union)b)
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i b(orb([sv]?([0-9]{1,10}|["'][^=]{1,10}["'])[sv]?[<->]+|[sv]+([0-9]{1,10}|'[^=]{1,10}')([sv]*?[<->])?)|xorb[sv]+([0-9]{1,10}|'[^=]{1,10}')([sv]*?[<->])?)|'[sv]+x?or[sv]+\.{1,20}[!+-<->]
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i bandb([sv]+([0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?([0-9]{1,10}|["'][^=]{1,10}["']) ?[<->]+)
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i autonomous_transaction|(current_use|n?varcha|tbcreato)r|db(a_users|ms_java)|open(owa_util|query|rowset)|s(p_((addextendedpro|sqlexe)c|execute(sql)?|help|is_srvrolemember|makewebtask|oacreate|p(assword|repare)|replwritetovarbin)|ql_(longvarchar|variant))|utl_(file|http)|xp_(availablemedia|(cmdshel|servicecontro)l|dirtree|e(numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(_enumdomains)?|reg(addmultistring|delete(key|value)|enum(key|value)s|re(ad|movemultistring)|write)|terminate(_process)?)
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){12})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i !^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+\.[-0-9A-Z_a-z]+$
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (?i:b0x[a-fd]{3,})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ["'`][sv]*?((is[sv]+not|not[sv]+(like|glob|(betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^([^']*?('[^']*?'[^']*?)*?'|[^"]*?("[^"]*?"[^"]*?)*?"|[^`]*?(`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^(and|or)$
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^\.*?x5c['"`](\.*?['"`])?s*(and|or)b
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i W+d*?s*?bhavingbs*?[^s-]
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ["'`][sd]*?[^ws]W*?dW*?\.*?["'`d]
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){8})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){6})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i W{4}
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ';
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){3})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){2})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_rfi hdr_sub(User-Agent) -i ^(?i:file|ftps?|https?)://(d{1,3}.d{1,3}.d{1,3}.d{1,3})
|
||||
http-request deny if block_rfi
|
||||
@ -18,32 +150,17 @@ http-request deny if block_rfi
|
||||
acl block_rfi hdr_sub(User-Agent) -i !@endsWith \.%{request_headers.host}
|
||||
http-request deny if block_rfi
|
||||
|
||||
acl block_exceptions hdr_sub(User-Agent) -i @streq GET /
|
||||
http-request deny if block_exceptions
|
||||
acl block_fixation hdr_sub(User-Agent) -i (?i:.cookieb\.*?;W*?(expires|domain)W*?=|bhttp-equivW+set-cookieb)
|
||||
http-request deny if block_fixation
|
||||
|
||||
acl block_exceptions hdr_sub(User-Agent) -i @ipMatch 127.0.0.1,::1
|
||||
http-request deny if block_exceptions
|
||||
acl block_fixation hdr_sub(User-Agent) -i ^(jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$
|
||||
http-request deny if block_fixation
|
||||
|
||||
acl block_exceptions hdr_sub(User-Agent) -i @endsWith (internal dummy connection)
|
||||
http-request deny if block_exceptions
|
||||
acl block_fixation hdr_sub(User-Agent) -i ^(ht|f)tps?://(\.*?)/
|
||||
http-request deny if block_fixation
|
||||
|
||||
acl block_exceptions hdr_sub(User-Agent) -i ^(GET /|OPTIONS *) HTTP/[12]\.[01]$
|
||||
http-request deny if block_exceptions
|
||||
|
||||
acl block_attack hdr_sub(User-Agent) -i ^content-types*:s*(\.*)$
|
||||
http-request deny if block_attack
|
||||
|
||||
acl block_attack hdr_sub(User-Agent) -i content-transfer-encoding:(\.*)
|
||||
http-request deny if block_attack
|
||||
|
||||
acl block_generic hdr_sub(User-Agent) -i while[sv]*([sv(]*(!+(false|null|undefined|NaN|[+-]?0|"{2}|'{2}|`{2})|(!!)*((t(rue|his)|[+-]?(Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(Boolea|Functio)n|Object|Array)b|{\.*}|[\.*]|"[^"]+"|'[^']+'|`[^`]+`))\.*)
|
||||
http-request deny if block_generic
|
||||
|
||||
acl block_generic hdr_sub(User-Agent) -i [s*constructors*]
|
||||
http-request deny if block_generic
|
||||
|
||||
acl block_generic hdr_sub(User-Agent) -i @{\.*}
|
||||
http-request deny if block_generic
