Home›Help›Trac

Changeset 14722 for trunk/plugins


Ignore:
Timestamp:
12/06/10 21:55:02 (18 months ago)
Author:
Alexander Trofimov
Message:

Ticket #2312

Location:
trunk/plugins/phpids/IDS
Files:
2 added
16 edited

Legend:

Unmodified
Added
Removed

  • trunk/plugins/phpids/IDS/Caching/Database.php

    r13571 r14722  
    107107     * 
    108108     * @param string $type caching type 
    109      * @param array $init the IDS_Init object 
     109     * @param object $init the IDS_Init object 
    110110     *  
    111111     * @return void 
    … …  
    122122     * Returns an instance of this class 
    123123     * 
    124      * @param string $type caching type 
    125      * @param array  $init the IDS_Init object 
     124     * @static 
     125     * @param  string $type caching type 
     126     * @param  object $init the IDS_Init object 
    126127     *  
    127128     * @return object $this 
    … …  
    194195 
    195196        } catch (PDOException $e) { 
    196             die('PDOException: ' . $e->getMessage()); 
     197            throw new PDOException('PDOException: ' . $e->getMessage()); 
    197198        } 
    198199        return false; 
    … …  
    202203     * Connect to database and return a handle 
    203204     * 
    204      * @return object dbh 
     205     * @return object PDO 
     206     * @throws Exception if connection parameters are faulty 
    205207     * @throws PDOException if a db error occurred 
    206208     */ 
    … …  
    227229            ); 
    228230            $handle->setAttribute( 
    229                 PDO::MYSQL_ATTR_USE_BUFFERED_QUERY, true 
     231                PDO::MYSQL_ATTR_USE_BUFFERED_QUERY, true 
    230232            ); 
    231233 
    232234        } catch (PDOException $e) { 
    233             die('PDOException: ' . $e->getMessage()); 
     235            throw new PDOException('PDOException: ' . $e->getMessage()); 
    234236        } 
    235237        return $handle; 
    … …  
    242244     * @param array  $data   the caching data 
    243245     *  
    244      * @return object dbh 
     246     * @return object PDO 
    245247     * @throws PDOException if a db error occurred 
    246248     */     
    … …  
    276278     
    277279        } catch (PDOException $e) { 
    278             die('PDOException: ' . $e->getMessage()); 
     280            throw new PDOException('PDOException: ' . $e->getMessage()); 
    279281        }     
    280282    } 

  • trunk/plugins/phpids/IDS/Caching/Factory.php

    r13571 r14722  
    5555     * Factory method 
    5656     * 
    57      * @param array $init the IDS_Init object 
    58      * @param string $type the caching type 
     57     * @param  object $init the IDS_Init object 
     58     * @param  string $type the caching type 
    5959     *  
    6060     * @return object the caching facility 

  • trunk/plugins/phpids/IDS/Caching/File.php

    r13571 r14722  
    8484     * Constructor 
    8585     * 
    86      * @param string $type caching type 
    87      * @param array $init the IDS_Init object 
     86     * @param  string $type caching type 
     87     * @param  object $init the IDS_Init object 
    8888     *  
    8989     * @return void 
    … …  
    106106     * Returns an instance of this class 
    107107     * 
    108      * @param string $type caching type 
    109      * @param array $init the IDS_Init object 
     108     * @param  string $type caching type 
     109     * @param  object $init the IDS_Init object 
    110110     *  
    111111     * @return object $this 

  • trunk/plugins/phpids/IDS/Caching/Memcached.php

    r13571 r14722  
    9292     * Constructor 
    9393     * 
    94      * @param string $type caching type 
    95      * @param array  $init the IDS_Init object 
     94     * @param  string $type caching type 
     95     * @param  array  $init the IDS_Init object 
    9696     *  
    97      * @throws Exception if necessary files aren't writeable 
    9897     * @return void 
    9998     */ 
    … …  
    110109     * Returns an instance of this class 
    111110     * 
    112      * @param string $type caching type 
    113      * @param array $init the IDS_Init object 
     111     * @param  string $type caching type 
     112     * @param  object $init the IDS_Init object 
    114113     *  
    115114     * @return object $this 
    … …  
    128127     * Writes cache data 
    129128     * 
    130      * @param array $data the caching data 
     129     * @param  array $data the caching data 
    131130     *  
    132      * @throws Exception if necessary files aren't writeable 
    133131     * @return object $this 
    134132     */ 

  • trunk/plugins/phpids/IDS/Caching/Session.php

    r13571 r14722  
    7777     * Constructor 
    7878     * 
    79      * @param string $type caching type 
    80      * @param array $init the IDS_Init object 
     79     * @param  string $type caching type 
     80     * @param  object $init the IDS_Init object 
    8181     *  
    8282     * @return void 
    … …  
    9191     * Returns an instance of this class 
    9292     * 
    93      * @param string $type   caching type 
    94      * @param array $init the IDS_Init object 
     93     * @param  string $type   caching type 
     94     * @param  object $init the IDS_Init object 
    9595     *  
    9696     * @return object $this 

  • trunk/plugins/phpids/IDS/Converter.php

    r13571 r14722  
    8787    public static function convertFromRepetition($value)  
    8888    { 
    89         // remove obvios repetition patterns 
     89        // remove obvios repetition patterns 
    9090        $value = preg_replace( 
    9191            '/(?:(.{2,})\1{32,})|(?:[+=|\-@\s]{128,})/',  
    … …  
    135135     * @return string 
    136136     */ 
    137     public static function convertFromNewLines($value) 
     137    public static function convertFromWhiteSpace($value) 
    138138    { 
    139139        //check for inline linebreaks 
    140140        $search = array('\r', '\n', '\f', '\t', '\v'); 
    141141        $value  = str_replace($search, ';', $value); 
     142 
     143        // replace replacement characters regular spaces 
     144        $value = str_replace('�', ' ', $value); 
    142145 
    143146        //convert real linebreaks 
    … …  
    260263            $value    .= "\n" . str_replace(';;', ';', $converted); 
    261264        } 
    262  
     265        // normalize obfuscated protocol handlers 
     266        $value = preg_replace( 
     267            '/(?:j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\s*)|(d\s*a\s*t\s*a\s*)/ms',  
     268            'javascript', $value 
     269        ); 
     270         
    263271        return $value; 
    264272    } 
    … …  
    295303    { 
    296304        $matches = array(); 
    297         if(preg_match_all('/(?:0x[a-f\d]{2,}[a-f\d]*)+/im', $value, $matches)) { 
    298             foreach($matches[0] as $match) { 
     305        if(preg_match_all('/(?:(?:\A|[^\d])0x[a-f\d]{2,}[a-f\d]*)+/im', $value, $matches)) { 
     306            foreach($matches[0] as $match) { 
    299307                $converted = ''; 
    300308                foreach(str_split($match, 2) as $hex_index) { 
    … …  
    325333            '(?:(?:^|\W)IN[+\s]*\([\s\d"]+[^()]*\))/ims'); 
    326334        $value   = preg_replace($pattern, '"=0', $value); 
    327         $value   = preg_replace('/\W+\s+like\s+\W+/', ' 1 like 1 ', $value); 
    328         $value   = preg_replace('/null[,\s]/ims', ',0', $value); 
     335        $value   = preg_replace('/\W+\s*like\s*\W+/ims', '1" OR "1"', $value); 
     336        $value   = preg_replace('/null[,"\s]/ims', ',0', $value); 
     337        $value   = preg_replace('/\d+\./ims', ' 1', $value); 
    329338        $value   = preg_replace('/,null/ims', ',0', $value); 
    330339        $value   = preg_replace('/(?:between|mod)/ims', 'or', $value); 
    … …  
    333342        $pattern = array('/[^\w,(]NULL|\\\N|TRUE|FALSE|UTC_TIME|' . 
    334343                         'LOCALTIME(?:STAMP)?|CURRENT_\w+|BINARY|' . 
    335                          '(?:(?:ASCII|SOUNDEX|' . 
     344                         '(?:(?:ASCII|SOUNDEX|FIND_IN_SET|' . 
    336345                         'MD5|R?LIKE)[+\s]*\([^()]+\))|(?:-+\d)/ims'); 
    337346        $value   = preg_replace($pattern, 0, $value); 
    338347        $pattern = array('/(?:NOT\s+BETWEEN)|(?:IS\s+NOT)|(?:NOT\s+IN)|' . 
    339                          '(?:XOR|\WDIV\W|\WNOT\W|<>|RLIKE(?:\s+BINARY)?)|' . 
     348                         '(?:XOR|\WDIV\W|<>|RLIKE(?:\s+BINARY)?)|' . 
    340349                         '(?:REGEXP\s+BINARY)|' . 
    341350                         '(?:SOUNDS\s+LIKE)/ims'); 
    … …  
    361370            chr(0), chr(1), chr(2), chr(3), chr(4), chr(5), 
    362371            chr(6), chr(7), chr(8), chr(11), chr(12), chr(14), 
    363             chr(15), chr(16), chr(17), chr(18), chr(19), 
    364             chr(192), chr(193), chr(238), chr(255) 
     372            chr(15), chr(16), chr(17), chr(18), chr(19), chr(24),  
     373            chr(25), chr(192), chr(193), chr(238), chr(255) 
    365374        ); 
    366375         
    367376        $value = str_replace($search, '%00', $value); 
    368         $urlencoded = urlencode($value); 
    369377 
    370378        //take care for malicious unicode characters 
    … …  
    419427        foreach ($matches[1] as $item) { 
    420428            if (isset($item) && !preg_match('/[a-f0-9]{32}/i', $item)) { 
    421                 $base64_item = base64_decode($item); 
     429                $base64_item = base64_decode($item); 
    422430                $value = str_replace($item, $base64_item, $value); 
    423431            } 
    … …  
    440448        foreach ($values as $item) { 
    441449            if (ord($item) >= 127) { 
    442                 $value = str_replace($item, 'U', $value); 
     450                $value = str_replace($item, ' ', $value); 
    443451            } 
    444452        } 
    … …  
    482490        if (!empty($matches[0])) { 
    483491            foreach ($matches[0] as $match) { 
    484                 $chr = chr(hexdec(substr($match, 2, 4)));  
     492                $chr = chr(hexdec(substr($match, 2, 4)));  
    485493                $value = str_replace($match, $chr, $value); 
    486494            } 
    … …  
    490498        return $value; 
    491499    } 
    492  
    493500 
    494501    /** 
    … …  
    608615     * This method collects and decodes proprietary encoding types 
    609616     * 
    610      * @param string      $value   the value to convert 
    611      * @param IDS_Monitor $monitor the monitor object 
     617     * @param string $value the value to convert 
    612618     * 
    613619     * @static 
    … …  
    653659        $value = preg_replace('/(\w\s)&\s(\w)/', '$1$2', $value); 
    654660         
    655         //normalize JS backspace linebreaks 
    656         $value = preg_replace('/^\/|\/$|,\/\n|\/,|[\\\]+\s{4}/', null, $value); 
     661        //normalize escaped RegExp modifiers 
     662        $value = preg_replace('/\/\\\(\w)/', '/$1', $value);         
    657663         
    658664        return $value; 
    … …  
    671677    { 
    672678        $threshold = 3.49; 
    673  
    674679        if (strlen($value) > 25) { 
    675680             
    … …  
    677682            $tmp_value = preg_replace('/\s{4}|==$/m', null, $value); 
    678683            $tmp_value = preg_replace( 
    679                 '/\s{4}|[\p{L}\d\+\-,.%()]{8,}/m',  
     684                '/\s{4}|[\p{L}\d\+\-=,.%()]{8,}/m',  
    680685                'aaa',  
    681686                $tmp_value 
    … …  
    686691            $tmp_value = preg_replace('/"[\p{L}\d\s]+"/m', null, $tmp_value); 
    687692 
    688             $stripped_length = strlen(preg_replace('/[\d\s\p{L}\.:,%&\/><\-)!]+/m', 
     693            $stripped_length = strlen(preg_replace('/[\d\s\p{L}\.:,%&\/><\-)!|]+/m', 
    689694                null, $tmp_value)); 
    690695            $overall_length  = strlen( 

