wip avec résolution de conflits
This commit is contained in:
parent
63b2d2b256
commit
ef19ba2b72
208 changed files with 178625 additions and 192002 deletions
|
|
@ -1,117 +1,85 @@
|
|||
|
||||
#user nobody;
|
||||
worker_processes 1;
|
||||
|
||||
#error_log logs/error.log;
|
||||
#error_log logs/error.log notice;
|
||||
#error_log logs/error.log info;
|
||||
|
||||
#pid logs/angie.pid;
|
||||
|
||||
user www-data;
|
||||
worker_processes auto;
|
||||
pid /run/angie.pid;
|
||||
include /etc/angie/modules-enabled/*.conf;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
worker_connections 768;
|
||||
# multi_accept on;
|
||||
}
|
||||
|
||||
|
||||
http {
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
# '$status $body_bytes_sent "$http_referer" '
|
||||
# '"$http_user_agent" "$http_x_forwarded_for"';
|
||||
##
|
||||
# Basic Settings
|
||||
##
|
||||
|
||||
#access_log logs/access.log main;
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
# server_tokens off;
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
# server_names_hash_bucket_size 64;
|
||||
# server_name_in_redirect off;
|
||||
|
||||
#keepalive_timeout 0;
|
||||
keepalive_timeout 65;
|
||||
include /etc/angie/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
#gzip on;
|
||||
##
|
||||
# SSL Settings
|
||||
##
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
#charset koi8-r;
|
||||
##
|
||||
# Logging Settings
|
||||
##
|
||||
|
||||
#access_log logs/host.access.log main;
|
||||
access_log /var/log/angie/access.log;
|
||||
error_log /var/log/angie/error.log;
|
||||
|
||||
location / {
|
||||
root html;
|
||||
index index.html index.htm;
|
||||
}
|
||||
##
|
||||
# Gzip Settings
|
||||
##
|
||||
|
||||
#error_page 404 /404.html;
|
||||
gzip on;
|
||||
|
||||
# redirect server error pages to the static page /50x.html
|
||||
#
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /50x.html {
|
||||
root html;
|
||||
}
|
||||
# gzip_vary on;
|
||||
# gzip_proxied any;
|
||||
# gzip_comp_level 6;
|
||||
# gzip_buffers 16 8k;
|
||||
# gzip_http_version 1.1;
|
||||
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
|
||||
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
|
||||
#
|
||||
#location ~ \.php$ {
|
||||
# proxy_pass http://127.0.0.1;
|
||||
#}
|
||||
|
||||
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
|
||||
#
|
||||
#location ~ \.php$ {
|
||||
# root html;
|
||||
# fastcgi_pass 127.0.0.1:9000;
|
||||
# fastcgi_index index.php;
|
||||
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
|
||||
# include fastcgi_params;
|
||||
#}
|
||||
|
||||
# deny access to .htaccess files, if Apache's document root
|
||||
# concurs with Angie's one
|
||||
#
|
||||
#location ~ /\.ht {
|
||||
# deny all;
|
||||
#}
|
||||
}
|
||||
|
||||
|
||||
# another virtual host using mix of IP-, name-, and port-based configuration
|
||||
#
|
||||
#server {
|
||||
# listen 8000;
|
||||
# listen somename:8080;
|
||||
# server_name somename alias another.alias;
|
||||
|
||||
# location / {
|
||||
# root html;
|
||||
# index index.html index.htm;
|
||||
# }
|
||||
#}
|
||||
|
||||
|
||||
# HTTPS server
|
||||
#
|
||||
#server {
|
||||
# listen 443 ssl;
|
||||
# server_name localhost;
|
||||
|
||||
# ssl_certificate cert.pem;
|
||||
# ssl_certificate_key cert.key;
|
||||
|
||||
# ssl_session_cache shared:SSL:1m;
|
||||
# ssl_session_timeout 5m;
|
||||
|
||||
# ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
# ssl_prefer_server_ciphers on;
|
||||
|
||||
# location / {
|
||||
# root html;
|
||||
# index index.html index.htm;
|
||||
# }
|
||||
#}
|
||||
##
|
||||
# Virtual Host Configs
|
||||
##
|
||||
|
||||
include /etc/angie/conf.d/*.conf;
|
||||
include /etc/angie/sites-enabled/*;
|
||||
}
|
||||
|
||||
|
||||
#mail {
|
||||
# # See sample authentication script at:
|
||||
# # http://wiki.angie.org/ImapAuthenticateWithApachePhpScript
|
||||
#
|
||||
# # auth_http localhost/auth.php;
|
||||
# # pop3_capabilities "TOP" "USER";
|
||||
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
|
||||
#
|
||||
# server {
|
||||
# listen localhost:110;
|
||||
# protocol pop3;
|
||||
# proxy on;
|
||||
# }
|
||||
#
|
||||
# server {
|
||||
# listen localhost:143;
|
||||
# protocol imap;
|
||||
# proxy on;
|
||||
# }
|
||||
#}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
###
|
||||
## This file comes with the "Angie modules" on https://deb.paranoid.nl/angie-modules
|
||||
## This file comes with the "NGINX Mainline and modules" on https://deb.paranoid.nl/nginx-modules
|
||||
## It contains various optimizations, examples and tweaks.
|
||||
####
|
||||
|
||||
|
|
@ -11,10 +11,8 @@ worker_rlimit_nofile 10000;
|
|||
pid /run/angie.pid;
|
||||
include /etc/angie/modules-enabled/*.conf;
|
||||
|
||||
pcre_jit on;
|
||||
|
||||
events {
|
||||
worker_connections 8192; # this can go as high as ulimit -n
|
||||
worker_connections 65535;
|
||||
multi_accept on;
|
||||
use epoll;
|
||||
}
|
||||
|
|
@ -31,23 +29,20 @@ http {
|
|||
directio 256k;
|
||||
sendfile_max_chunk 256k;
|
||||
|
||||
tcp_nopush on;
|
||||
tcp_nopush off;
|
||||
tcp_nodelay on;
|
||||
types_hash_max_size 2048;
|
||||
server_names_hash_bucket_size 128;
|
||||
variables_hash_max_size 1024;
|
||||
# server_name_in_redirect off;
|
||||
|
||||
include /etc/angie/mime.types;
|
||||
server_name_in_redirect off; # if off, angie will use the requested Host header
|
||||
source_charset utf-8; # same value as "charset"
|
||||
|
||||
default_type application/octet-stream;
|
||||
|
||||
###
|
||||
## Enable security_headers only if you installed/enabled the module
|
||||
###
|
||||
# security_headers on;
|
||||
|
||||
|
||||
###
|
||||
## Enable other security headers.
|
||||
###
|
||||
# hide_server_tokens on;
|
||||
# fastcgi_hide_header X-Powered-By;
|
||||
# server_tokens off;
|
||||
|
|
@ -55,13 +50,15 @@ http {
|
|||
##
|
||||
# Optimizing TLS over TCP to reduce latency (Cloudflare patch)
|
||||
##
|
||||
# ssl_dyn_rec_enable on;
|
||||
#ssl_dyn_rec_enable on;
|
||||
|
||||
##
|
||||
# Enable HTTP2 and HTTP3
|
||||
#
|
||||
http2 on;
|
||||
#http3 on;
|
||||
#
|
||||
##
|
||||
|
||||
##
|
||||
# SSL Settings
|
||||
|
|
@ -81,11 +78,11 @@ http {
|
|||
ssl_early_data on;
|
||||
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_cache shared:le_nginx_SSL:10m; #letsencrypt only
|
||||
ssl_session_timeout 1440m;
|
||||
|
||||
# OCSP Stapling
|
||||
# fetch OCSP records from URL in ssl_certificate and cache them
|
||||
# Please enter your own nameservers for security
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
resolver 1.1.1.1 8.8.8.8 valid=300;
|
||||
|
|
@ -103,73 +100,51 @@ http {
|
|||
##
|
||||
# Gzip Settings
|
||||
##
|
||||
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_buffers 16 8k;
|
||||
gzip_http_version 1.1;
|
||||
gzip_min_length 250;
|
||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
|
||||
##
|
||||
# Brotli settings (Please load module first!)
|
||||
##
|
||||
#brotli on;
|
||||
#brotli_comp_level 4;
|
||||
#brotli_buffers 32 8k;
|
||||
#brotli_min_length 1000;
|
||||
#brotli_static on;
|
||||
#brotli_types image/svg+xml text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript image/x-icon;
|
||||
|
||||
##
|
||||
# ZSTD Settings (Please load module first!)
|
||||
##
|
||||
#zstd on;
|
||||
#zstd_min_length 256; # no less than 256 bytes
|
||||
#zstd_comp_level 3; # set the level to #
|
||||
#zstd_buffers 32 8k;
|
||||
#zstd_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/ xml+rss text/javascript image/x-icon;
|
||||
|
||||
|
||||
###
|
||||
## Miscellaneous
|
||||
###
|
||||
|
||||
# cache informations about FDs, frequently accessed files
|
||||
# can boost performance, but you need to test those values
|
||||
#open_file_cache max=200000 inactive=20s;
|
||||
#open_file_cache_valid 30s;
|
||||
#open_file_cache_min_uses 2;
|
||||
keepalive_disable none; # allow all browsers to use keepalive connections
|
||||
keepalive_requests 50; # number of requests per connection, does not affect SPDY
|
||||
max_ranges 1; # allow a single range header for resumed downloads and to stop large range header DoS attacks
|
||||
msie_padding off;
|
||||
#open_file_cache max=10000 inactive=2h;
|
||||
#open_file_cache_errors on;
|
||||
|
||||
server_names_hash_bucket_size 256;
|
||||
server_names_hash_max_size 2048;
|
||||
variables_hash_bucket_size 256;
|
||||
variables_hash_max_size 2048;
|
||||
map_hash_max_size 2048;
|
||||
map_hash_bucket_size 256;
|
||||
|
||||
#postpone_output 1440; # postpone sends to match our machine's MSS
|
||||
read_ahead 512K; # kernel read head set to the output_buffers
|
||||
output_buffers 4 512k;
|
||||
#open_file_cache_min_uses 1;
|
||||
#open_file_cache_valid 1h;
|
||||
output_buffers 2 512k;
|
||||
#postpone_output 1440; # postpone sends to match our machine's MSS
|
||||
read_ahead 512K; # kernel read head set to the output_buffers
|
||||
server_name_in_redirect off; # if off, angie will use the requested Host header
|
||||
source_charset utf-8; # same value as "charset"
|
||||
|
||||
# Buffer size for POST submissions
|
||||
client_body_buffer_size 80K;
|
||||
client_body_buffer_size 10K;
|
||||
client_max_body_size 16m;
|
||||
|
||||
# Buffer size for Headers
|
||||
client_header_buffer_size 1k;
|
||||
|
||||
# Allow the server to close the connection after a client stops
|
||||
# responding.
|
||||
# Frees up socket-associated memory.
|
||||
#
|
||||
reset_timedout_connection on;
|
||||
|
||||
# Timeouts, do not keep connections open longer then necessary to reduce
|
||||
# resource usage and deny Slowloris type attacks.
|
||||
client_body_timeout 12; # maximum time between packets the client can pause when sending angie any data
|
||||
client_header_timeout 12;# maximum time the client has to send the entire header to ngin
|
||||
keepalive_timeout 15; # timeout which a single keep-alive client connection will stay open
|
||||
keepalive_disable none; # allow all browsers to use keepalive connections
|
||||
keepalive_requests 5000; # number of requests per connection, does not affect SPDY
|
||||
reset_timedout_connection on; # Allow the server to close the connection after a client stops responding.
|
||||
send_timeout 12;
|
||||
client_body_timeout 10s; # maximum time between packets the client can pause when sending angie any data
|
||||
client_header_timeout 10s; # maximum time the client has to send the entire header to angie
|
||||
keepalive_timeout 120s; # timeout which a single keep-alive client connection will stay open
|
||||
|
||||
##
|
||||
# Virtual Host Configs
|
||||
|
|
|
|||
|
|
@ -7,44 +7,7 @@ gzip_proxied any;
|
|||
gzip_vary on;
|
||||
gzip_disable "msie6";
|
||||
gzip_static on;
|
||||
gzip_types
|
||||
application/atom+xml
|
||||
application/geo+json
|
||||
application/javascript
|
||||
application/json
|
||||
application/ld+json
|
||||
application/manifest+json
|
||||
application/rdf+xml
|
||||
application/rss+xml
|
||||
application/vnd.api+json
|
||||
application/vnd.geo+json
|
||||
application/vnd.ms-fontobject
|
||||
application/x-font-opentype
|
||||
application/x-font-truetype
|
||||
application/x-font-ttf
|
||||
application/x-javascript
|
||||
application/x-web-app-manifest+json
|
||||
application/xhtml+xml
|
||||
application/xml
|
||||
font/eot
|
||||
font/opentype
|
||||
font/otf
|
||||
font/ttf
|
||||
image/bmpg
|
||||
image/svg+xml
|
||||
image/vnd.microsoft.icon
|
||||
image/x-icon
|
||||
text/cache-manifest
|
||||
text/css
|
||||
text/html
|
||||
text/javascript
|
||||
text/plain
|
||||
text/vcard
|
||||
text/vnd.rim.location.xloc
|
||||
text/vtt
|
||||
text/x-component
|
||||
text/x-cross-domain-policy
|
||||
text/xml;
|
||||
gzip_types application/atom+xml application/geo+json application/javascript application/json application/ld+json application/manifest+json application/rdf+xml application/rss+xml application/vnd.api+json application/vnd.geo+json application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/x-javascript application/x-web-app-manifest+json application/xhtml+xml application/xml font/eot font/opentype font/otf font/ttf image/bmpg image/svg+xml image/vnd.microsoft.icon image/x-icon text/cache-manifest text/css text/html text/javascript text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy text/xml;
|
||||
|
||||
brotli on;
|
||||
brotli_buffers 32 4K;
|
||||
|
|
@ -62,41 +25,4 @@ zstd_buffers 32 4K;
|
|||
zstd_comp_level 3;
|
||||
zstd_min_length 1000;
|
||||
zstd_static on;
|
||||
zstd_types
|
||||
application/atom+xml
|
||||
application/geo+json
|
||||
application/javascript
|
||||
application/json
|
||||
application/ld+json
|
||||
application/manifest+json
|
||||
application/rdf+xml
|
||||
application/rss+xml
|
||||
application/vnd.api+json
|
||||
application/vnd.geo+json
|
||||
application/vnd.ms-fontobject
|
||||
application/x-font-opentype
|
||||
application/x-font-truetype
|
||||
application/x-font-ttf
|
||||
application/x-javascript
|
||||
application/x-web-app-manifest+json
|
||||
application/xhtml+xml
|
||||
application/xml
|
||||
font/eot
|
||||
font/opentype
|
||||
font/otf
|
||||
font/ttf
|
||||
image/bmpg
|
||||
image/svg+xml
|
||||
image/vnd.microsoft.icon
|
||||
image/x-icon
|
||||
text/cache-manifest
|
||||
text/css
|
||||
text/html
|
||||
text/javascript
|
||||
text/plain
|
||||
text/vcard
|
||||
text/vnd.rim.location.xloc
|
||||
text/vtt
|
||||
text/x-component
|
||||
text/x-cross-domain-policy
|
||||
text/xml;
|
||||
zstd_types application/atom+xml application/geo+json application/javascript application/json application/ld+json application/manifest+json application/rdf+xml application/rss+xml application/vnd.api+json application/vnd.geo+json application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/x-javascript application/x-web-app-manifest+json application/xhtml+xml application/xml font/eot font/opentype font/otf font/ttf image/bmpg image/svg+xml image/vnd.microsoft.icon image/x-icon text/cache-manifest text/css text/html text/javascript text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy text/xml;
|
||||
|
|
|
|||
13
containers/conf/angie/dhparam.pem
Normal file
13
containers/conf/angie/dhparam.pem
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
-----BEGIN DH PARAMETERS-----
|
||||
MIICCAKCAgEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
|
||||
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
|
||||
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
|
||||
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
|
||||
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
|
||||
ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
|
||||
7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
|
||||
nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e
|
||||
8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx
|
||||
iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K
|
||||
zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eZV9q//////////8CAQI=
|
||||
-----END DH PARAMETERS-----
|
||||
|
|
@ -0,0 +1,96 @@
|
|||
#######################################
|
||||
## Scanners ids: 10000000 ##
|
||||
#######################################
|
||||
|
||||
# http://pastebin.com/NP64hTQr
|
||||
# http://blog.initiative-s.de/2013/09/kompromitierte-wordpress-blogs-werden-fuer-ddos-attacken-genutzt/
|
||||
# If using wp then turn off this rule
|
||||
MainRule id:10000000 "s:$UWA:8" "str:wordpress/" "mz:$HEADERS_VAR:User-Agent" "msg:Wordpress in user-agent";
|
||||
|
||||
# https://github.com/robertdavidgraham/masscan
|
||||
MainRule id:10000001 "s:$UWA:8" "str:masscan" "mz:$HEADERS_VAR:User-Agent" "msg:masscan in user-agent";
|
||||
|
||||
# block acunetix scan
|
||||
MainRule id:10000002 "s:$UWA:8" "str:99999999999999999999999" "mz:$HEADERS_VAR:Content-length" "msg:acunetix scan nginx buffer size";
|
||||
MainRule id:10000003 "s:$UWA:8" "str:acunetix" "mz:URL|BODY|$HEADERS_VAR:Accept|$HEADERS_VAR:User-Agent" "msg:acunetix scan website";
|
||||
MainRule id:10000004 "s:$UWA:8" "str:acunetix/wvs" "mz:$HEADERS_VAR:Accept" "msg:acunetix scan website";
|
||||
|
||||
MainRule id:10000005 "s:$UWA:8" "str:havij" "mz:$HEADERS_VAR:User-Agent" "msg:Havij in user-agent";
|
||||
MainRule id:10000006 "s:$UWA:8" "str:webmole" "mz:$HEADERS_VAR:User-Agent" "msg:webmole in user-agent";
|
||||
MainRule id:10000007 "s:$UWA:8" "str:nlpproject.info" "mz:$HEADERS_VAR:User-Agent" "msg:nlpproject.info in user-agent";
|
||||
MainRule id:10000008 "s:$UWA:8" "str:cloudmapping" "mz:$HEADERS_VAR:User-Agent" "msg:cloudmapping in user-agent";
|
||||
MainRule id:10000009 "s:$UWA:8" "str:sucuri" "mz:$HEADERS_VAR:User-Agent" "msg:Sucuri in user-agent";
|
||||
MainRule id:10000010 "s:$UWA:8" "str:brutus/" "mz:$HEADERS_VAR:User-Agent" "msg:Brutus in user-agent";
|
||||
MainRule id:10000011 "s:$UWA:4" "str:apachebench" "mz:$HEADERS_VAR:User-Agent" "msg:apachebench in user-agent";
|
||||
MainRule id:10000012 "s:$UWA:8" "str:/netsparker" "mz:URL" "msg:netsparker in user-agent";
|
||||
MainRule id:10000013 "s:$UWA:8" "str:mysqloit" "mz:$HEADERS_VAR:User-Agent" "msg:Mysqloit in user-agent";
|
||||
MainRule id:10000014 "s:$UWA:8" "str:network-services-auditor" "mz:$HEADERS_VAR:User-Agent" "msg:network-services-auditor in user-agent";
|
||||
MainRule id:10000015 "s:$UWA:8" "str:dav.pm" "mz:$HEADERS_VAR:User-Agent" "msg:dav.pm in user-agent";
|
||||
MainRule id:10000016 "s:$UWA:8" "str:w3af" "mz:$HEADERS_VAR:User-Agent" "msg:w3af in user-agent";
|
||||
MainRule id:10000017 "s:$UWA:8" "str:http_get_vars" "mz:$HEADERS_VAR:User-Agent" "msg:PHP-Injetion on UA";
|
||||
MainRule id:10000018 "s:$UWA:8" "str:whisker" "mz:$HEADERS_VAR:User-Agent" "msg:whisker in user-agent";
|
||||
MainRule id:10000019 "s:$UWA:8" "str:whatweb" "mz:$HEADERS_VAR:User-Agent" "msg:whatweb in user-agent";
|
||||
MainRule id:10000020 "s:$UWA:8" "str:dirbuster" "mz:$HEADERS_VAR:User-Agent" "msg:DirBuster in user-agent";
|
||||
|
||||
# https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/
|
||||
# https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a68d7d#diff-a35f2ee9e1d2d3983a3270ee10ec70bf86349c53febdeabdf104f88cb2167961R370
|
||||
# prevent php supply chain attack
|
||||
MainRule id:10000021 "s:$UWA:8" "str:zerodium" "mz:$HEADERS_VAR:User-Agent" "msg:zerodium in user-agent";
|
||||
|
||||
# prevent log4j attack
|
||||
# info https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
|
||||
# payload check https://github.com/johto89/Some-collections-for-Security-Researcher/blob/master/log4j-all-in-one.md
|
||||
MainRule id:10000022 "s:$UWA:8" "str:${" "mz:$HEADERS_VAR:User-Agent" "msg:log4j attack detection";
