# HAProxy WAF ACL rules acl block_initialization hdr_sub(User-Agent) -i ^\.*$ http-request deny if block_initialization acl block_initialization hdr_sub(User-Agent) -i !(URLENCODED|MULTIPART|XML|JSON) http-request deny if block_initialization acl block_initialization hdr_sub(User-Agent) -i ^[a-f]*([0-9])[a-f]*([0-9]) http-request deny if block_initialization acl block_rfi hdr_sub(User-Agent) -i ^(?i:file|ftps?|https?)://(d{1,3}.d{1,3}.d{1,3}.d{1,3}) http-request deny if block_rfi acl block_rfi hdr_sub(User-Agent) -i !@endsWith \.%{request_headers.host} http-request deny if block_rfi acl block_exceptions hdr_sub(User-Agent) -i @streq GET / http-request deny if block_exceptions acl block_exceptions hdr_sub(User-Agent) -i @ipMatch 127.0.0.1,::1 http-request deny if block_exceptions acl block_exceptions hdr_sub(User-Agent) -i @endsWith (internal dummy connection) http-request deny if block_exceptions acl block_exceptions hdr_sub(User-Agent) -i ^(GET /|OPTIONS *) HTTP/[12]\.[01]$ http-request deny if block_exceptions acl block_attack hdr_sub(User-Agent) -i (get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i [rn]W*?(content-(type|length)|set-cookie|location):s*w http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i (bhttp/d|<(html|meta)b) http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i [nr] http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i [nr]+(s|location|refresh|(set-)?cookie|(x-)?(forwarded-(for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*: http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i ^[^sv,;]+[sv,;]\.*?(application/(\.++)?json|(application/(soap+)?|text/)xml) http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i unix:[^|]*| http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i ^[^sv,;]+[sv,;]\.*?b(((tex|multipar)t|application)|((audi|vide)o|image|cs[sv]|(vn|relate)d|p(df|lain)|json|(soa|cs)p|x(ml|-www-form-urlencoded)|form-data|x-amf|(octe|repor)t|stream)|([+/]))b http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i \. http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i TX:paramcounter_(\.*) http-request deny if block_attack acl block_java hdr_sub(User-Agent) -i java.lang\.(runtime|processbuilder) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i (runtime|processbuilder) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i (unmarshaller|base64data|java\.) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i (clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i \.*\.(jsp|jspx)\.*$ http-request deny if block_java acl block_java hdr_sub(User-Agent) -i ($|\$?)({|&l(brace|cub);?)([^}]{0,15}($|\$?)({|&l(brace|cub);?)|jndi|ctx) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i ($|\$?)({|&l(brace|cub);?)([^}]*($|\$?)({|&l(brace|cub);?)|jndi|ctx) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i xacxedx00x05 http-request deny if block_java acl block_java hdr_sub(User-Agent) -i (rO0ABQ|KztAAU|Cs7QAF) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i javab\.+(runtime|processbuilder) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i (class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i (cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU) http-request deny if block_java acl block_java hdr_sub(User-Agent) -i ($|\$?)({|&l(brace|cub);?) http-request deny if block_java acl block_sql hdr_sub(User-Agent) -i (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver]) http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle\.*Driver|Warning\.*oci_\.*|Warning\.*ora_\.*) http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:) http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i Dynamic SQL Error http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i Exception (condition )?d+\. Transaction rollback\. http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i org.hsqldb.jdbc http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception\.*Informix) http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i (?i:Warning\.*ingres_|Ingres SQLSTATE|IngresW\.