  • trunk/plugins/phpids/IDS/Event.php

    r13571 r14722  
    219219     * Returns an iterator to iterate over the appended filters. 
    220220     * 
    221      * @return Iterator|IteratorAggregate 
     221     * @return ArrayObject the filter collection 
    222222     */ 
    223223    public function getIterator()  

  • trunk/plugins/phpids/IDS/Filter.php

    r13571 r14722  
    8484     * Constructor 
    8585     * 
     86     * @param integer $id          filter id 
    8687     * @param mixed   $rule        filter rule 
    8788     * @param string  $description filter description 
    … …  
    9394    public function __construct($id, $rule, $description, array $tags, $impact)  
    9495    { 
    95         $this->id          = $id; 
     96        $this->id          = $id; 
    9697        $this->rule        = $rule; 
    9798        $this->tags        = $tags; 
    … …  
    174175    public function getId()  
    175176    { 
    176         return $this->id; 
     177        return $this->id; 
    177178    } 
    178179} 

  • trunk/plugins/phpids/IDS/Log/Database.php

    r13571 r14722  
    4545      `value` text NOT null, 
    4646      `page` varchar(255) NOT null, 
     47      `tags` varchar(128) NOT null, 
    4748      `ip` varchar(15) NOT null, 
    4849      `impact` int(11) unsigned NOT null, 
    … …  
    143144     *  
    144145     * @return void 
     146     * @throws PDOException if a db error occurred 
    145147     */ 
    146148    protected function __construct($config)  
    … …  
    161163 
    162164        // determine correct IP address 
    163         if ($_SERVER['REMOTE_ADDR'] != '127.0.0.1') { 
     165        if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { 
     166            $this->ip = $_SERVER['HTTP_X_FORWARDED_FOR']; 
     167        } else { 
    164168            $this->ip = $_SERVER['REMOTE_ADDR']; 
    165         } elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { 
    166             $this->ip = $_SERVER['HTTP_X_FORWARDED_FOR']; 
    167169        } 
    168170 
    … …  
    179181                    value, 
    180182                    page, 
     183                    tags, 
    181184                    ip, 
    182185                    impact, 
    … …  
    188191                    :value, 
    189192                    :page, 
     193                    :tags, 
    190194                    :ip, 
    191195                    :impact, 
    … …  
    196200 
    197201        } catch (PDOException $e) { 
    198             die('PDOException: ' . $e->getMessage()); 
     202            throw new PDOException('PDOException: ' . $e->getMessage()); 
    199203        } 
    200204    } 
    … …  
    206210     * an array. 
    207211     * 
    208      * @param mixed $config IDS_Init | array 
    209      * @param string the class name to use 
     212     * @param  mixed  $config    IDS_Init | array 
     213     * @param  string $classname the class name to use 
    210214     *  
    211215     * @return object $this 
    … …  
    261265            $value  = $event->getValue(); 
    262266            $impact = $event->getImpact(); 
     267            $tags   = implode(', ', $event->getTags()); 
    263268 
    264269            $this->statement->bindParam('name', $name); 
    265270            $this->statement->bindParam('value', $value); 
    266271            $this->statement->bindParam('page', $page); 
     272            $this->statement->bindParam('tags', $tags); 
    267273            $this->statement->bindParam('ip', $ip); 
    268274            $this->statement->bindParam('impact', $impact); 

  • trunk/plugins/phpids/IDS/Log/Email.php

    r13571 r14722  
    176176     * IDS_Init or an array. 
    177177     * 
    178      * @param mixed  $config IDS_Init | array 
    179      * @param string the class name to use 
     178     * @param  mixed  $config    IDS_Init | array 
     179     * @param  string $classname the class name to use 
    180180     * 
    181181     * @return object $this 
    … …  
    282282            $attackedParameters .= $event->getName() . '=' . 
    283283                ((!isset($this->urlencode) ||$this->urlencode)  
    284                     ? urlencode($event->getValue())  
    285                     : $event->getValue()) . ", "; 
     284                    ? urlencode($event->getValue())  
     285                    : $event->getValue()) . ", "; 
    286286        } 
    287287 
    … …  
    293293                       $this->ip, 
    294294                       date('c'), 
    295                        $event->getImpact(), 
     295                       $data->getImpact(), 
    296296                       join(' ', $data->getTags()), 
    297297                       trim($attackedParameters), 
    298                        urlencode($_SERVER['REQUEST_URI']), 
     298                       htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, 'UTF-8'), 
    299299                       $_SERVER['SERVER_ADDR']); 
    300300    } 

