mirror of
https://github.com/fabriziosalmi/patterns.git
synced 2025-12-17 17:55:48 +00:00
38 lines
4.8 KiB
Plaintext
38 lines
4.8 KiB
Plaintext
# Apache ModSecurity rules for JAVA
|
|
SecRuleEngine On
|
|
|
|
SecRule REQUEST_URI "@lt 1" "id:1444,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 1" "id:1445,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx java.lang.(?:runtime|processbuilder)" "id:1446,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1447,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:unmarshaller|base64data|java.)" "id:1448,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1449,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1450,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@pmFromFile java-classes.data" "id:1451,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx .*.(?:jsp|jspx).*$" "id:1452,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|$?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1453,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 2" "id:1454,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 2" "id:1455,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|$?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1456,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx xacxedx00x05" "id:1457,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:rO0ABQ|KztAAU|Cs7QAF)" "id:1458,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1459,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx javab.+(?:runtime|processbuilder)" "id:1460,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)" "id:1461,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 3" "id:1462,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 3" "id:1463,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)" "id:1464,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 4" "id:1465,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 4" "id:1466,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)" "id:1467,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 1" "id:1531,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 1" "id:1532,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@pmFromFile java-code-leakages.data" "id:1533,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@pmFromFile java-errors.data" "id:1534,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 2" "id:1535,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 2" "id:1536,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 3" "id:1537,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 3" "id:1538,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 4" "id:1539,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 4" "id:1540,phase:1,deny,status:403,log,msg:'java attack detected'"
|