# Nginx WAF rules for SHELLS location / { set $attack_detected 0; if ($request_uri ~* "Mini Shell.*Developed By LameHacker") { set $attack_detected 1; } if ($request_uri ~* "(r57 Shell Version [0-9.]+|r57 shell)") { set $attack_detected 1; } if ($request_uri ~* "^nn

Input command :

") { set $attack_detected 1; } if ($request_uri ~* "s72 Shell v[0-9.]+ Codinf by Cr@zy_King") { set $attack_detected 1; } if ($request_uri ~* "^PHP Web Shellrnrnrn ") { set $attack_detected 1; } if ($request_uri ~* "@contains punkholicshell") { set $attack_detected 1; } if ($request_uri ~* "^.*? - WSO [0-9.]+") { set $attack_detected 1; } if ($request_uri ~* "@contains

webadmin.php

") { set $attack_detected 1; } if ($request_uri ~* "^nnRu24PostWebShell -") { set $attack_detected 1; } if ($request_uri ~* "^ *<html>n[ ]+<head>n[ ]+<title>lostDC -") { set $attack_detected 1; } if ($request_uri ~* "^<html>n <head>n <title>azrail [0-9.]+ by C-W-M") { set $attack_detected 1; } if ($request_uri ~* "^nn