|
||||
|
||||
# Python libraries like python-requests, python-urllib, etc..
|
||||
MainRule id:10000023 "s:$UWA:8" "str:python" "mz:$HEADERS_VAR:User-Agent" "msg:python in user-agent";
|
||||
|
||||
# Meterpreter
|
||||
MainRule id:10000024 "s:$UWA:8" "str:meterpreter" "mz:$HEADERS_VAR:User-Agent" "msg:meterpreter in user-agent";
|
||||
|
||||
# https://github.com/zmap/zgrab2
|
||||
MainRule id:10000025 "s:$UWA:8" "str:zgrab" "mz:$HEADERS_VAR:User-Agent" "msg:zgrab in user-agent";
|
||||
|
||||
# Known tools like nmap,curl,wget
|
||||
MainRule id:10000026 "s:$UWA:8" "str:nmap" "mz:$HEADERS_VAR:User-Agent" "msg:nmap in user-agent";
|
||||
MainRule id:10000027 "s:$UWA:8" "str:curl" "mz:$HEADERS_VAR:User-Agent" "msg:curl in user-agent";
|
||||
MainRule id:10000028 "s:$UWA:8" "str:wget" "mz:$HEADERS_VAR:User-Agent" "msg:wget in user-agent";
|
||||
MainRule id:10000029 "s:$UWA:8" "str:sqlmap" "mz:$HEADERS_VAR:User-Agent" "msg:slqmap in user-agent";
|
||||
|
||||
# Scan from Expense with this User-Agent:
|
||||
# Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers presences on the Internet.
|
||||
# If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com
|
||||
MainRule id:10000030 "s:$UWA:8" "str:paloaltonetworks.com" "mz:$HEADERS_VAR:User-Agent" "msg:paloaltonetworks in user-agent";
|
||||
MainRule id:10000031 "s:$UWA:8" "str:palo alto network" "mz:$HEADERS_VAR:User-Agent" "msg:palo alto network in user-agent";
|
||||
MainRule id:10000032 "s:$UWA:8" "str:Expense" "mz:$HEADERS_VAR:User-Agent" "msg:Expense in user-agent";
|
||||
|
||||
# Scan from NetSystemsResearch with this User-Agent:
|
||||
# NetSystemsResearch studies the availability of various services across the internet. Our website is netsystemsresearch.com
|
||||
MainRule id:10000033 "s:$UWA:8" "str:NetSystemsResearch" "mz:$HEADERS_VAR:User-Agent" "msg:NetSystemsResearch in user-agent";
|
||||
|
||||
# Golang default User-Agent
|
||||
MainRule id:10000034 "s:$UWA:8" "str:Go-http" "mz:$HEADERS_VAR:User-Agent" "msg:Golang in user-agent";
|
||||
|
||||
# Perl default User-Agent
|
||||
MainRule id:10000035 "s:$UWA:8" "str:libwww-perl" "mz:$HEADERS_VAR:User-Agent" "msg:libwww-perl in user-agent";
|
||||
|
||||
# l9tcpid in User-Agent
|
||||
MainRule id:10000036 "s:$UWA:8" "str:l9tcpid" "mz:$HEADERS_VAR:User-Agent" "msg:l9tcpid in user-agent";
|
||||
|
||||
# l9explore in User-Agent
|
||||
MainRule id:10000037 "s:$UWA:8" "str:l9explore" "mz:$HEADERS_VAR:User-Agent" "msg:l9explore in user-agent";
|
||||
|
||||
# WPScan in User-Agent
|
||||
MainRule id:10000038 "s:$UWA:8" "str:wpscan" "mz:$HEADERS_VAR:User-Agent" "msg:WPScan in user-agent";
|
||||
|
||||
# WinHttpReq in User-Agent
|
||||
MainRule id:10000039 "s:$UWA:8" "str:WinHttpReq" "mz:$HEADERS_VAR:User-Agent" "msg:WinHttpReq in user-agent";
|
||||
|
||||
# EgyScan security scanner uses AliElTop in some of the attacks
|
||||
MainRule id:10000040 "s:$UWA:8" "str:AliElTop" "mz:ANY" "msg:EgyScan security scanner";
|
||||
|
||||
# Guzzle PHP HTTP client
|
||||
MainRule id:10000041 "s:$UWA:8" "str:GuzzleHttp" "mz:$HEADERS_VAR:User-Agent" "msg:GuzzleHttp in user-agent";
|
||||
|
||||
# Java client
|
||||
MainRule id:10000042 "s:$UWA:8" "str:AsyncHttpClient" "mz:$HEADERS_VAR:User-Agent" "msg:AsyncHttpClient in user-agent";
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
#######################################
|
||||
## Webserver Security ids: 20000000 ##
|
||||
#######################################
|
||||
|
||||
# webserver critical files
|
||||
MainRule id:20000000 "s:$UWA:8" "str:.conf" "mz:URL" "msg:file access to .conf";
|
||||
MainRule id:20000001 "s:$UWA:8" "str:.ini" "mz:URL" "msg:file access to .ini";
|
||||
MainRule id:20000002 "s:$UWA:8" "str:.sql" "mz:URL" "msg:file access to .sql";
|
||||
MainRule id:20000003 "s:$UWA:8" "rx:\.txt$" "mz:URL" "msg:file access to .txt";
|
||||
MainRule id:20000004 "s:$UWA:8" "str:/sftp-config.json" "mz:URL|BODY" "msg:file access to sftp-config.json";
|
||||
MainRule id:20000005 "s:$UWA:8" "str:/.bzr" "mz:URL" "msg:bazaar version control folder access";
|
||||
MainRule id:20000006 "s:$UWA:8" "str:/.git" "mz:URL" "msg:git version control folder access";
|
||||
MainRule id:20000007 "s:$UWA:8" "str:/.hg" "mz:URL" "msg:mercurial version control folder access";
|
||||
MainRule id:20000008 "s:$UWA:8" "str:/.svn" "mz:URL" "msg:svn version control folder access";
|
||||
MainRule id:20000009 "s:$UWA:8" "str:/bzr/" "mz:URL" "msg:bazaar version control folder access";
|
||||
MainRule id:20000010 "s:$UWA:8" "str:/git/" "mz:URL" "msg:git version control folder access";
|
||||
MainRule id:20000011 "s:$UWA:8" "str:/hg/" "mz:URL" "msg:mercurial version control folder access";
|
||||
MainRule id:20000012 "s:$UWA:8" "str:/svn/" "mz:URL" "msg:svn version control folder access";
|
||||
MainRule id:20000013 "s:$UWA:8" "str:.htpasswd" "mz:ARGS|BODY|URL|FILE_EXT" "msg:file access to .htpasswd";
|
||||
MainRule id:20000014 "s:$UWA:8" "str:.htaccess" "mz:ARGS|BODY|URL|FILE_EXT" "msg:file access to .htaccess";
|
||||
MainRule id:20000015 "s:$UWA:8" "str:.ds_store" "mz:URL" "msg:file access to .ds_store";
|
||||
MainRule id:20000016 "s:$UWA:8" "str:changelog" "mz:URL" "msg:file access to changelog";
|
||||
MainRule id:20000017 "s:$UWA:8" "rx:^/core.\d+$" "mz:URL" "msg:file access to core dumps";
|
||||
MainRule id:20000018 "s:$UWA:8" "rx:\.module$" "mz:URL" "msg:file access to .module (drupal)";
|
||||
MainRule id:20000019 "s:$UWA:8" "str:web.config" "mz:URL" "msg:file access to web.config (drupal)";
|
||||
MainRule id:20000020 "s:$UWA:8" "rx:release[-_]notes\." "mz:URL" "msg:file access to release notes";
|
||||
MainRule id:20000021 "s:$UWA:8" "rx:~$" "mz:URL" "msg:file access to cache files";
|
||||
MainRule id:20000022 "s:$UWA:8" "str:web-inf" "mz:URL|BODY|ARGS" "msg:folder access to WEB-INF";
|
||||
|
||||
# Exposed Services
|
||||
MainRule id:20000023 "s:$UWA:8" "str:/cgi-bin/luci" "mz:URL" "msg:Exposed OpenWRT";
|
||||
MainRule id:20000024 "s:$UWA:8" "rx:^/cgi-bin/.+\.cgi$" "mz:URL" "msg:Exposed cgi-bin";
|
||||
MainRule id:20000025 "s:$UWA:8" "str:/jenkins" "mz:URL" "msg:Exposed Jenkins";
|
||||
MainRule id:20000026 "s:$UWA:8" "str:/console/login/LoginForm.jsp" "mz:URL" "msg:Exposed Oracle WebLogic Server Administration Console";
|
||||
MainRule id:20000027 "s:$UWA:8" "str:/nuxeo/login.jsp" "mz:URL" "msg:Exposed Nuxeo Enterprise Platform";
|
||||
MainRule id:20000028 "s:$UWA:8" "str:/zabbix/index.php" "mz:URL" "msg:Exposed Zabbix";
|
||||
|
||||
# Known hacking tools like burp suite, etc..
|
||||
MainRule id:20000029 "s:$UWA:8" "str:burpcollaborator.net" "mz:ARGS|BODY|HEADERS" "msg:burp collaborator";
|
||||
MainRule id:20000030 "s:$UWA:8" "str:/netsparker" "mz:URL" "msg:Netsparker";
|
||||
|
||||
# Malicious strings in request
|
||||
MainRule id:20000031 "s:$UWA:8" "str:\n\r" "mz:URL" "msg:HTTP - Smuggling-Attempt (NewLine in URI)";
|
||||
MainRule id:20000032 "s:$UWA:6" "rx:^[a-zA-Z\d-]+\.[a-zA-Z]+$" "mz:$HEADERS_VAR:Host" "msg:HOST-Header Injection";
|
||||
MainRule id:20000033 "s:$UWA:8" "str:/bin/sh" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/bin/sh in URI";
|
||||
MainRule id:20000034 "s:$UWA:8" "str:/etc/passwd" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/etc/passwd in URI";
|
||||
MainRule id:20000035 "s:$UWA:8" "str:/etc/shadow" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/etc/shadow in URI";
|
||||
MainRule id:20000036 "s:$UWA:8" "str:/etc/hosts" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/etc/hosts in URI";
|
||||
MainRule id:20000037 "s:$UWA:8" "str:/Windows/system.ini" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/Windows/system.ini in URI";
|
||||
MainRule id:20000038 "s:$UWA:8" "rx:<!DOCTYPE(\s+)(%*\s*)([{}:.a-zA-Z0-9_-]*)(\s+)SYSTEM" "mz:BODY" "msg: possible XML/XXE-Exploitation atempt (Doctype)";
|
||||
MainRule id:20000039 "s:$UWA:8" "str:http://http://" "mz:HEADERS" "msg:Abnormal double http:// in HTTP header";
|
||||
MainRule id:20000040 "s:$UWA:8" "str:https://http://" "mz:HEADERS" "msg:Abnormal double http:// in HTTP header";
|
||||
MainRule id:20000041 "s:$UWA:8" "str:http://https://" "mz:HEADERS" "msg:Abnormal double http:// in HTTP header";
|
||||
MainRule id:20000042 "s:$UWA:8" "str:https://https://" "mz:HEADERS" "msg:Abnormal double http:// in HTTP header";
|
||||
|
||||
# ThinkPHP Remote Code Execution CVE-2018-20062
|
||||
MainRule id:20000043 "s:$UWA:8" "str:index/\think\app/invokefunction" "mz:URL" "msg:CVE-2018-20062";
|
||||
|
||||
# AWS related files
|
||||
MainRule id:20000044 "s:$UWA:8" "str:/.aws/" "mz:URL" "msg:AWS Credential Stealer";
|
||||
|
||||
# dot folders and files
|
||||
MainRule id:20000045 "s:$UWA:8" "rx:/\.[^.]" "mz:URL" "msg:Access to dot folder or file";
|
||||
|
||||
# Exposed Microsoft Exchange
|
||||
MainRule id:20000046 "s:$UWA:8" "str:autodiscover/autodiscover.json" "mz:URL" "msg:Exposed Microsoft Exchange";
|
||||
MainRule id:20000047 "s:$UWA:8" "str:autodiscover/autodiscover.xml" "mz:URL" "msg:Exposed Microsoft Exchange";
|
||||
MainRule id:20000048 "s:$UWA:8" "str:/auth.owa" "mz:URL" "msg:Exposed Microsoft Exchange";
|
||||
|
||||
# Ignition 2.5.1 Remote Code Execution CVE-2021-3129
|
||||
MainRule id:20000049 "s:$UWA:8" "str:/_ignition/execute-solution" "mz:URL" "msg:CVE-2021-3129";
|
||||
|
||||
# CVE-2018-13379 path traversal vulnerability in Fortinet's FortiGate SSL VPN
|
||||
# https://x.x.x.x/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession
|
||||
MainRule id:20000050 "s:$UWA:8" "str:/sslvpn_websession" "mz:ARGS|BODY|HEADERS" "msg:CVE-2018-13379";
|
||||
|
||||
# Exposed Apache Tomcat Administration Panel
|
||||
MainRule id:20000051 "s:$UWA:8" "str:/manager/html" "mz:URL" "msg:Exposed Apache Tomcat Administration Panel";
|
||||
|
||||
# Block NMAP enumeration
|
||||
MainRule id:20000052 "s:$UWA:8" "str:/HNAP1" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000053 "s:$UWA:8" "rx:/default\.(asp|aspx|cfm|cgi|jsa|jsp|php|pl)$" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000054 "s:$UWA:8" "rx:/start\.(asp|aspx|cfm|cgi|jsa|jsp|php|pl)$" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000055 "s:$UWA:8" "rx:/localstart\.(asp|aspx|cfm|cgi|jsa|jsp|php|pl)$" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000056 "s:$UWA:8" "rx:/admin\.(asp|aspx|cfm|cgi|jsa|jsp|php|pl)$" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000057 "s:$UWA:8" "str:/nmaplowercheck" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
|
||||
# Siemens PLC scan
|
||||
MainRule id:20000058 "s:$UWA:8" "str:/__Additional" "mz:URL" "msg:Siemens PLC scan";
|
||||
MainRule id:20000059 "s:$UWA:8" "str:/docs/cplugError.html/" "mz:URL" "msg:Siemens PLC scan";
|
||||
MainRule id:20000060 "s:$UWA:8" "str:/Portal/Portal.mwsl" "mz:URL" "msg:Siemens PLC scan";
|
||||
|
||||
# Block Citrix XenApp
|
||||
MainRule id:20000061 "s:$UWA:8" "str:/scripts/wpnbr.dll" "mz:URL" "msg:Citrix XenApp";
|
||||
|
||||
# Block jenkins authentication bypass CVE-2018-1000861
|
||||
MainRule id:20000062 "s:$UWA:8" "str:/securityRealm/user/admin/search/index" "mz:URL" "msg:CVE-2018-1000861";
|
||||
|
||||
# Block jenkins RCE CVE-2019-1003029, CVE-2019-1003030
|
||||
MainRule id:20000063 "s:$UWA:8" "str:/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript/" "mz:URL" "msg:CVE-2019-1003029, CVE-2019-1003030";
|
||||
|
||||
# Log4J bypass
|
||||
MainRule id:20000064 "s:$UWA:8" "str:${env:NaN:-" "mz:URL|ARGS|BODY|HEADERS" "msg:Attempted Log4J Bypass";
|
||||
|
||||
# Windows system paths
|
||||
MainRule id:20000065 "s:$UWA:8" "str:\Windows\system.ini" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:\Windows\system.ini in URI";
|
||||
MainRule id:20000066 "s:$UWA:8" "str:/Windows/win.ini" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/Windows/win.ini in URI";
|
||||
MainRule id:20000067 "s:$UWA:8" "str:\Windows\win.ini" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:\Windows\win.ini in URI";
|
||||
|
||||
# Exposed Apache Host Manager App
|
||||
MainRule id:20000068 "s:$UWA:8" "str:/manager/text/list" "mz:URL" "msg:Exposed Apache Host Manager App";
|
||||
|
||||
# Spring Cloud Gateway Code Injection Vulnerability
|
||||
MainRule id:20000069 "s:$UWA:8" "str:/actuator/gateway/routes" "mz:URL" "msg:CVE-2022-22947";
|
||||
|
||||
# Block Spring4Shell
|
||||
MainRule id:20000070 "s:$UWA:8" "str:class.module.classLoader.resources." "mz:RAW_BODY" "msg:CVE-2022-22965";
|
||||
MainRule id:20000071 "s:$UWA:8" "rx:<%|%>" "mz:HEADERS" "msg:CVE-2022-22965";
|
||||
|
||||
# Block Microsoft Exchange Server Remote Code Execution
|
||||
MainRule id:20000072 "s:$UWA:8" "str:/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application" "mz:URL" "msg:CVE-2021-28481";
