Created
November 7, 2018 20:06
-
-
Save notfalsedev/9f912b03f0a7d64d591380a2b818abf3 to your computer and use it in GitHub Desktop.
Block MySQL injections, RFI, base64, etc.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Block MySQL injections, RFI, base64, etc. | |
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR] | |
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR] | |
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR] | |
RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR] | |
RewriteCond %{QUERY_STRING} (\.\./|\.\.) [OR] | |
RewriteCond %{QUERY_STRING} ftp\: [NC,OR] | |
RewriteCond %{QUERY_STRING} http\: [NC,OR] | |
RewriteCond %{QUERY_STRING} https\: [NC,OR] | |
RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR] | |
RewriteCond %{QUERY_STRING} ^(.)/self/(.)$ [NC,OR] | |
RewriteCond %{QUERY_STRING} ^(.)cPath=http://(.)$ [NC,OR] | |
RewriteCond %{QUERY_STRING} (\<|%3C).script.(\>|%3E) [NC,OR] | |
RewriteCond %{QUERY_STRING} (<|%3C)([^s]s)+cript.(>|%3E) [NC,OR] | |
RewriteCond %{QUERY_STRING} (\<|%3C).iframe.(\>|%3E) [NC,OR] | |
RewriteCond %{QUERY_STRING} (<|%3C)([^i]i)+frame.(>|%3E) [NC,OR] | |
RewriteCond %{QUERY_STRING} base64_encode.\(.\) [NC,OR] | |
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]\([^)]\) [NC,OR] | |
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR] | |
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR] | |
RewriteCond %{QUERY_STRING} ^.(\[|\]|\(|\)|<|>). [NC,OR] | |
RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR] | |
RewriteCond %{QUERY_STRING} (\./|\../|\.../)+(motd|etc|bin) [NC,OR] | |
RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR] | |
#RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%3C|%3E|%00) [NC,OR] | |
RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR] | |
RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR] | |
RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR] | |
RewriteCond %{QUERY_STRING} (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).(/\|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR] | |
RewriteCond %{QUERY_STRING} (sp_executesql) [NC] |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment