mirror of
https://github.com/fabriziosalmi/patterns.git
synced 2025-12-17 17:55:48 +00:00
21 lines
2.5 KiB
Plaintext
21 lines
2.5 KiB
Plaintext
# Apache ModSecurity rules for ATTACK
|
|
SecRuleEngine On
|
|
|
|
SecRule REQUEST_URI "\." "id:1063,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\[nr\]" "id:1057,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\(\?:bhttp/d\|<\(\?:html\|meta\)b\)" "id:1053,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "content\-transfer\-encoding:\(\.\*\)" "id:1209,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\[nr\]" "id:1054,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\[nr\]" "id:1060,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\^\[\^sv,;\]\+\[sv,;\]\.\*\?b\(\?:\(\(\?:tex\|multipar\)t\|application\)\|\(\(\?:audi\|vide\)o\|image\|cs\[sv\]\|\(\?:vn\|relate\)d\|p\(\?:df\|lain\)\|json\|\(\?:soa\|cs\)p\|x\(\?:ml\|\-www\-form\-urlencoded\)\|form\-data\|x\-amf\|\(\?:octe\|repor\)t\|stream\)\|\(\[\+/\]\)\)b" "id:1061,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\[nr\]\+\(\?:s\|location\|refresh\|\(\?:set\-\)\?cookie\|\(\?:x\-\)\?\(\?:forwarded\-\(\?:for\|host\|server\)\|host\|via\|remote\-ip\|remote\-addr\|originating\-IP\)\)s\*:" "id:1056,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\^content\-types\*:s\*\(\.\*\)\$" "id:1208,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\(\?:get\|post\|head\|options\|connect\|put\|delete\|trace\|track\|patch\|propfind\|propatch\|mkcol\|copy\|move\|lock\|unlock\)s\+\[\^s\]\+s\+http/d" "id:1051,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\[rn\]W\*\?\(\?:content\-\(\?:type\|length\)\|set\-cookie\|location\):s\*w" "id:1052,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\[nr\]" "id:1055,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "@gt\ 1" "id:1064,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "\^\[\^sv,;\]\+\[sv,;\]\.\*\?\(\?:application/\(\?:\.\+\+\)\?json\|\(\?:application/\(\?:soap\+\)\?\|text/\)xml\)" "id:1058,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "unix:\[\^\|\]\*\|" "id:1059,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "TX:paramcounter_\(\.\*\)" "id:1065,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
SecRule REQUEST_URI "@gt\ 0" "id:1062,phase:1,deny,status:403,log,msg:'attack attack detected'"
|