# Nginx WAF rules for SHELLS
location / {
set $attack_detected 0;
if ($request_uri ~* "Symlink_Sa [0-9.]+") {
set $attack_detected 1;
}
if ($request_uri ~* "^rnrnrnPhpSpy Ver [0-9]+") {
set $attack_detected 1;
}
if ($request_uri ~* "(r57 Shell Version [0-9.]+|r57 shell)") {
set $attack_detected 1;
}
if ($request_uri ~* "s72 Shell v[0-9.]+ Codinf by Cr@zy_King") {
set $attack_detected 1;
}
if ($request_uri ~* "B4TM4N SH3LL.*") {
set $attack_detected 1;
}
if ($request_uri ~* "^rnrnGRP WebShell [0-9.]+") {
set $attack_detected 1;
}
if ($request_uri ~* "^<title>PHP Web Shellrnrnrn ") {
set $attack_detected 1;
}
if ($request_uri ~* "@contains webadmin.php
") {
set $attack_detected 1;
}
if ($request_uri ~* "^nnRu24PostWebShell -") {
set $attack_detected 1;
}
if ($request_uri ~* "<title>CasuS [0-9.]+ by MafiABoY") {
set $attack_detected 1;
}
if ($request_uri ~* "^nnInput command :
n