kindle
11 years ago
12 changed files with 655 additions and 109 deletions
@ -0,0 +1,12 @@
|
||||
RulePath = "/usr/local/nginx/conf/waf/wafconf/" |
||||
attacklog = "off" |
||||
logdir = "/usr/local/nginx/logs/hack/" |
||||
UrlDeny="on" |
||||
Redirect="on" |
||||
CookieMatch="on" |
||||
postMatch="on" |
||||
whiteModule="on" |
||||
ipWhitelist={"127.0.0.1"} |
||||
CCDeny="off" |
||||
CCrate="100/60" |
||||
html=[[Please go away~~ ]] |
||||
@ -0,0 +1,267 @@
|
||||
-- Copyright (C) Yichun Zhang (agentzh) |
||||
|
||||
|
||||
local sub = string.sub |
||||
local req_socket = ngx.req.socket |
||||
local null = ngx.null |
||||
local match = string.match |
||||
local setmetatable = setmetatable |
||||
local error = error |
||||
local get_headers = ngx.req.get_headers |
||||
local type = type |
||||
local print = print |
||||
|
||||
|
||||
local _M = { _VERSION = '0.08' } |
||||
|
||||
|
||||
local MAX_LINE_SIZE = 512 |
||||
|
||||
local STATE_BEGIN = 1 |
||||
local STATE_READING_HEADER = 2 |
||||
local STATE_READING_BODY = 3 |
||||
local STATE_EOF = 4 |
||||
|
||||
|
||||
local mt = { __index = _M } |
||||
|
||||
local state_handlers |
||||
|
||||
|
||||
local function get_boundary() |
||||
local header = get_headers()["content-type"] |
||||
if not header then |
||||
return nil |
||||
end |
||||
|
||||
if type(header) == "table" then |
||||
header = header[1] |
||||
end |
||||
|
||||
local m = match(header, ";%s*boundary=\"([^\"]+)\"") |
||||
if m then |
||||
return m |
||||
end |
||||
|
||||
return match(header, ";%s*boundary=([^\",;]+)") |
||||
end |
||||
|
||||
|
||||
function _M.new(self, chunk_size) |
||||
local boundary = get_boundary() |
||||
|
||||
print("boundary: ", boundary) |
||||
|
||||
if not boundary then |
||||
return nil, "no boundary defined in Content-Type" |
||||
end |
||||
|
||||
print('boundary: "', boundary, '"') |
||||
|
||||
local sock, err = req_socket() |
||||
if not sock then |
||||
return nil, err |
||||
end |
||||
|
||||
local read2boundary, err = sock:receiveuntil("--" .. boundary) |
||||
if not read2boundary then |
||||
return nil, err |
||||
end |
||||
|
||||
local read_line, err = sock:receiveuntil("\r\n") |
||||
if not read_line then |
||||
return nil, err |
||||
end |
||||
|
||||
return setmetatable({ |
||||
sock = sock, |
||||
size = chunk_size or 4096, |
||||
read2boundary = read2boundary, |
||||
read_line = read_line, |
||||
boundary = boundary, |
||||
state = STATE_BEGIN |
||||
}, mt) |
||||
end |
||||
|
||||
|
||||
function _M.set_timeout(self, timeout) |
||||
local sock = self.sock |
||||
if not sock then |
||||
return nil, "not initialized" |
||||
end |
||||
|
||||
return sock:settimeout(timeout) |
||||
end |
||||
|
||||
|
||||
local function discard_line(self) |
||||
local read_line = self.read_line |
||||
|
||||
local line, err = self.read_line(MAX_LINE_SIZE) |
||||
if not line then |
||||
return nil, err |
||||
end |
||||
|
||||
local dummy, err = self.read_line(1) |
||||
if dummy then |
||||
return nil, "line too long: " .. line .. dummy .. "..." |
||||
end |
||||
|
||||
if err then |
||||
return nil, err |
||||
end |
||||
|
||||
return 1 |
||||
end |
||||
|
||||
|
||||
local function discard_rest(self) |
||||
local sock = self.sock |
||||
local size = self.size |
||||
|
||||
while true do |
||||
local dummy, err = sock:receive(size) |
||||
if err and err ~= 'closed' then |
||||
return nil, err |
||||
end |
||||
|
||||
if not dummy then |
||||
return 1 |
||||
end |
||||
end |
||||
end |
||||
|
||||
|
||||
local function read_body_part(self) |
||||
local read2boundary = self.read2boundary |
||||
|
||||
local chunk, err = read2boundary(self.size) |
||||
if err then |
||||
return nil, nil, err |
||||
end |
||||
|
||||
if not chunk then |
||||
local sock = self.sock |
||||
|
||||
local data = sock:receive(2) |
||||
if data == "--" then |
||||
local ok, err = discard_rest(self) |
||||
if not ok then |
||||
return nil, nil, err |
||||
end |
||||
|
||||
self.state = STATE_EOF |
||||
return "part_end" |
||||
end |
||||
|
||||