*Driver) http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i (?i:Warning: ibase_|Unexpected end of command in statement) http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i (?i:SQL error\.*POS[0-9]+\.*|Warning\.*maxdb\.*) http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i (System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function \.* expects parameter|Unclosed quotation mark before the character string|Syntax error \.* in query expression|Data type mismatch in criteria expression\.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB\.*SQL Server|Warning\.*mssql_\.*|Driver\.*SQL[ _-]*Server|SQL Server\.*Driver|SQL Server\.*[0-9a-fA-F]{8}|Exception\.*WSystem.Data.SqlClient\.|Conversion failed when converting the varchar value \.*? to data type int\.) http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i (Warning\.*sqlite_\.*|Warning\.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException) http-request deny if block_sql acl block_sql hdr_sub(User-Agent) -i (Sybase message:|Warning\.{2,20}sybase|Sybase\.*Server message\.*) http-request deny if block_sql acl block_lfi hdr_sub(User-Agent) -i ((^|[x5c/;])\.{2,3}[x5c/;]|[x5c/;]\.{2,3}([x5c/;]|$)) http-request deny if block_lfi acl block_attack hdr_sub(User-Agent) -i ^content-types*:s*(\.*)$ http-request deny if block_attack acl block_attack hdr_sub(User-Agent) -i content-transfer-encoding:(\.*) http-request deny if block_attack acl block_generic hdr_sub(User-Agent) -i while[sv]*([sv(]*(!+(false|null|undefined|NaN|[+-]?0|"{2}|'{2}|`{2})|(!!)*((t(rue|his)|[+-]?(Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(Boolea|Functio)n|Object|Array)b|{\.*}|[\.*]|"[^"]+"|'[^']+'|`[^`]+`))\.*) http-request deny if block_generic acl block_generic hdr_sub(User-Agent) -i [s*constructors*] http-request deny if block_generic acl block_generic hdr_sub(User-Agent) -i @{\.*} http-request deny if block_generic acl block_fixation hdr_sub(User-Agent) -i (?i:.cookieb\.*?;W*?(expires|domain)W*?=|bhttp-equivW+set-cookieb) http-request deny if block_fixation acl block_fixation hdr_sub(User-Agent) -i ^(jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$ http-request deny if block_fixation acl block_fixation hdr_sub(User-Agent) -i ^(ht|f)tps?://(\.*?)/ http-request deny if block_fixation acl block_fixation hdr_sub(User-Agent) -i !@endsWith %{request_headers.host} http-request deny if block_fixation acl block_php hdr_sub(User-Agent) -i ( http-request deny if block_php acl block_sqli hdr_sub(User-Agent) -i @detectSQLi http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i (?i:sleep(s*?d*?s*?)|benchmark(\.*?,\.*?)) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$ http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i alter[sv]*?[0-9A-Z_a-z]+\.*?char(acter)?[sv]+set[sv]+[0-9A-Z_a-z]+|["'`](;*?[sv]*?waitfor[sv]+(time|delay)[sv]+["'`]|;\.*?:[sv]*?goto) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i union\.*?select\.*?from http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i select[sv]*?pg_sleep|waitfor[sv]*?delay[sv]?["'`]+[sv]?[0-9]|;[sv]*?shutdown[sv]*?([#;{]|/*|--) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i create[sv]+function[sv]\.+[sv]returns|;[sv]*?(alter|((cre|trunc|upd)at|renam)e|d(e(lete|sc)|rop)|(inser|selec)t|load)b[sv]*?[([]?[0-9A-Z_a-z]{2,} http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i ^([^']*'|[^"]*"|[^`]*`)[sv]*; http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i 1.e[(-),] http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i (^s*["'`;]+|["'`]+s*$) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i [sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(=|<=>|(sounds[sv]+)?like|glob|r(like|egexp))[sv"'-)`]*?b([0-9A-Z_a-z]+)b http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i @streq %{TX.2} http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i [sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(like|r(like|egexp)))[sv"'-)`]*?b([0-9A-Z_a-z]+)b http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i !