|
||||
acl block_fixation hdr_sub(User-Agent) -i !@endsWith %{request_headers.host}
|
||||
http-request deny if block_fixation
|
||||
|
||||
acl block_attack hdr_sub(User-Agent) -i (get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d
|
||||
http-request deny if block_attack
|
||||
@ -75,93 +192,6 @@ http-request deny if block_attack
|
||||
acl block_attack hdr_sub(User-Agent) -i TX:paramcounter_(\.*)
|
||||
http-request deny if block_attack
|
||||
|
||||
acl block_fixation hdr_sub(User-Agent) -i (?i:.cookieb\.*?;W*?(expires|domain)W*?=|bhttp-equivW+set-cookieb)
|
||||
http-request deny if block_fixation
|
||||
|
||||
acl block_fixation hdr_sub(User-Agent) -i ^(jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$
|
||||
http-request deny if block_fixation
|
||||
|
||||
acl block_fixation hdr_sub(User-Agent) -i ^(ht|f)tps?://(\.*?)/
|
||||
http-request deny if block_fixation
|
||||
|
||||
acl block_fixation hdr_sub(User-Agent) -i !@endsWith %{request_headers.host}
|
||||
http-request deny if block_fixation
|
||||
|
||||
acl block_leakages hdr_sub(User-Agent) -i (<(TITLE>Index of\.*?<H|title>Index of\.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)
|
||||
http-request deny if block_leakages
|
||||
|
||||
acl block_leakages hdr_sub(User-Agent) -i ^#!s?/
|
||||
http-request deny if block_leakages
|
||||
|
||||
acl block_leakages hdr_sub(User-Agent) -i ^5d{2}$
|
||||
http-request deny if block_leakages
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i java.lang\.(runtime|processbuilder)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i (runtime|processbuilder)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i (unmarshaller|base64data|java\.)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i (clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i \.*\.(jsp|jspx)\.*$
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i ($|\$?)({|&l(brace|cub);?)([^}]{0,15}($|\$?)({|&l(brace|cub);?)|jndi|ctx)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i ($|\$?)({|&l(brace|cub);?)([^}]*($|\$?)({|&l(brace|cub);?)|jndi|ctx)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i xacxedx00x05
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i (rO0ABQ|KztAAU|Cs7QAF)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i javab\.+(runtime|processbuilder)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i (class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i (cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_java hdr_sub(User-Agent) -i ($|\$?)({|&l(brace|cub);?)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i (<?([^x]|x[^m]|xm[^l]|xml[^s]|xml$|$)|<?php|[(/|x5c)?php])
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i \.*.ph(pd*|tml|ar|ps|t|pt)\.*$
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i @pm =
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i (bzip2|expect|glob|ogg|(ph|r)ar|ssh2(\.(s(hell|(ft|c)p)|exec|tunnel))?|z(ip|lib))://
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i [oOcC]:d+:"\.+?":d+:{\.*}
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i AUTH_TYPE|HTTP_(ACCEPT(_(CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(HOS|USER_AGEN)T|KEEP_ALIVE|(REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i \.*\.(phpd*|phtml)\.\.*$
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i @pm ?>
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_enforcement hdr_sub(User-Agent) -i !^(&(([acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|([cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(mp|pos)|nbsp|oslash);|[^"';=])*$
|
||||
http-request deny if block_enforcement
|
||||
|
||||
@ -303,110 +333,47 @@ http-request deny if block_enforcement
|
||||
acl block_enforcement hdr_sub(User-Agent) -i (^|[^x5c])x5c[cdeghijklmpqwxyz123456789]
|
||||
http-request deny if block_enforcement
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i @detectSQLi
|
||||
http-request deny if block_sqli
|
||||
acl block_lfi hdr_sub(User-Agent) -i ((^|[x5c/;])\.{2,3}[x5c/;]|[x5c/;]\.{2,3}([x5c/;]|$))
|
||||
http-request deny if block_lfi
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (?i:sleep(s*?d*?s*?)|benchmark(\.*?,\.*?))