|
||||
|
||||
# Prevents IndoXploit/IDX Shell dump access
|
||||
# A website that has been infected will have a world-browsable folder called `idx_config`
|
||||
# which contains text versions of the configuration file of every CMS installation the shell
|
||||
# is able to find (impacts WordPress, Joomla and Magento).
|
||||
MainRule id:20000073 "s:$UWA:8" "str:/idx_config" "mz:URL" "msg:Prevent IndoXploit/IDX Shell dump access";
|
||||
|
||||
# Prevents old grafana to return all folders
|
||||
# https://github.com/grafana/grafana/pull/44175
|
||||
MainRule id:20000074 "s:$UWA:8" "rx:^0$" "mz:$URL:/api/search|$ARGS_VAR:folderIds" "msg:Access all grafana folders";
|
||||
|
||||
# Block access to yaml files
|
||||
MainRule id:20000075 "s:$UWA:8" "str:.yml" "mz:URL" "msg:file access to .yml";
|
||||
MainRule id:20000076 "s:$UWA:8" "str:.yaml" "mz:URL" "msg:file access to .yaml";
|
||||
|
||||
# Block access to HashiCorp Consul/Vault template files
|
||||
MainRule id:20000077 "s:$UWA:8" "rx:\.ctmpl$" "mz:URL" "msg:file access to .ctmpl";
|
||||
MainRule id:20000078 "s:$UWA:8" "rx:\.hcl$" "mz:URL" "msg:file access to .hcl";
|
||||
|
||||
# Block access to known files used for fingerprinting
|
||||
MainRule id:20000079 "s:$UWA:8" "rx:\.md$" "mz:URL" "msg:file access to .md";
|
||||
MainRule id:20000080 "s:$UWA:8" "rx:read[-_]?me" "mz:URL" "msg:file access to readme";
|
||||
MainRule id:20000081 "s:$UWA:8" "rx:\.toml$" "mz:URL" "msg:file access to .toml";
|
||||
|
||||
# AWS related files
|
||||
MainRule id:20000082 "s:$UWA:8" "str:dockerrun.aws.json" "mz:URL" "msg:Exposed AWS Elastic Beanstalk configuration";
|
||||
|
||||
# Block access to temporary backup files like .bak,.bak.php, etc...
|
||||
MainRule id:20000083 "s:$UWA:8" "str:.bak" "mz:URL" "msg:file access to temporary backup files";
|
||||
|
||||
# Path traversal in nuxt/framework when in dev mode
|
||||
# https://huntr.dev/bounties/4849af83-450c-435e-bc0b-71705f5be440/
|
||||
MainRule id:20000084 "s:$UWA:8" "str:_nuxt/@" "mz:URL" "msg:path traversal in nuxt framework";
|
||||
|
||||
# AWS NodeJS related files
|
||||
MainRule id:20000085 "s:$UWA:8" "str:awsconfig" "mz:URL" "msg:Exposed AWS config files";
|
||||
MainRule id:20000086 "s:$UWA:8" "str:aws-config" "mz:URL" "msg:Exposed AWS config files";
|
||||
MainRule id:20000087 "s:$UWA:8" "str:awscred" "mz:URL" "msg:Exposed AWS config files";
|
||||
MainRule id:20000088 "s:$UWA:8" "str:aws-cred" "mz:URL" "msg:Exposed AWS config files";
|
||||
|
||||
# Text editors temp and config files
|
||||
MainRule id:20000089 "s:$UWA:8" "str:.old" "mz:URL" "msg:Exposed temp copy";
|
||||
MainRule id:20000090 "s:$UWA:8" "str:.save" "mz:URL" "msg:Exposed temp copy";
|
||||
MainRule id:20000091 "s:$UWA:8" "str:.DS_Store" "mz:URL" "msg:Exposed temp copy";
|
||||
MainRule id:20000092 "s:$UWA:8" "str:vscode" "mz:URL" "msg:Exposed vscode directory";
|
||||
|
||||
# Exposed .env
|
||||
MainRule id:20000093 "s:$UWA:8" "str:/.env" "mz:URL" "msg:access to .env file or dir";
|
||||
|
||||
# androxgh0st exploit
|
||||
MainRule id:20000094 "s:$UWA:8" "str:androxgh0st" "mz:ANY" "msg:androxgh0st exploit";
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
#######################################
|
||||
## Wordpress ids: 30000000 ##
|
||||
#######################################
|
||||
|
||||
MainRule id:30000000 "s:$UWA:8" "str:system.multicall" "mz:$URL:/xmlrpc.php|BODY" "msg:Wordpress XMLRPC possible Password Brute Force";
|
||||
MainRule id:30000001 "s:$UWA:8" "str:system.listmethods" "mz:$URL:/xmlrpc.php|BODY" "msg:WordPress XMLRPC Enumeration system.listMethods";
|
||||
MainRule id:30000002 "s:$UWA:8" "str:system.getcapabilities" "mz:$URL:/xmlrpc.php|BODY" "msg:WordPress XMLRPC Enumeration system.getCapabilities";
|
||||
MainRule id:30000003 "s:$UWA:8" "str:/w3tc/dbcache" "mz:URL" "msg:WordPress TotalCache-DBCache-Access";
|
||||
MainRule id:30000004 "s:$UWA:8" "str:/uploadify/uploadify.php" "mz:URL" "msg:WordPress Uploadify-Access";
|
||||
MainRule id:30000005 "s:$UWA:8" "str:/wp-content/plugins/mm-forms-community/upload/temp/" "mz:URL" "msg:Access To mm-forms-community upload dir";
|
||||
MainRule id:30000006 "s:$UWA:8" "str:wp-config.php" "mz:BODY|ARGS|URL" "msg:WordPress access to wp-config.php";
|
||||
|
||||
# block malicious access ALFA_DATA|alfacgiapi|cgialfa path
|
||||
MainRule id:30000007 "s:$UWA:8" "str:ALFA_DATA" "mz:URL" "msg:WordPress malicious access to ALFA_DATA path";
|
||||
MainRule id:30000008 "s:$UWA:8" "str:alfacgiapi" "mz:URL" "msg:WordPress malicious access to alfacgiapi path";
|
||||
MainRule id:30000009 "s:$UWA:8" "str:cgialfa" "mz:URL" "msg:WordPress malicious access to cgialfa path";
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
#######################################
|
||||
## PHP Security ids: 40000000 ##
|
||||
#######################################
|
||||
|
||||
# Php Functions
|
||||
MainRule id:40000000 "s:$UWA:8" "str:gzinflate(" "mz:URL|BODY|ARGS" "msg:gzinflate in URI";
|
||||
MainRule id:40000001 "s:$UWA:8" "str:system(" "mz:URL|BODY|ARGS" "msg:php system called";
|
||||
MainRule id:40000002 "s:$UWA:8" "str:base64_decode(" "mz:URL|BODY|ARGS" "msg:php base64_decode called";
|
||||
MainRule id:40000003 "s:$UWA:8" "str:@eval" "mz:URL|BODY|ARGS" "msg:php eval called";
|
||||
MainRule id:40000004 "s:$UWA:8" "rx:eval\((\s+)?\$_" "mz:URL|BODY|ARGS" "msg:php eval called";
|
||||
|
||||
# PhpMyAdmin
|
||||
MainRule id:40000005 "s:$UWA:8" "str:/db-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000006 "s:$UWA:8" "str:/dbadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000007 "s:$UWA:8" "str:/myadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000008 "s:$UWA:8" "str:/mysqldumper " "mz:URL" "msg:MysqlDumper";
|
||||
MainRule id:40000009 "s:$UWA:8" "str:/mysqlmanager" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000010 "s:$UWA:8" "str:/p/m/a/" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000011 "s:$UWA:8" "str:/php-my-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000012 "s:$UWA:8" "str:/php-myadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000013 "s:$UWA:8" "str:/phpmanager" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000014 "s:$UWA:8" "str:/phpmy" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000015 "s:$UWA:8" "str:/phpmy-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000016 "s:$UWA:8" "str:/phpmyadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000017 "s:$UWA:8" "str:/phppgadmin " "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000018 "s:$UWA:8" "str:/pma" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000019 "s:$UWA:8" "str:/sql-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000020 "s:$UWA:8" "str:/sqladmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000021 "s:$UWA:8" "str:/sqlweb" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000022 "s:$UWA:8" "str:/sysadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000023 "s:$UWA:8" "str:/webadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000024 "s:$UWA:8" "str:/webdb" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000025 "s:$UWA:8" "str:/websql" "mz:URL" "msg:SQL Admin Interface";
|
||||
|
||||
# Block PHPUnit eval-stdin.php CVE-2017-9841
|
||||
MainRule id:40000026 "s:$UWA:8" "str:eval-stdin.php" "mz:URL" "msg:CVE-2017-9841";
|
||||
|
||||
# Block PHP easter egg which normally can be disabled via expose_php = off
|
||||
MainRule id:40000027 "s:$UWA:8" "rx:PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" "mz:URL|BODY|ARGS" "msg:PHP easter egg credits";
|
||||
|
||||
# Block PHP Xdebug
|
||||
MainRule id:40000028 "s:$UWA:8" "str:XDEBUG_SESSION" "mz:ANY" "msg:Block PHP Xdebug";
|
||||
|
||||
# Block PHPinfo access
|
||||
MainRule id:40000029 "s:$UWA:8" "str:phpinfo" "mz:URL|BODY|ARGS" "msg:PHPinfo access";
|
||||
|
||||
# Block known php installer exploit
|
||||
MainRule id:40000030 "s:$UWA:8" "str:install.php" "mz:URL" "msg:Access to php install";
|
||||
|
||||
# Block more sql admin interface
|
||||
MainRule id:40000031 "s:$UWA:8" "str:/mysql-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000032 "s:$UWA:8" "str:/mysqladmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000033 "s:$UWA:8" "str:/sqlmanager" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000034 "s:$UWA:8" "str:/mysql/" "mz:URL" "msg:SQL Admin Interface";
|
||||
|
||||
# Block access to Lavarel telescope since it allows to read logs and SQL queries
|
||||
MainRule id:40000035 "s:$UWA:8" "str:/telescope/" "mz:URL" "msg:Access to Lavarel telescope";
|
||||
|
||||
# Block access to adminer/phpMinAdmin sql admin interface
|
||||
MainRule id:40000036 "s:$UWA:8" "str:adminer" "mz:URL" "msg:SQL Admin Interface";
|
||||
|
||||
# Block access to Symfony Web Framework dev mode.
|
||||
MainRule id:40000037 "s:$UWA:8" "str:app_dev" "mz:URL" "msg:Symfony Web Framework dev mode";
|
||||
|
||||
# phpstorm in request
|
||||
MainRule id:40000038 "s:$UWA:8" "str:phpstorm" "mz:URL|ARGS|HEADERS" "msg:phpstorm in request";
|
||||
|
|
@ -0,0 +1,96 @@
|
|||
#######################################
|
||||
## Scanners ids: 10000000 ##
|
||||
#######################################
|
||||
|
||||
# http://pastebin.com/NP64hTQr
|
||||
# http://blog.initiative-s.de/2013/09/kompromitierte-wordpress-blogs-werden-fuer-ddos-attacken-genutzt/
|
||||
# If using wp then turn off this rule
|
||||
MainRule id:10000000 "s:$UWA:8" "str:wordpress/" "mz:$HEADERS_VAR:User-Agent" "msg:Wordpress in user-agent";
|
||||
|
||||
# https://github.com/robertdavidgraham/masscan
|
||||
MainRule id:10000001 "s:$UWA:8" "str:masscan" "mz:$HEADERS_VAR:User-Agent" "msg:masscan in user-agent";
|
||||
|
||||
# block acunetix scan
|
||||
MainRule id:10000002 "s:$UWA:8" "str:99999999999999999999999" "mz:$HEADERS_VAR:Content-length" "msg:acunetix scan nginx buffer size";
|
||||
MainRule id:10000003 "s:$UWA:8" "str:acunetix" "mz:URL|BODY|$HEADERS_VAR:Accept|$HEADERS_VAR:User-Agent" "msg:acunetix scan website";
|
||||
MainRule id:10000004 "s:$UWA:8" "str:acunetix/wvs" "mz:$HEADERS_VAR:Accept" "msg:acunetix scan website";
|
||||
|
||||
MainRule id:10000005 "s:$UWA:8" "str:havij" "mz:$HEADERS_VAR:User-Agent" "msg:Havij in user-agent";
|
||||
MainRule id:10000006 "s:$UWA:8" "str:webmole" "mz:$HEADERS_VAR:User-Agent" "msg:webmole in user-agent";
|
||||
MainRule id:10000007 "s:$UWA:8" "str:nlpproject.info" "mz:$HEADERS_VAR:User-Agent" "msg:nlpproject.info in user-agent";
|
||||
MainRule id:10000008 "s:$UWA:8" "str:cloudmapping" "mz:$HEADERS_VAR:User-Agent" "msg:cloudmapping in user-agent";
|
||||
MainRule id:10000009 "s:$UWA:8" "str:sucuri" "mz:$HEADERS_VAR:User-Agent" "msg:Sucuri in user-agent";
|
||||
MainRule id:10000010 "s:$UWA:8" "str:brutus/" "mz:$HEADERS_VAR:User-Agent" "msg:Brutus in user-agent";
|
||||
MainRule id:10000011 "s:$UWA:4" "str:apachebench" "mz:$HEADERS_VAR:User-Agent" "msg:apachebench in user-agent";
|
||||
MainRule id:10000012 "s:$UWA:8" "str:/netsparker" "mz:URL" "msg:netsparker in user-agent";
|
||||
MainRule id:10000013 "s:$UWA:8" "str:mysqloit" "mz:$HEADERS_VAR:User-Agent" "msg:Mysqloit in user-agent";
|
||||
MainRule id:10000014 "s:$UWA:8" "str:network-services-auditor" "mz:$HEADERS_VAR:User-Agent" "msg:network-services-auditor in user-agent";
|
||||
MainRule id:10000015 "s:$UWA:8" "str:dav.pm" "mz:$HEADERS_VAR:User-Agent" "msg:dav.pm in user-agent";
|
||||
MainRule id:10000016 "s:$UWA:8" "str:w3af" "mz:$HEADERS_VAR:User-Agent" "msg:w3af in user-agent";
|
||||
MainRule id:10000017 "s:$UWA:8" "str:http_get_vars" "mz:$HEADERS_VAR:User-Agent" "msg:PHP-Injetion on UA";
|
||||
MainRule id:10000018 "s:$UWA:8" "str:whisker" "mz:$HEADERS_VAR:User-Agent" "msg:whisker in user-agent";
|
||||
MainRule id:10000019 "s:$UWA:8" "str:whatweb" "mz:$HEADERS_VAR:User-Agent" "msg:whatweb in user-agent";
|
||||
MainRule id:10000020 "s:$UWA:8" "str:dirbuster" "mz:$HEADERS_VAR:User-Agent" "msg:DirBuster in user-agent";
|
||||
|
||||
# https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/
|
||||
# https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a68d7d#diff-a35f2ee9e1d2d3983a3270ee10ec70bf86349c53febdeabdf104f88cb2167961R370
|
||||
# prevent php supply chain attack
|
||||
MainRule id:10000021 "s:$UWA:8" "str:zerodium" "mz:$HEADERS_VAR:User-Agent" "msg:zerodium in user-agent";
|
||||
|
||||
# prevent log4j attack
|
||||
# info https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
|
||||
# payload check https://github.com/johto89/Some-collections-for-Security-Researcher/blob/master/log4j-all-in-one.md
|
||||
MainRule id:10000022 "s:$UWA:8" "str:${" "mz:$HEADERS_VAR:User-Agent" "msg:log4j attack detection";
|
||||
|
||||
# Python libraries like python-requests, python-urllib, etc..
|
||||
MainRule id:10000023 "s:$UWA:8" "str:python" "mz:$HEADERS_VAR:User-Agent" "msg:python in user-agent";
|
||||
|
||||
# Meterpreter
|
||||
MainRule id:10000024 "s:$UWA:8" "str:meterpreter" "mz:$HEADERS_VAR:User-Agent" "msg:meterpreter in user-agent";
|
||||
|
||||
# https://github.com/zmap/zgrab2
|
||||
MainRule id:10000025 "s:$UWA:8" "str:zgrab" "mz:$HEADERS_VAR:User-Agent" "msg:zgrab in user-agent";
|
||||
|
||||
# Known tools like nmap,curl,wget
|
||||
MainRule id:10000026 "s:$UWA:8" "str:nmap" "mz:$HEADERS_VAR:User-Agent" "msg:nmap in user-agent";
|
||||
MainRule id:10000027 "s:$UWA:8" "str:curl" "mz:$HEADERS_VAR:User-Agent" "msg:curl in user-agent";
|
||||
MainRule id:10000028 "s:$UWA:8" "str:wget" "mz:$HEADERS_VAR:User-Agent" "msg:wget in user-agent";
|
||||
MainRule id:10000029 "s:$UWA:8" "str:sqlmap" "mz:$HEADERS_VAR:User-Agent" "msg:slqmap in user-agent";
|
||||
|
||||
# Scan from Expense with this User-Agent:
|
||||
# Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers presences on the Internet.