@streq %{TX.2} http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i ["'`][sv]*?((and|n(and|ot)|(xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?["'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+["'`]|like[sv]*?["'`]%|select[sv]+?[sv"'-),-.0-9A-[]_-z]+from[sv]+ http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i ["'`][sv]*?b(x?or|div|like|between|and)b[sv]*?["'`]?[0-9]|x5cx(2[37]|3d)|^(\.?["'`]$|["'x5c`]*?(["'0-9`]+|[^"'`]+["'`])[sv]*?b(and|n(and|ot)|(xx?)?or|div|like|between||||&&)b[sv]*?["'0-9A-Z_-z][!&(-)+-\.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?["'`][sv]*?[0-9A-Z_a-z]|@([0-9A-Z_a-z]+[sv]+(and|x?or|div|like|between)b[sv]*?["'0-9`]+|[-0-9A-Z_a-z]+[sv](and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?["'`]\.|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z] http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i (?i:^[Wd]+s*?(alter|union)b) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i b(orb([sv]?([0-9]{1,10}|["'][^=]{1,10}["'])[sv]?[<->]+|[sv]+([0-9]{1,10}|'[^=]{1,10}')([sv]*?[<->])?)|xorb[sv]+([0-9]{1,10}|'[^=]{1,10}')([sv]*?[<->])?)|'[sv]+x?or[sv]+\.{1,20}[!+-<->] http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i bandb([sv]+([0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?([0-9]{1,10}|["'][^=]{1,10}["']) ?[<->]+) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i autonomous_transaction|(current_use|n?varcha|tbcreato)r|db(a_users|ms_java)|open(owa_util|query|rowset)|s(p_((addextendedpro|sqlexe)c|execute(sql)?|help|is_srvrolemember|makewebtask|oacreate|p(assword|repare)|replwritetovarbin)|ql_(longvarchar|variant))|utl_(file|http)|xp_(availablemedia|(cmdshel|servicecontro)l|dirtree|e(numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(_enumdomains)?|reg(addmultistring|delete(key|value)|enum(key|value)s|re(ad|movemultistring)|write)|terminate(_process)?) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){12}) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i !^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+\.[-0-9A-Z_a-z]+$ http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i (?i:b0x[a-fd]{3,}) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i ["'`][sv]*?((is[sv]+not|not[sv]+(like|glob|(betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|]) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i ^([^']*?('[^']*?'[^']*?)*?'|[^"]*?("[^"]*?"[^"]*?)*?"|[^`]*?(`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i ^(and|or)$ http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i ^\.*?x5c['"`](\.*?['"`])?s*(and|or)b http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i W+d*?s*?bhavingbs*?[^s-] http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i ["'`][sd]*?[^ws]W*?dW*?\.*?["'`d] http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){8}) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){6}) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i W{4} http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i '; http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){3}) http-request deny if block_sqli acl block_sqli hdr_sub(User-Agent) -i (([~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){2}) http-request deny if block_sqli acl block_leakages hdr_sub(User-Agent) -i (<(TITLE>Index of\.*?Index of\.*?Index of|>[To Parent Directory]
) http-request deny if block_leakages acl block_leakages hdr_sub(User-Agent) -i ^#!s?/ http-request deny if block_leakages acl block_leakages hdr_sub(User-Agent) -i ^5d{2}$ http-request deny if block_leakages acl block_php hdr_sub(User-Agent) -i (b(f(tp_(nb_)?f?(ge|pu)t|get(s?s|c)|scanf|write|open|read)|gz((encod|writ)e|compress|open|read)|s(ession_start|candir)|read((gz)?file|dir)|move_uploaded_file|(proc_|bz)open|call_user_func)|$_((pos|ge)t|session))b http-request deny if block_php acl block_php hdr_sub(User-Agent) -i ]*>[sS]*? http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i \.(b(x(link:href|html|mlns)|data:text/html|formaction|patternb\.*?=)|!ENTITY[sv]+(%[sv]+)?