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i java.lang\.(runtime|processbuilder)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i (runtime|processbuilder)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i alter[sv]*?[0-9A-Z_a-z]+\.*?char(acter)?[sv]+set[sv]+[0-9A-Z_a-z]+|["'`](;*?[sv]*?waitfor[sv]+(time|delay)[sv]+["'`]|;\.*?:[sv]*?goto)
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i (unmarshaller|base64data|java\.)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i union\.*?select\.*?from
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i (clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i select[sv]*?pg_sleep|waitfor[sv]*?delay[sv]?["'`]+[sv]?[0-9]|;[sv]*?shutdown[sv]*?([#;{]|/*|--)
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i \.*\.(jsp|jspx)\.*$
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i create[sv]+function[sv]\.+[sv]returns|;[sv]*?(alter|((cre|trunc|upd)at|renam)e|d(e(lete|sc)|rop)|(inser|selec)t|load)b[sv]*?[([]?[0-9A-Z_a-z]{2,}
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i ($|\$?)({|&l(brace|cub);?)([^}]{0,15}($|\$?)({|&l(brace|cub);?)|jndi|ctx)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^([^']*'|[^"]*"|[^`]*`)[sv]*;
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i ($|\$?)({|&l(brace|cub);?)([^}]*($|\$?)({|&l(brace|cub);?)|jndi|ctx)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i 1.e[(-),]
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i xacxedx00x05
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (^s*["'`;]+|["'`]+s*$)
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i (rO0ABQ|KztAAU|Cs7QAF)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i [sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(=|<=>|(sounds[sv]+)?like|glob|r(like|egexp))[sv"'-)`]*?b([0-9A-Z_a-z]+)b
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i javab\.+(runtime|processbuilder)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i @streq %{TX.2}
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i (class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i [sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(like|r(like|egexp)))[sv"'-)`]*?b([0-9A-Z_a-z]+)b
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i (cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i !@streq %{TX.2}
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ["'`][sv]*?((and|n(and|ot)|(xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?["'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+["'`]|like[sv]*?["'`]%|select[sv]+?[sv"'-),-.0-9A-[]_-z]+from[sv]+
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ["'`][sv]*?b(x?or|div|like|between|and)b[sv]*?["'`]?[0-9]|x5cx(2[37]|3d)|^(\.?["'`]$|["'x5c`]*?(["'0-9`]+|[^"'`]+["'`])[sv]*?b(and|n(and|ot)|(xx?)?or|div|like|between||||&&)b[sv]*?["'0-9A-Z_-z][!&(-)+-\.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?["'`][sv]*?[0-9A-Z_a-z]|@([0-9A-Z_a-z]+[sv]+(and|x?or|div|like|between)b[sv]*?["'0-9`]+|[-0-9A-Z_a-z]+[sv](and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?["'`]\.|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (?i:^[Wd]+s*?(alter|union)b)
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i b(orb([sv]?([0-9]{1,10}|["'][^=]{1,10}["'])[sv]?[<->]+|[sv]+([0-9]{1,10}|'[^=]{1,10}')([sv]*?[<->])?)|xorb[sv]+([0-9]{1,10}|'[^=]{1,10}')([sv]*?[<->])?)|'[sv]+x?or[sv]+\.{1,20}[!+-<->]
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i bandb([sv]+([0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?([0-9]{1,10}|["'][^=]{1,10}["']) ?[<->]+)
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i autonomous_transaction|(current_use|n?varcha|tbcreato)r|db(a_users|ms_java)|open(owa_util|query|rowset)|s(p_((addextendedpro|sqlexe)c|execute(sql)?|help|is_srvrolemember|makewebtask|oacreate|p(assword|repare)|replwritetovarbin)|ql_(longvarchar|variant))|utl_(file|http)|xp_(availablemedia|(cmdshel|servicecontro)l|dirtree|e(numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(_enumdomains)?|reg(addmultistring|delete(key|value)|enum(key|value)s|re(ad|movemultistring)|write)|terminate(_process)?)