|
||||
# If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com
|
||||
MainRule id:10000030 "s:$UWA:8" "str:paloaltonetworks.com" "mz:$HEADERS_VAR:User-Agent" "msg:paloaltonetworks in user-agent";
|
||||
MainRule id:10000031 "s:$UWA:8" "str:palo alto network" "mz:$HEADERS_VAR:User-Agent" "msg:palo alto network in user-agent";
|
||||
MainRule id:10000032 "s:$UWA:8" "str:Expense" "mz:$HEADERS_VAR:User-Agent" "msg:Expense in user-agent";
|
||||
|
||||
# Scan from NetSystemsResearch with this User-Agent:
|
||||
# NetSystemsResearch studies the availability of various services across the internet. Our website is netsystemsresearch.com
|
||||
MainRule id:10000033 "s:$UWA:8" "str:NetSystemsResearch" "mz:$HEADERS_VAR:User-Agent" "msg:NetSystemsResearch in user-agent";
|
||||
|
||||
# Golang default User-Agent
|
||||
MainRule id:10000034 "s:$UWA:8" "str:Go-http" "mz:$HEADERS_VAR:User-Agent" "msg:Golang in user-agent";
|
||||
|
||||
# Perl default User-Agent
|
||||
MainRule id:10000035 "s:$UWA:8" "str:libwww-perl" "mz:$HEADERS_VAR:User-Agent" "msg:libwww-perl in user-agent";
|
||||
|
||||
# l9tcpid in User-Agent
|
||||
MainRule id:10000036 "s:$UWA:8" "str:l9tcpid" "mz:$HEADERS_VAR:User-Agent" "msg:l9tcpid in user-agent";
|
||||
|
||||
# l9explore in User-Agent
|
||||
MainRule id:10000037 "s:$UWA:8" "str:l9explore" "mz:$HEADERS_VAR:User-Agent" "msg:l9explore in user-agent";
|
||||
|
||||
# WPScan in User-Agent
|
||||
MainRule id:10000038 "s:$UWA:8" "str:wpscan" "mz:$HEADERS_VAR:User-Agent" "msg:WPScan in user-agent";
|
||||
|
||||
# WinHttpReq in User-Agent
|
||||
MainRule id:10000039 "s:$UWA:8" "str:WinHttpReq" "mz:$HEADERS_VAR:User-Agent" "msg:WinHttpReq in user-agent";
|
||||
|
||||
# EgyScan security scanner uses AliElTop in some of the attacks
|
||||
MainRule id:10000040 "s:$UWA:8" "str:AliElTop" "mz:ANY" "msg:EgyScan security scanner";
|
||||
|
||||
# Guzzle PHP HTTP client
|
||||
MainRule id:10000041 "s:$UWA:8" "str:GuzzleHttp" "mz:$HEADERS_VAR:User-Agent" "msg:GuzzleHttp in user-agent";
|
||||
|
||||
# Java client
|
||||
MainRule id:10000042 "s:$UWA:8" "str:AsyncHttpClient" "mz:$HEADERS_VAR:User-Agent" "msg:AsyncHttpClient in user-agent";
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
#######################################
|
||||
## Webserver Security ids: 20000000 ##
|
||||
#######################################
|
||||
|
||||
# webserver critical files
|
||||
MainRule id:20000000 "s:$UWA:8" "str:.conf" "mz:URL" "msg:file access to .conf";
|
||||
MainRule id:20000001 "s:$UWA:8" "str:.ini" "mz:URL" "msg:file access to .ini";
|
||||
MainRule id:20000002 "s:$UWA:8" "str:.sql" "mz:URL" "msg:file access to .sql";
|
||||
MainRule id:20000003 "s:$UWA:8" "rx:\.txt$" "mz:URL" "msg:file access to .txt";
|
||||
MainRule id:20000004 "s:$UWA:8" "str:/sftp-config.json" "mz:URL|BODY" "msg:file access to sftp-config.json";
|
||||
MainRule id:20000005 "s:$UWA:8" "str:/.bzr" "mz:URL" "msg:bazaar version control folder access";
|
||||
MainRule id:20000006 "s:$UWA:8" "str:/.git" "mz:URL" "msg:git version control folder access";
|
||||
MainRule id:20000007 "s:$UWA:8" "str:/.hg" "mz:URL" "msg:mercurial version control folder access";
|
||||
MainRule id:20000008 "s:$UWA:8" "str:/.svn" "mz:URL" "msg:svn version control folder access";
|
||||
MainRule id:20000009 "s:$UWA:8" "str:/bzr/" "mz:URL" "msg:bazaar version control folder access";
|
||||
MainRule id:20000010 "s:$UWA:8" "str:/git/" "mz:URL" "msg:git version control folder access";
|
||||
MainRule id:20000011 "s:$UWA:8" "str:/hg/" "mz:URL" "msg:mercurial version control folder access";
|
||||
MainRule id:20000012 "s:$UWA:8" "str:/svn/" "mz:URL" "msg:svn version control folder access";
|
||||
MainRule id:20000013 "s:$UWA:8" "str:.htpasswd" "mz:ARGS|BODY|URL|FILE_EXT" "msg:file access to .htpasswd";
|
||||
MainRule id:20000014 "s:$UWA:8" "str:.htaccess" "mz:ARGS|BODY|URL|FILE_EXT" "msg:file access to .htaccess";
|
||||
MainRule id:20000015 "s:$UWA:8" "str:.ds_store" "mz:URL" "msg:file access to .ds_store";
|
||||
MainRule id:20000016 "s:$UWA:8" "str:changelog" "mz:URL" "msg:file access to changelog";
|
||||
MainRule id:20000017 "s:$UWA:8" "rx:^/core.\d+$" "mz:URL" "msg:file access to core dumps";
|
||||
MainRule id:20000018 "s:$UWA:8" "rx:\.module$" "mz:URL" "msg:file access to .module (drupal)";
|
||||
MainRule id:20000019 "s:$UWA:8" "str:web.config" "mz:URL" "msg:file access to web.config (drupal)";
|
||||
MainRule id:20000020 "s:$UWA:8" "rx:release[-_]notes\." "mz:URL" "msg:file access to release notes";
|
||||
MainRule id:20000021 "s:$UWA:8" "rx:~$" "mz:URL" "msg:file access to cache files";
|
||||
MainRule id:20000022 "s:$UWA:8" "str:web-inf" "mz:URL|BODY|ARGS" "msg:folder access to WEB-INF";
|
||||
|
||||
# Exposed Services
|
||||
MainRule id:20000023 "s:$UWA:8" "str:/cgi-bin/luci" "mz:URL" "msg:Exposed OpenWRT";
|
||||
MainRule id:20000024 "s:$UWA:8" "rx:^/cgi-bin/.+\.cgi$" "mz:URL" "msg:Exposed cgi-bin";
|
||||
MainRule id:20000025 "s:$UWA:8" "str:/jenkins" "mz:URL" "msg:Exposed Jenkins";
|
||||
MainRule id:20000026 "s:$UWA:8" "str:/console/login/LoginForm.jsp" "mz:URL" "msg:Exposed Oracle WebLogic Server Administration Console";
|
||||
MainRule id:20000027 "s:$UWA:8" "str:/nuxeo/login.jsp" "mz:URL" "msg:Exposed Nuxeo Enterprise Platform";
|
||||
MainRule id:20000028 "s:$UWA:8" "str:/zabbix/index.php" "mz:URL" "msg:Exposed Zabbix";
|
||||
|
||||
# Known hacking tools like burp suite, etc..
|
||||
MainRule id:20000029 "s:$UWA:8" "str:burpcollaborator.net" "mz:ARGS|BODY|HEADERS" "msg:burp collaborator";
|
||||
MainRule id:20000030 "s:$UWA:8" "str:/netsparker" "mz:URL" "msg:Netsparker";
|
||||
|
||||
# Malicious strings in request
|
||||
MainRule id:20000031 "s:$UWA:8" "str:\n\r" "mz:URL" "msg:HTTP - Smuggling-Attempt (NewLine in URI)";
|
||||
MainRule id:20000032 "s:$UWA:6" "rx:^[a-zA-Z\d-]+\.[a-zA-Z]+$" "mz:$HEADERS_VAR:Host" "msg:HOST-Header Injection";
|
||||
MainRule id:20000033 "s:$UWA:8" "str:/bin/sh" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/bin/sh in URI";
|
||||
MainRule id:20000034 "s:$UWA:8" "str:/etc/passwd" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/etc/passwd in URI";
|
||||
MainRule id:20000035 "s:$UWA:8" "str:/etc/shadow" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/etc/shadow in URI";
|
||||
MainRule id:20000036 "s:$UWA:8" "str:/etc/hosts" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/etc/hosts in URI";
|
||||
MainRule id:20000037 "s:$UWA:8" "str:/Windows/system.ini" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/Windows/system.ini in URI";
|
||||
MainRule id:20000038 "s:$UWA:8" "rx:<!DOCTYPE(\s+)(%*\s*)([{}:.a-zA-Z0-9_-]*)(\s+)SYSTEM" "mz:BODY" "msg: possible XML/XXE-Exploitation atempt (Doctype)";
|
||||
MainRule id:20000039 "s:$UWA:8" "str:http://http://" "mz:HEADERS" "msg:Abnormal double http:// in HTTP header";
|
||||
MainRule id:20000040 "s:$UWA:8" "str:https://http://" "mz:HEADERS" "msg:Abnormal double http:// in HTTP header";
|
||||
MainRule id:20000041 "s:$UWA:8" "str:http://https://" "mz:HEADERS" "msg:Abnormal double http:// in HTTP header";
|
||||
MainRule id:20000042 "s:$UWA:8" "str:https://https://" "mz:HEADERS" "msg:Abnormal double http:// in HTTP header";
|
||||
|
||||
# ThinkPHP Remote Code Execution CVE-2018-20062
|
||||
MainRule id:20000043 "s:$UWA:8" "str:index/\think\app/invokefunction" "mz:URL" "msg:CVE-2018-20062";
|
||||
|
||||
# AWS related files
|
||||
MainRule id:20000044 "s:$UWA:8" "str:/.aws/" "mz:URL" "msg:AWS Credential Stealer";
|
||||
|
||||
# dot folders and files
|
||||
MainRule id:20000045 "s:$UWA:8" "rx:/\.[^.]" "mz:URL" "msg:Access to dot folder or file";
|
||||
|
||||
# Exposed Microsoft Exchange
|
||||
MainRule id:20000046 "s:$UWA:8" "str:autodiscover/autodiscover.json" "mz:URL" "msg:Exposed Microsoft Exchange";
|
||||
MainRule id:20000047 "s:$UWA:8" "str:autodiscover/autodiscover.xml" "mz:URL" "msg:Exposed Microsoft Exchange";
|
||||
MainRule id:20000048 "s:$UWA:8" "str:/auth.owa" "mz:URL" "msg:Exposed Microsoft Exchange";
|
||||
|
||||
# Ignition 2.5.1 Remote Code Execution CVE-2021-3129
|
||||
MainRule id:20000049 "s:$UWA:8" "str:/_ignition/execute-solution" "mz:URL" "msg:CVE-2021-3129";
|
||||
|
||||
# CVE-2018-13379 path traversal vulnerability in Fortinet's FortiGate SSL VPN
|
||||
# https://x.x.x.x/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession
|
||||
MainRule id:20000050 "s:$UWA:8" "str:/sslvpn_websession" "mz:ARGS|BODY|HEADERS" "msg:CVE-2018-13379";
|
||||
|
||||
# Exposed Apache Tomcat Administration Panel
|
||||
MainRule id:20000051 "s:$UWA:8" "str:/manager/html" "mz:URL" "msg:Exposed Apache Tomcat Administration Panel";
|
||||
|
||||
# Block NMAP enumeration
|
||||
MainRule id:20000052 "s:$UWA:8" "str:/HNAP1" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000053 "s:$UWA:8" "rx:/default\.(asp|aspx|cfm|cgi|jsa|jsp|php|pl)$" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000054 "s:$UWA:8" "rx:/start\.(asp|aspx|cfm|cgi|jsa|jsp|php|pl)$" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000055 "s:$UWA:8" "rx:/localstart\.(asp|aspx|cfm|cgi|jsa|jsp|php|pl)$" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000056 "s:$UWA:8" "rx:/admin\.(asp|aspx|cfm|cgi|jsa|jsp|php|pl)$" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
MainRule id:20000057 "s:$UWA:8" "str:/nmaplowercheck" "mz:URL" "msg:NMAP enumeration attempt";
|
||||
|
||||
# Siemens PLC scan
|
||||
MainRule id:20000058 "s:$UWA:8" "str:/__Additional" "mz:URL" "msg:Siemens PLC scan";
|
||||
MainRule id:20000059 "s:$UWA:8" "str:/docs/cplugError.html/" "mz:URL" "msg:Siemens PLC scan";
|
||||
MainRule id:20000060 "s:$UWA:8" "str:/Portal/Portal.mwsl" "mz:URL" "msg:Siemens PLC scan";
|
||||
|
||||
# Block Citrix XenApp
|
||||
MainRule id:20000061 "s:$UWA:8" "str:/scripts/wpnbr.dll" "mz:URL" "msg:Citrix XenApp";
|
||||
|
||||
# Block jenkins authentication bypass CVE-2018-1000861
|
||||
MainRule id:20000062 "s:$UWA:8" "str:/securityRealm/user/admin/search/index" "mz:URL" "msg:CVE-2018-1000861";
|
||||
|
||||
# Block jenkins RCE CVE-2019-1003029, CVE-2019-1003030
|
||||
MainRule id:20000063 "s:$UWA:8" "str:/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript/" "mz:URL" "msg:CVE-2019-1003029, CVE-2019-1003030";
|
||||
|
||||
# Log4J bypass
|
||||
MainRule id:20000064 "s:$UWA:8" "str:${env:NaN:-" "mz:URL|ARGS|BODY|HEADERS" "msg:Attempted Log4J Bypass";
|
||||
|
||||
# Windows system paths
|
||||
MainRule id:20000065 "s:$UWA:8" "str:\Windows\system.ini" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:\Windows\system.ini in URI";
|
||||
MainRule id:20000066 "s:$UWA:8" "str:/Windows/win.ini" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:/Windows/win.ini in URI";
|
||||
MainRule id:20000067 "s:$UWA:8" "str:\Windows\win.ini" "mz:URL|BODY|ARGS|$HEADERS_VAR:User-Agent|$HEADERS_VAR:Cookie" "msg:\Windows\win.ini in URI";
|
||||
|
||||
# Exposed Apache Host Manager App
|
||||
MainRule id:20000068 "s:$UWA:8" "str:/manager/text/list" "mz:URL" "msg:Exposed Apache Host Manager App";
|
||||
|
||||
# Spring Cloud Gateway Code Injection Vulnerability
|
||||
MainRule id:20000069 "s:$UWA:8" "str:/actuator/gateway/routes" "mz:URL" "msg:CVE-2022-22947";
|
||||
|
||||
# Block Spring4Shell
|
||||
MainRule id:20000070 "s:$UWA:8" "str:class.module.classLoader.resources." "mz:RAW_BODY" "msg:CVE-2022-22965";
|
||||
MainRule id:20000071 "s:$UWA:8" "rx:<%|%>" "mz:HEADERS" "msg:CVE-2022-22965";
|
||||
|
||||
# Block Microsoft Exchange Server Remote Code Execution
|
||||
MainRule id:20000072 "s:$UWA:8" "str:/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application" "mz:URL" "msg:CVE-2021-28481";
|
||||
|
||||
# Prevents IndoXploit/IDX Shell dump access
|
||||
# A website that has been infected will have a world-browsable folder called `idx_config`
|
||||
# which contains text versions of the configuration file of every CMS installation the shell
|
||||
# is able to find (impacts WordPress, Joomla and Magento).
|
||||
MainRule id:20000073 "s:$UWA:8" "str:/idx_config" "mz:URL" "msg:Prevent IndoXploit/IDX Shell dump access";
|
||||
|
||||
# Prevents old grafana to return all folders
|
||||
# https://github.com/grafana/grafana/pull/44175
|
||||
MainRule id:20000074 "s:$UWA:8" "rx:^0$" "mz:$URL:/api/search|$ARGS_VAR:folderIds" "msg:Access all grafana folders";
|
||||
|
||||
# Block access to yaml files
|
||||
MainRule id:20000075 "s:$UWA:8" "str:.yml" "mz:URL" "msg:file access to .yml";
|
||||
MainRule id:20000076 "s:$UWA:8" "str:.yaml" "mz:URL" "msg:file access to .yaml";
|
||||
|
||||
# Block access to HashiCorp Consul/Vault template files
|
||||
MainRule id:20000077 "s:$UWA:8" "rx:\.ctmpl$" "mz:URL" "msg:file access to .ctmpl";
|
||||
MainRule id:20000078 "s:$UWA:8" "rx:\.hcl$" "mz:URL" "msg:file access to .hcl";
|
||||
|
||||
# Block access to known files used for fingerprinting
|
||||
MainRule id:20000079 "s:$UWA:8" "rx:\.md$" "mz:URL" "msg:file access to .md";
|
||||
MainRule id:20000080 "s:$UWA:8" "rx:read[-_]?me" "mz:URL" "msg:file access to readme";
|
||||
MainRule id:20000081 "s:$UWA:8" "rx:\.toml$" "mz:URL" "msg:file access to .toml";
|
||||
|
||||
# AWS related files
|
||||
MainRule id:20000082 "s:$UWA:8" "str:dockerrun.aws.json" "mz:URL" "msg:Exposed AWS Elastic Beanstalk configuration";
|
||||
|
||||
# Block access to temporary backup files like .bak,.bak.php, etc...
|
||||
MainRule id:20000083 "s:$UWA:8" "str:.bak" "mz:URL" "msg:file access to temporary backup files";
|
||||
|
||||
# Path traversal in nuxt/framework when in dev mode
|
||||
# https://huntr.dev/bounties/4849af83-450c-435e-bc0b-71705f5be440/
|
||||
MainRule id:20000084 "s:$UWA:8" "str:_nuxt/@" "mz:URL" "msg:path traversal in nuxt framework";
|
||||
|
||||
# AWS NodeJS related files
|
||||
MainRule id:20000085 "s:$UWA:8" "str:awsconfig" "mz:URL" "msg:Exposed AWS config files";
|
||||
MainRule id:20000086 "s:$UWA:8" "str:aws-config" "mz:URL" "msg:Exposed AWS config files";
|
||||
MainRule id:20000087 "s:$UWA:8" "str:awscred" "mz:URL" "msg:Exposed AWS config files";
|
||||
MainRule id:20000088 "s:$UWA:8" "str:aws-cred" "mz:URL" "msg:Exposed AWS config files";
|
||||
|
||||
# Text editors temp and config files
|
||||
MainRule id:20000089 "s:$UWA:8" "str:.old" "mz:URL" "msg:Exposed temp copy";
|
||||
MainRule id:20000090 "s:$UWA:8" "str:.save" "mz:URL" "msg:Exposed temp copy";
|
||||
MainRule id:20000091 "s:$UWA:8" "str:.DS_Store" "mz:URL" "msg:Exposed temp copy";
|
||||
MainRule id:20000092 "s:$UWA:8" "str:vscode" "mz:URL" "msg:Exposed vscode directory";
|
||||
|
||||
# Exposed .env
|
||||
MainRule id:20000093 "s:$UWA:8" "str:/.env" "mz:URL" "msg:access to .env file or dir";
|
||||
|
||||
# androxgh0st exploit
|
||||
MainRule id:20000094 "s:$UWA:8" "str:androxgh0st" "mz:ANY" "msg:androxgh0st exploit";
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
#######################################
|
||||
## Wordpress ids: 30000000 ##
|
||||
#######################################
|
||||
|
||||
MainRule id:30000000 "s:$UWA:8" "str:system.multicall" "mz:$URL:/xmlrpc.php|BODY" "msg:Wordpress XMLRPC possible Password Brute Force";
|
||||
MainRule id:30000001 "s:$UWA:8" "str:system.listmethods" "mz:$URL:/xmlrpc.php|BODY" "msg:WordPress XMLRPC Enumeration system.listMethods";
|
||||
MainRule id:30000002 "s:$UWA:8" "str:system.getcapabilities" "mz:$URL:/xmlrpc.php|BODY" "msg:WordPress XMLRPC Enumeration system.getCapabilities";
|
||||
MainRule id:30000003 "s:$UWA:8" "str:/w3tc/dbcache" "mz:URL" "msg:WordPress TotalCache-DBCache-Access";
|
||||
MainRule id:30000004 "s:$UWA:8" "str:/uploadify/uploadify.php" "mz:URL" "msg:WordPress Uploadify-Access";
|
||||
MainRule id:30000005 "s:$UWA:8" "str:/wp-content/plugins/mm-forms-community/upload/temp/" "mz:URL" "msg:Access To mm-forms-community upload dir";
|
||||
MainRule id:30000006 "s:$UWA:8" "str:wp-config.php" "mz:BODY|ARGS|URL" "msg:WordPress access to wp-config.php";
|
||||
|
||||
# block malicious access ALFA_DATA|alfacgiapi|cgialfa path
|
||||
MainRule id:30000007 "s:$UWA:8" "str:ALFA_DATA" "mz:URL" "msg:WordPress malicious access to ALFA_DATA path";
|
||||
MainRule id:30000008 "s:$UWA:8" "str:alfacgiapi" "mz:URL" "msg:WordPress malicious access to alfacgiapi path";
|
||||
MainRule id:30000009 "s:$UWA:8" "str:cgialfa" "mz:URL" "msg:WordPress malicious access to cgialfa path";
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
#######################################
|
||||
## PHP Security ids: 40000000 ##
|
||||
#######################################
|
||||
|
||||
# Php Functions
|
||||
MainRule id:40000000 "s:$UWA:8" "str:gzinflate(" "mz:URL|BODY|ARGS" "msg:gzinflate in URI";
|
||||
MainRule id:40000001 "s:$UWA:8" "str:system(" "mz:URL|BODY|ARGS" "msg:php system called";
|
||||
MainRule id:40000002 "s:$UWA:8" "str:base64_decode(" "mz:URL|BODY|ARGS" "msg:php base64_decode called";
|
||||
MainRule id:40000003 "s:$UWA:8" "str:@eval" "mz:URL|BODY|ARGS" "msg:php eval called";
|
||||
MainRule id:40000004 "s:$UWA:8" "rx:eval\((\s+)?\$_" "mz:URL|BODY|ARGS" "msg:php eval called";
|
||||
|
||||
# PhpMyAdmin
|
||||
MainRule id:40000005 "s:$UWA:8" "str:/db-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000006 "s:$UWA:8" "str:/dbadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000007 "s:$UWA:8" "str:/myadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000008 "s:$UWA:8" "str:/mysqldumper " "mz:URL" "msg:MysqlDumper";
|
||||
MainRule id:40000009 "s:$UWA:8" "str:/mysqlmanager" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000010 "s:$UWA:8" "str:/p/m/a/" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000011 "s:$UWA:8" "str:/php-my-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000012 "s:$UWA:8" "str:/php-myadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000013 "s:$UWA:8" "str:/phpmanager" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000014 "s:$UWA:8" "str:/phpmy" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000015 "s:$UWA:8" "str:/phpmy-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000016 "s:$UWA:8" "str:/phpmyadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000017 "s:$UWA:8" "str:/phppgadmin " "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000018 "s:$UWA:8" "str:/pma" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000019 "s:$UWA:8" "str:/sql-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000020 "s:$UWA:8" "str:/sqladmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000021 "s:$UWA:8" "str:/sqlweb" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000022 "s:$UWA:8" "str:/sysadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000023 "s:$UWA:8" "str:/webadmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000024 "s:$UWA:8" "str:/webdb" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000025 "s:$UWA:8" "str:/websql" "mz:URL" "msg:SQL Admin Interface";
|
||||
|
||||
# Block PHPUnit eval-stdin.php CVE-2017-9841
|
||||
MainRule id:40000026 "s:$UWA:8" "str:eval-stdin.php" "mz:URL" "msg:CVE-2017-9841";
|
||||
|
||||
# Block PHP easter egg which normally can be disabled via expose_php = off
|
||||
MainRule id:40000027 "s:$UWA:8" "rx:PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" "mz:URL|BODY|ARGS" "msg:PHP easter egg credits";
|
||||
|
||||
# Block PHP Xdebug
|
||||
MainRule id:40000028 "s:$UWA:8" "str:XDEBUG_SESSION" "mz:ANY" "msg:Block PHP Xdebug";
|
||||
|
||||
# Block PHPinfo access
|
||||
MainRule id:40000029 "s:$UWA:8" "str:phpinfo" "mz:URL|BODY|ARGS" "msg:PHPinfo access";
|
||||
|
||||
# Block known php installer exploit
|
||||
MainRule id:40000030 "s:$UWA:8" "str:install.php" "mz:URL" "msg:Access to php install";
|
||||
|
||||
# Block more sql admin interface
|
||||
MainRule id:40000031 "s:$UWA:8" "str:/mysql-admin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000032 "s:$UWA:8" "str:/mysqladmin" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000033 "s:$UWA:8" "str:/sqlmanager" "mz:URL" "msg:SQL Admin Interface";
|
||||
MainRule id:40000034 "s:$UWA:8" "str:/mysql/" "mz:URL" "msg:SQL Admin Interface";
|
||||
|
||||
# Block access to Lavarel telescope since it allows to read logs and SQL queries
|
||||
MainRule id:40000035 "s:$UWA:8" "str:/telescope/" "mz:URL" "msg:Access to Lavarel telescope";
|
||||
|
||||
# Block access to adminer/phpMinAdmin sql admin interface
|
||||
MainRule id:40000036 "s:$UWA:8" "str:adminer" "mz:URL" "msg:SQL Admin Interface";
|
||||
|
||||
# Block access to Symfony Web Framework dev mode.
|
||||
MainRule id:40000037 "s:$UWA:8" "str:app_dev" "mz:URL" "msg:Symfony Web Framework dev mode";
|
||||
|
||||
# phpstorm in request
|
||||
MainRule id:40000038 "s:$UWA:8" "str:phpstorm" "mz:URL|ARGS|HEADERS" "msg:phpstorm in request";
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
#######################################
|
||||
## SQL Injection ids: 50000000 ##
|
||||
#######################################
|
||||
|
||||
# Transact-SQL General Extended Stored Procedures
|
||||
# https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/general-extended-stored-procedures-transact-sql
|
||||
MainRule id:50000000 "s:$SQL:8" "rx:xp_(cmdshell|enumgroups|grantlogin|logevent|loginconfig|logininfo|msver|revokelogin|sprintf|sqlmaint|sscanf)" "mz:BODY|HEADERS|ARGS|URL" "msg:Transact-SQL GESP";
|
||||
|
||||
# Classic SQL injection
|
||||
MainRule id:50000001 "s:$SQL:8" "rx:(CHAR|CONCAT|CONCAT_WS)\([0-9a-fx,]+\)" "mz:BODY|HEADERS|ARGS|URL" "msg:SQL Injection";
|
||||
MainRule id:50000002 "s:$SQL:8" "rx:SLEEP(\s+)?\(" "mz:BODY|HEADERS|ARGS|URL" "msg:SQL Injection";
|
||||
MainRule id:50000003 "s:$SQL:8" "rx:\bBENCHMARK\b\([0-9,]+.+\)" "mz:BODY|HEADERS|ARGS|URL" "msg:SQL Injection";
|
||||
MainRule id:50000004 "s:$SQL:8" "rx:\b(UNION|INFORMATION_SCHEMA)\b.*(#|--|\*)" "mz:BODY|HEADERS|ARGS|URL" "msg:SQL Injection";
|
||||
MainRule id:50000005 "s:$SQL:8" "rx:(MD\d|SHA\d+)(\s+)?\(" "mz:BODY|HEADERS|ARGS|URL" "msg:SQL Injection";
|
||||
MainRule id:50000006 "s:$SQL:8" "rx:DBMS_PIPE|RECEIVE_MESSAGE|WAITFOR|DELAY" "mz:BODY|HEADERS|ARGS|URL" "msg:SQL Injection";
|
||||
95
containers/conf/angie/naxsi_rules/naxsi_core.rules
Normal file
95
containers/conf/angie/naxsi_rules/naxsi_core.rules
Normal file
|
|
@ -0,0 +1,95 @@
|
|||
##################################
|
||||
## INTERNAL RULES IDS:1-999 ##
|
||||
##################################
|
||||
#@MainRule "msg:weird request, unable to parse" id:1;
|
||||
#@MainRule "msg:request too big, stored on disk and not parsed" id:2;
|
||||
#@MainRule "msg:invalid hex encoding, null bytes" id:10;
|
||||
#@MainRule "msg:unknown content-type" id:11;
|
||||
#@MainRule "msg:invalid formatted url" id:12;
|
||||
#@MainRule "msg:invalid POST format" id:13;
|
||||
#@MainRule "msg:invalid POST boundary" id:14;
|
||||
#@MainRule "msg:invalid JSON" id:15;
|
||||
#@MainRule "msg:empty POST" id:16;
|
||||
#@MainRule "msg:libinjection_sql" id:17;
|
||||
#@MainRule "msg:libinjection_xss" id:18;
|
||||
#@MainRule "msg:no generic rules" id:19;
|
||||
#@MainRule "msg:bad utf8" id:20;
|
||||
#@MainRule "msg:illegal host header" id:21;
|
||||
|
||||
##################################
|
||||
## SQL Injections IDs:1000-1099 ##
|
||||
##################################
|
||||
MainRule "rx:select|union|update|delete|insert|table|from|ascii|hex|unhex|drop|load_file|substr|group_concat|dumpfile|bigint" "msg:sql keywords" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1000;
|
||||
MainRule "str:\"" "msg:double quote" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8,$XSS:8" id:1001;
|
||||
MainRule "str:0x" "msg:0x, possible hex encoding" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:2" id:1002;
|
||||
## Hardcore rules
|
||||
MainRule "str:/*" "msg:mysql comment (/*)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1003;
|
||||
MainRule "str:*/" "msg:mysql comment (*/)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1004;
|
||||
MainRule "str:|" "msg:mysql keyword (|)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1005;
|
||||
MainRule "str:&&" "msg:mysql keyword (&&)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1006;
|
||||
## end of hardcore rules
|
||||
MainRule "str:--" "msg:mysql comment (--)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1007;
|
||||
MainRule "str:;" "msg:semicolon" "mz:BODY|URL|ARGS" "s:$SQL:4,$XSS:8" id:1008;
|
||||
MainRule "str:=" "msg:equal sign in var, probable sql/xss" "mz:ARGS|BODY" "s:$SQL:2" id:1009;
|
||||
MainRule "str:(" "msg:open parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1010;
|
||||
MainRule "str:)" "msg:close parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1011;
|
||||
MainRule "str:'" "msg:simple quote" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1013;
|
||||
MainRule "str:," "msg:comma" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
|
||||
MainRule "str:#" "msg:mysql comment (#)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1016;
|
||||
MainRule "str:@@" "msg:double arobase (@@)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1017;
|
||||
MainRule "rx:::json|to_json|jsonb?_build|jsonb?_object|jsonb?_each|jsonb?_extract|jsonb?_typeof|jsonb?_array|jsonb_set|json_query|json_keys" "msg:json functions and operators" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1018;
|
||||
|
||||
###############################
|
||||
## OBVIOUS RFI IDs:1100-1199 ##
|
||||
###############################
|
||||
MainRule "str:http://" "msg:http:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1100;
|
||||
MainRule "str:https://" "msg:https:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1101;
|
||||
MainRule "str:ftp://" "msg:ftp:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1102;
|
||||
MainRule "str:php://" "msg:php:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1103;
|
||||
MainRule "str:sftp://" "msg:sftp:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1104;
|
||||
MainRule "str:zlib://" "msg:zlib:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1105;
|
||||
MainRule "str:data://" "msg:data:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1106;
|
||||
MainRule "str:glob://" "msg:glob:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1107;
|
||||
MainRule "str:phar://" "msg:phar:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1108;
|
||||
MainRule "str:file://" "msg:file:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1109;
|
||||
MainRule "str:gopher://" "msg:gopher:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1110;
|
||||
MainRule "str:zip://" "msg:zip:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1111;
|
||||
MainRule "str:expect://" "msg:expect:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1112;
|
||||
MainRule "str:input://" "msg:input:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1113;
|
||||
|
||||
#######################################
|
||||
## Directory traversal IDs:1200-1299 ##
|
||||
#######################################
|
||||
MainRule "str:.." "msg:double dot" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1200;
|
||||
MainRule "str:/etc/passwd" "msg:obvious probe" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1202;
|
||||
MainRule "str:c:\\" "msg:obvious windows path" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1203;
|
||||
MainRule "str:cmd.exe" "msg:obvious probe" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1204;
|
||||
MainRule "str:\\" "msg:backslash" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1205;
|
||||
#MainRule "str:/" "msg:slash in args" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:2" id:1206;
|
||||
MainRule "str:/..;/" "msg:dir traversal bypass" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:2" id:1207;
|
||||
MainRule "str:/.;/" "msg:dir traversal bypass" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1208;
|
||||
MainRule "str:/.%2e/" "msg:dir traversal bypass" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1209;
|
||||
MainRule "str:/%2e./" "msg:dir traversal bypass" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1210;
|
||||
|
||||
########################################
|
||||
## Cross Site Scripting IDs:1300-1399 ##
|
||||
########################################
|
||||
MainRule "str:<" "msg:html open tag" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1302;
|
||||
MainRule "str:>" "msg:html close tag" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1303;
|
||||
MainRule "str:[" "msg:open square backet ([), possible js" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1310;
|
||||
MainRule "str:]" "msg:close square bracket (]), possible js" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1311;
|
||||
MainRule "str:~" "msg:tilde (~) character" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1312;
|
||||
MainRule "str:`" "msg:grave accent (`)" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1314;
|
||||
MainRule "rx:%[23]." "msg:double encoding" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1315;
|
||||
|
||||
####################################
|
||||
## Evading tricks IDs: 1400-1500 ##
|
||||
####################################
|
||||
MainRule "str:&#" "msg:utf7/8 encoding" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1400;
|
||||
MainRule "str:%U" "msg:M$ encoding" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1401;
|
||||
|
||||
#############################
|
||||
## File uploads: 1500-1600 ##
|
||||
#############################
|
||||
MainRule "rx:\.ph|\.asp|\.ht|\.jsp" "msg:asp/php/jsp/htaccess file upload" "mz:FILE_EXT" "s:$UPLOAD:8" id:1500;
|
||||
MainRule "rx:^[\.a-z0-9_\- ]+$" negative "msg:uploaded filename contains non-printable ascii chars" "mz:FILE_EXT" "s:$UPLOAD:8" id:1501;
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
# DokuWiki rules
|
||||
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:usergroups";
|
||||
BasicRule wl:0 "mz:$BODY_VAR:wikitext";
|
||||
BasicRule wl:0 "mz:$BODY_VAR:summary";
|
||||
BasicRule wl:0 "mz:$BODY_VAR:prefix";
|
||||
BasicRule wl:0 "mz:$BODY_VAR:suffix";
|
||||
61
containers/conf/angie/naxsi_rules/whitelists/drupal.rules
Normal file
61
containers/conf/angie/naxsi_rules/whitelists/drupal.rules
Normal file
|
|
@ -0,0 +1,61 @@
|
|||
####################################
|
||||
## Drupal whitelists ALPHA ##
|
||||
####################################
|
||||
|
||||
# some url patterns
|
||||
BasicRule wl:1000 "mz:$URL:/modules/update/update.css|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/misc/tableselect.js|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/modules/contextual/images/gear-select.png|URL|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1000 "mz:$URL:/misc/ui/jquery.ui.sortable.min.js|URL|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1000 "mz:$URL:/misc/tableheader.js|URL|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1000 "mz:$URL:/misc/tabledrag.js|URL|$HEADERS_VAR:cookie";
|
||||
|
||||
# bad keywords in posts etc (update etc)
|
||||
BasicRule wl:1000 "mz:$URL:/|$BODY_VAR:comment_confirm_delete|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/|$ARGS_VAR:q";
|
||||
BasicRule wl:1000 "mz:$URL:/|$BODY_VAR:form_id";
|
||||
BasicRule wl:1000 "mz:$URL:/|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1010 "mz:$URL:/|$ARGS_VAR:date";
|
||||
|
||||
# XSS because of [ and ] in POST variables
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^body|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^menu|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^path|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^comment_body|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^field_|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^type|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^modules|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^blocks|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^palette|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^regions|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^roles|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^fields|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$ARGS_VAR_X:^destination|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^filter|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^search_active_modules|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^shortcuts|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^formats|NAME";
|
||||
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR:status";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR:role";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR:permission";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR:type";
|
||||
|
||||
# update module
|
||||
BasicRule wl:16 "mz:$URL:/|BODY";
|
||||
|
||||
# user mail
|
||||
BasicRule wl:1007,1010,1011,1013,1015,1310,1311 "mz:$URL:/|$BODY_VAR_X:^user_mail";
|
||||
|
||||
# other stuff
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:form_build_id";
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:menu[parent]";
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:form_token";
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:additional_settings__active_tab";
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:date";
|
||||
|
||||
BasicRule wl:1302,1303 "mz:$URL:/|$BODY_VAR_X:^filters";
|
||||
BasicRule wl:1010,1011 "mz:$URL:/|$BODY_VAR:actions_label";
|
||||
BasicRule wl:1015 "mz:$URL:/|$BODY_VAR:date_format_long";
|
||||
BasicRule wl:1009,1016 "mz:$URL:/|$ARGS_VAR:destination";
|
||||
BasicRule wl:1016 "mz:$URL:/|$BODY_VAR_X:^palette";
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
# Etherpad: Really real-time collaborative document editing http://etherpad.org
|
||||
BasicRule wl:1001,1008,1010,1011,1013,1015,1101 "mz:$URL:/jserror|$BODY_VAR:errorinfo";
|
||||
BasicRule wl:2 "mz:$URL_X:^/p/.*/import$|BODY";
|
||||
BasicRule wl:1311 "mz:$URL_X:^/p/.*]$|URL";
|
||||
BasicRule wl:1007 "mz:URL";
|
||||
BasicRule wl:1315 "mz:$HEADERS_VAR:cookie";
|
||||
BasicRule wl:11 "mz:$URL:/socket.io/|BODY";
|
||||
10
containers/conf/angie/naxsi_rules/whitelists/iris.rules
Normal file
10
containers/conf/angie/naxsi_rules/whitelists/iris.rules
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
# Web IRC client Iris for the atheme platform https://github.com/atheme-legacy/iris
|
||||
### Allowed chars in the URI of WebChat Wizard "custom link" or "embed"
|
||||
BasicRule wl:1000,1315 "mz:$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:channels";
|
||||
BasicRule wl:1000,1002,1005,1007,1013,1200,1205,1310,1311,1314 "mz:$ARGS_VAR:nick";
|
||||
BasicRule wl:1000,1005,1008,1013,1015,1200,1205 "mz:$URL:/|ARGS";
|
||||
### Allowed chars in Chat and Private
|
||||
BasicRule wl:0 "mz:$URL:/e/p|$BODY_VAR:c";
|
||||
### Allowed chars in nick same as are allowed in IRCD
|
||||
BasicRule wl:1000,1002,1005,1007,1205,1310,1311,1314 "mz:$URL:/e/n|$BODY_VAR:nick";
|
||||
10
containers/conf/angie/naxsi_rules/whitelists/rutorrent.rules
Normal file
10
containers/conf/angie/naxsi_rules/whitelists/rutorrent.rules
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
BasicRule wl:1005,1010,1011,1315 "mz:$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1402 "mz:$HEADERS_VAR:content-type";
|
||||
BasicRule wl:11 "mz:$URL:/rutorrent/php/setsettings.php|BODY";
|
||||
BasicRule wl:11 "mz:$URL:/rutorrent/php/getsettings.php|BODY";
|
||||
BasicRule wl:1000,1001,1015,1310,1311 "mz:$BODY_VAR:v";
|
||||
BasicRule wl:1005,1008 "mz:$BODY_VAR:cookie";
|
||||
BasicRule wl:1000,1100,1101,1315 "mz:$BODY_VAR:url";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/rutorrent/php/addtorrent.php|$ARGS_VAR:result[]|NAME";
|
||||
BasicRule wl:1000,1100,1101 "mz:$ARGS_VAR:name[]";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/rutorrent/php/addtorrent.php|$ARGS_VAR:name[]|NAME";
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
# DokuWiki rules
|
||||
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:usergroups";
|
||||
BasicRule wl:0 "mz:$BODY_VAR:wikitext";
|
||||
BasicRule wl:0 "mz:$BODY_VAR:summary";
|
||||
BasicRule wl:0 "mz:$BODY_VAR:prefix";
|
||||
BasicRule wl:0 "mz:$BODY_VAR:suffix";
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
####################################
|
||||
## Drupal whitelists ALPHA ##
|
||||
####################################
|
||||
|
||||
# some url patterns
|
||||
BasicRule wl:1000 "mz:$URL:/modules/update/update.css|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/misc/tableselect.js|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/modules/contextual/images/gear-select.png|URL|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1000 "mz:$URL:/misc/ui/jquery.ui.sortable.min.js|URL|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1000 "mz:$URL:/misc/tableheader.js|URL|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1000 "mz:$URL:/misc/tabledrag.js|URL|$HEADERS_VAR:cookie";
|
||||
|
||||
# bad keywords in posts etc (update etc)
|
||||
BasicRule wl:1000 "mz:$URL:/|$BODY_VAR:comment_confirm_delete|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/|$ARGS_VAR:q";
|
||||
BasicRule wl:1000 "mz:$URL:/|$BODY_VAR:form_id";
|
||||
BasicRule wl:1000 "mz:$URL:/|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1010 "mz:$URL:/|$ARGS_VAR:date";
|
||||
|
||||
# XSS because of [ and ] in POST variables
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^body|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^menu|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^path|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^comment_body|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^field_|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^type|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^modules|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^blocks|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^palette|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^regions|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^roles|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^fields|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$ARGS_VAR_X:^destination|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^filter|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^search_active_modules|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^shortcuts|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR_X:^formats|NAME";
|
||||
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR:status";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR:role";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR:permission";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/|$BODY_VAR:type";
|
||||
|
||||
# update module
|
||||
BasicRule wl:16 "mz:$URL:/|BODY";
|
||||
|
||||
# user mail
|
||||
BasicRule wl:1007,1010,1011,1013,1015,1310,1311 "mz:$URL:/|$BODY_VAR_X:^user_mail";
|
||||
|
||||
# other stuff
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:form_build_id";
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:menu[parent]";
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:form_token";
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:additional_settings__active_tab";
|
||||
BasicRule wl:1007 "mz:$URL:/|$BODY_VAR:date";
|
||||
|
||||
BasicRule wl:1302,1303 "mz:$URL:/|$BODY_VAR_X:^filters";
|
||||
BasicRule wl:1010,1011 "mz:$URL:/|$BODY_VAR:actions_label";
|
||||
BasicRule wl:1015 "mz:$URL:/|$BODY_VAR:date_format_long";
|
||||
BasicRule wl:1009,1016 "mz:$URL:/|$ARGS_VAR:destination";
|
||||
BasicRule wl:1016 "mz:$URL:/|$BODY_VAR_X:^palette";
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
# Etherpad: Really real-time collaborative document editing http://etherpad.org
|
||||
BasicRule wl:1001,1008,1010,1011,1013,1015,1101 "mz:$URL:/jserror|$BODY_VAR:errorinfo";
|
||||
BasicRule wl:2 "mz:$URL_X:^/p/.*/import$|BODY";
|
||||
BasicRule wl:1311 "mz:$URL_X:^/p/.*]$|URL";
|
||||
BasicRule wl:1007 "mz:URL";
|
||||
BasicRule wl:1315 "mz:$HEADERS_VAR:cookie";
|
||||
BasicRule wl:11 "mz:$URL:/socket.io/|BODY";
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
# whitelist robots.txt
|
||||
BasicRule wl:20000003 "mz:$URL:/robots.txt|URL";
|
||||
|
||||
# whitelist /.well-known/security.txt
|
||||
BasicRule wl:20000003,20000045 "mz:$URL:/.well-known/security.txt|URL";
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
# Web IRC client Iris for the atheme platform https://github.com/atheme-legacy/iris
|
||||
### Allowed chars in the URI of WebChat Wizard "custom link" or "embed"
|
||||
BasicRule wl:1000,1315 "mz:$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:channels";
|
||||
BasicRule wl:1000,1002,1005,1007,1013,1200,1205,1310,1311,1314 "mz:$ARGS_VAR:nick";
|
||||
BasicRule wl:1000,1005,1008,1013,1015,1200,1205 "mz:$URL:/|ARGS";
|
||||
### Allowed chars in Chat and Private
|
||||
BasicRule wl:0 "mz:$URL:/e/p|$BODY_VAR:c";
|
||||
### Allowed chars in nick same as are allowed in IRCD
|
||||
BasicRule wl:1000,1002,1005,1007,1205,1310,1311,1314 "mz:$URL:/e/n|$BODY_VAR:nick";
|
||||
|
|
@ -0,0 +1,124 @@
|
|||
# Jellyfin rules
|
||||
|
||||
# global
|
||||
BasicRule wl:2,11 "mz:BODY";
|
||||
BasicRule wl:17 "mz:$HEADERS_VAR:accept";
|
||||
BasicRule wl:1000 "mz:URL";
|
||||
BasicRule wl:1000,1002 "mz:$HEADERS_VAR:cookie";
|
||||
|
||||
# /Users.*
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR_X:^Fields$|$URL_X:^/Users.*$";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR_X:^EnableImageTypes$|$URL_X:^/Users.*$";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR_X:^RememberAudioSelections$|NAME|$URL_X:^/Users/[0-9a-f-]*.*$";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR_X:^RememberSubtitleSelections$|NAME|$URL_X:^/Users/[0-9a-f-]*.*$";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR_X:^SortBy$|$URL_X:^/Users.*$";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR_X:^Ids$|$URL_X:^/Users.*$";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR_X:^MediaTypes$|$URL_X:^/Users.*$";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR_X:^SortOrder$|$URL_X:^/Users/[0-9a-f-]*/Items$";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR_X:^IncludeItemTypes$|$URL_X:^/Users/[0-9a-f-]*/Items$";
|
||||
|
||||
# /Users/authenticatebyname
|
||||
BasicRule wl:1010,1011,1012,1302 "mz:$BODY_VAR:Pw|$URL:/Users/authenticatebyname";
|
||||
|
||||
# /UserItems/Resume
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:fields|$URL:/UserItems/Resume";
|
||||
|
||||
# /Shows.*
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR_X:^Fields$|$URL_X:^/Shows/[0-9a-f-]*/Seasons$";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR_X:^Fields$|$URL_X:^/Shows/[0-9a-f-]*/Episodes$";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR_X:^EnableImageTypes$|$URL_X:^/Shows/NextUp.*$";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR_X:^Fields$|$URL_X:^/Shows/NextUp.*$";
|
||||
BasicRule wl:1000 "mz:$ARGS_VAR_X:^NextUpDateCutoff$|$URL_X:^/Shows/NextUp.*$";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:StartIndex|$URL:/Shows/NextUp?";
|
||||
|
||||
# /DisplayPreferences
|
||||
BasicRule wl:15,1000,1001,1015,1101,1205 "mz:BODY|$URL:/DisplayPreferences/usersettings";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR_X:^chromecastVersion$|$URL_X:^/DisplayPreferences/[0-9a-f-]*$";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR_X:^ShowBackdrop$|NAME|$URL_X:^/DisplayPreferences/[0-9a-f-]*$";
|
||||
BasicRule wl:1101 "mz:BODY|NAME|$URL:/DisplayPreferences/usersettings";
|
||||
|
||||
# /Items.*
|
||||
BasicRule wl:17 "mz:$HEADERS_VAR_X:^accept$|$URL_X:^/Items/[0-9a-f-]*/.*$";
|
||||
BasicRule wl:1000 "mz:URL|$URL_X:^/Items/[0-9a-f-]*/.*$";
|
||||
BasicRule wl:1000 "mz:$ARGS_VAR_X:^inheritFromParent$|NAME|$URL_X:^/Items/[0-9a-f-]*/ThemeMedia$";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR_X:^Fields$|$URL_X:^/Items.*$";
|
||||
BasicRule wl:1005 "mz:$BODY_VAR_X:^Value$|$URL_X:^/Items/[0-9a-f-]*/PlaybackInfo$";
|
||||
BasicRule wl:1013,1100 "mz:$ARGS_VAR:searchTerm|$URL:/Items";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR_X:^VideoCodec$|$URL_X:^/Items/[0-9a-f-]*/PlaybackInfo$";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR_X:^AudioCodec$|$URL_X:^/Items/[0-9a-f-]*/PlaybackInfo$";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR_X:^Container$|$URL_X:^/Items/[0-9a-f-]*/PlaybackInfo$";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:ExcludeLocationTypes|$URL:/Items?";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:Fields|$URL:/Items?";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:Filters|$URL:/Items?";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:ImageTypes|$URL:/Items?";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:IncludeItemTypes|$URL:/Items?";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:Recursive|$URL:/Items?";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:SortBy|$URL:/Items?";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:SortOrder|$URL:/Items?";
|
||||
|
||||
