├── docs ├── .gitignore ├── package.json ├── index.md ├── .vitepress │ └── config.ts ├── getting-started.md ├── nginx.md ├── apache.md ├── traefik.md ├── badbots.md ├── haproxy.md └── api.md ├── requirements.txt ├── .github ├── FUNDING.yml ├── ISSUE_TEMPLATE │ ├── feature_request.md │ └── bug_report.md └── workflows │ ├── docs.yml │ ├── test_nginx.yml │ ├── test_apache_docker.yml │ └── update_patterns.yml ├── tests └── nginx.conf ├── waf_patterns ├── apache │ ├── lfi.conf │ ├── leakages.conf │ ├── rfi.conf │ ├── exceptions.conf │ ├── generic.conf │ ├── iis.conf │ ├── detection.conf │ ├── correlation.conf │ ├── fixation.conf │ ├── php.conf │ ├── attack.conf │ ├── initialization.conf │ ├── sql.conf │ ├── java.conf │ ├── README.md │ ├── shells.conf │ ├── evaluation.conf │ ├── rce.conf │ ├── sqli.conf │ └── enforcement.conf ├── nginx │ ├── rfi.conf │ ├── leakages.conf │ ├── exceptions.conf │ ├── correlation.conf │ ├── initialization.conf │ ├── evaluation.conf │ ├── generic.conf │ ├── fixation.conf │ ├── iis.conf │ ├── php.conf │ ├── attack.conf │ ├── README.md │ ├── java.conf │ ├── sql.conf │ ├── shells.conf │ ├── enforcement.conf │ ├── waf_rules.conf │ ├── rce.conf │ ├── sqli.conf │ └── xss.conf ├── haproxy │ ├── waf.acl │ └── README.md └── traefik │ └── README.md ├── LICENSE ├── SECURITY.md ├── CONTRIBUTING.md ├── import_apache_waf.py ├── CODE_OF_CONDUCT.md ├── import_nginx_waf.py ├── json2traefik.py ├── import_haproxy_waf.py ├── import_traefik_waf.py ├── json2apache.py └── badbots.py /docs/.gitignore: -------------------------------------------------------------------------------- 1 | node_modules 2 | .vitepress/cache 3 | .vitepress/dist 4 | -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | requests>=2.28.0 2 | beautifulsoup4>=4.11.1 3 | tqdm>=4.64.0 4 | -------------------------------------------------------------------------------- /.github/FUNDING.yml: -------------------------------------------------------------------------------- 1 | # These are supported funding model platforms 2 | 3 | github: fabriziosalmi 4 | -------------------------------------------------------------------------------- /tests/nginx.conf: -------------------------------------------------------------------------------- 1 | server { 2 | listen 80; 3 | server_name example.com; 4 | 5 | location / { 6 | return 200 "Hello, World!"; 7 | } 8 | } 9 | -------------------------------------------------------------------------------- /waf_patterns/apache/lfi.conf: -------------------------------------------------------------------------------- 1 | # Apache ModSecurity rules for LFI 2 | SecRuleEngine On 3 | 4 | SecRule REQUEST_URI "\(\?:\(\?:\^\|\[x5c/;\]\)\.\{2,3\}\[x5c/;\]\|\[x5c/;\]\.\{2,3\}\(\?:\[x5c/;\]\|\$\)\)" "id:1000,phase:1,deny,status:403,log,msg:'lfi attack detected'" 5 | -------------------------------------------------------------------------------- /docs/package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "patterns-docs", 3 | "version": "1.0.0", 4 | "private": true, 5 | "type": "module", 6 | "scripts": { 7 | "docs:dev": "vitepress dev", 8 | "docs:build": "vitepress build", 9 | "docs:preview": "vitepress preview" 10 | }, 11 | "devDependencies": { 12 | "vitepress": "^1.5.0" 13 | } 14 | } -------------------------------------------------------------------------------- /waf_patterns/apache/leakages.conf: -------------------------------------------------------------------------------- 1 | # Apache ModSecurity rules for LEAKAGES 2 | SecRuleEngine On 3 | 4 | SecRule REQUEST_URI "\^\#!s\?