  • trunk/plugins/phpids/IDS/Log/File.php

    r13571 r14722  
    8888 
    8989        // determine correct IP address 
    90         if ($_SERVER['REMOTE_ADDR'] != '127.0.0.1') { 
     90        if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { 
     91            $this->ip = $_SERVER['HTTP_X_FORWARDED_FOR']; 
     92        } else { 
    9193            $this->ip = $_SERVER['REMOTE_ADDR']; 
    92         } elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { 
    93             $this->ip = $_SERVER['HTTP_X_FORWARDED_FOR']; 
    9494        } 
    9595 
    … …  
    104104     * instance for each file can be initiated. 
    105105     * 
    106      * @param mixed $config IDS_Init or path to a file 
    107      * @param string the class name to use 
     106     * @param  mixed  $config    IDS_Init or path to a file 
     107     * @param  string $classname the class name to use 
    108108     *  
    109109     * @return object $this 
    … …  
    159159                              $this->ip, 
    160160                              date('c'), 
    161                               $event->getImpact(), 
     161                              $data->getImpact(), 
    162162                              join(' ', $data->getTags()), 
    163163                              trim($attackedParameters), 
    … …  
    171171     * Stores given data into a file 
    172172     * 
    173      * @param object $data IDS_Report 
     173     * @param  object $data IDS_Report 
    174174     *  
    175175     * @throws Exception if the logfile isn't writeable 
    176      * @return mixed 
     176     * @return boolean 
    177177     */ 
    178178    public function execute(IDS_Report $data)  

  • trunk/plugins/phpids/IDS/Monitor.php

    r13571 r14722  
    304304 
    305305        // check if this field is part of the exceptions 
    306         if (is_array($this->exceptions) 
    307             && in_array($key, $this->exceptions, true)) { 
    308             return false; 
     306        if (is_array($this->exceptions)) { 
     307            foreach($this->exceptions as $exception) { 
     308                $matches = array(); 
     309                if(preg_match('/(\/.*\/[^eE]*)$/', $exception, $matches)) { 
     310                    if(isset($matches[1]) && preg_match($matches[1], $key)) { 
     311                        return false; 
     312                    }  
     313                } else { 
     314                    if($exception === $key) { 
     315                        return false; 
     316                    } 
     317                } 
     318            } 
    309319        } 
    310320 
    … …  
    372382     * @param  mixed $value 
    373383     * @since  0.5 
     384     * @throws Exception 
    374385     * 
    375386     * @return array 
    … …  
    405416        } 
    406417 
     418        $value = preg_replace('/[\x0b-\x0c]/', ' ', $value); 
     419        $key = preg_replace('/[\x0b-\x0c]/', ' ', $key);    
     420 
    407421        $purified_value = $this->htmlpurifier->purify($value); 
    408422        $purified_key   = $this->htmlpurifier->purify($key); 
    … …  
    475489        $purified = preg_replace('/\s+alt="[^"]*"/m', null, $purified); 
    476490        $purified = preg_replace('/=?\s*"\s*"/m', null, $purified); 
    477  
     491         
     492        $original = preg_replace('/\s+alt="[^"]*"/m', null, $original); 
    478493        $original = preg_replace('/=?\s*"\s*"/m', null, $original); 
    479         $original = preg_replace('/\s+alt=?/m', null, $original); 
    480  
    481         // check which string is longer 
    482         $length = (strlen($original) - strlen($purified)); 
     494        $original = preg_replace('/style\s*=\s*([^"])/m', 'style = "$1', $original); 
     495         
     496        # strip whitespace between tags 
     497        $original = trim(preg_replace('/>\s*</m', '><', $original)); 
     498        $purified = trim(preg_replace('/>\s*</m', '><', $purified)); 
     499         
     500        $original = preg_replace( 
     501            '/(=\s*(["\'`])[^>"\'`]*>[^>"\'`]*["\'`])/m', 'alt$1', $original 
     502        ); 
     503 
     504        // no purified html is left 
     505        if (!$purified) { 
     506            return $original; 
     507        } 
     508         
     509        // calculate the diff length 
     510        $length = mb_strlen($original) - mb_strlen($purified); 
     511 
    483512        /* 
    484513         * Calculate the difference between the original html input 
    485514         * and the purified string. 
    486515         */ 
    487         if ($length > 0) { 
    488             $array_2 = str_split($original); 
    489             $array_1 = str_split($purified); 
     516        $array_1 = str_split(html_entity_decode(urldecode($original))); 
     517        $array_2 = str_split($purified); 
     518 
     519        // create an array containing the single character differences 
     520        $differences = array(); 
     521        foreach ($array_1 as $key => $value) { 
     522            if (!isset($array_2[$key]) || $value !== $array_2[$key]) { 
     523                $differences[] = $value; 
     524            } 
     525        } 
     526 
     527        // return the diff - ready to hit the converter and the rules 
     528        if(intval($length) <= 10) { 
     529            $diff = trim(join('', $differences)); 
    490530        } else { 
    491             $array_1 = str_split($original); 
    492             $array_2 = str_split($purified); 
    493         } 
    494         foreach ($array_2 as $key => $value) { 
    495             if ($value !== $array_1[$key]) { 
    496                 $array_1   = array_reverse($array_1); 
    497                 $array_1[] = $value; 
    498                 $array_1   = array_reverse($array_1); 
    499             } 
    500         } 
    501  
    502         // return the diff - ready to hit the converter and the rules 
    503         $diff = trim(join('', array_reverse( 
    504             (array_slice($array_1, 0, $length))))); 
     531            $diff = substr(trim(join('', $differences)), 0, strlen($original)); 
     532        } 
    505533 
    506534        // clean up spaces between tag delimiters 
    … …  
    511539            '|applet|base|img|style)/m', '<$1', $diff); 
    512540 
    513         if ($original == $purified && !$redux) { 
     541        if (strlen($diff) < 4) { 
    514542            return null; 
    515543        } 
    … …  
    538566            $value = $this->tmpJsonString; 
    539567        } else { 
    540             $this->tmpJsonString .=  " " . $tmp_value . "\n"; 
     568            $this->tmpJsonString .=  " " . $tmp_value . "\n"; 
    541569        } 
    542570 
    … …  
    545573            $key = $this->tmpJsonString; 
    546574        } else { 
    547             $this->tmpJsonString .=  " " . $tmp_key . "\n"; 
     575            $this->tmpJsonString .=  " " . $tmp_key . "\n"; 
    548576        } 
    549577 
    … …  
    566594            $this->tmpJsonString .=  $key . " " . $value . "\n"; 
    567595        } else { 
    568             $this->_jsonDecodeValues( 
    569                 json_encode($key), json_encode($value) 
    570             ); 
     596            $this->_jsonDecodeValues( 
     597                json_encode($key), json_encode($value) 
     598            ); 
    571599        } 
    572600    } 
    … …  
    683711     * Adds a value to the json array 
    684712     * 
    685      * @since 0.5.3 
     713     * @param  string the value containing JSON data 
     714     * @since  0.5.3 
    686715     * 
    687716     * @return void 

  • trunk/plugins/phpids/IDS/Report.php

    r13571 r14722  
    224224     * use foreach() to iterate through all stored IDS_Event objects. 
    225225     * 
    226      * @return Iterator 
     226     * @return ArrayObject the event collection 
    227227     */ 
    228228    public function getIterator() 

  • trunk/plugins/phpids/IDS/Version.php

    r13571 r14722  
    4646abstract class IDS_Version 
    4747{ 
    48     const VERSION = '0.6.3.1'; 
     48    const VERSION = '0.5.6'; 
    4949} 