# /Shows/Upcoming
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:EnableImageTypes|$URL:/Shows/Upcoming";
|
||||
|
||||
# /Movies/Recommendations
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:Fields|$URL:/Movies/Recommendations";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:EnableImageTypes|$URL:/Movies/Recommendations";
|
||||
|
||||
# /System/Configuration
|
||||
BasicRule wl:1013,1015 "mz:$BODY_VAR:SortRemoveCharacters|$URL:/System/Configuration";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:LibraryUpdateDuration|$URL:/System/Configuration";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:Name|$URL:/System/Configuration";
|
||||
BasicRule wl:1101 "mz:$BODY_VAR:Url|$URL:/System/Configuration";
|
||||
BasicRule wl:50000006 "mz:$BODY_VAR:LibraryMonitorDelay|$URL:/System/Configuration";
|
||||
BasicRule wl:50000006 "mz:$BODY_VAR:ThrottleDelaySeconds|NAME|$URL:/System/Configuration/encoding";
|
||||
|
||||
# /System/Configuration/branding
|
||||
BasicRule wl:1000,1001,1002,1003,1004,1008,1009,1010,1011,1015,1016,1205 "mz:$BODY_VAR:CustomCss|$URL:/System/Configuration/branding";
|
||||
BasicRule wl:1302 "mz:$BODY_VAR:LoginDisclaimer|$URL:/System/Configuration/branding";
|
||||
|
||||
# /Sessions
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:EventName|$URL:/Sessions/Playing/Progress";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:SupportedCommands|$URL:/Sessions/Capabilities";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:SupportedCommands|$URL:/Sessions/Capabilities/Full";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:AudioCodec|$URL:/Sessions/Capabilities/Full";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:VideoCodec|$URL:/Sessions/Capabilities/Full";
|
||||
BasicRule wl:1200 "mz:$HEADERS_VAR:cookie|$URL:/Sessions/Logout";
|
||||
|
||||
# Branding
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:Splashscreen|$URL:/Branding/Splashscreen";
|
||||
|
||||
# /Library
|
||||
BasicRule wl:1005,1008,1205 "mz:$BODY_VAR:CustomTagDelimiters|$URL:/Library/VirtualFolders/LibraryOptions";
|
||||
|
||||
# /Playlists
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR_X:^EnableImageTypes$|$URL_X:^/Playlists/[0-9a-f-]*/Items$";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR_X:^Fields$|$URL_X:^/Playlists/[0-9a-f-]*/Items$";
|
||||
|
||||
# /SyncPlay
|
||||
BasicRule wl:1013 "mz:$BODY_VAR:GroupName|$URL:/SyncPlay/New";
|
||||
|
||||
# /Videos.*
|
||||
BasicRule wl:12 "mz:ARGS|$URL_X:^/videos/.*$";
|
||||
BasicRule wl:17 "mz:$HEADERS_VAR_X:^accept$|$URL_X:^/Videos/.*$";
|
||||
BasicRule wl:1015 "mz:ARGS|$URL_X:^/videos/.*$";
|
||||
|
||||
# /LiveTv
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:EnableImageTypes|$URL:/LiveTv/Programs/Recommended";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:Fields|$URL:/LiveTv/Programs";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:Fields|$URL:/LiveTv/Programs/Recommended";
|
||||
|
||||
# Playback Reporting Plugin
|
||||
|
||||
# /user_usage_stats
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:filter|$URL:/user_usage_stats/PlayActivity";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:filter|$URL:/user_usage_stats/HourlyReport";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:filter|$URL:/user_usage_stats/DurationHistogramReport";
|
||||
|
||||
# Artist
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:fields|$URL:/Artists";
|
||||
BasicRule wl:1013,1100 "mz:$ARGS_VAR:searchTerm|$URL:/Artists";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:SortBy|$URL:/Artists";
|
||||
|
||||
# Persons
|
||||
BasicRule wl:1000,1013 "mz:$ARGS_VAR:fields|$URL:/Persons";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:SortBy|$URL:/Persons";
|
||||
BasicRule wl:1100 "mz:$ARGS_VAR:searchTerm|$URL:/Persons";
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
BasicRule wl:1005,1010,1011,1315 "mz:$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1402 "mz:$HEADERS_VAR:content-type";
|
||||
BasicRule wl:11 "mz:$URL:/rutorrent/php/setsettings.php|BODY";
|
||||
BasicRule wl:11 "mz:$URL:/rutorrent/php/getsettings.php|BODY";
|
||||
BasicRule wl:1000,1001,1015,1310,1311 "mz:$BODY_VAR:v";
|
||||
BasicRule wl:1005,1008 "mz:$BODY_VAR:cookie";
|
||||
BasicRule wl:1000,1100,1101,1315 "mz:$BODY_VAR:url";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/rutorrent/php/addtorrent.php|$ARGS_VAR:result[]|NAME";
|
||||
BasicRule wl:1000,1100,1101 "mz:$ARGS_VAR:name[]";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/rutorrent/php/addtorrent.php|$ARGS_VAR:name[]|NAME";
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
######### #########
|
||||
###### ######
|
||||
### Because of wordpress.rules is full of wl rules even got double. ###
|
||||
### Thats why I start from scratch so these rules are in BETA us on own risk. ###
|
||||
### I us not that many plugins and those I use only after I checked there code. ###
|
||||
###### ######
|
||||
######### #########
|
||||
### HEADERS
|
||||
BasicRule wl:1001,1315 "mz:$HEADERS_VAR:cookie";
|
||||
### Theme customize
|
||||
BasicRule wl:1001,1015,1310,1311 "mz:$URL_X:^/.*$|$BODY_VAR_X:^customized$|BODY";
|
||||
### Widget customize
|
||||
BasicRule wl:1001,1015,1310,1311 "mz:$URL_X:^/.*$|$BODY_VAR_X:^partials$|BODY";
|
||||
### oEmbed API
|
||||
BasicRule wl:1000,1009,1101 "mz:$URL_X:^/.*wp-json/oembed/1.0/embed|$ARGS_VAR_X:^url$";
|
||||
BasicRule wl:1009,1101 "mz:$URL_X:^/.*wp-json/oembed/1.0/embed|ARGS";
|
||||
BasicRule wl:1009,1101 "mz:ARGS";
|
||||
### Trackbacks
|
||||
BasicRule wl:1005,1008,1010,1011,1015,1016,1100,1101,1400 "mz:$URL_X:^/.*trackback$/|BODY";
|
||||
BasicRule wl:1005,1008,1010,1011,1015,1016,1100,1101,1400 "mz:BODY";
|
||||
BasicRule wl:1008,1010,1011,1015,1016,1100,1101,1400 "mz:$URL_X:^/.*trackback$/|$BODY_VAR_X:^excerpt$";
|
||||
BasicRule wl:1008,1010,1011,1015,1016,1100,1101,1400 "mz:$BODY_VAR:excerpt";
|
||||
BasicRule wl:1101 "mz:$URL_X:^/.*trackback$/|$BODY_VAR_X:^url$";
|
||||
BasicRule wl:1005 "mz:$URL_X:^/.*trackback$/|$BODY_VAR_X:^title$";
|
||||
BasicRule wl:1101 "mz:$BODY_VAR:url";
|
||||
BasicRule wl:1005 "mz:$BODY_VAR:title";
|
||||
|
|
@ -0,0 +1,152 @@
|
|||
# WordPress naxsi rules
|
||||
|
||||
### HEADERS
|
||||
BasicRule wl:1000,1001,1005,1007,1010,1011,1013,1100,1101,1200,1308,1309,1310,1311,1315 "mz:$HEADERS_VAR:cookie";
|
||||
# xmlrpc
|
||||
BasicRule wl:1402 "mz:$HEADERS_VAR:content-type";
|
||||
|
||||
### simple BODY (POST)
|
||||
BasicRule wl:1001,1009,1015,1016,1101,1310,1311 "mz:$URL:/|$BODY_VAR:customized";
|
||||
# comments
|
||||
BasicRule wl:1000,1010,1011,1013,1015,1200,1310,1311 "mz:$BODY_VAR:post_title";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:original_publish";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:save";
|
||||
BasicRule wl:1008,1010,1011,1013,1015 "mz:$BODY_VAR:sk2_my_js_payload";
|
||||
BasicRule wl:1001,1005,1009,1016,1100,1101,1310 "mz:$BODY_VAR:url";
|
||||
BasicRule wl:1009,1100,1101 "mz:$BODY_VAR:referredby";
|
||||
BasicRule wl:1009,1100,1101 "mz:$BODY_VAR:_wp_original_http_referer";
|
||||
BasicRule wl:1000,1001,1005,1007,1008,1009,1010,1011,1013,1015,1016,1100,1101,1200,1302,1303,1310,1311,1315,1400 "mz:$BODY_VAR:comment";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:redirect_to";
|
||||
BasicRule wl:1000,1009,1315 "mz:$BODY_VAR:_wp_http_referer";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:action";
|
||||
BasicRule wl:1001,1013 "mz:$BODY_VAR:blogname";
|
||||
BasicRule wl:1013,1015 "mz:$BODY_VAR:blogdescription";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:date_format_custom";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:date_format";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:tax_input%5bpost_tag%5d";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:tax_input[post_tag]";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:siteurl";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:home";
|
||||
BasicRule wl:1000,1015 "mz:$BODY_VAR:submit";
|
||||
# news content matches pretty much everything
|
||||
BasicRule wl:0 "mz:$BODY_VAR:content";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:delete_option";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:prowl-msg-message";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:_url";
|
||||
BasicRule wl:1001,1009 "mz:$BODY_VAR:c2c_text_replace%5btext_to_replace%5d";
|
||||
BasicRule wl:1200 "mz:$BODY_VAR:ppn_post_note";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:author";
|
||||
BasicRule wl:1001,1015 "mz:$BODY_VAR:excerpt";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:catslist";
|
||||
BasicRule wl:1005,1008,1009,1010,1011,1015,1315 "mz:$BODY_VAR:cookie";
|
||||
BasicRule wl:1101 "mz:$BODY_VAR:googleplus";
|
||||
BasicRule wl:1007 "mz:$BODY_VAR:name";
|
||||
BasicRule wl:1007 "mz:$BODY_VAR:action";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:attachment%5burl%5d";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:attachment_url";
|
||||
BasicRule wl:1001,1009,1100,1101,1302,1303,1310,1311 "mz:$BODY_VAR:html";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:title";
|
||||
BasicRule wl:1001,1009,1015 "mz:$BODY_VAR:recaptcha_challenge_field";
|
||||
BasicRule wl:1011 "mz:$BODY_VAR:pwd";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:excerpt";
|
||||
|
||||
### BODY|NAME
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:delete_option|NAME";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:from|NAME";
|
||||
|
||||
### Simple ARGS (GET)
|
||||
# WP login screen
|
||||
BasicRule wl:1100,1101 "mz:$ARGS_VAR:redirect_to";
|
||||
BasicRule wl:1000,1009 "mz:$ARGS_VAR:_wp_http_referer";
|
||||
BasicRule wl:1000 "mz:$ARGS_VAR:wp_http_referer";
|
||||
BasicRule wl:1000 "mz:$ARGS_VAR:action";
|
||||
BasicRule wl:1000 "mz:$ARGS_VAR:action2";
|
||||
# load and load[] GET variable
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:load";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:load[]";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:q";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:load%5b%5d";
|
||||
|
||||
### URL
|
||||
BasicRule wl:1000 "mz:URL|$URL:/wp-admin/update-core.php";
|
||||
BasicRule wl:1000 "mz:URL|$URL:/wp-admin/update.php";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-includes/js/imgareaselect/imgareaselect.css|URL";
|
||||
BasicRule wl:1002 "mz:$URL_X:/wp-content/uploads/[0-9]{4}/[0-9]{2}/[^/]+\.jpg$|URL";
|
||||
# URL|ARGS
|
||||
BasicRule wl:1015 "mz:$URL:/wp-admin/load-styles.php|$ARGS_VAR:dashicons,admin-bar,wp-admin,buttons,wp-auth-check";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/about.php|$ARGS_VAR:updated";
|
||||
BasicRule wl:1009 "mz:$URL:/wp-admin/customize.php|$ARGS_VAR:return";
|
||||
# URL|BODY
|
||||
BasicRule wl:1009,1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:_wp_http_referer";
|
||||
BasicRule wl:1016 "mz:$URL:/wp-admin/post.php|$BODY_VAR:metakeyselect";
|
||||
BasicRule wl:11 "mz:$URL:/xmlrpc.php|BODY";
|
||||
BasicRule wl:11,16 "mz:$URL:/wp-cron.php|BODY";
|
||||
BasicRule wl:2 "mz:$URL:/wp-admin/async-upload.php|BODY";
|
||||
# URL|BODY|NAME
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:_wp_original_http_referer|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/post.php|$BODY_VAR:metakeyselect|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/user-edit.php|$BODY_VAR:from|NAME";
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:attachment%5burl%5d|NAME";
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:attachment_url|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/plugins.php|$BODY_VAR:verify-delete|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/post.php|$BODY_VAR:post_category[]|NAME";
|
||||
BasicRule wl:1311 "mz:$URL:/wp-admin/post.php|$BODY_VAR:post_category|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/post.php|$BODY_VAR:tax_input[post_tag]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/post.php|$BODY_VAR:newtag[post_tag]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/users.php|$BODY_VAR:users[]|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/update-core.php|$BODY_VAR:Update%2BTranslations|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/update-core.php|$BODY_VAR:Update%2BNow|NAME";
|
||||
# URL|ARGS|NAME
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/load-scripts.php|$ARGS_VAR:load[]|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/users.php|$ARGS_VAR:delete_count|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/users.php|$ARGS_VAR:update|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/customize.php|$ARGS_VAR:autofocus[control]|NAME";
|
||||
|
||||
# plain WP site
|
||||
BasicRule wl:1000 "mz:URL|$URL:/wp-admin/update-core.php";
|
||||
BasicRule wl:1000 "mz:URL|$URL:/wp-admin/update.php";
|
||||
# URL|BODY
|
||||
BasicRule wl:1009,1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:_wp_http_referer";
|
||||
BasicRule wl:1016 "mz:$URL:/wp-admin/post.php|$BODY_VAR:metakeyselect";
|
||||
BasicRule wl:11 "mz:$URL:/xmlrpc.php|BODY";
|
||||
BasicRule wl:11,16 "mz:$URL:/wp-cron.php|BODY";
|
||||
# URL|BODY|NAME
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:_wp_original_http_referer|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/post.php|$BODY_VAR:metakeyselect|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/user-edit.php|$BODY_VAR:from|NAME";
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:attachment%5burl%5d|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:data[wp-auth-check]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:data[wp-check-locked-posts][]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:data[wp-refresh-post-lock][post_id]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:data[wp-refresh-post-lock][lock]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/update-core.php|$BODY_VAR:checked[]|NAME";
|
||||
# URL|ARGS|NAME
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/load-scripts.php|$ARGS_VAR:load[]|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/users.php|$ARGS_VAR:delete_count|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/users.php|$ARGS_VAR:update|NAME";
|
||||
|
||||
### Plugins
|
||||
#WP Minify
|
||||
BasicRule wl:1015 "mz:$URL:/wp-content/plugins/bwp-minify/min/|$ARGS_VAR:f";
|
||||
#Jetpack Infinite Scroll
|
||||
BasicRule wl:1310,1311 "mz:$BODY_VAR:scripts[]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$BODY_VAR:styles[]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$BODY_VAR_X:^query_args\[.*\]|NAME";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:query_args[update_post_term_cache]|NAME";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:query_args[update_post_meta_cache]|NAME";
|
||||
#UpdraftPlus
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/updraftplus/includes/select2/select2.min.css|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/updraftplus/includes/select2/select2.min.js|URL";
|
||||
#WP plugin updates
|
||||
BasicRule wl:1315 "mz:$ARGS_VAR:query|$URL:/wp-json/jetpack/v4/jitm";
|
||||
#Jetpack Google Fonts
|
||||
BasicRule wl:1001 "mz:$URL_X:^/wp-content/plugins/jetpack/css/.*|URL";
|
||||
#WooCommerce
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/woocommerce/assets/js/select2/select2.full.min.js|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/woocommerce/assets/js/selectWoo/selectWoo.full.min.js|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/woocommerce/assets/js/stupidtable/stupidtable.min.js|URL";
|
||||
#WPML
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/sitepress-multilingual-cms/lib/select2/select2.min.js|URL";
|
||||
#Yoast SEO
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/wordpress-seo/js/dist/select2/select2.full.min.js|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/wordpress-seo/css/dist/select2/select2.min.css|URL";
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
# Zerobin is here in directory /paste if diffrent change $URL:/paste/ below
|
||||
BasicRule wl:1015 "mz:$URL:/paste/|$BODY_VAR:data";
|
||||
BasicRule wl:1315 "mz:$URL:/paste/|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1001 "mz:$URL:/paste/|$BODY_VAR:data";
|
||||
BasicRule wl:1009 "mz:$URL:/paste/|$BODY_VAR:data";
|
||||
BasicRule wl:1009 "mz:$URL:/paste/|$BODY_VAR:nickname";
|
||||
BasicRule wl:1001 "mz:$URL:/paste/|$BODY_VAR:nickname";
|
||||
BasicRule wl:1015 "mz:$URL:/paste/|$BODY_VAR:nickname";
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
######### #########
|
||||
###### ######
|
||||
### Because of wordpress.rules is full of wl rules even got double. ###
|
||||
