External/patterns
1
0
Fork 0
mirror of https://github.com/fabriziosalmi/patterns.git synced 2025-12-29 16:15:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update: [Sun Dec 29 23:20:18 UTC 2024]

Browse Source
This commit is contained in:
github-actions[bot]
2024-12-29 23:20:18 +00:00
parent 36f08db3eb
commit 3760d3dcde
35 changed files with 17042 additions and 1242 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
waf_patterns/nginx/php.conf
View File

@@ -42,11 +42,11 @@ location / {
set $attack_detected 1;
}
if ($request_uri ~* "@rx (?i)b(?[") {
if ($request_uri ~* "@rx (?i)b(?["']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:*.**/|/.*)|#.*[sv]|")*["']*)?[sv]*(.*)") {
set $attack_detected 1;
}
if ($request_uri ~* "@rx [oOcC]:d+:") {
if ($request_uri ~* "@rx [oOcC]:d+:".+?":d+:{.*}") {
set $attack_detected 1;
}
@@ -54,7 +54,7 @@ location / {
set $attack_detected 1;
}
if ($request_uri ~* "@rx (?:((?:.+)(?:[") {
if ($request_uri ~* "@rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+));") {
set $attack_detected 1;
}
@@ -98,7 +98,7 @@ location / {
set $attack_detected 1;
}
if ($request_uri ~* "@rx (?:((?:.+)(?:[") {
if ($request_uri ~* "@rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+))(?:;|$)?") {
set $attack_detected 1;
}