  • trunk/plugins/phpids/IDS/default_filter.json

    r13571 r14722  
    1 <html><head></head><body>{"filters":{"filter":[{"id":"1","rule":"(?:\"[^\"]*[^-]?&gt;)|(?:[^\\w\\s]\\s*\\\/&gt;)|(?:&gt;\")","description":"finds html breaking injections including whitespace attacks","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"2","rule":"(?:\"+.*[&lt;=]\\s*\"[^\"]+\")|(?:\"\\w+\\s*=)|(?:&gt;\\w=\\\/)|(?:#.+\\)[\"\\s]*&gt;)|(?:\"\\s*(?:src|style|on\\w+)\\s*=\\s*\")|(?:[^\"]?\"[,;\\s]+\\w*[\\[\\(])","description":"finds attribute breaking injections including whitespace attacks","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"69","rule":"(?:[\\s\\d\\\/\"]+(?:on\\w+|style)=[$\"\\w])","description":"finds malicious attribute injection attempts","tags":{"tag":["xss","csrf"]},"impact":"6"},{"id":"3","rule":"(?:^&gt;[\\w\\s]*&lt;\\\/?\\w{2,}&gt;)","description":"finds unquoted attribute breaking injections","tags":{"tag":["xss","csrf"]},"impact":"2"},{"id":"4","rule":"(?:[+\\\/]\\s*name[\\W\\d]*[)+])|(?:;\\W*url\\s*=)|(?:[^\\w\\s\\\/?:&gt;]\\s*(?:location|referrer|name)\\s*[^\\\/\\w\\s-])","description":"Detects url-, name-, JSON, and referrer-contained payload attacks","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"5","rule":"(?:\\W\\s*hash\\s*[^\\w\\s-])|(?:\\w+=\\W*[^,]*,[^\\s(]\\s*\\()|(?:\\?\"[^\\s\"]\":)|(?:(?<!--\\\/)__[a-z]+__)|(?:(?:^|[\\s)\\]\\}])(?:s|g)etter\\s*=)","description":"Detects hash-contained xss payload attacks, setter usage and property overloading","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"6","rule":"(?:with\\s*\\(\\s*.+\\s*\\)\\s*\\w+\\s*\\()|(?:(?:do|while|for)\\s*\\([^)]*\\)\\s*\\{)|(?:\\\/[\\w\\s]*\\[\\W*\\w)","description":"Detects self contained xss via with(), common loops and regex to string conversion","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"7","rule":"(?:\\d\\s*[|&]{2}\\s*\\w)|(?:[=(].+\\?.+:)|(?:with\\([^)]*\\)\\))|(?:\\.\\s*source\\W)|(?:\\?[^:=]+:[^;]+(;|$))","description":"Detects JavaScript with(), ternary operators and XML predicate attacks","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"8","rule":"(?:\\([\\w\\s]+\\([\\w\\s]+\\)[\\w\\s]+\\))|(?:(?<!(?:mozilla\\\/\\d\\.\\d\\s))\\([^)[]+\\[[^\\]]+\\][^)]*\\))|(?:[^\\s!][{([][^({[]+[{([][^}\\])]+[}\\])][\\s+\",\\d]*[}\\])])|(?:\"\\)?\\]\\W*\\[)|(?:=\\s*[^\\s:;]+\\s*[{([][^}\\])]+[}\\])];)","description":"Detects self-executing JavaScript functions","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"9","rule":"(?:\\\\u00[a-f0-9]{2})|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})","description":"Detects the IE octal, hex and unicode entities","tags":{"tag":["xss","csrf"]},"impact":"2"},{"id":"10","rule":"(?:(?:\\\/|\\\\)?\\.+(\\\/|\\\\)(?:\\.+)?)|(?:\\w+\\.exe\\??\\s)|(?:;\\s*\\w+\\s*\\\/[\\w*-]+\\\/)|(?:\\d\\.\\dx\\|)|(?:%(?:c0\\.|af\\.|5c\\.))|(?:\\\/(?:%2e){2})","description":"Detects basic directory traversal","tags":{"tag":["dt","id","lfi"]},"impact":"5"},{"id":"11","rule":"(?:%c0%ae\\\/)|(?:(?:\\\/|\\\\)(home|conf|usr|etc|proc|opt|s?bin|local|dev|tmp|kern|[br]oot|sys|system|windows|winnt|program|%[a-z_-]{3,}%)(?:\\\/|\\\\))|(?:(?:\\\/|\\\\)inetpub|localstart\\.asp|boot\\.ini)","description":"Detects specific directory and path traversal","tags":{"tag":["dt","id","lfi"]},"impact":"5"},{"id":"12","rule":"(?:etc\\\/\\W*passwd)","description":"Detects etc\/passwd inclusion attempts","tags":{"tag":["dt","id","lfi"]},"impact":"5"},{"id":"13","rule":"(?:%u(?:ff|00|e\\d)\\w\\w)|(?:(?:%(?:e\\w|c[^3\\W]|))(?:%\\w\\w)(?:%\\w\\w)?)","description":"Detects halfwidth\/fullwidth encoded unicode HTML breaking attempts","tags":{"tag":["xss","csrf"]},"impact":"3"},{"id":"14","rule":"(?:\\w+script:|@import[^\\w]|;base64|base64,)|(?:\\w+\\s*\\([\\w\\s]+,[\\w\\s]+,[\\w\\s]+,[\\w\\s]+,[\\w\\s]+,[\\w\\s]+\\))","description":"Detects possible includes and packed functions","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"5"},{"id":"15","rule":"([^*:\\s\\w,.\\\/?+-]\\s*)?(?<![a-z]\\s)(?<![a-z\\\/_@-->\\-\\|])(\\s*return\\s*)?(?:create(?:element|attribute|textnode)|[a-z]+events?|setattribute|getelement\\w+|appendchild|createrange|createcontextualfragment|removenode|parentnode|decodeuricomponent|\\wettimeout|option|useragent)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%\",.+\\-]))","description":"Detects JavaScript DOM\/miscellaneous properties and methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"6"},{"id":"16","rule":"([^*\\s\\w,.\\\/?+-]\\s*)?(?<!--[a-mo-z]-->\\-\\|])(\\s*return\\s*)?(?:alert|inputbox|showmodaldialog|infinity|isnan|isnull|msgbox|expression|prompt|write(?:ln)?|confirm|dialog|urn|(?:un)?eval|exec|execscript|tostring|status|execute|window|unescape|navigate|jquery|getscript|extend|prototype)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%\",.:\\\/+\\-]))","description":"Detects possible includes and typical script methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"5"},{"id":"17","rule":"([^*:\\s\\w,.\\\/?+-]\\s*)?(?<!--[a-z]-->\\|])(\\s*return\\s*)?(?:hash|name|href|navigateandfind|source|pathname|close|constructor|port|protocol|assign|replace|back|forward|document|ownerdocument|window|self|parent|frames|_?content|date|cookie|innerhtml|innertext|csstext+?|outerhtml|print|moveby|resizeto|createstylesheet|stylesheets)(?(1)[^\\w%\"]|(?:\\s*[^@\\\/\\s\\w%,.+\\-]))","description":"Detects JavaScript object properties and methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"4"},{"id":"18","rule":"([^*:\\s\\w,.\\\/?+-]\\s*)?(?<!--[a-z]-->\\-\\|])(\\s*return\\s*)?(?:join|pop|push|reverse|reduce|concat|map|shift|sp?lice|sort|unshift)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%,.+\\-]))","description":"Detects JavaScript array properties and methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"4"},{"id":"19","rule":"([^*:\\s\\w,.\\\/?+-]\\s*)?(?<!--[a-z]-->\\-\\|])(\\s*return\\s*)?(?:set|atob|btoa|charat|charcodeat|charset|concat|crypto|frames|fromcharcode|indexof|lastindexof|match|navigator|toolbar|menubar|replace|regexp|slice|split|substr|substring|escape|\\w+codeuri\\w*)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%,.+\\-]))","description":"Detects JavaScript string properties and methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"4"},{"id":"20","rule":"([^*:\\s\\w,.\\\/?+-]\\s*)?(?<!--[a-z]-->\\|])(\\s*return\\s*)?(?:globalstorage|sessionstorage|postmessage|callee|constructor|content|domain|prototype|try|catch|top|call|apply|url|function|object|array|string|math|if|elseif|case|switch|regex|boolean|location|settimeout|setinterval|void|setexpression|namespace|while)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%\",.+\\-]))","description":"Detects JavaScript language constructs","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"4"},{"id":"21","rule":"(?:,\\s*(?:alert|showmodaldialog|eval)\\s*,)|(?::\\s*eval\\s*[^\\s])|([^:\\s\\w,.\\\/?+-]\\s*)?(?<!--[a-z\\\/_@]-->]*)t(?!rong))|(?:\\<scri)|(>&lt;\\w+:\\w+)","description":"Detects obfuscated script tags and XML wrapped HTML","tags":{"tag":"xss"},"impact":"4"},{"id":"34","rule":"(?:\\&lt;\\\/\\w+\\s\\w+)|(?:@(?:cc_on|set)[\\s@,\"=])","description":"Detects attributes in closing tags and conditional compilation tokens","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"35","rule":"(?:--[^\\n]*$)|(?:\\<!--|-->)|(?:[^*]\\\/\\*|\\*\\\/[^*])|(?:(?:[\\W\\d]#|--|{)$)|(?:\\\/{3,}.*$)|(?:<!--\\[\\W)|(?:\\]-->)","description":"Detects common comment types","tags":{"tag":["xss","csrf","id"]},"impact":"3"},{"id":"37","rule":"(?:\\<base\\s+)|(?:><!--(?:element|entity|\\[CDATA))","description":"Detects base href injections and XML entity injections","tags":{"tag":["xss","csrf","id"]},"impact":"5"},{"id":"38","rule":"(?:\\<[\\\/]?(?:[i]?frame|applet|isindex|marquee|keygen|script|audio|video|input|button|textarea|style|base|body|meta|link|object|embed|param|plaintext|xm\\w+|image|im(?:g|port)))","description":"Detects possibly malicious html elements including some attributes","tags":{"tag":["xss","csrf","id","rfe","lfi"]},"impact":"4"},{"id":"39","rule":"(?:\\\\x[01fe][\\db-ce-f])|(?:%[01fe][\\db-ce-f])|(?:&#[01fe][\\db-ce-f])|(?:\\\\[01fe][\\db-ce-f])|(?:&#x[01fe][\\db-ce-f])","description":"Detects nullbytes and other dangerous characters","tags":{"tag":["id","rfe","xss"]},"impact":"5"},{"id":"40","rule":"(?:\"\\s*(?:#|--|{))|(?:\\\/\\*!\\s?\\d+)|(?:ch(?:a)?r\\s*\\(\\s*\\d)|(?:(?:(n?and|x?or|not)\\s+|\\|\\||\\&\\&)\\s*\\w+\\()","description":"Detects MySQL comments, conditions and ch(a)r injections","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"41","rule":"(?:\\)\\s*like\\s*\\()|(?:having\\s+[\\d\\w\\-\"]+\\s*[(=<-->~])|(?:if\\s?\\([\\d\\w]\\s*[=&lt;&gt;~])","description":"Detects conditional SQL injection attempts","tags":{"tag":["sqli","id","lfi"]},"impact":"4"},{"id":"42","rule":"(?:\\\\x(?:23|27|3d))|(?:^.?\"$)|(?:^.*\\\\\".+(?<!--\\\\)\")|(?:(?:^[\"\\\\]*(?:[\\d\"]+|[^\"]+\"))+\\s*(?:n?and|x?or|not|\\|\\||\\&\\&)\\s*[\\w\"[+&!@(),.-])|(?:[^\\w\\s]\\w+\\s*[|-]\\s*\"\\s*\\w)|(?:@\\w+\\s+(and|or)\\s*[\"\\d]+)|(?:@[\\w-]+\\s(and|or)\\s*[^\\w\\s])|(?:[^\\w\\s:]\\s*\\d\\W+[^\\w\\s]\\s*\".)","description":"Detects classic SQL injection probings 1\/2","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"43","rule":"(?:\"\\s*\\*.+(?:or|id)\\W*\"\\d)|(?:\\^\")|(?:^[\\w\\s\"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:\"[\\s\\d]*[^\\w\\s]+\\W*\\d\\W*.*[\"\\d])|(?:\"\\s*[^\\w\\s?]+\\s*[^\\w\\s]+\\s*\")|(?:\"\\s*[^\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:\".*\\*\\s*\\d)|(?:\"\\s*or\\s[\\w-]+.*\\d)|(?:[()*<-->%+-][\\w-]+[^\\w\\s]+\"[^,])","description":"Detects classic SQL injection probings 2\/2","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"44","rule":"(?:\\d\"\\s+\"\\s+\\d)|(?:^admin\\s*\"|(\\\/\\*)+\"+\\s?(?:--|#|\\\/\\*|{)?)|(?:\"\\s*or[\\w\\s-]+\\s*[+&lt;&gt;=(),-]\\s*[\\d\"])|(?:\"\\s*[^\\w\\s]?=\\s*\")|(?:\"\\W*[+=]+\\W*\")|(?:\"\\s*[!=|][\\d\\s!=+-]+.*[\"(].*$)|(?:\"\\s*[!=|][\\d\\s!=]+.*\\d+$)|(?:\"\\s*like\\W+[\\w\"(])|(?:\\sis\\s*0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:\"[&lt;&gt;~]+\")","description":"Detects basic SQL authentication bypass attempts 1\/3","tags":{"tag":["sqli","id","lfi"]},"impact":"7"},{"id":"45","rule":"(?:union\\s*(?:all|distinct|[(!@]*)?\\s*[([]\\s*select)|(?:\\w+\\s+like\\s+\\\")|(?:like\\s*\"\\%)|(?:\"\\s*like\\W*[\"\\d])|(?:\"\\s*(?:n?and|x?or|not |\\|\\||\\&amp;\\&amp;)\\s+[\\s\\w]+=\\s*\\w+\\s*having)|(?:\"\\s*\\*\\s*\\w+\\W+\")|(?:\"\\s*[^?\\w\\s=.,;)(]+\\s*[(@\"]*\\s*\\w+\\W+\\w)|(?:select\\s*[\\[\\]()\\s\\w\\.,-]+from)","description":"Detects basic SQL authentication bypass attempts 2\/3","tags":{"tag":["sqli","id","lfi"]},"impact":"7"},{"id":"46","rule":"(?:(?:n?and|x?or|not |\\|\\||\\&amp;\\&amp;)\\s+[\\s\\w+]+(?:regexp\\s*\\(|sounds\\s+like\\s*\"|[=\\d]+x))|(\"\\s*\\d\\s*(?:--|#))|(?:\"[%&amp;&lt;&gt;^=]+\\d\\s*(=|or))|(?:\"\\W+[\\w+-]+\\s*=\\s*\\d\\W+\")|(?:\"\\s*is\\s*\\d.+\"?\\w)|(?:\"\\|?[\\w-]{3,}[^\\w\\s.,]+\")|(?:\"\\s*is\\s*[\\d.]+\\s*\\W.*\")","description":"Detects basic SQL authentication bypass attempts 3\/3","tags":{"tag":["sqli","id","lfi"]},"impact":"7"},{"id":"47","rule":"(?:^\\s*[;&gt;\"]\\s*(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc))|(?:(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s+(?:concat|char|load_file)\\s?\\(?)|(?:end\\s*\\);)|(\"\\s+regexp\\W)","description":"Detects concatenated basic SQL injection and SQLLFI attempts","tags":{"tag":["sqli","id","lfi"]},"impact":"5"},{"id":"48","rule":"(?:\\\/\\w+;?\\s+(?:having|and|or|select))|(?:\\d\\s+group\\s+by.+\\()|(?:(?:;|#|--)\\s*(?:drop|alter))|(?:(?:;|#|--)\\s*(?:update|insert)\\s*\\w{2,})|(?:[^\\w]SET\\s*@\\w+)|(?:(?:n?and|x?or|not |\\|\\||\\&amp;\\&amp;)\\s+\\w+[!=+]+[\\s\\d]*[\"=(])","description":"Detects chained SQL injection attempts 1\/2","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"49","rule":"(?:\\*\\\/from)|(?:\\+\\s*\\d+\\s*\\+\\s*@)|(?:\\w\"\\s*(?:[-+=|@]+\\s*)+[\\d(])|(?:coalesce\\s*\\(|@@\\w+\\s*[^\\w\\s])|(?:\\W!+\"\\w)|(?:\";\\s*(?:if|while|begin))|(?:\"[\\s\\d]+=\\s*\\d)|(?:order\\s+by\\s+if\\w*\\s*\\()","description":"Detects chained SQL injection attempts 2\/2","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"50","rule":"(?:(select|;)\\s+(?:benchmark|if|sleep)\\s?\\(\\s?\\(?\\s?\\w+)","description":"Detects SQL benchmark and sleep injection attempts including conditional queries","tags":{"tag":["sqli","id"]},"impact":"4"},{"id":"51","rule":"(?:create\\s+function\\s+\\w+\\s+returns)|(?:;\\s*(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s*[\\[(]?\\w{2,})","description":"Detects MySQL UDF injection and other data\/structure manipulation attempts","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"52","rule":"(?:alter\\s*\\w+.*character\\s+set\\s+\\w+)|(\";\\s*waitfor\\s+time\\s+\")|(?:\";.*:\\s*goto)","description":"Detects MySQL charset switch and MSSQL DoS attempts","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"53","rule":"(?:procedure\\s+analyse\\s*\\()|(?:;\\s*(declare|open)\\s+[\\w-]+)|(?:create\\s+(procedure|function)\\s*\\w+\\s*\\(\\s*\\)\\s*-)|(?:declare[^\\w]+[@#]\\s*\\w+)|(exec\\s*\\(\\s*@)","description":"Detects MySQL and PostgreSQL stored procedure\/function injections","tags":{"tag":["sqli","id"]},"impact":"7"},{"id":"54","rule":"(?:select\\s*pg_sleep)|(?:waitfor\\s*delay\\s?