[^sv]+[sv]+(SYSTEM|PUBLIC)|@import|;base64)b http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i <[^0-9<>A-Z_a-z]*([^sv"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(s[^0-9A-Z_a-z]*?(c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0-9>A-Z_a-z])|f[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?m|m[^0-9A-Z_a-z]*?(a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?q[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?e|e[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?a[^0-9>A-Z_a-z])|(l[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?k|o[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?j[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?c[^0-9A-Z_a-z]*?t|e[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?d|a[^0-9A-Z_a-z]*?(p[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?t|u[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?o|n[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?e)|p[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m|i?[^0-9A-Z_a-z]*?f[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?e|b[^0-9A-Z_a-z]*?(a[^0-9A-Z_a-z]*?s[^0-9A-Z_a-z]*?e|o[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?y|i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?s)|i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a?[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?e?|v[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?o)[^0-9>A-Z_a-z])|(<[0-9A-Z_a-z]\.*[sv/]|["'](\.*[sv/])?)(background|formaction|lowsrc|on(a(bort|ctivate|d(apteradded|dtrack)|fter(print|(scriptexecu|upda)te)|lerting|n(imation(cancel|end|iteration|start)|tennastatechange)|ppcommand|u(dio(end|process|start)|xclick))|b(e(fore((((de)?activa|scriptexecu)t|toggl)e|c(opy|ut)|editfocus|input|p(aste|rint)|u(nload|pdate))|gin(Event)?)|l(ocked|ur)|oun(ce|dary)|roadcast|usy)|c(a((ch|llschang)ed|nplay(through)?|rdstatechange)|(ell|fstate)change|h(a(rging(time)?cha)?nge|ecking)|l(ick|ose)|o(m(mand(update)?|p(lete|osition(end|start|update)))|n(nect(ed|ing)|t(extmenu|rolselect))|py)|u(echange|t))|d(ata((availabl|chang)e|error|setc(hanged|omplete))|blclick|e(activate|livery(error|success)|vice(found|light|(mo|orienta)tion|proximity))|i(aling|s(abled|c(hargingtimechange|onnect(ed|ing))))|o(m(a(ctivate|ttrmodified)|(characterdata|subtree)modified|focus(in|out)|mousescroll|node(inserted(intodocument)?|removed(fromdocument)?))|wnloading)|r(ag(drop|e(n(d|ter)|xit)|(gestur|leav)e|over|start)|op)|urationchange)|e(mptied|n(abled|d(ed|Event)?|ter)|rror(update)?|xit)|f(ailed|i(lterchange|nish)|o(cus(in|out)?|rm(change|input))|ullscreenchange)|g(amepad(axismove|button(down|up)|(dis)?connected)|et)|h(ashchange|e(adphoneschange|l[dp])|olding)|i(cc(cardlockerror|infochange)|n(coming|put|valid))|key(down|press|up)|l(evelchange|o(ad(e(d(meta)?data|nd)|start)?|secapture)|y)|m(ark|essage|o(use(down|enter|(lea|mo)ve|o(ut|ver)|up|wheel)|ve(end|start)?|z(a(fterpaint|udioavailable)|(beforeresiz|orientationchang|t(apgestur|imechang))e|(edgeui(c(ancel|omplet)|start)e|network(down|up)loa)d|fullscreen(change|error)|m(agnifygesture(start|update)?|ouse(hittest|pixelscroll))|p(ointerlock(change|error)|resstapgesture)|rotategesture(start|update)?|s(crolledareachanged|wipegesture(end|start|update)?))))|no(match|update)|o((bsolet|(ff|n)lin)e|pen|verflow(changed)?)|p(a(ge(hide|show)|int|(st|us)e)|lay(ing)?|o(inter(down|enter|((lea|mo)v|rawupdat)e|o(ut|ver)|up)|p(state|up(hid(den|ing)|show(ing|n))))|ro(gress|pertychange))|r(atechange|e(adystatechange|ceived|movetrack|peat(Event)?|quest|s(et|ize|u(lt|m(e|ing)))|trieving)|ow(e(nter|xit)|s(delete|inserted)))|s(croll(end)?|e(arch|ek(complete|ed|ing)|lect(ionchange|start)?|n(ding|t)|t)|how|(ound|peech)(end|start)|t(a(lled|rt|t(echange|uschanged))|k(comma|sessione)nd|op)|u(bmit|ccess|spend)|vg(abort|error|(un)?load|resize|scroll|zoom))|t(ext|ime(out|update)|o(ggle|uch(cancel|en(d|ter)|(lea|mo)ve|start))|ransition(cancel|end|run|start))|u(n(derflow|handledrejection|load)|p(dateready|gradeneeded)|s(erproximity|sdreceived))|v(ersion|o(ic|lum)e)change|w(a(it|rn)ing|ebkit(animation(end|iteration|start)|transitionend)|heel)|zoom)|ping|s(rc|tyle))[x08-nf-r ]*?= http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i (?i:\.*?(@[ix5c]|([:=]|&#x?0*(58|3A|61|3D);?)\.*?([(x5c]|&#x?0*(40|28|92|5C);?))) http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i (?i:<\.*[:]?vmlframe\.*?[s/+]*?src[s/+]*=) http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i ] http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i ]*[xbe>]|<[^xbe]*xbe http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i (xbcs*/s*[^xbe>]*[xbe>])|( http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i <(a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)W http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i (?i:["'][ ]*([^a-z0-9~_:' ]|in)\.*?((l|x5cu006C)(o|x5cu006F)(c|x5cu0063)(a|x5cu0061)(t|x5cu0074)(i|x5cu0069)(o|x5cu006F)(n|x5cu006E)|(n|x5cu006E)(a|x5cu0061)(m|x5cu006D)(e|x5cu0065)|(o|x5cu006F)(n|x5cu006E)(e|x5cu0065)(r|x5cu0072)(r|x5cu0072)(o|x5cu006F)(r|x5cu0072)|(v|x5cu0076)(a|x5cu0061)(l|x5cu006C)(u|x5cu0075)(e|x5cu0065)(O|x5cu004F)(f|x5cu0066))\.*?=) http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i ["'][ ]*([^a-z0-9~_:' ]|in)\.+?[\.]\.+?= http-request deny if block_xss acl block_xss hdr_sub(User-Agent) -i {{\.*?}} http-request deny if block_xss acl block_enforcement hdr_sub(User-Agent) -i !^(&(([acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|([cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(mp|pos)|nbsp|oslash);|[^"';=])*$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !^d+$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ^(GET|HEAD)$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !^0?$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @streq POST http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i (d+)-(d+) http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i b(keep-alive|close),s?(keep-alive|close)b http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i x25 http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @validateUrlEncoding http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ^application/x-www-form-urlencoded http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @validateUtf8Encoding http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i %u[fF]{2}[0-9a-fA-F]{2} http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @validateByteRange 1-255 http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ^$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !^OPTIONS$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !@pm AppleWebKit Android Business Enterprise Entreprise http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !^0$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i (^([d\.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$) http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ^multipart/form-data http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !^[w/\.+*-]+(s?;s?(action|boundary|charset|component|start(-info)?|type|version)s?=s?['"w\.()+,/:=?<>@#*-]+)*$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ^[^;s]+ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i charsets*=s*["']?([^;"'s]+) http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i charset\.*?charset http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i \.([^\.]+)$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @within %{tx.restricted_extensions} http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i \.[^\.~]+~(/\.*|)$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ^\.*$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @within %{tx.restricted_headers_basic} http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !@streq JSON http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i x5cu[0-9a-f]{4} http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @contains # http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ^bytes=((d+)?-(d+)?s*,?s*){6} http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !@endsWith .pdf http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @endsWith .pdf http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ^bytes=((d+)?-(d+)?s*,?s*){63} http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i %[0-9a-fA-F]{2} http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @validateByteRange 9,10,13,32-126,128-255 http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ['";=] http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @within %{tx.restricted_headers_extended} http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @validateByteRange 32-36,38-126 http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !^(OPTIONS|CONNECT)$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !@pm AppleWebKit Android http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i ^up http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i !^((max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(=[0-9]+)?)(s*,s*|$)){1,7}$ http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @validateByteRange 38,44-46,48-58,61,65-90,95,97-122 http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i @validateByteRange 32,34,38,42-59,61,65-90,95,97-122 http-request deny if block_enforcement acl block_enforcement hdr_sub(User-Agent) -i (^|[^x5c])x5c[cdeghijklmpqwxyz123456789] http-request deny if block_enforcement acl block_rce hdr_sub(User-Agent) -i $(((\.*|(\.*)))|{\.*})|[<>](\.*)|/[0-9A-Z_a-z]*[!?\.+] http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i b(for(/[dflr]\.*)? %+[^ ]+ in(\.*)[sv]?do|if(/i)?( not)?( (e(xist|rrorlevel)|defined|cmdextversion)b|[ (]\.*(b(g(eq|tr)|equ|neq|l(eq|ss))b|==))) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i ![0-9]s*'s*[0-9] http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i !-d http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i ^(s*)s+{ http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i ba["')[-x5c]*(((|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l["')[-x5c]*(((|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(((|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(((|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?sb[sv]+[!-"%',0-9@-Z_a-z]+=[^sv] http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i ($((((\.*)|\.*))|{\.*})|[<>](\.*)|[!?\.+]) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{] http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i / http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i s http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i ^[^\.]+\.[^;?]+[;?](\.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{])) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i ^[^\.]*?(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i ;[sv]*\.[sv]*["']?(a(rchive|uth)|b(a(ckup|il)|inary)|c(d|h(anges|eck)|lone|onnection)|d(atabases|b(config|info)|ump)|e(cho|qp|x(cel|it|p(ert|lain)))|f(ilectrl|ullschema)|he(aders|lp)|i(mpo(rt|ster)|ndexes|otrace)|l(i(mi|n)t|o(ad|g))|(mod|n(onc|ullvalu)|unmodul)e|o(nce|pen|utput)|p(arameter|r(int|o(gress|mpt)))|quit|re(ad|cover|store)|s(ave|c(anstats|hema)|e(lftest|parator|ssion)|h(a3sum|ell|ow)?|tats|ystem)|t(ables|estc(ase|trl)|ime(out|r)|race)|vfs(info|list|name)|width) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i rn(?s:\.)*?b((?i:E)(HLO [--.A-Za-zx17fx212a]{1,255}|XPN \.{1,64})|HELO [--.A-Za-zx17fx212a]{1,255}|MAIL FROM:<\.{1,64}(?i:@)\.{1,255}(?i:>)|(?i:R)(CPT TO:((?i:<)\.{1,64}(?i:@)\.{1,255}(?i:>)|(?i: ))?(?i:<)\.{1,64}(?i:>)|SETb)|VRFY \.{1,64}( <\.{1,64}(?i:@)\.{1,255}(?i:>)|(?i:@)\.{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20}(?i: )(([+/-9A-Z_a-zx17fx212a]{4})*([+/-9A-Z_a-zx17fx212a]{2}(?i:=)|[+/-9A-Z_a-zx17fx212a]{3}))?(?i:=)|STARTTLSb|NOOPb((?i: )\.{1,255})?) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i (?is)rn\.*?b((LIST|TOP [0-9]+)( [0-9]+)?|U(SER \.+?|IDL( [0-9]+)?)|PASS \.+?|(RETR|DELE) [0-9]+?|A(POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9A-Z_]{1,20} (([+/-9A-Z_a-z]{4})*([+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=)) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i /([?