# custom.conf —— 本地自定义规则示例
# ID 段：100000-199999

# 100001: 拦截 SQL 注入特征（UNION SELECT）
SecRule REQUEST_URI|ARGS "@rx (?i)union[\s/*]+select" \
    "id:100001,phase:1,deny,status:403,log,msg:'SQL injection: UNION SELECT'"

# 100002: 拦截 SQL 注释符
SecRule ARGS "@rx (?i)(--|#|/\*.*\*/)" \
    "id:100002,phase:2,deny,status:403,log,msg:'SQL injection: comment'"

# 100003: 拦截 XSS 标签
SecRule ARGS|REQUEST_HEADERS "@rx (?i)<script|javascript:|onerror=|onload=" \
    "id:100003,phase:2,deny,status:403,log,msg:'XSS probe'"

# 100004: 路径遍历
SecRule REQUEST_URI|ARGS "@rx (?i)\.\./|\.\.%2f|\.\.%5c" \
    "id:100004,phase:1,deny,status:403,log,msg:'Path traversal'"

# 100005: 命令注入常见关键字
SecRule ARGS "@rx (?i)(;|\|)&?\s*(cat|ls|id|whoami|uname|wget|curl|bash|sh)\s" \
    "id:100005,phase:2,deny,status:403,log,msg:'Command injection'"

# 100006: 已知恶意扫描器 UA
SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(nikto|sqlmap|nmap|masscan|acunetix|nessus)" \
    "id:100006,phase:1,deny,status:403,log,msg:'Malicious scanner UA'"