├── 403.lua
├── aes.lua
├── b64.lua
├── config.lua
├── fileio.lua
├── init.lua
├── log.lua
├── nginx
├── nginx.conf
└── zE48AHvK
│ ├── crypto-js.min.js
│ ├── index.html
│ ├── info.html
│ ├── info.js
│ ├── jump.js
│ └── webdriver.js
├── node
└── js_confuse.js
├── randomStr.lua
├── readme.md
├── req.lua
├── rsp_body.lua
├── rsp_header.lua
├── tableXstring.lua
├── tu
└── ainrm@20220211170151.webp
└── whiteList.lua
/403.lua:
--------------------------------------------------------------------------------
1 | function emptyPrint()
2 | end
3 |
4 | function say_html()
5 | ngx.header.content_type = "text/html"
6 | ngx.status = ngx.HTTP_FORBIDDEN
7 | ngx.say(html)
8 | ngx.exit(ngx.status)
9 | end
--------------------------------------------------------------------------------
/aes.lua:
--------------------------------------------------------------------------------
1 | local aes = require "resty.aes"
2 | local str = require "resty.string"
3 | local iv = 'ABCDEF1234123412'
4 |
5 |
6 | -- 需要自己写一个函数将16进制转2进制
7 | function hex2bin(hexstr)
8 | local str = ""
9 | for i = 1, string.len(hexstr) - 1, 2 do
10 | local doublebytestr = string.sub(hexstr, i, i+1);
11 | local n = tonumber(doublebytestr, 16);
12 | if 0 == n then
13 | str = str .. '\00'
14 | else
15 | str = str .. string.format("%c", n)
16 | end
17 | end
18 | return str
19 | end
20 |
21 | -- 加密函数,返回16进制
22 | function encrypT(content, key)
23 | local aes_128_cbc_with_iv = assert(aes:new(key, nil, aes.cipher(128,"cbc"), {iv=iv}))
24 | local encrypted = aes_128_cbc_with_iv:encrypt(content)
25 | return str.to_hex(encrypted)
26 | end
27 |
28 | -- 解密函数 返回解密字符串
29 | function dencrypT(content, key)
30 | local aes_128_cbc_with_iv = assert(aes:new(key, nil, aes.cipher(128,"cbc"), {iv=iv}))
31 | local dencrypted = aes_128_cbc_with_iv:decrypt(hex2bin(content))
32 | return dencrypted
33 | end
34 |
35 | --ngx.say(encrypt('123456'))
36 | --ngx.say(dencrypt('32e29ba66134e3d8f2c149a2b93006c7'))
--------------------------------------------------------------------------------
/b64.lua:
--------------------------------------------------------------------------------
1 | function encodeBase64(source_str)
2 | local b64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
3 | local s64 = ''
4 | local str = source_str
5 |
6 | while #str > 0 do
7 | local bytes_num = 0
8 | local buf = 0
9 |
10 | for byte_cnt=1,3 do
11 | buf = (buf * 256)
12 | if #str > 0 then
13 | buf = buf + string.byte(str, 1, 1)
14 | str = string.sub(str, 2)
15 | bytes_num = bytes_num + 1
16 | end
17 | end
18 |
19 | for group_cnt=1,(bytes_num+1) do
20 | local b64char = math.fmod(math.floor(buf/262144), 64) + 1
21 | s64 = s64 .. string.sub(b64chars, b64char, b64char)
22 | buf = buf * 64
23 | end
24 |
25 | for fill_cnt=1,(3-bytes_num) do
26 | s64 = s64 .. '='
27 | end
28 | end
29 |
30 | return s64
31 | end
32 |
33 | function decodeBase64(str64)
34 | local b64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
35 | local temp={}
36 | for i=1,64 do
37 | temp[string.sub(b64chars,i,i)] = i
38 | end
39 | temp['=']=0
40 | local str=""
41 | for i=1,#str64,4 do
42 | if i>#str64 then
43 | break
44 | end
45 | local data = 0
46 | local str_count=0
47 | for j=0,3 do
48 | local str1=string.sub(str64,i+j,i+j)
49 | if not temp[str1] then
50 | return
51 | end
52 | if temp[str1] < 1 then
53 | data = data * 64
54 | else
55 | data = data * 64 + temp[str1]-1
56 | str_count = str_count + 1
57 | end
58 | end
59 | for j=16,0,-8 do
60 | if str_count > 0 then
61 | str=str..string.char(math.floor(data/math.pow(2,j)))
62 | data=math.fmod(data,math.pow(2,j))
63 | str_count = str_count - 1
64 | end
65 | end
66 | end
67 |
68 | local last = tonumber(string.byte(str, string.len(str), string.len(str)))
69 | if last == 0 then
70 | str = string.sub(str, 1, string.len(str) - 1)
71 | end
72 | return str
73 | end
74 |
75 |
76 | --url解码
77 | local function decodeURI(s)
78 | s = string.gsub(s, '%%(%x%x)', function(h) return string.char(tonumber(h, 16)) end)
79 | return s
80 | end
81 |
82 | --url加码
83 | local function encodeURI(s)
84 | s = string.gsub(s, "([^%w%.%- ])", function(c) return string.format("%%%02X", string.byte(c)) end)
85 | return string.gsub(s, " ", "+")
86 | end
--------------------------------------------------------------------------------
/config.lua:
--------------------------------------------------------------------------------
1 | attacklog = "off"
2 | shiroProtect = "off"
3 | toolsProtect = "off"
4 | jsProtect = "off"
5 | sensitiveProtect = "on"
6 |
7 |
8 | logdir = "/gate/log" -- log文件夹需要有写权限
9 | aesKey = '1231231231234567' -- 16位
10 | cookieA = 'h0yGbdRv'
11 | cookieB = 'kQpFHdoh'
12 | cookieC = 'aLoFjX4v'
13 | cookieD = 'x9i7RDYX23'
14 | jsPath = 'zE48AHvK/index.html'
15 | whiteExt = {'js', 'css', 'png', 'jpg'}
16 |
17 |
18 |
19 | html=[[
20 |
21 |
22 | 网站防火墙
23 |
30 |
31 |
32 |
33 |
34 |
35 |
36 |
37 |
38 |
网站防火墙
39 |
40 |
您的请求带有不合法参数，已被网站管理员设置拦截！
41 |
可能原因：您提交的内容包含危险的攻击请求
42 |
如何解决：
43 |
- 1）检查提交内容；
44 | - 2）如网站托管，请联系空间提供商；
45 | - 3）普通网站访客，请联系网站管理员；
46 |
47 |
48 |