27 lines
1.1 KiB
Plaintext
27 lines
1.1 KiB
Plaintext
# custom.conf —— 本地自定义规则示例
|
||
# ID 段：100000-199999
|
||
|
||
# 100001: 拦截 SQL 注入特征（UNION SELECT）
|
||
#SecRule REQUEST_URI|ARGS "@rx (?i)union[\s/*]+select" \
|
||
# "id:100001,phase:1,deny,status:403,log,msg:'SQL injection: UNION SELECT'"
|
||
|
||
## 100002: 拦截 SQL 注释符
|
||
#SecRule ARGS "@rx (?i)(--|#|/\*.*\*/)" \
|
||
# "id:100002,phase:2,deny,status:403,log,msg:'SQL injection: comment'"
|
||
|
||
# 100003: 拦截 XSS 标签
|
||
#SecRule ARGS|REQUEST_HEADERS "@rx (?i)<script|javascript:|onerror=|onload=" \
|
||
# "id:100003,phase:2,deny,status:403,log,msg:'XSS probe'"
|
||
|
||
# 100004: 路径遍历
|
||
#SecRule REQUEST_URI|ARGS "@rx (?i)\.\./|\.\.%2f|\.\.%5c" \
|
||
# "id:100004,phase:1,deny,status:403,log,msg:'Path traversal'"
|
||
|
||
# 100005: 命令注入常见关键字
|
||
#SecRule ARGS "@rx (?i)(;|\|)&?\s*(cat|ls|id|whoami|uname|wget|curl|bash|sh)\s" \
|
||
# "id:100005,phase:2,deny,status:403,log,msg:'Command injection'"
|
||
|
||
# 100006: 已知恶意扫描器 UA
|
||
#SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(nikto|sqlmap|nmap|masscan|acunetix|nessus)" \
|
||
# "id:100006,phase:1,deny,status:403,log,msg:'Malicious scanner UA'"
|