### Thats why I start from scratch so these rules are in BETA us on own risk. ###
|
||||
### I us not that many plugins and those I use only after I checked there code. ###
|
||||
###### ######
|
||||
######### #########
|
||||
### HEADERS
|
||||
BasicRule wl:1001,1315 "mz:$HEADERS_VAR:cookie";
|
||||
### Theme customize
|
||||
BasicRule wl:1001,1015,1310,1311 "mz:$URL_X:^/.*$|$BODY_VAR_X:^customized$|BODY";
|
||||
### Widget customize
|
||||
BasicRule wl:1001,1015,1310,1311 "mz:$URL_X:^/.*$|$BODY_VAR_X:^partials$|BODY";
|
||||
### oEmbed API
|
||||
BasicRule wl:1000,1009,1101 "mz:$URL_X:^/.*wp-json/oembed/1.0/embed|$ARGS_VAR_X:^url$";
|
||||
BasicRule wl:1009,1101 "mz:$URL_X:^/.*wp-json/oembed/1.0/embed|ARGS";
|
||||
BasicRule wl:1009,1101 "mz:ARGS";
|
||||
### Trackbacks
|
||||
BasicRule wl:1005,1008,1010,1011,1015,1016,1100,1101,1400 "mz:$URL_X:^/.*trackback$/|BODY";
|
||||
BasicRule wl:1005,1008,1010,1011,1015,1016,1100,1101,1400 "mz:BODY";
|
||||
BasicRule wl:1008,1010,1011,1015,1016,1100,1101,1400 "mz:$URL_X:^/.*trackback$/|$BODY_VAR_X:^excerpt$";
|
||||
BasicRule wl:1008,1010,1011,1015,1016,1100,1101,1400 "mz:$BODY_VAR:excerpt";
|
||||
BasicRule wl:1101 "mz:$URL_X:^/.*trackback$/|$BODY_VAR_X:^url$";
|
||||
BasicRule wl:1005 "mz:$URL_X:^/.*trackback$/|$BODY_VAR_X:^title$";
|
||||
BasicRule wl:1101 "mz:$BODY_VAR:url";
|
||||
BasicRule wl:1005 "mz:$BODY_VAR:title";
|
||||
152
containers/conf/angie/naxsi_rules/whitelists/wordpress.rules
Normal file
152
containers/conf/angie/naxsi_rules/whitelists/wordpress.rules
Normal file
|
|
@ -0,0 +1,152 @@
|
|||
# WordPress naxsi rules
|
||||
|
||||
### HEADERS
|
||||
BasicRule wl:1000,1001,1005,1007,1010,1011,1013,1100,1101,1200,1308,1309,1310,1311,1315 "mz:$HEADERS_VAR:cookie";
|
||||
# xmlrpc
|
||||
BasicRule wl:1402 "mz:$HEADERS_VAR:content-type";
|
||||
|
||||
### simple BODY (POST)
|
||||
BasicRule wl:1001,1009,1015,1016,1101,1310,1311 "mz:$URL:/|$BODY_VAR:customized";
|
||||
# comments
|
||||
BasicRule wl:1000,1010,1011,1013,1015,1200,1310,1311 "mz:$BODY_VAR:post_title";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:original_publish";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:save";
|
||||
BasicRule wl:1008,1010,1011,1013,1015 "mz:$BODY_VAR:sk2_my_js_payload";
|
||||
BasicRule wl:1001,1005,1009,1016,1100,1101,1310 "mz:$BODY_VAR:url";
|
||||
BasicRule wl:1009,1100,1101 "mz:$BODY_VAR:referredby";
|
||||
BasicRule wl:1009,1100,1101 "mz:$BODY_VAR:_wp_original_http_referer";
|
||||
BasicRule wl:1000,1001,1005,1007,1008,1009,1010,1011,1013,1015,1016,1100,1101,1200,1302,1303,1310,1311,1315,1400 "mz:$BODY_VAR:comment";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:redirect_to";
|
||||
BasicRule wl:1000,1009,1315 "mz:$BODY_VAR:_wp_http_referer";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:action";
|
||||
BasicRule wl:1001,1013 "mz:$BODY_VAR:blogname";
|
||||
BasicRule wl:1013,1015 "mz:$BODY_VAR:blogdescription";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:date_format_custom";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:date_format";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:tax_input%5bpost_tag%5d";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:tax_input[post_tag]";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:siteurl";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:home";
|
||||
BasicRule wl:1000,1015 "mz:$BODY_VAR:submit";
|
||||
# news content matches pretty much everything
|
||||
BasicRule wl:0 "mz:$BODY_VAR:content";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:delete_option";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:prowl-msg-message";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:_url";
|
||||
BasicRule wl:1001,1009 "mz:$BODY_VAR:c2c_text_replace%5btext_to_replace%5d";
|
||||
BasicRule wl:1200 "mz:$BODY_VAR:ppn_post_note";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:author";
|
||||
BasicRule wl:1001,1015 "mz:$BODY_VAR:excerpt";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:catslist";
|
||||
BasicRule wl:1005,1008,1009,1010,1011,1015,1315 "mz:$BODY_VAR:cookie";
|
||||
BasicRule wl:1101 "mz:$BODY_VAR:googleplus";
|
||||
BasicRule wl:1007 "mz:$BODY_VAR:name";
|
||||
BasicRule wl:1007 "mz:$BODY_VAR:action";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:attachment%5burl%5d";
|
||||
BasicRule wl:1100,1101 "mz:$BODY_VAR:attachment_url";
|
||||
BasicRule wl:1001,1009,1100,1101,1302,1303,1310,1311 "mz:$BODY_VAR:html";
|
||||
BasicRule wl:1015 "mz:$BODY_VAR:title";
|
||||
BasicRule wl:1001,1009,1015 "mz:$BODY_VAR:recaptcha_challenge_field";
|
||||
BasicRule wl:1011 "mz:$BODY_VAR:pwd";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:excerpt";
|
||||
|
||||
### BODY|NAME
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:delete_option|NAME";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:from|NAME";
|
||||
|
||||
### Simple ARGS (GET)
|
||||
# WP login screen
|
||||
BasicRule wl:1100,1101 "mz:$ARGS_VAR:redirect_to";
|
||||
BasicRule wl:1000,1009 "mz:$ARGS_VAR:_wp_http_referer";
|
||||
BasicRule wl:1000 "mz:$ARGS_VAR:wp_http_referer";
|
||||
BasicRule wl:1000 "mz:$ARGS_VAR:action";
|
||||
BasicRule wl:1000 "mz:$ARGS_VAR:action2";
|
||||
# load and load[] GET variable
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:load";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:load[]";
|
||||
BasicRule wl:1015 "mz:$ARGS_VAR:q";
|
||||
BasicRule wl:1000,1015 "mz:$ARGS_VAR:load%5b%5d";
|
||||
|
||||
### URL
|
||||
BasicRule wl:1000 "mz:URL|$URL:/wp-admin/update-core.php";
|
||||
BasicRule wl:1000 "mz:URL|$URL:/wp-admin/update.php";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-includes/js/imgareaselect/imgareaselect.css|URL";
|
||||
BasicRule wl:1002 "mz:$URL_X:/wp-content/uploads/[0-9]{4}/[0-9]{2}/[^/]+\.jpg$|URL";
|
||||
# URL|ARGS
|
||||
BasicRule wl:1015 "mz:$URL:/wp-admin/load-styles.php|$ARGS_VAR:dashicons,admin-bar,wp-admin,buttons,wp-auth-check";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/about.php|$ARGS_VAR:updated";
|
||||
BasicRule wl:1009 "mz:$URL:/wp-admin/customize.php|$ARGS_VAR:return";
|
||||
# URL|BODY
|
||||
BasicRule wl:1009,1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:_wp_http_referer";
|
||||
BasicRule wl:1016 "mz:$URL:/wp-admin/post.php|$BODY_VAR:metakeyselect";
|
||||
BasicRule wl:11 "mz:$URL:/xmlrpc.php|BODY";
|
||||
BasicRule wl:11,16 "mz:$URL:/wp-cron.php|BODY";
|
||||
BasicRule wl:2 "mz:$URL:/wp-admin/async-upload.php|BODY";
|
||||
# URL|BODY|NAME
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:_wp_original_http_referer|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/post.php|$BODY_VAR:metakeyselect|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/user-edit.php|$BODY_VAR:from|NAME";
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:attachment%5burl%5d|NAME";
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:attachment_url|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/plugins.php|$BODY_VAR:verify-delete|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/post.php|$BODY_VAR:post_category[]|NAME";
|
||||
BasicRule wl:1311 "mz:$URL:/wp-admin/post.php|$BODY_VAR:post_category|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/post.php|$BODY_VAR:tax_input[post_tag]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/post.php|$BODY_VAR:newtag[post_tag]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/users.php|$BODY_VAR:users[]|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/update-core.php|$BODY_VAR:Update%2BTranslations|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/update-core.php|$BODY_VAR:Update%2BNow|NAME";
|
||||
# URL|ARGS|NAME
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/load-scripts.php|$ARGS_VAR:load[]|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/users.php|$ARGS_VAR:delete_count|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/users.php|$ARGS_VAR:update|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/customize.php|$ARGS_VAR:autofocus[control]|NAME";
|
||||
|
||||
# plain WP site
|
||||
BasicRule wl:1000 "mz:URL|$URL:/wp-admin/update-core.php";
|
||||
BasicRule wl:1000 "mz:URL|$URL:/wp-admin/update.php";
|
||||
# URL|BODY
|
||||
BasicRule wl:1009,1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:_wp_http_referer";
|
||||
BasicRule wl:1016 "mz:$URL:/wp-admin/post.php|$BODY_VAR:metakeyselect";
|
||||
BasicRule wl:11 "mz:$URL:/xmlrpc.php|BODY";
|
||||
BasicRule wl:11,16 "mz:$URL:/wp-cron.php|BODY";
|
||||
# URL|BODY|NAME
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/post.php|$BODY_VAR:_wp_original_http_referer|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/post.php|$BODY_VAR:metakeyselect|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/user-edit.php|$BODY_VAR:from|NAME";
|
||||
BasicRule wl:1100,1101 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:attachment%5burl%5d|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:data[wp-auth-check]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:data[wp-check-locked-posts][]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:data[wp-refresh-post-lock][post_id]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/admin-ajax.php|$BODY_VAR:data[wp-refresh-post-lock][lock]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/update-core.php|$BODY_VAR:checked[]|NAME";
|
||||
# URL|ARGS|NAME
|
||||
BasicRule wl:1310,1311 "mz:$URL:/wp-admin/load-scripts.php|$ARGS_VAR:load[]|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/users.php|$ARGS_VAR:delete_count|NAME";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-admin/users.php|$ARGS_VAR:update|NAME";
|
||||
|
||||
### Plugins
|
||||
#WP Minify
|
||||
BasicRule wl:1015 "mz:$URL:/wp-content/plugins/bwp-minify/min/|$ARGS_VAR:f";
|
||||
#Jetpack Infinite Scroll
|
||||
BasicRule wl:1310,1311 "mz:$BODY_VAR:scripts[]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$BODY_VAR:styles[]|NAME";
|
||||
BasicRule wl:1310,1311 "mz:$BODY_VAR_X:^query_args\[.*\]|NAME";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:query_args[update_post_term_cache]|NAME";
|
||||
BasicRule wl:1000 "mz:$BODY_VAR:query_args[update_post_meta_cache]|NAME";
|
||||
#UpdraftPlus
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/updraftplus/includes/select2/select2.min.css|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/updraftplus/includes/select2/select2.min.js|URL";
|
||||
#WP plugin updates
|
||||
BasicRule wl:1315 "mz:$ARGS_VAR:query|$URL:/wp-json/jetpack/v4/jitm";
|
||||
#Jetpack Google Fonts
|
||||
BasicRule wl:1001 "mz:$URL_X:^/wp-content/plugins/jetpack/css/.*|URL";
|
||||
#WooCommerce
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/woocommerce/assets/js/select2/select2.full.min.js|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/woocommerce/assets/js/selectWoo/selectWoo.full.min.js|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/woocommerce/assets/js/stupidtable/stupidtable.min.js|URL";
|
||||
#WPML
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/sitepress-multilingual-cms/lib/select2/select2.min.js|URL";
|
||||
#Yoast SEO
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/wordpress-seo/js/dist/select2/select2.full.min.js|URL";
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/wordpress-seo/css/dist/select2/select2.min.css|URL";
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
# Zerobin is here in directory /paste if diffrent change $URL:/paste/ below
|
||||
BasicRule wl:1015 "mz:$URL:/paste/|$BODY_VAR:data";
|
||||
BasicRule wl:1315 "mz:$URL:/paste/|$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1001 "mz:$URL:/paste/|$BODY_VAR:data";
|
||||
BasicRule wl:1009 "mz:$URL:/paste/|$BODY_VAR:data";
|
||||
BasicRule wl:1009 "mz:$URL:/paste/|$BODY_VAR:nickname";
|
||||
BasicRule wl:1001 "mz:$URL:/paste/|$BODY_VAR:nickname";
|
||||
BasicRule wl:1015 "mz:$URL:/paste/|$BODY_VAR:nickname";
|
||||
20
containers/conf/angie/sites-available/default
Normal file
20
containers/conf/angie/sites-available/default
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
server {
|
||||
listen 80 default_server backlog=2048 reuseport fastopen=256;
|
||||
listen [::]:80 default_server backlog=2048 reuseport fastopen=256;
|
||||
|
||||
# redirect all http traffic to https
|
||||
#return 301 https://$host$request_uri;
|
||||
|
||||
# Reject everything on your default IP
|
||||
location / { return 444; }
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl reuseport fastopen=256 backlog=2048;
|
||||
listen [::]:443 ssl reuseport fastopen=256 backlog=2048;
|
||||
|
||||
# Reject everything on your default IP
|
||||
location / { return 444; }
|
||||
|
||||
ssl_reject_handshake on;
|
||||
}
|
||||
91
containers/conf/angie/sites-available/example
Normal file
91
containers/conf/angie/sites-available/example
Normal file
|
|
@ -0,0 +1,91 @@
|
|||
##
|
||||
# You should look at the following URL's in order to grasp a solid understanding
|
||||
# of angie configuration files in order to fully unleash the power of angie.
|
||||
# https://www.angie.com/resources/wiki/start/
|
||||
# https://www.angie.com/resources/wiki/start/topics/tutorials/config_pitfalls/
|
||||
# https://wiki.debian.org/angie/DirectoryStructure
|
||||
#
|
||||
# In most cases, administrators will remove this file from sites-enabled/ and
|
||||
# leave it as reference inside of sites-available where it will continue to be
|
||||
# updated by the angie packaging team.
|
||||
#
|
||||
# This file will automatically load configuration files provided by other
|
||||
# applications, such as Drupal or Wordpress. These applications will be made
|
||||
# available underneath a path with that package name, such as /drupal8.
|
||||
#
|
||||
# Please see /usr/share/doc/angie-doc/examples/ for more detailed examples.
|
||||
##
|
||||
|
||||
# Default server configuration
|
||||
#
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
|
||||
# SSL configuration
|
||||
#
|
||||
# listen 443 ssl default_server;
|
||||
# listen [::]:443 ssl default_server;
|
||||
#
|
||||
# Note: You should disable gzip for SSL traffic.
|
||||
# See: https://bugs.debian.org/773332
|
||||
#
|
||||
# Read up on ssl_ciphers to ensure a secure configuration.
|
||||
# See: https://bugs.debian.org/765782
|
||||
#
|
||||
# Self signed certs generated by the ssl-cert package
|
||||
# Don't use them in a production server!
|
||||
#
|
||||
# include snippets/snakeoil.conf;
|
||||
|
||||
root /var/www/html;
|
||||
|
||||
# Add index.php to the list if you are using PHP
|
||||
index index.html index.htm index.angie-debian.html;
|
||||
|
||||
server_name _;
|
||||
|
||||
location / {
|
||||
# First attempt to serve request as file, then
|
||||
# as directory, then fall back to displaying a 404.
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
# pass PHP scripts to FastCGI server
|
||||
#
|
||||
#location ~ \.php$ {
|
||||
# include snippets/fastcgi-php.conf;
|
||||
#
|
||||
# # With php-fpm (or other unix sockets):
|
||||
# fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
|
||||
# # With php-cgi (or other tcp sockets):
|
||||
# fastcgi_pass 127.0.0.1:9000;
|
||||
#}
|
||||
|
||||
# deny access to .htaccess files, if Apache's document root
|
||||
# concurs with angie's one
|
||||
#
|
||||
#location ~ /\.ht {
|
||||
# deny all;
|
||||
#}
|
||||
}
|
||||
|
||||
|
||||
# Virtual Host configuration for example.com
|
||||
#
|
||||
# You can move that to a different file under sites-available/ and symlink that
|
||||
# to sites-enabled/ to enable it.
|
||||
#
|
||||
#server {
|
||||
# listen 80;
|
||||
# listen [::]:80;
|
||||
#
|
||||
# server_name example.com;
|
||||
#
|
||||
# root /var/www/example.com;
|
||||
# index index.html;
|
||||
#
|
||||
# location / {
|
||||
# try_files $uri $uri/ =404;
|
||||
# }
|
||||
#}
|
||||
|
|
@ -1,15 +1,15 @@
|
|||
allow_url_fopen = 0
|
||||
allow_url_include = 0
|
||||
cgi.fix_pathinfo = 0
|
||||
display_errors = 0
|
||||
display_startup_errors = 0
|
||||
expose_php = 0
|
||||
file_uploads = On
|
||||
max_execution_time = 600
|
||||
max_input_time = 600
|
||||
max_input_vars = 2000
|
||||
memory_limit = 1024M
|
||||
post_max_size = 32M
|
||||
register_globals = Off
|
||||
upload_max_filesize = 32M
|
||||
open_basedir = "/"
|
||||
allow_url_fopen=0
|
||||
allow_url_include=0
|
||||
cgi.fix_pathinfo=0
|
||||
display_errors=0
|
||||
display_startup_errors=0
|
||||
expose_php=0
|
||||
file_uploads=On
|
||||
max_execution_time=600
|
||||
max_input_time=600
|
||||
max_input_vars=2000
|
||||
memory_limit=1024M
|
||||
open_basedir="/"
|
||||
post_max_size=32M
|
||||
register_globals=Off
|
||||
upload_max_filesize=32M
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue