[http.middlewares] [http.middlewares.bad_bot_block_INITIALIZATION] [http.middlewares.bad_bot_block_INITIALIZATION.plugin.badbot] userAgent = [ "!@rx (?:URLENCODED|MULTIPART|XML|JSON)", "@rx ^[a-f]*([0-9])[a-f]*([0-9])", "@lt %{tx.blocking_paranoia_level}", "@rx ^.*$", "!@lt %{tx.sampling_percentage}", "@eq 0", "@eq 100", "@eq 1" ] [http.middlewares.bad_bot_block_ENFORCEMENT] [http.middlewares.bad_bot_block_ENFORCEMENT.plugin.badbot] userAgent = [ "@gt %{tx.arg_name_length}", "@validateByteRange 32-36,38-126", "@streq POST", "@gt %{tx.arg_length}", "@gt %{tx.max_file_size}", "@gt 1", "@lt 4", "@endsWith .pdf", "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}", "@validateByteRange 9,10,13,32-126,128-255", "!@rx ^0$", "@rx .[^.~]+~(?:/.*|)$", "@eq 0", "@within %{tx.restricted_extensions}", "!@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)", "@validateUrlEncoding", "@lt 2", "@eq 1", "@validateUtf8Encoding", "!@within %{tx.allowed_http_versions}", "!@streq JSON", "!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$", "@gt 50", "!@eq 0", "@rx ['\\";=]", "!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0", "!@pm AppleWebKit Android Business Enterprise Entreprise", "@lt 3", "@rx (?i)x5cu[0-9a-f]{4}", "@rx %u[fF]{2}[0-9a-fA-F]{2}", "@rx %[0-9a-fA-F]{2}", "@rx b(?:keep-alive|close),s?(?:keep-alive|close)b", "@rx ^(?i)application/x-www-form-urlencoded", "!@rx ^(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$", "@rx charsets*=s*[\\"']?([^;\\"'s]+)", "!@rx ^0?$", "!@pm AppleWebKit Android", "@rx x25", "@within %{tx.restricted_headers_extended}", "@validateByteRange 32,34,38,42-59,61,65-90,95,97-122", "@rx ^(?:GET|HEAD)$", "@lt 1", "@rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)", "!@rx ^(?:?[01])?$", "!@within %{tx.allowed_request_content_type}", "!@within %{tx.allowed_request_content_type_charset}", "!@rx ^(?:OPTIONS|CONNECT)$", "@ge 1", "@validateByteRange 1-255", "@rx (d+)-(d+)", "@gt %{tx.combined_file_sizes}", "@rx ^$", "@gt %{tx.total_arg_length}", "@contains #", "!@rx ^d+$", "@gt %{tx.max_num_args}", "@validateByteRange 38,44-46,48-58,61,65-90,95,97-122", "@rx ^(?i)up", "@rx charset.*?charset", "!@rx (?i)^(?:get /[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sv]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?)[sv]+[.-9A-Z_a-z]+)$", "@rx .([^.]+)$", "!@rx (?i)^(?:&(?:(?:[acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|(?:[cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^\\"';=])*$", "@gt 0", "!@within %{tx.allowed_methods}", "@rx ^(?i)multipart/form-data", "!@rx ^[w/.+*-]+(?:s?;s?(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['\\"w.()+,/:=?<>@#*-]+)*$", "@rx ^[^;s]+", "!@rx ^OPTIONS$", "@lt %{tx.1}", "@rx ^.*$", "!@endsWith .pdf", "@within %{tx.restricted_headers_basic}", "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}", "@rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789]" ] [http.middlewares.bad_bot_block_FIXATION] [http.middlewares.bad_bot_block_FIXATION.plugin.badbot] userAgent = [ "@lt 1", "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$", "@rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)", "@lt 3", "!@endsWith %{request_headers.host}", "@lt 4", "@eq 0", "@rx ^(?:ht|f)tps?://(.*?)/", "@lt 2" ] [http.middlewares.bad_bot_block_DETECTION] [http.middlewares.bad_bot_block_DETECTION.plugin.badbot] userAgent = [ "@lt 1", "@lt 3", "@pmFromFile scanners-user-agents.data", "@lt 4", "@lt 2" ] [http.middlewares.bad_bot_block_ATTACK] [http.middlewares.bad_bot_block_ATTACK.plugin.badbot] userAgent = [ "@gt 1", "@rx [", "@rx .", "@lt 4", "@rx ^[^sv,;]+[sv,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b", "@lt 2", "@rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w", "!@eq 0", "@lt 3", "@rx ^[^sv,;]+[sv,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)", "!@rx ^(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$", "@rx (?:bhttp/d|<(?:html|meta)b)", "@rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:", "!@within |%{tx.allowed_request_content_type_charset}|", "@lt 1", "@rx [nr]", "@rx ^content-types*:s*(.*)$", "@rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d", "@rx TX:paramcounter_(.*)", "@rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)", "@gt 0", "@rx unix:[^|]*|", "@rx (][^]]+$|][^]]+[)", "@rx content-transfer-encoding:(.*)" ] [http.middlewares.bad_bot_block_RFI] [http.middlewares.bad_bot_block_RFI.plugin.badbot] userAgent = [ "@rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})", "@lt 1", "!