if data ~= "\r\n" then |
||||
local ok, err = discard_line(self) |
||||
if not ok then |
||||
return nil, nil, err |
||||
end |
||||
end |
||||
|
||||
self.state = STATE_READING_HEADER |
||||
return "part_end" |
||||
end |
||||
|
||||
return "body", chunk |
||||
end |
||||
|
||||
|
||||
local function read_header(self) |
||||
local read_line = self.read_line |
||||
|
||||
local line, err = read_line(MAX_LINE_SIZE) |
||||
if err then |
||||
return nil, nil, err |
||||
end |
||||
|
||||
local dummy, err = read_line(1) |
||||
if dummy then |
||||
return nil, nil, "line too long: " .. line .. dummy .. "..." |
||||
end |
||||
|
||||
if err then |
||||
return nil, nil, err |
||||
end |
||||
|
||||
-- print("read line: ", line) |
||||
|
||||
if line == "" then |
||||
-- after the last header |
||||
self.state = STATE_READING_BODY |
||||
return read_body_part(self) |
||||
end |
||||
|
||||
local key, value = match(line, "([^: \t]+)%s*:%s*(.+)") |
||||
if not key then |
||||
return 'header', line |
||||
end |
||||
|
||||
return 'header', {key, value, line} |
||||
end |
||||
|
||||
|
||||
local function eof() |
||||
return "eof", nil |
||||
end |
||||
|
||||
|
||||
function _M.read(self) |
||||
local size = self.size |
||||
|
||||
local handler = state_handlers[self.state] |
||||
if handler then |
||||
return handler(self) |
||||
end |
||||
|
||||
return nil, nil, "bad state: " .. self.state |
||||
end |
||||
|
||||
|
||||
local function read_preamble(self) |
||||
local sock = self.sock |
||||
if not sock then |
||||
return nil, nil, "not initialized" |
||||
end |
||||
|
||||
local size = self.size |
||||
local read2boundary = self.read2boundary |
||||
|
||||
while true do |
||||
local preamble, err = read2boundary(size) |
||||
if not preamble then |
||||
break |
||||
end |
||||
|
||||
-- discard the preamble data chunk |
||||
-- print("read preamble: ", preamble) |
||||
end |
||||
|
||||
local ok, err = discard_line(self) |
||||
if not ok then |
||||
return nil, nil, err |
||||
end |
||||
|
||||
local read2boundary, err = sock:receiveuntil("\r\n--" .. self.boundary) |
||||
if not read2boundary then |
||||
return nil, nil, err |
||||
end |
||||
|
||||
self.read2boundary = read2boundary |
||||
|
||||
self.state = STATE_READING_HEADER |
||||
return read_header(self) |
||||
end |
||||
|
||||
|
||||
state_handlers = { |
||||
read_preamble, |
||||
read_header, |
||||
read_body_part, |
||||
eof |
||||
} |
||||
|
||||
|
||||
return _M |
||||
@ -1,24 +1,60 @@
|
||||
ngx.req.read_body() |
||||
if ngx.re.match(ngx.var.request_uri,whitelist,"isjo") then |
||||
return |
||||
else |
||||
if ngx.re.match(ngx.unescape_uri(ngx.var.request_uri),regex.."|"..get,"isjo") then |
||||
log('GET',ngx.unescape_uri(ngx.var.request_uri)) |
||||
check() |
||||
elseif ngx.var.http_user_agent and ngx.re.match(ngx.var.http_user_agent,regex.."|"..agent,"isjo") then |
||||
log('USER-AGENT',ngx.unescape_uri(ngx.var.request_uri)) |
||||
check() |
||||
elseif ngx.req.get_body_data() and ngx.re.match(ngx.unescape_uri(ngx.req.get_body_data()),regex.."|"..post,"isjo") then |
||||
log('POST',ngx.unescape_uri(ngx.var.request_uri),ngx.unescape_uri(ngx.req.get_body_data())) |
||||
check() |
||||
elseif ngx.req.get_headers()["Cookie"] and ngx.re.match(ngx.unescape_uri(ngx.req.get_headers()["Cookie"]),regex,"isjo")then |
||||
log('COOKIE',ngx.unescape_uri(ngx.var.request_uri),ngx.unescape_uri(ngx.req.get_headers()["Cookie"])) |
||||
check() |
||||
elseif ngx.req.get_headers()['Acunetix-Aspect'] then |
||||
ngx.exit(400) |
||||
elseif ngx.req.get_headers()['X-Scan-Memo'] then |
||||
ngx.exit(400) |
||||
else |
||||
return |
||||
local upload = require "upload" |
||||
local content_length=tonumber(ngx.req.get_headers()['content-length']) |
||||
local method=ngx.req.get_method() |
||||
if whiteip() then |
||||
elseif denycc() then |
||||
elseif ngx.var.http_Acunetix_Aspect then |
||||
ngx.exit(444) |
||||
elseif ngx.var.http_X_Scan_Memo then |
||||
ngx.exit(444) |
||||
elseif whiteurl() then |
||||
elseif ua() then |
||||
elseif url() then |
||||
elseif args() then |
||||
elseif cookie() then |
||||
elseif PostCheck then |
||||
if method=="POST" then |
||||
local boundary = get_boundary() |
||||
if boundary then |
||||
local form = upload:new(500) |
||||
if not form then |
||||
return |
||||
end |
||||
form:set_timeout(1000) -- 1 sec |
||||
while true do |
||||
local typ, res, err = form:read() |
||||
if not typ then |
||||
return |
||||
end |
||||
if typ=="body" then |
||||
body(res) |
||||
end |
||||
|
||||
if typ == "eof" then |
||||
break |
||||
end |
||||
end |
||||
|
||||
-- local typ, res, err = form:read() |
||||
-- body(res) |
||||
else |
||||
ngx.req.read_body() |
||||
local args = ngx.req.get_post_args() |
||||
if not args then |
||||
return |
||||
end |
||||
for key, val in pairs(args) do |
||||
if type(val) == "table" then |
||||
data=table.concat(val, ", ") |
||||
else |
||||
data=val |
||||
end |
||||
if data and type(data) ~= "boolean" and body(data) then |
||||
return true |
||||
end |
||||
end |
||||
end |
||||
end |
||||
else |
||||
return |
||||
end |
||||
|
||||
@ -0,0 +1,20 @@
|
||||
\.\./ |
||||
\:\$ |
||||
\$\{ |
||||
select.+(from|limit) |
||||
(?:(union(.*?)select)) |
||||
having|rongjitest |
||||
sleep\((\s*)(\d*)(\s*)\) |
||||
benchmark\((.*)\,(.*)\) |
||||
base64_decode\( |
||||
(?:from\W+information_schema\W) |
||||
(?:(?:current_)user|database|schema|connection_id)\s*\( |
||||
(?:etc\/\W*passwd) |
||||
into(\s+)+(?:dump|out)file\s* |
||||
group\s+by.+\( |
||||
xwork.MethodAccessor |
||||
(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\( |
||||
xwork\.MethodAccessor |
||||
(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\/ |
||||
java\.lang |
||||
\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\[ |
||||
@ -0,0 +1,20 @@
|
||||
\.\./ |
||||
\:\$ |
||||
\$\{ |
||||
select.+(from|limit) |
||||
(?:(union(.*?)select)) |
||||
having|rongjitest |
||||
sleep\((\s*)(\d*)(\s*)\) |
||||
benchmark\((.*)\,(.*)\) |
||||
base64_decode\( |
||||
(?:from\W+information_schema\W) |
||||
(?:(?:current_)user|database|schema|connection_id)\s*\( |
||||
(?:etc\/\W*passwd) |
||||
into(\s+)+(?:dump|out)file\s* |
||||
group\s+by.+\( |
||||
xwork.MethodAccessor |
||||
(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\( |
||||
xwork\.MethodAccessor |
||||
(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\/ |
||||
java\.lang |
||||
\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\[ |
||||
@ -1 +1,20 @@
|
||||
\)\.exec\( |
||||
\.\./ |
||||
\:\$ |
||||
\$\{ |
||||
select.+(from|limit) |
||||
(?:(union(.*?)select)) |
||||
having|rongjitest |
||||
sleep\((\s*)(\d*)(\s*)\) |
||||
benchmark\((.*)\,(.*)\) |
||||
base64_decode\( |
||||
(?:from\W+information_schema\W) |
||||
(?:(?:current_)user|database|schema|connection_id)\s*\( |
||||
(?:etc\/\W*passwd) |
||||
into(\s+)+(?:dump|out)file\s* |
||||
group\s+by.+\( |
||||
xwork.MethodAccessor |
||||
(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\( |
||||
xwork\.MethodAccessor |
||||
(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\/ |
||||
java\.lang |
||||
\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\[ |
||||
|
||||
@ -0,0 +1,6 @@
|
||||
\.(svn|htaccess|bash_history) |
||||
\.(bak|inc|old|mdb|sql|backup|java|class)$ |
||||
(vhost|bbs|host|wwwroot|www|site|root|hytop|flashfxp).*.rar |
||||
(phpmyadmin|jmx-console|jmxinvokerservlet) |
||||
java\.lang |
||||
/(attachments|upimg|images|css|uploadfiles|html|uploads|templets|static|template|data|inc|forumdata|upload|includes|cache|avatar)/(\\w+).(php|jsp) |
||||
@ -1 +1 @@
|
||||
.*(LWP::Simple|winhttp|clshttp|HTTrack|harvest|nsauditor|dirbuster|pangolin|nmap|sqlninja|grendel-scan|hydra|perl|HTMLParser|libwww|BBBike|sqlmap|w3af|owasp|Nikto|fimap|havij|PycURL|sae|zmeu|BabyKrokodil|python|netsparker|httperf|ApacheBench|webbench).* |
||||
(HTTrack|harvest|audit|dirbuster|pangolin|nmap|sqln|-scan|hydra|Parser|libwww|BBBike|sqlmap|w3af|owasp|Nikto|fimap|havij|PycURL|zmeu|BabyKrokodil|netsparker|httperf|bench) |
||||
|
||||
Loading…
Reference in new issue