mirror of
https://github.com/fabriziosalmi/patterns.git
synced 2025-12-17 17:55:48 +00:00
38 lines
4.8 KiB
Plaintext
38 lines
4.8 KiB
Plaintext
# Apache ModSecurity rules for JAVA
|
|
SecRuleEngine On
|
|
|
|
SecRule REQUEST_URI "@lt 1" "id:1287,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 1" "id:1288,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@pmFromFile java-code-leakages.data" "id:1289,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@pmFromFile java-errors.data" "id:1290,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 2" "id:1291,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 2" "id:1292,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 3" "id:1293,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 3" "id:1294,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 4" "id:1295,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 4" "id:1296,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 1" "id:1622,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 1" "id:1623,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx java.lang.(?:runtime|processbuilder)" "id:1624,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1625,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:unmarshaller|base64data|java.)" "id:1626,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1627,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1628,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@pmFromFile java-classes.data" "id:1629,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx .*.(?:jsp|jspx).*$" "id:1630,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|$?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1631,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 2" "id:1632,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 2" "id:1633,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|$?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1634,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx xacxedx00x05" "id:1635,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:rO0ABQ|KztAAU|Cs7QAF)" "id:1636,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1637,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx javab.+(?:runtime|processbuilder)" "id:1638,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)" "id:1639,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 3" "id:1640,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 3" "id:1641,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)" "id:1642,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 4" "id:1643,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@lt 4" "id:1644,phase:1,deny,status:403,log,msg:'java attack detected'"
|
|
SecRule REQUEST_URI "@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)" "id:1645,phase:1,deny,status:403,log,msg:'java attack detected'"
|