/" "id:1021,phase:1,deny,status:403,log,msg:'leakages attack detected'" 5 | SecRule REQUEST_URI "\^5d\{2\}\$" "id:1022,phase:1,deny,status:403,log,msg:'leakages attack detected'" 6 | SecRule REQUEST_URI "\(\?:<\(\?:TITLE>Index\ of\.\*\?Index\ of\.\*\?Index\ of\|>\[To\ Parent\ Directory\]
\)" "id:1020,phase:1,deny,status:403,log,msg:'leakages attack detected'" 7 | -------------------------------------------------------------------------------- /waf_patterns/apache/rfi.conf: -------------------------------------------------------------------------------- 1 | # Apache ModSecurity rules for RFI 2 | SecRuleEngine On 3 | 4 | SecRule REQUEST_URI "!@endsWith\ \.%\{request_headers\.host\}" "id:1043,phase:1,deny,status:403,log,msg:'rfi attack detected'" 5 | SecRule REQUEST_URI "!@endsWith\ \.%\{request_headers\.host\}" "id:1044,phase:1,deny,status:403,log,msg:'rfi attack detected'" 6 | SecRule REQUEST_URI "\^\(\?i:file\|ftps\?\|https\?\)://\(\?:d\{1,3\}\.d\{1,3\}\.d\{1,3\}\.d\{1,3\}\)" "id:1042,phase:1,deny,status:403,log,msg:'rfi attack detected'" 7 | -------------------------------------------------------------------------------- /waf_patterns/nginx/rfi.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for RFI 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_rfi { 6 | default 0; 7 | "~*^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})" 1; 8 | "~*!@endsWith .%{request_headers.host}" 1; 9 | } 10 | 11 | if ($waf_block_rfi) { 12 | return 403; 13 | # Log the blocked request (optional) 14 | # access_log /var/log/nginx/waf_blocked.log; 15 | } 16 | 17 | -------------------------------------------------------------------------------- /waf_patterns/nginx/leakages.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for LEAKAGES 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_leakages { 6 | default 0; 7 | "~*^#!s?/" 1; 8 | "~*^5d{2}$" 1; 9 | "~*(?:<(?:TITLE>Index of.*?Index of.*?Index of|>[To Parent Directory]
)" 1; 10 | } 11 | 12 | if ($waf_block_leakages) { 13 | return 403; 14 | # Log the blocked request (optional) 15 | # access_log /var/log/nginx/waf_blocked.log; 16 | } 17 | 18 | -------------------------------------------------------------------------------- /waf_patterns/nginx/exceptions.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for EXCEPTIONS 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_exceptions { 6 | default 0; 7 | "~*@streq GET /" 1; 8 | "~*@endsWith (internal dummy connection)" 1; 9 | "~*^(?:GET /|OPTIONS *) HTTP/[12].[01]$" 1; 10 | "~*@ipMatch 127.0.0.1,::1" 1; 11 | } 12 | 13 | if ($waf_block_exceptions) { 14 | return 403; 15 | # Log the blocked request (optional) 16 | # access_log /var/log/nginx/waf_blocked.log; 17 | } 18 | 19 | -------------------------------------------------------------------------------- /waf_patterns/nginx/correlation.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for CORRELATION 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_correlation { 6 | default 0; 7 | "~*@ge 5" 1; 8 | "~*@ge %{tx.inbound_anomaly_score_threshold}" 1; 9 | "~*@ge %{tx.outbound_anomaly_score_threshold}" 1; 10 | "~*@gt 0" 1; 11 | "~*@eq 0" 1; 12 | } 13 | 14 | if ($waf_block_correlation) { 15 | return 403; 16 | # Log the blocked request (optional) 17 | # access_log /var/log/nginx/waf_blocked.log; 18 | } 19 | 20 | -------------------------------------------------------------------------------- /waf_patterns/nginx/initialization.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for INITIALIZATION 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_initialization { 6 | default 0; 7 | "~*^[a-f]*([0-9])[a-f]*([0-9])" 1; 8 | "~*@eq 100" 1; 9 | "~*@eq 1" 1; 10 | "~*!@rx (?:URLENCODED|MULTIPART|XML|JSON)" 1; 11 | "~*^.*$" 1; 12 | "~*@eq 0" 1; 13 | } 14 | 15 | if ($waf_block_initialization) { 16 | return 403; 17 | # Log the blocked request (optional) 18 | # access_log /var/log/nginx/waf_blocked.log; 19 | } 20 | 21 | -------------------------------------------------------------------------------- /waf_patterns/nginx/evaluation.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for EVALUATION 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_evaluation { 6 | default 0; 7 | "~*@ge 3" 1; 8 | "~*@ge 2" 1; 9 | "~*@ge %{tx.inbound_anomaly_score_threshold}" 1; 10 | "~*@ge 4" 1; 11 | "~*@eq 1" 1; 12 | "~*@ge %{tx.outbound_anomaly_score_threshold}" 1; 13 | "~*@ge 1" 1; 14 | } 15 | 16 | if ($waf_block_evaluation) { 17 | return 403; 18 | # Log the blocked request (optional) 19 | # access_log /var/log/nginx/waf_blocked.log; 20 | } 21 | 22 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature request 3 | about: Suggest an idea for this project 4 | title: '' 5 | labels: '' 6 | assignees: '' 7 | 8 | --- 9 | 10 | **Is your feature request related to a problem? Please describe.** 11 | A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] 12 | 13 | **Describe the solution you'd like** 14 | A clear and concise description of what you want to happen. 15 | 16 | **Describe alternatives you've considered** 17 | A clear and concise description of any alternative solutions or features you've considered. 18 | 19 | **Additional context** 20 | Add any other context or screenshots about the feature request here. 21 | -------------------------------------------------------------------------------- /waf_patterns/nginx/generic.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for GENERIC 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_generic { 6 | default 0; 7 | "~*[s*constructors*]" 1; 8 | "~*@{.*}" 1; 9 | "~*while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|\"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|\"[^\"]+\"|'[^']+'|`[^`]+`)).*)" 1; 10 | } 11 | 12 | if ($waf_block_generic) { 13 | return 403; 14 | # Log the blocked request (optional) 15 | # access_log /var/log/nginx/waf_blocked.log; 16 | } 17 | 18 | -------------------------------------------------------------------------------- /waf_patterns/apache/exceptions.conf: -------------------------------------------------------------------------------- 1 | # Apache ModSecurity rules for EXCEPTIONS 2 | SecRuleEngine On 3 | 4 | SecRule REQUEST_URI "@streq\ GET\ /" "id:1283,phase:1,deny,status:403,log,msg:'exceptions attack detected'" 5 | SecRule REQUEST_URI "@ipMatch\ 127\.0\.0\.1,::1" "id:1284,phase:1,deny,status:403,log,msg:'exceptions attack detected'" 6 | SecRule REQUEST_URI "\^\(\?:GET\ /\|OPTIONS\ \*\)\ HTTP/\[12\]\.\[01\]\$" "id:1287,phase:1,deny,status:403,log,msg:'exceptions attack detected'" 7 | SecRule REQUEST_URI "@ipMatch\ 127\.0\.0\.1,::1" "id:1285,phase:1,deny,status:403,log,msg:'exceptions attack detected'" 8 | SecRule REQUEST_URI "@endsWith\ \(internal\ dummy\ connection\)" "id:1286,phase:1,deny,status:403,log,msg:'exceptions attack detected'" 9 | -------------------------------------------------------------------------------- /waf_patterns/apache/generic.conf: -------------------------------------------------------------------------------- 1 | # Apache ModSecurity rules for GENERIC 2 | SecRuleEngine On 3 | 4 | SecRule REQUEST_URI "\[s\*constructors\*\]" "id:1227,phase:1,deny,status:403,log,msg:'generic attack detected'" 5 | SecRule REQUEST_URI "@\{\.\*\}" "id:1228,phase:1,deny,status:403,log,msg:'generic attack detected'" 6 | SecRule REQUEST_URI "while\[sv\]\*\(\[sv\(\]\*\(\?:!\+\(\?:false\|null\|undefined\|NaN\|\[\+\-\]\?0\|"\{2\}\|'\{2\}\|`\{2\}\)\|\(\?:!!\)\*\(\?:\(\?:t\(\?:rue\|his\)\|\[\+\-\]\?\(\?:Infinity\|\[1\-9\]\[0\-9\]\*\)\|new\ \[A\-Za\-z\]\[0\-9A\-Z_a\-z\]\*\|window\|String\|\(\?:Boolea\|Functio\)n\|Object\|Array\)b\|\{\.\*\}\|\[\.\*\]\|"\[\^"\]\+"\|'\[\^'\]\+'\|`\[\^`\]\+`\)\)\.\*\)" "id:1226,phase:1,deny,status:403,log,msg:'generic attack detected'" 7 | -------------------------------------------------------------------------------- /waf_patterns/nginx/fixation.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for FIXATION 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_fixation { 6 | default 0; 7 | "~*(?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)" 1; 8 | "~*!@endsWith %{request_headers.host}" 1; 9 | "~*^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" 1; 10 | "~*^(?:ht|f)tps?://(.*?)/" 1; 11 | "~*@eq 0" 1; 12 | } 13 | 14 | if ($waf_block_fixation) { 15 | return 403; 16 | # Log the blocked request (optional) 17 | # access_log /var/log/nginx/waf_blocked.log; 18 | } 19 | 20 | -------------------------------------------------------------------------------- /waf_patterns/nginx/iis.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for IIS 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_iis { 6 | default 0; 7 | "~*!@rx ^404$" 1; 8 | "~*(?:Microsoft OLE DB Provider for SQL Server(?:.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)
Timeout expired
)|

internal server error

.*?

part of the server has crashed or it has a configuration error.

|cannot connect to the server: timed out)" 1; 9 | "~*[a-z]:x5cinetpubb" 1; 10 | "~*bServer Error in.{0,50}?bApplicationb" 1; 11 | } 12 | 13 | if ($waf_block_iis) { 14 | return 403; 15 | # Log the blocked request (optional) 16 | # access_log /var/log/nginx/waf_blocked.log; 17 | } 18 | 19 | -------------------------------------------------------------------------------- /waf_patterns/apache/iis.conf: -------------------------------------------------------------------------------- 1 | # Apache ModSecurity rules for IIS 2 | SecRuleEngine On 3 | 4 | SecRule REQUEST_URI "\(\?:Microsoft\ OLE\ DB\ Provider\ for\ SQL\ Server\(\?:\.\{1,20\}\?error\ '800\(\?:04005\|40e31\)'\.\{1,40\}\?Timeout\ expired\|\ \(0x80040e31\)
Timeout\ expired
\)\|

internal\ server\ error

\.\*\?

part\ of\ the\ server\ has\ crashed\ or\ it\ has\ a\ configuration\ error\.

\|cannot\ connect\ to\ the\ server:\ timed\ out\)" "id:1245,phase:1,deny,status:403,log,msg:'iis attack detected'" 5 | SecRule REQUEST_URI "\[a\-z\]:x5cinetpubb" "id:1244,phase:1,deny,status:403,log,msg:'iis attack detected'" 6 | SecRule REQUEST_URI "bServer\ Error\ in\.\{0,50\}\?bApplicationb" "id:1247,phase:1,deny,status:403,log,msg:'iis attack detected'" 7 | SecRule REQUEST_URI "!@rx\ \^404\$" "id:1246,phase:1,deny,status:403,log,msg:'iis attack detected'" 8 | -------------------------------------------------------------------------------- /waf_patterns/apache/detection.conf: -------------------------------------------------------------------------------- 1 | # Apache ModSecurity rules for DETECTION 2 | SecRuleEngine On 3 | 4 | SecRule REQUEST_URI "@lt 1" "id:1176,phase:1,deny,status:403,log,msg:'detection attack detected'" 5 | SecRule REQUEST_URI "@lt 1" "id:1177,phase:1,deny,status:403,log,msg:'detection attack detected'" 6 | SecRule REQUEST_URI "@pmFromFile scanners-user-agents.data" "id:1178,phase:1,deny,status:403,log,msg:'detection attack detected'" 7 | SecRule REQUEST_URI "@lt 2" "id:1179,phase:1,deny,status:403,log,msg:'detection attack detected'" 8 | SecRule REQUEST_URI "@lt 2" "id:1180,phase:1,deny,status:403,log,msg:'detection attack detected'" 9 | SecRule REQUEST_URI "@lt 3" "id:1181,phase:1,deny,status:403,log,msg:'detection attack detected'" 10 | SecRule REQUEST_URI "@lt 3" "id:1182,phase:1,deny,status:403,log,msg:'detection attack detected'" 11 | SecRule REQUEST_URI "@lt 4" "id:1183,phase:1,deny,status:403,log,msg:'detection attack detected'" 12 | SecRule REQUEST_URI "@lt 4" "id:1184,phase:1,deny,status:403,log,msg:'detection attack detected'" 13 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Create a report to help us improve 4 | title: '' 5 | labels: '' 6 | assignees: '' 7 | 8 | --- 9 | 10 | **Describe the bug** 11 | A clear and concise description of what the bug is. 12 | 13 | **To Reproduce** 14 | Steps to reproduce the behavior: 15 | 1. Run command '...' 16 | 2. With configuration '...' 17 | 3. See error 18 | 19 | **Expected behavior** 20 | A clear and concise description of what you expected to happen. 21 | 22 | **Error messages/logs** 23 | If applicable, add error messages or log output to help explain your problem. 24 | 25 | ``` 26 | Paste error messages or logs here 27 | ``` 28 | 29 | **Environment (please complete the following information):** 30 | - OS: [e.g. Ubuntu 22.04, macOS 13, Windows 11] 31 | - Python Version: [e.g. 3.11.0] 32 | - Web Server: [e.g. Nginx 1.22, Apache 2.4, Traefik 2.9, HAProxy 2.6] 33 | - Installation Method: [e.g. built from source, downloaded pre-generated configs] 34 | 35 | **Additional context** 36 | Add any other context about the problem here. 37 | -------------------------------------------------------------------------------- /waf_patterns/apache/correlation.conf: -------------------------------------------------------------------------------- 1 | # Apache ModSecurity rules for CORRELATION 2 | SecRuleEngine On 3 | 4 | SecRule REQUEST_URI "@ge\ 5" "id:1338,phase:1,deny,status:403,log,msg:'correlation attack detected'" 5 | SecRule REQUEST_URI "@gt\ 0" "id:1344,phase:1,deny,status:403,log,msg:'correlation attack detected'" 6 | SecRule REQUEST_URI "@eq\ 0" "id:1337,phase:1,deny,status:403,log,msg:'correlation attack detected'" 7 | SecRule REQUEST_URI "@ge\ %\{tx\.outbound_anomaly_score_threshold\}" "id:1341,phase:1,deny,status:403,log,msg:'correlation attack detected'" 8 | SecRule REQUEST_URI "@eq\ 0" "id:1339,phase:1,deny,status:403,log,msg:'correlation attack detected'" 9 | SecRule REQUEST_URI "@ge\ %\{tx\.inbound_anomaly_score_threshold\}" "id:1342,phase:1,deny,status:403,log,msg:'correlation attack detected'" 10 | SecRule REQUEST_URI "@ge\ %\{tx\.outbound_anomaly_score_threshold\}" "id:1343,phase:1,deny,status:403,log,msg:'correlation attack detected'" 11 | SecRule REQUEST_URI "@ge\ %\{tx\.inbound_anomaly_score_threshold\}" "id:1340,phase:1,deny,status:403,log,msg:'correlation attack detected'" 12 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2024 fab 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /waf_patterns/apache/fixation.conf: -------------------------------------------------------------------------------- 1 | # Apache ModSecurity rules for FIXATION 2 | SecRuleEngine On 3 | 4 | SecRule REQUEST_URI "@eq\ 0" "id:1225,phase:1,deny,status:403,log,msg:'fixation attack detected'" 5 | SecRule REQUEST_URI "\^\(\?:jsessionid\|aspsessionid\|asp\.net_sessionid\|phpsession\|phpsessid\|weblogicsession\|session_id\|session\-id\|cfid\|cftoken\|cfsid\|jservsession\|jwsession\)\$" "id:1221,phase:1,deny,status:403,log,msg:'fixation attack detected'" 6 | SecRule REQUEST_URI "\^\(\?:jsessionid\|aspsessionid\|asp\.net_sessionid\|phpsession\|phpsessid\|weblogicsession\|session_id\|session\-id\|cfid\|cftoken\|cfsid\|jservsession\|jwsession\)\$" "id:1224,phase:1,deny,status:403,log,msg:'fixation attack detected'" 7 | SecRule REQUEST_URI "!@endsWith\ %\{request_headers\.host\}" "id:1223,phase:1,deny,status:403,log,msg:'fixation attack detected'" 8 | SecRule REQUEST_URI "\^\(\?:ht\|f\)tps\?://\(\.\*\?\)/" "id:1222,phase:1,deny,status:403,log,msg:'fixation attack detected'" 9 | SecRule REQUEST_URI "\(\?i:\.cookieb\.\*\?;W\*\?\(\?:expires\|domain\)W\*\?=\|bhttp\-equivW\+set\-cookieb\)" "id:1220,phase:1,deny,status:403,log,msg:'fixation attack detected'" 10 | -------------------------------------------------------------------------------- /waf_patterns/nginx/php.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for PHP 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_php { 6 | default 0; 7 | "~*.*.ph(?:pd*|tml|ar|ps|t|pt).*$" 1; 8 | "~*[oOcC]:d+:\".+?\":d+:{.*}" 1; 9 | "~*(?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b" 1; 10 | "~*.*.(?:phpd*|phtml)..*$" 1; 11 | "~*@pm =" 1; 12 | "~*@pm ?>" 1; 13 | "~*(?i)" "id:1256,phase:1,deny,status:403,log,msg:'php attack detected'" 14 | SecRule REQUEST_URI "\(\?i\)<\?\(\?:=\|php\)\?s\+" "id:1100,phase:1,deny,status:403,log,msg:'php attack detected'" 15 | -------------------------------------------------------------------------------- /waf_patterns/nginx/sql.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for SQL 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_sql { 6 | default 0; 7 | "~*(?i:An illegal character has been found in the statement|com.informix.jdbc|Exception.*Informix)" 1; 8 | "~*(?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)" 1; 9 | "~*(?i)Exception (?:condition )?d+. Transaction rollback." 1; 10 | "~*(?i)(?:System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*WSystem.Data.SqlClient.|Conversion failed when converting the varchar value .*? to data type int.)" 1; 11 | "~*(?i)Dynamic SQL Error" 1; 12 | "~*(?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)" 1; 13 | "~*(?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)" 1; 14 | "~*(?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)" 1; 15 | "~*(?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])" 1; 16 | "~*(?i:Warning: ibase_|Unexpected end of command in statement)" 1; 17 | "~*(?i)org.hsqldb.jdbc" 1; 18 | "~*(?i:Warning.*ingres_|Ingres SQLSTATE|IngresW.*Driver)" 1; 19 | "~*(?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)" 1; 20 | } 21 | 22 | if ($waf_block_sql) { 23 | return 403; 24 | # Log the blocked request (optional) 25 | # access_log /var/log/nginx/waf_blocked.log; 26 | } 27 | 28 | -------------------------------------------------------------------------------- /waf_patterns/haproxy/waf.acl: -------------------------------------------------------------------------------- 1 | # HAProxy WAF ACL rules 2 | 3 | # Rules for User-Agent 4 | acl block_initialization_no_id hdr_reg(User-Agent) -i ^\.*\$ 5 | acl block_enforcement_no_id hdr_sub(User-Agent) -i str -m !reg %{tx.allowed_methods} 6 | acl block_fixation_no_id hdr_reg(User-Agent) -i (?i:.cookieb\.*?;W*?(expires|domain)W*?=|bhttp-equivW+set-cookieb) 7 | acl block_attack_no_id hdr_sub(User-Agent) -i str -m !str 0 8 | acl block_rfi_no_id hdr_reg(User-Agent) -i ^(?i:file|ftps?|https?)://(d{1,3}.d{1,3}.d{1,3}.d{1,3}) 9 | acl block_exceptions_no_id hdr_sub(User-Agent) -i str -m str GET / 10 | acl block_lfi_no_id hdr_reg(User-Agent) -i ((^|[x5c/;])\.{2,3}[x5c/;]|[x5c/;]\.{2,3}([x5c/;]|\$)) 11 | acl block_generic_no_id hdr_reg(User-Agent) -i while[sv]*([sv(]*(!+(false|null|undefined|NaN|[+-]?0|"{2}|'{2}|`{2})|(!!)*((t(rue|his)|[+-]?(Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(Boolea|Functio)n|Object|Array)b|{\.*}|[\.*]|"[^"]+"|'[^']+'|`[^`]+`))\.*) 12 | acl block_xss_no_id hdr_reg(User-Agent) -i ]*>[sS]*? 13 | acl block_php_no_id hdr_reg(User-Agent) -i (](\.*)|/[0-9A-Z_a-z]*[!?\.+] 15 | acl block_sqli_no_id hdr_reg(User-Agent) -i (?i:sleep(s*?d*?s*?)|benchmark(\.*?,\.*?)) 16 | acl block_java_no_id hdr_reg(User-Agent) -i java.lang\.(runtime|processbuilder) 17 | acl block_sql_no_id hdr_reg(User-Agent) -i (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver]) 18 | acl block_leakages_no_id hdr_reg(User-Agent) -i (<(TITLE>Index of\.*?Index of\.*?Index of|>[To Parent Directory]
) 19 | acl block_shells_no_id hdr_reg(User-Agent) -i (r57 Shell Version [0-9\.]+|r57 shell) 20 | acl block_iis_no_id hdr_reg(User-Agent) -i [a-z]:x5cinetpubb 21 | 22 | 23 | # Deny Actions 24 | http-request log if block_initialization_no_id or block_enforcement_no_id or block_fixation_no_id or block_attack_no_id or block_rfi_no_id or block_exceptions_no_id or block_lfi_no_id or block_generic_no_id or block_xss_no_id or block_php_no_id or block_rce_no_id or block_sqli_no_id or block_java_no_id or block_sql_no_id or block_leakages_no_id or block_shells_no_id or block_iis_no_id 25 | 26 | -------------------------------------------------------------------------------- /waf_patterns/nginx/shells.conf: -------------------------------------------------------------------------------- 1 | # Nginx WAF rules for SHELLS 2 | # Automatically generated from OWASP rules. 3 | # Include this file in your server or location block. 4 | 5 | map $request_uri $waf_block_shells { 6 | default 0; 7 | "~*^n n azrail [0-9.]+ by C-W-M" 1; 8 | "~*SimAttacker - (?:Version|Vrsion) : [0-9.]+ -" 1; 9 | "~*^<html>n<title>.*? ~ Shell Inn