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){12})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i !^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+\.[-0-9A-Z_a-z]+$
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (?i:b0x[a-fd]{3,})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ["'`][sv]*?((is[sv]+not|not[sv]+(like|glob|(betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^([^']*?('[^']*?'[^']*?)*?'|[^"]*?("[^"]*?"[^"]*?)*?"|[^`]*?(`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^(and|or)$
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ^\.*?x5c['"`](\.*?['"`])?s*(and|or)b
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i W+d*?s*?bhavingbs*?[^s-]
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ["'`][sd]*?[^ws]W*?dW*?\.*?["'`d]
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){8})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){6})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i W{4}
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i ';
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){3})
|
||||
http-request deny if block_sqli
|
||||
|
||||
acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){2})
|
||||
http-request deny if block_sqli
|
||||
acl block_java hdr_sub(User-Agent) -i ($|\$?)({|&l(brace|cub);?)
|
||||
http-request deny if block_java
|
||||
|
||||
acl block_rce hdr_sub(User-Agent) -i $(((\.*|(\.*)))|{\.*})|[<>](\.*)|/[0-9A-Z_a-z]*[!?\.+]
|
||||
http-request deny if block_rce
|
||||
@ -468,44 +435,65 @@ http-request deny if block_rce
|
||||
acl block_rce hdr_sub(User-Agent) -i !(d|!)
|
||||
http-request deny if block_rce
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])
|
||||
http-request deny if block_sql
|
||||
acl block_initialization hdr_sub(User-Agent) -i ^\.*$
|
||||
http-request deny if block_initialization
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle\.*Driver|Warning\.*oci_\.*|Warning\.*ora_\.*)
|
||||
http-request deny if block_sql
|
||||
acl block_initialization hdr_sub(User-Agent) -i !(URLENCODED|MULTIPART|XML|JSON)
|
||||
http-request deny if block_initialization
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)
|
||||
http-request deny if block_sql
|
||||
acl block_initialization hdr_sub(User-Agent) -i ^[a-f]*([0-9])[a-f]*([0-9])
|
||||
http-request deny if block_initialization
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i Dynamic SQL Error
|
||||
http-request deny if block_sql
|
||||
acl block_php hdr_sub(User-Agent) -i (<?([^x]|x[^m]|xm[^l]|xml[^s]|xml$|$)|<?php|[(/|x5c)?php])
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i Exception (condition )?d+\. Transaction rollback\.
|
||||
http-request deny if block_sql
|
||||
acl block_php hdr_sub(User-Agent) -i \.*.ph(pd*|tml|ar|ps|t|pt)\.*$
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i org.hsqldb.jdbc
|
||||
http-request deny if block_sql
|
||||
acl block_php hdr_sub(User-Agent) -i @pm =
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception\.*Informix)
|
||||
http-request deny if block_sql
|
||||
acl block_php hdr_sub(User-Agent) -i php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:Warning\.*ingres_|Ingres SQLSTATE|IngresW\.*Driver)
|
||||
http-request deny if block_sql
|
||||
acl block_php hdr_sub(User-Agent) -i (bzip2|expect|glob|ogg|(ph|r)ar|ssh2(\.(s(hell|(ft|c)p)|exec|tunnel))?|z(ip|lib))://
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)
|
||||
http-request deny if block_sql
|
||||
acl block_php hdr_sub(User-Agent) -i [oOcC]:d+:"\.+?":d+:{\.*}
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (?i:SQL error\.*POS[0-9]+\.*|Warning\.*maxdb\.*)
|
||||
http-request deny if block_sql
|
||||
acl block_php hdr_sub(User-Agent) -i AUTH_TYPE|HTTP_(ACCEPT(_(CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(HOS|USER_AGEN)T|KEEP_ALIVE|(REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function \.* expects parameter|Unclosed quotation mark before the character string|Syntax error \.* in query expression|Data type mismatch in criteria expression\.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB\.*SQL Server|Warning\.*mssql_\.*|Driver\.*SQL[ _-]*Server|SQL Server\.*Driver|SQL Server\.*[0-9a-fA-F]{8}|Exception\.*WSystem.Data.SqlClient\.|Conversion failed when converting the varchar value \.*? to data type int\.)
|
||||
http-request deny if block_sql
|
||||
acl block_php hdr_sub(User-Agent) -i \.*\.(phpd*|phtml)\.\.*$
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (Warning\.*sqlite_\.*|Warning\.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)
|
||||
http-request deny if block_sql
|
||||
acl block_php hdr_sub(User-Agent) -i @pm ?>
|
||||
http-request deny if block_php
|
||||
|
||||
acl block_sql hdr_sub(User-Agent) -i (Sybase message:|Warning\.{2,20}sybase|Sybase\.*Server message\.*)
|
||||
http-request deny if block_sql
|
||||
acl block_generic hdr_sub(User-Agent) -i while[sv]*([sv(]*(!+(false|null|undefined|NaN|[+-]?0|"{2}|'{2}|`{2})|(!!)*((t(rue|his)|[+-]?(Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(Boolea|Functio)n|Object|Array)b|{\.*}|[\.*]|"[^"]+"|'[^']+'|`[^`]+`))\.*)
|
||||
http-request deny if block_generic
|
||||
|
||||
acl block_generic hdr_sub(User-Agent) -i [s*constructors*]
|
||||
http-request deny if block_generic
|
||||
|
||||
acl block_generic hdr_sub(User-Agent) -i @{\.*}
|
||||
http-request deny if block_generic
|
||||
|
||||
acl block_leakages hdr_sub(User-Agent) -i (<(TITLE>Index of\.*?<H|title>Index of\.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)
|
||||
http-request deny if block_leakages
|
||||
|
||||
acl block_leakages hdr_sub(User-Agent) -i ^#!s?/
|
||||
http-request deny if block_leakages
|
||||
|
||||
acl block_leakages hdr_sub(User-Agent) -i ^5d{2}$
|
||||
http-request deny if block_leakages
|
||||
|
||||
acl block_attack hdr_sub(User-Agent) -i ^content-types*:s*(\.*)$
|
||||
http-request deny if block_attack
|
||||
|
||||
acl block_attack hdr_sub(User-Agent) -i content-transfer-encoding:(\.*)
|
||||
http-request deny if block_attack
|
||||
|
||||
acl block_xss hdr_sub(User-Agent) -i !@validateByteRange 20, 45-47, 48-57, 65-90, 95, 97-122
|
||||
http-request deny if block_xss
|
||||
@ -582,6 +570,18 @@ http-request deny if block_xss
|
||||
acl block_xss hdr_sub(User-Agent) -i {{\.*?}}
|
||||
http-request deny if block_xss
|
||||
|
||||
acl block_exceptions hdr_sub(User-Agent) -i @streq GET /
|
||||
http-request deny if block_exceptions
|
||||
|
||||
acl block_exceptions hdr_sub(User-Agent) -i @ipMatch 127.0.0.1,::1
|
||||
http-request deny if block_exceptions
|
||||
|
||||
acl block_exceptions hdr_sub(User-Agent) -i @endsWith (internal dummy connection)
|
||||
http-request deny if block_exceptions
|
||||
|
||||
acl block_exceptions hdr_sub(User-Agent) -i ^(GET /|OPTIONS *) HTTP/[12]\.[01]$
|
||||
http-request deny if block_exceptions
|
||||
|
||||
acl block_php hdr_sub(User-Agent) -i (b(f(tp_(nb_)?f?(ge|pu)t|get(s?s|c)|scanf|write|open|read)|gz((encod|writ)e|compress|open|read)|s(ession_start|candir)|read((gz)?file|dir)|move_uploaded_file|(proc_|bz)open|call_user_func)|$_((pos|ge)t|session))b
|
||||
http-request deny if block_php
|
||||
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -3,73 +3,7 @@
|
||||
# Include this file inside server block
|
||||
|
||||
# WAF rules
|
||||
if ($waf_block_initialization) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_lfi) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_rfi) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_exceptions) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_attack) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_generic) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_evaluation) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_fixation) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_leakages) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_java) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_php) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_enforcement) {
|
||||
if ($waf_block_sql) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
@ -81,13 +15,73 @@
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_rfi) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_fixation) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_attack) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_enforcement) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_lfi) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_java) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_rce) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_sql) {
|
||||
if ($waf_block_initialization) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_php) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_evaluation) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_generic) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_leakages) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
@ -99,13 +93,13 @@
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_iis) {
|
||||
if ($waf_block_exceptions) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_shells) {
|
||||
if ($waf_block_iis) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
@ -117,3 +111,9 @@
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
if ($waf_block_shells) {
|
||||
return 403;
|
||||
# Log the blocked request (optional)
|
||||
# access_log /var/log/nginx/waf_blocked.log;
|
||||
}
|
||||
|
||||
|
||||
File diff suppressed because one or more lines are too long
Loading…
x
Reference in New Issue
Block a user