\"+\\s?\\d)|(?:;\\s*shutdown\\s*(?:;|--|#|\\\/\\*|{))","description":"Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"55","rule":"(?:from\\s+information_schema\\W)|(?:(?:(?:current_)?user|database|schema|connection_id)\\s*\\([^\\)]*)|(?:\";?\\s*(?:select|union|having)\\s*[\"(\\d])|(?:\\wiif\\s*\\()|(?:exec\\s+master\\.)|(?:union select @)|(?:union[\\w(\\s]*select)|(?:select.*\\w?user\\()|(?:into[\\s+]+(?:dump|out)file\\s*\")","description":"Detects MSSQL code execution and information gathering attempts","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"56","rule":"(?:merge.*using\\s*\\()|(execute\\s*immediate\\s*\")|(?:\\W+\\d*\\s+having\\s+\\d)|(?:match\\s*[\\w(),+-]+\\s*against\\s*\\()","description":"Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"57","rule":"(?:select\\s*\\*\\s*from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s*\\(\\s*space\\s*\\()","description":"Detects MySQL comment-\/space-obfuscated injections","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"58","rule":"(?:@[\\w-]+\\s*\\()|(?:]\\s*\\(\\s*[\"!]\\s*\\w)|(?:&lt;[?%](?:php)?.*(?:[?%]&gt;)?)|(?:;[\\s\\w|]*\\$\\w+\\s*=)|(?:\\$\\w+\\s*=(?:(?:\\s*\\$?\\w+\\s*[(;])|\\s*\".*\"))|(?:;\\s*\\{\\W*\\w+\\s*\\()","description":"Detects code injection attempts 1\/3","tags":{"tag":["id","rfe","lfi"]},"impact":"7"},{"id":"59","rule":"(?:(?:[;]+|(&lt;[?%](?:php)?)).*(?:define|eval|file_get_contents|include|require|require_once|set|shell_exec|phpinfo|system|passthru|preg_\\w+|execute)\\s*[\"(@])","description":"Detects code injection attempts 2\/3","tags":{"tag":["id","rfe","lfi"]},"impact":"7"},{"id":"60","rule":"(?:(?:[;]+|(&lt;[?%](?:php)?)).*[^\\w](?:echo|print|print_r|var_dump|[fp]open))|(?:;\\s*rm\\s+-\\w+\\s+)|(?:;.*{.*\\$\\w+\\s*=)|(?:\\$\\w+\\s*\\[\\]\\s*=\\s*)","description":"Detects code injection attempts 3\/3","tags":{"tag":["id","rfe","lfi"]},"impact":"7"},{"id":"61","rule":"(?:\\w+]?(?<!--href)(?<!src)(?<!longdesc)(?<!returnurl)=(?:https?|ftp):)|(?:\\{\\s*\\$\\s*\\{)","description":"Detects url injections and RFE attempts","tags":{"tag":["id","rfe","lfi"]},"impact":"5"},{"id":"62","rule":"(?:function[^(]*\\([^)]*\\))|(?:(?:delete|void|throw|instanceof|new|typeof)\\W+\\w+\\s*[([])|([)\\]]\\s*\\.\\s*\\w+\\s*=)|(?:\\(\\s*new\\s+\\w+\\s*\\)\\.)","description":"Detects common function declarations and special JS operators","tags":{"tag":["id","rfe","lfi"]},"impact":"5"},{"id":"63","rule":"(?:[\\w.-]+@[\\w.-]+%(?:[01][\\db-ce-f])+\\w+:)","description":"Detects common mail header injections","tags":{"tag":["id","spam"]},"impact":"5"},{"id":"64","rule":"(?:\\.pl\\?\\w+=\\w?\\|\\w+;)|(?:\\|\\(\\w+=\\*)|(?:\\*\\s*\\)+\\s*;)","description":"Detects perl echo shellcode injection and LDAP vectors","tags":{"tag":["lfi","rfe"]},"impact":"5"},{"id":"65","rule":"(?:(^|\\W)const\\s+[\\w\\-]+\\s*=)|(?:(?:do|for|while)\\s*\\([^;]+;+\\))|(?:(?:^|\\W)on\\w+\\s*=[\\w\\W]*(?:on\\w+|alert|eval|print|confirm|prompt))|(?:groups=\\d+\\(\\w+\\))|(?:(.)\\1{128,})","description":"Detects basic XSS DoS attempts","tags":{"tag":["rfe","dos"]},"impact":"5"},{"id":"67","rule":"(?:\\({2,}\\+{2,}:{2,})|(?:\\({2,}\\+{2,}:+)|(?:\\({3,}\\++:{2,})|(?:\\$\\[!!!\\])","description":"Detects unknown attack vectors based on PHPIDS Centrifuge detection","tags":{"tag":["xss","csrf","id","rfe","lfi"]},"impact":"7"},{"id":"68","rule":"(?:[\\s\\\/\"]+[-\\w\\\/\\\\\\*]+\\s*=.+(?:\\\/\\s*-->))","description":"finds attribute breaking injections including obfuscated attributes","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"69","rule":"(?:(?:msgbox|eval)\\s*\\+|(?:language\\s*=\\*vbscript))","description":"finds basic VBScript injection attempts","tags":{"tag":["xss","csrf"]},"impact":"4"}]}}</base\\s+)|(?:></scri)|(></body></html> 
     1{"filters":{"filter":[{"id":"1","rule":"(?:\"[^\"]*[^-]?>)|(?:[^\\w\\s]\\s*\\\/>)|(?:>\")","description":"finds html breaking injections including whitespace attacks","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"2","rule":"(?:\"+.*[<=]\\s*\"[^\"]+\")|(?:\"\\w+\\s*=)|(?:>\\w=\\\/)|(?:#.+\\)[\"\\s]*>)|(?:\"\\s*(?:src|style|on\\w+)\\s*=\\s*\")|(?:[^\"]?\"[,;\\s]+\\w*[\\[\\(])","description":"finds attribute breaking injections including whitespace attacks","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"69","rule":"(?:[\\s\\d\\\/\"]+(?:on\\w+|style|poster|background)=[$\"\\w])","description":"finds malicious attribute injection attempts","tags":{"tag":["xss","csrf"]},"impact":"6"},{"id":"3","rule":"(?:^>[\\w\\s]*<\\\/?\\w{2,}>)","description":"finds unquoted attribute breaking injections","tags":{"tag":["xss","csrf"]},"impact":"2"},{"id":"4","rule":"(?:[+\\\/]\\s*name[\\W\\d]*[)+])|(?:;\\W*url\\s*=)|(?:[^\\w\\s\\\/?:>]\\s*(?:location|referrer|name)\\s*[^\\\/\\w\\s-])","description":"Detects url-, name-, JSON, and referrer-contained payload attacks","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"5","rule":"(?:\\W\\s*hash\\s*[^\\w\\s-])|(?:\\w+=\\W*[^,]*,[^\\s(]\\s*\\()|(?:\\?\"[^\\s\"]\":)|(?:(?<!\\\/)__[a-z]+__)|(?:(?:^|[\\s)\\]\\}])(?:s|g)etter\\s*=)","description":"Detects hash-contained xss payload attacks, setter usage and property overloading","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"6","rule":"(?:with\\s*\\(\\s*.+\\s*\\)\\s*\\w+\\s*\\()|(?:(?:do|while|for)\\s*\\([^)]*\\)\\s*\\{)|(?:\\\/[\\w\\s]*\\[\\W*\\w)","description":"Detects self contained xss via with(), common loops and regex to string conversion","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"7","rule":"(?:[=(].+\\?.+:)|(?:with\\([^)]*\\)\\))|(?:\\.\\s*source\\W)","description":"Detects JavaScript with(), ternary operators and XML predicate attacks","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"8","rule":"(?:\\\/\\w*\\s*\\)\\s*\\()|(?:\\(.*\\\/.+\\\/\\w*\\s*\\))|(?:\\([\\w\\s]+\\([\\w\\s]+\\)[\\w\\s]+\\))|(?:(?<!(?:mozilla\\\/\\d\\.\\d\\s))\\([^)[]+\\[[^\\]]+\\][^)]*\\))|(?:[^\\s!][{([][^({[]+[{([][^}\\])]+[}\\])][\\s+\",\\d]*[}\\])])|(?:\"\\)?\\]\\W*\\[)|(?:=\\s*[^\\s:;]+\\s*[{([][^}\\])]+[}\\])];)","description":"Detects self-executing JavaScript functions","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"9","rule":"(?:\\\\u00[a-f0-9]{2})|(?:\\\\x0*[a-f0-9]{2})|(?:\\\\\\d{2,3})","description":"Detects the IE octal, hex and unicode entities","tags":{"tag":["xss","csrf"]},"impact":"2"},{"id":"10","rule":"(?:(?:\\\/|\\\\)?