@endsWith .%{request_headers.host}", "@rx ^(?i:file|ftps?|https?).*??+$", "@lt 3", "@lt 4", "@rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://", "@lt 2", "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)" ] [http.middlewares.bad_bot_block_EXCEPTIONS] [http.middlewares.bad_bot_block_EXCEPTIONS.plugin.badbot] userAgent = [ "@endsWith (internal dummy connection)", "@ipMatch 127.0.0.1,::1", "@streq GET /", "@rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$" ] [http.middlewares.bad_bot_block_LFI] [http.middlewares.bad_bot_block_LFI.plugin.badbot] userAgent = [ "@lt 1", "@lt 3", "@lt 4", "@rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[0-1]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))", "@pmFromFile restricted-files.data", "@pmFromFile lfi-os-files.data", "@lt 2", "@rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))" ] [http.middlewares.bad_bot_block_GENERIC] [http.middlewares.bad_bot_block_GENERIC.plugin.badbot] userAgent = [ "@lt 1", "@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sv]*(", "@rx @{.*}", "@rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sv]+Function[sv]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sv]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sv]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[[\\"'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)[\\"'`]])|(?:binding|constructor|env|global|main(?:Module)?|process|require)[|console(?:.(?:debug|error|info|trace|warn)(?:.call)?(|[[\\"'`](?:debug|error|info|trace|warn)[\\"'`]])|require(?:.(?:resolve(?:.call)?(|main|extensions|cache)|[[\\"'`](?:(?:resolv|cach)e|main|extensions)[\\"'`]])", "@lt 3", "@rx while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|\\"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|\\"[^\\"]+\\"|'[^']+'|`[^`]+`)).*)", "@rx [s*constructors*]", "@lt 4", "@rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][--.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sv]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][--.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+))", "@rx Process[sv]*.[sv]*spawn[sv]*(", "@rx (?:__proto__|constructors*(?:.|[)s*prototype)", "@rx ^data:(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*", "@lt 2", "@pmFromFile ssrf.data" ] [http.middlewares.bad_bot_block_XSS] [http.middlewares.bad_bot_block_XSS.plugin.badbot] userAgent = [ "@rx (?i).(?:b(?:x(?:link:href|html|mlns)|data:text/html|formaction|patternb.*?=)|!ENTITY[sv]+(?:%[sv]+)?[^sv]+[sv]+(?:SYSTEM|PUBLIC)|@import|;base64)b", "@rx (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:v|&#(?:0*(?:86|118)|x0*[57]6);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;)).", "@rx (?i)", "@detectXSS", "@rx (?i:<.*[:]?vmlframe.*?[s/+]*?src[s/+]*=)", "@rx (?:xbcs*/s*[^xbe>]*[xbe>])|(?:))|@W*?iW*?mW*?pW*?oW*?rW*?tW*?(?:/*[sS]*?)?(?:[\\"']|W*?uW*?rW*?l[sS]*?()|[^-]*?-W*?mW*?oW*?zW*?-W*?bW*?iW*?nW*?dW*?iW*?nW*?g[^:]*?:W*?uW*?rW*?l[sS]*?(", "@rx (?:self|document|this|top|window)s*(?:/*|[[)]).+?(?:]|*/)", "@rx (?i)b(?:eval|set(?:timeout|interval)|new[sv]+Function|a(?:lert|tob)|btoa)[sv]*(", "@lt 2", "@rx (?i)[\\"'][ ]*(?:[^a-z0-9~_:' ]|in).+?[.].+?=", "@rx {{.*?}}", "@rx (?i:.*?(?:@[ix5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(x5c]|&#x?0*(?:40|28|92|5C);?)))", "@rx (?i)]*>[sS]*?", "@rx <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)W", "@rx (?i)b(?:s(?:tyle|rc)|href)b[sS]*?=", "@rx (?i)(?:v|&#(?:0*8|x0*5)[36];)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*6[26]|x0*(?:98|42));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;)).", "@lt 3", "@pm document.cookie document.domain document.write .parentnode .innerhtml window.location -moz-binding ", "@rx ^.*? - WSO [0-9.]+", "@contains punkholicshell", "@rx SimAttacker - (?:Version|Vrsion) : [0-9.]+ -", "@rx ^<html>n<head>n<title>Ru24PostWebShell -" ] [http.middlewares.bad_bot_block_CORRELATION] [http.middlewares.bad_bot_block_CORRELATION.plugin.badbot] userAgent = [ "@lt 1", "@ge %{tx.outbound_anomaly_score_threshold}", "@gt 0", "@ge %{tx.inbound_anomaly_score_threshold}", "@ge 5", "@lt 3", "@lt 4", "@eq 0", "@lt 2" ] [http.middlewares.bad_bot_block_IIS] [http.middlewares.bad_bot_block_IIS.plugin.badbot] userAgent = [ "@lt 1", "!@rx ^404$", "@lt 3", "@rx bServer Error in.{0,50}?bApplicationb", "@lt 4", "@pmFromFile iis-errors.data", "@rx [a-z]:x5cinetpubb", "@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error.</h2>|cannot connect to the server: timed out)", "@lt 2" ]