mirror of
https://github.com/fabriziosalmi/patterns.git
synced 2025-12-18 02:05:42 +00:00
33 lines
1.4 KiB
Plaintext
33 lines
1.4 KiB
Plaintext
# HAProxy WAF ACL rules
|
|
|
|
# Rules for User-Agent
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int == 0 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int >= 1 }
|
|
http-request if { User-Agent int == 0 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
http-request if { User-Agent int < 1 }
|
|
acl block_exceptions_no_id hdr_sub(User-Agent) -i str -m str GET /
|
|
http-request if { User-Agent int < 1 }
|
|
|
|
|
|
# High Severity Rules (Deny)
|
|
|
|
# Medium Severity Rules (Log)
|
|
http-request log if block_java_no_id or block_correlation_no_id or block_detection_no_id or block_fixation_no_id or block_rfi_no_id or block_rce_no_id or block_attack_no_id or block_enforcement_no_id or block_php_no_id or block_evaluation_no_id or block_initialization_no_id or block_shells_no_id or block_generic_no_id or block_leakages_no_id or block_iis_no_id or block_sql_no_id or block_lfi_no_id or block_xss_no_id or block_exceptions_no_id or block_sqli_no_id
|
|
|
|
# Low Severity Rules (Tarpit)
|
|
|