\\.+(\\\/|\\\\)(?:\\.+)?)|(?:\\w+\\.exe\\??\\s)|(?:;\\s*\\w+\\s*\\\/[\\w*-]+\\\/)|(?:\\d\\.\\dx\\|)|(?:%(?:c0\\.|af\\.|5c\\.))|(?:\\\/(?:%2e){2})","description":"Detects basic directory traversal","tags":{"tag":["dt","id","lfi"]},"impact":"5"},{"id":"11","rule":"(?:%c0%ae\\\/)|(?:(?:\\\/|\\\\)(home|conf|usr|etc|proc|opt|s?bin|local|dev|tmp|kern|[br]oot|sys|system|windows|winnt|program|%[a-z_-]{3,}%)(?:\\\/|\\\\))|(?:(?:\\\/|\\\\)inetpub|localstart\\.asp|boot\\.ini)","description":"Detects specific directory and path traversal","tags":{"tag":["dt","id","lfi"]},"impact":"5"},{"id":"12","rule":"(?:etc\\\/\\W*passwd)","description":"Detects etc\/passwd inclusion attempts","tags":{"tag":["dt","id","lfi"]},"impact":"5"},{"id":"13","rule":"(?:%u(?:ff|00|e\\d)\\w\\w)|(?:(?:%(?:e\\w|c[^3\\W]|))(?:%\\w\\w)(?:%\\w\\w)?)","description":"Detects halfwidth\/fullwidth encoded unicode HTML breaking attempts","tags":{"tag":["xss","csrf"]},"impact":"3"},{"id":"14","rule":"(?:#@~\\^\\w+)|(?:\\w+script:|@import[^\\w]|;base64|base64,)|(?:\\w+\\s*\\([\\w\\s]+,[\\w\\s]+,[\\w\\s]+,[\\w\\s]+,[\\w\\s]+,[\\w\\s]+\\))","description":"Detects possible includes, VBSCript\/JScript encodeed and packed functions","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"5"},{"id":"15","rule":"([^*:\\s\\w,.\\\/?+-]\\s*)?(?<![a-z]\\s)(?<![a-z\\\/_@>\\-\\|])(\\s*return\\s*)?(?:create(?:element|attribute|textnode)|[a-z]+events?|setattribute|getelement\\w+|appendchild|createrange|createcontextualfragment|removenode|parentnode|decodeuricomponent|\\wettimeout|option|useragent)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%\",.+\\-]))","description":"Detects JavaScript DOM\/miscellaneous properties and methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"6"},{"id":"16","rule":"([^*\\s\\w,.\\\/?+-]\\s*)?(?<![a-mo-z]>])(\\s*return\\s*)?(?:alert|inputbox|showmodaldialog|infinity|isnan|isnull|iterator|msgbox|expression|prompt|write(?:ln)?|confirm|dialog|urn|(?:un)?eval|exec|execscript|tostring|status|execute|window|unescape|navigate|jquery|getscript|extend|prototype)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%\",.:\\\/+\\-]))","description":"Detects possible includes and typical script methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"5"},{"id":"17","rule":"([^*:\\s\\w,.\\\/?+-]\\s*)?(?<![a-z]>])(\\s*return\\s*)?(?:hash|name|href|navigateandfind|source|pathname|close|constructor|port|protocol|assign|replace|back|forward|document|ownerdocument|window|top|this|self|parent|frames|_?content|date|cookie|innerhtml|innertext|csstext+?|outerhtml|print|moveby|resizeto|createstylesheet|stylesheets)(?(1)[^\\w%\"]|(?:\\s*[^@\\\/\\s\\w%.+\\-]))","description":"Detects JavaScript object properties and methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"4"},{"id":"18","rule":"([^*:\\s\\w,.\\\/?+-]\\s*)?(?<![a-z]>\\-\\|])(\\s*return\\s*)?(?:join|pop|push|reverse|reduce|concat|map|shift|sp?lice|sort|unshift)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%,.+\\-]))","description":"Detects JavaScript array properties and methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"4"},{"id":"19","rule":"([^*:\\s\\w,.\\\/?+-]\\s*)?(?<![a-z]>\\-\\|])(\\s*return\\s*)?(?:set|atob|btoa|charat|charcodeat|charset|concat|crypto|frames|fromcharcode|indexof|lastindexof|match|navigator|toolbar|menubar|replace|regexp|slice|split|substr|substring|escape|\\w+codeuri\\w*)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%,.+\\-]))","description":"Detects JavaScript string properties and methods","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"4"},{"id":"20","rule":"(?:\\)\\s*\\[)|(?:\\\/\\w*\\s*\\)\\s*\\W)|([^*:\\s\\w,.\\\/?+-]\\s*)?(?<![a-z]>\\|])(\\s*return\\s*)?(?:globalstorage|sessionstorage|postmessage|callee|constructor|content|domain|prototype|try|catch|top|call|apply|url|function|object|array|string|math|if|for\\s*(?:each)?|elseif|case|switch|regex|boolean|location|settimeout|setinterval|void|setexpression|namespace|while)(?(1)[^\\w%\"]|(?:\\s*[^@\\s\\w%\".+\\-]))","description":"Detects JavaScript language constructs","tags":{"tag":["xss","csrf","id","rfe"]},"impact":"4"},{"id":"21","rule":"(?:,\\s*(?:alert|showmodaldialog|eval)\\s*,)|(?::\\s*eval\\s*[^\\s])|([^:\\s\\w,.\\\/?+-]\\s*)?(?<![a-z\\\/_@]>]*)t(?!rong))|(?:\\<scri)|(<\\w+:\\w+)","description":"Detects obfuscated script tags and XML wrapped HTML","tags":{"tag":"xss"},"impact":"4"},{"id":"34","rule":"(?:\\<\\\/\\w+\\s\\w+)|(?:@(?:cc_on|set)[\\s@,\"=])","description":"Detects attributes in closing tags and conditional compilation tokens","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"35","rule":"(?:--[^\\n]*$)|(?:\\<!-|-->)|(?:[^*]\\\/\\*|\\*\\\/[^*])|(?:(?:[\\W\\d]#|--|{)$)|(?:\\\/{3,}.*$)|(?:<!\\[\\W)|(?:\\]!>)","description":"Detects common comment types","tags":{"tag":["xss","csrf","id"]},"impact":"3"},{"id":"37","rule":"(?:\\<base\\s+)|(?:<!(?:element|entity|\\[CDATA))","description":"Detects base href injections and XML entity injections","tags":{"tag":["xss","csrf","id"]},"impact":"5"},{"id":"38","rule":"(?:\\<[\\\/]?(?:[i]?frame|applet|isindex|marquee|keygen|script|audio|video|input|button|textarea|style|base|body|meta|link|object|embed|param|plaintext|xm\\w+|image|im(?:g|port)))","description":"Detects possibly malicious html elements including some attributes","tags":{"tag":["xss","csrf","id","rfe","lfi"]},"impact":"4"},{"id":"39","rule":"(?:\\\\x[01fe][\\db-ce-f])|(?:%[01fe][\\db-ce-f])|(?:&#[01fe][\\db-ce-f])|(?:\\\\[01fe][\\db-ce-f])|(?:&#x[01fe][\\db-ce-f])","description":"Detects nullbytes and other dangerous characters","tags":{"tag":["id","rfe","xss"]},"impact":"5"},{"id":"40","rule":"(?:\\)\\s*when\\s*\\d+\\s*then)|(?:\"\\s*(?:#|--|{))|(?:\\\/\\*!\\s?\\d+)|(?:ch(?:a)?r\\s*\\(\\s*\\d)|(?:(?:(n?and|x?or|not)\\s+|\\|\\||\\&\\&)\\s*\\w+\\()","description":"Detects MySQL comments, conditions and ch(a)r injections","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"41","rule":"(?:[\\s()]case\\s*\\()|(?:\\)\\s*like\\s*\\()|(?:having\\s*[^\\s]+\\s*[^\\w\\s])|(?:if\\s?\\([\\d\\w]\\s*[=<>~])","description":"Detects conditional SQL injection attempts","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"42","rule":"(?:\"\\s*or\\s*\\d)|(?:\\\\x(?:23|27|3d))|(?:^.?\"$)|(?:^.*\\\\\".+(?<!\\\\)\")|(?:(?:^[\"\\\\]*(?:[\\d\"]+|[^\"]+\"))+\\s*(?:n?and|x?or|not|\\|\\||\\&\\&)\\s*[\\w\"[+&!@(),.