*]+[a-z/]+|[a-z/]+[?*]+) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i rn(?s:\.)*?b(DATA|QUIT|HELP( \.{1,255})?) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i (?is)rn[0-9A-Z_a-z]{1,50}b (C((REATE|OPY [*,0-:]+) ["-#%-&*--9A-Zx5c_a-z]+|APABILITY|HECK|LOSE)|DELETE ["-#%-&*--.0-9A-Zx5c_a-z]+|EX(AMINE ["-#%-&*--.0-9A-Zx5c_a-z]+|PUNGE)|FETCH [*,0-:]+|L(IST ["-#*--9A-Zx5c_a-z~]+? ["-#%-&*--9A-Zx5c_a-z]+|OG(IN [--.0-9@_a-z]{1,40} \.*?|OUT))|RENAME ["-#%-&*--9A-Zx5c_a-z]+? ["-#%-&*--9A-Zx5c_a-z]+|S(E(LECT ["-#%-&*--9A-Zx5c_a-z]+|ARCH( CHARSET [--.0-9A-Z_a-z]{1,40})? ((KEYWORD x5c)?(A(LL|NSWERED)|BCC|D(ELETED|RAFT)|(FLAGGE|OL)D|RECENT|SEEN|UN((ANSWER|FLAGG)ED|D(ELETED|RAFT)|SEEN)|NEW)|(BODY|CC|FROM|HEADER \.{1,100}|NOT|OR \.{1,255}|T(EXT|O)) \.{1,255}|LARGER [0-9]{1,20}|[*,0-:]+|(BEFORE|ON|S(ENT((BEFOR|SINC)E|ON)|INCE)) "?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}"?|S(MALLER [0-9]{1,20}|UBJECT \.{1,255})|U(ID [*,0-:]+?|NKEYWORD x5c(Seen|(Answer|Flagg)ed|D(eleted|raft)|Recent))))|T(ORE [*,0-:]+? [+-]?FLAGS(.SILENT)? ((x5c[a-z]{1,20}))?|ARTTLS)|UBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+)|UN(SUBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+|AUTHENTICATE)|NOOP) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i rn(?s:\.)*?b((QUI|STA|RSE)(?i:T)|NOOP|CAPA) http-request deny if block_rce acl block_rce hdr_sub(User-Agent) -i !(d|!) http-request deny if block_rce acl block_iis hdr_sub(User-Agent) -i [a-z]:x5cinetpubb http-request deny if block_iis acl block_iis hdr_sub(User-Agent) -i (Microsoft OLE DB Provider for SQL Server(\.{1,20}?error '800(04005|40e31)'\.{1,40}?Timeout expired| (0x80040e31)
Timeout expired
)|

internal server error

\.*?

part of the server has crashed or it has a configuration error\.

|cannot connect to the server: timed out) http-request deny if block_iis acl block_iis hdr_sub(User-Agent) -i !^404$ http-request deny if block_iis acl block_iis hdr_sub(User-Agent) -i bServer Error in\.{0,50}?bApplicationb http-request deny if block_iis acl block_shells hdr_sub(User-Agent) -i (r57 Shell Version [0-9\.]+|r57 shell) http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^\.*? - WSO [0-9\.]+ http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i B4TM4N SH3LL\.* http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i Mini Shell\.*Developed By LameHacker http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i \.:: \.* ~ Ashiyane V [0-9\.]+ ::\. http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i Symlink_Sa [0-9\.]+ http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i CasuS [0-9\.]+ by MafiABoY http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^rnrnGRP WebShell [0-9\.]+ http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i <small>NGHshell [0-9\.]+ by Cr4sh</body></html>n$ http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i <title>SimAttacker - (Version|Vrsion) : [0-9\.]+ - http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^<!DOCTYPE html>n<html>n<!-- By Artyum \.*<title>Web Shell http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i lama's'hell v\. [0-9\.]+ http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^ *n[ ]+n[ ]+lostDC - http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^<title>PHP Web Shellrnrnrn http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^nn
Input command :
n
http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^nnRu24PostWebShell - http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i <title>s72 Shell v[0-9\.]+ Codinf by Cr@zy_King http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^rnrnrnPhpSpy Ver [0-9]+ http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^ nnnng00nshell v[0-9\.]+ http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i @contains <title>punkholicshell http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i ^n n azrail [0-9\.]+ by C-W-M http-request deny if block_shells acl block_shells hdr_sub(User-Agent) -i >SmEvK_PaThAn Shell v[0-9]+ coded by n\.*? ~ Shell Inn