-])|(?:[^\\w\\s]\\w+\\s*[|-]\\s*\"\\s*\\w)|(?:@\\w+\\s+(and|or)\\s*[\"\\d]+)|(?:@[\\w-]+\\s(and|or)\\s*[^\\w\\s])|(?:[^\\w\\s:]\\s*\\d\\W+[^\\w\\s]\\s*\".)","description":"Detects classic SQL injection probings 1\/2","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"43","rule":"(?:\"\\s*\\*.+(?:or|id)\\W*\"\\d)|(?:\\^\")|(?:^[\\w\\s\"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:\"[\\s\\d]*[^\\w\\s]+\\W*\\d\\W*.*[\"\\d])|(?:\"\\s*[^\\w\\s?]+\\s*[^\\w\\s]+\\s*\")|(?:\"\\s*[^\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:\".*\\*\\s*\\d)|(?:\"\\s*or\\s[\\w-]+.*\\d)|(?:[()*<>%+-][\\w-]+[^\\w\\s]+\"[^,])","description":"Detects classic SQL injection probings 2\/2","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"44","rule":"(?:\\d\"\\s+\"\\s+\\d)|(?:^admin\\s*\"|(\\\/\\*)+\"+\\s?(?:--|#|\\\/\\*|{)?)|(?:\"\\s*or[\\w\\s-]+\\s*[+<>=(),-]\\s*[\\d\"])|(?:\"\\s*[^\\w\\s]?=\\s*\")|(?:\"\\W*[+=]+\\W*\")|(?:\"\\s*[!=|][\\d\\s!=+-]+.*[\"(].*$)|(?:\"\\s*[!=|][\\d\\s!=]+.*\\d+$)|(?:\"\\s*like\\W+[\\w\"(])|(?:\\sis\\s*0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:\"[<>~]+\")","description":"Detects basic SQL authentication bypass attempts 1\/3","tags":{"tag":["sqli","id","lfi"]},"impact":"7"},{"id":"45","rule":"(?:union\\s*(?:all|distinct|[(!@]*)?\\s*[([]*\\s*select)|(?:\\w+\\s+like\\s+\\\")|(?:like\\s*\"\\%)|(?:\"\\s*like\\W*[\"\\d])|(?:\"\\s*(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s\\w]+=\\s*\\w+\\s*having)|(?:\"\\s*\\*\\s*\\w+\\W+\")|(?:\"\\s*[^?\\w\\s=.,;)(]+\\s*[(@\"]*\\s*\\w+\\W+\\w)|(?:select\\s*[\\[\\]()\\s\\w\\.,-]+from)","description":"Detects basic SQL authentication bypass attempts 2\/3","tags":{"tag":["sqli","id","lfi"]},"impact":"7"},{"id":"46","rule":"(?:in\\s*\\(+\\s*select)|(?:(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s\\w+]+(?:regexp\\s*\\(|sounds\\s+like\\s*\"|[=\\d]+x))|(\"\\s*\\d\\s*(?:--|#))|(?:\"[%&<>^=]+\\d\\s*(=|or))|(?:\"\\W+[\\w+-]+\\s*=\\s*\\d\\W+\")|(?:\"\\s*is\\s*\\d.+\"?\\w)|(?:\"\\|?[\\w-]{3,}[^\\w\\s.,]+\")|(?:\"\\s*is\\s*[\\d.]+\\s*\\W.*\")","description":"Detects basic SQL authentication bypass attempts 3\/3","tags":{"tag":["sqli","id","lfi"]},"impact":"7"},{"id":"47","rule":"(?:[\\d\\W]\\s+as\\s*[\"\\w]+\\s*from)|(?:^[\\W\\d]+\\s*(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc))|(?:(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s+(?:concat|char|load_file)\\s?\\(?)|(?:end\\s*\\);)|(\"\\s+regexp\\W)|(?:[\\s(]load_file\\s*\\()","description":"Detects concatenated basic SQL injection and SQLLFI attempts","tags":{"tag":["sqli","id","lfi"]},"impact":"5"},{"id":"48","rule":"(?:\\d+\\s*or\\s*\\d+\\s*[\\-+])|(?:\\\/\\w+;?\\s+(?:having|and|or|select))|(?:\\d\\s+group\\s+by.+\\()|(?:(?:;|#|--)\\s*(?:drop|alter))|(?:(?:;|#|--)\\s*(?:update|insert)\\s*\\w{2,})|(?:[^\\w]SET\\s*@\\w+)|(?:(?:n?and|x?or|not |\\|\\||\\&\\&)[\\s(]+\\w+[\\s)]*[!=+]+[\\s\\d]*[\"=()])","description":"Detects chained SQL injection attempts 1\/2","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"49","rule":"(?:\"\\s+and\\s*=\\W)|(?:\\(\\s*select\\s*\\w+\\s*\\()|(?:\\*\\\/from)|(?:\\+\\s*\\d+\\s*\\+\\s*@)|(?:\\w\"\\s*(?:[-+=|@]+\\s*)+[\\d(])|(?:coalesce\\s*\\(|@@\\w+\\s*[^\\w\\s])|(?:\\W!+\"\\w)|(?:\";\\s*(?:if|while|begin))|(?:\"[\\s\\d]+=\\s*\\d)|(?:order\\s+by\\s+if\\w*\\s*\\()|(?:[\\s(]+case\\d*\\W.+[tw]hen[\\s(])","description":"Detects chained SQL injection attempts 2\/2","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"50","rule":"(?:(select|;)\\s+(?:benchmark|if|sleep)\\s*?\\(\\s*\\(?\\s*\\w+)","description":"Detects SQL benchmark and sleep injection attempts including conditional queries","tags":{"tag":["sqli","id"]},"impact":"4"},{"id":"51","rule":"(?:create\\s+function\\s+\\w+\\s+returns)|(?:;\\s*(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s*[\\[(]?\\w{2,})","description":"Detects MySQL UDF injection and other data\/structure manipulation attempts","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"52","rule":"(?:alter\\s*\\w+.*character\\s+set\\s+\\w+)|(\";\\s*waitfor\\s+time\\s+\")|(?:\";.*:\\s*goto)","description":"Detects MySQL charset switch and MSSQL DoS attempts","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"53","rule":"(?:procedure\\s+analyse\\s*\\()|(?:;\\s*(declare|open)\\s+[\\w-]+)|(?:create\\s+(procedure|function)\\s*\\w+\\s*\\(\\s*\\)\\s*-)|(?:declare[^\\w]+[@#]\\s*\\w+)|(exec\\s*\\(\\s*@)","description":"Detects MySQL and PostgreSQL stored procedure\/function injections","tags":{"tag":["sqli","id"]},"impact":"7"},{"id":"54","rule":"(?:select\\s*pg_sleep)|(?:waitfor\\s*delay\\s?\"+\\s?\\d)|(?:;\\s*shutdown\\s*(?:;|--|#|\\\/\\*|{))","description":"Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"55","rule":"(?:\\sexec\\s+xp_cmdshell)|(?:\"\\s*!\\s*[\"\\w])|(?:from\\s+information_schema\\W)|(?:(?:(?:current_)?user|database|schema|connection_id)\\s*\\([^\\)]*)|(?:\";?\\s*(?:select|union|having)\\s*[^\\s])|(?:\\wiif\\s*\\()|(?:exec\\s+master\\.)|(?:union select @)|(?:union[\\w(\\s]*select)|(?:select.*\\w?user\\()|(?:into[\\s+]+(?:dump|out)file\\s*\")","description":"Detects MSSQL code execution and information gathering attempts","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"56","rule":"(?:merge.*using\\s*\\()|(execute\\s*immediate\\s*\")|(?:\\W+\\d*\\s*having\\s*[^\\s])|(?:match\\s*[\\w(),+-]+\\s*against\\s*\\()","description":"Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"57","rule":"(?:select\\s*\\*\\s*from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s*\\(\\s*space\\s*\\()","description":"Detects MySQL comment-\/space-obfuscated injections","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"58","rule":"(?:@[\\w-]+\\s*\\()|(?:]\\s*\\(\\s*[\"!]\\s*\\w)|(?:<[?%](?:php)?.*(?:[?%]>)?)|(?:;[\\s\\w|]*\\$\\w+\\s*=)|(?:\\$\\w+\\s*=(?:(?:\\s*\\$?\\w+\\s*[(;])|\\s*\".*\"))|(?:;\\s*\\{\\W*\\w+\\s*\\()","description":"Detects code injection attempts 1\/3","tags":{"tag":["id","rfe","lfi"]},"impact":"7"},{"id":"59","rule":"(?:(?:[;]+|(<[?%](?:php)?)).*(?:define|eval|file_get_contents|include|require|require_once|set|shell_exec|phpinfo|system|passthru|preg_\\w+|execute)\\s*[\"(@])","description":"Detects code injection attempts 2\/3","tags":{"tag":["id","rfe","lfi"]},"impact":"7"},{"id":"60","rule":"(?:(?:[;]+|(<[?%](?:php)?)).*[^\\w](?:echo|print|print_r|var_dump|[fp]open))|(?:;\\s*rm\\s+-\\w+\\s+)|(?:;.*{.*\\$\\w+\\s*=)|(?:\\$\\w+\\s*\\[\\]\\s*=\\s*)","description":"Detects code injection attempts 3\/3","tags":{"tag":["id","rfe","lfi"]},"impact":"7"},{"id":"61","rule":"(?:\\w+]?(?<!href)(?<!src)(?<!longdesc)(?<!returnurl)=(?:https?|ftp):)|(?:\\{\\s*\\$\\s*\\{)","description":"Detects url injections and RFE attempts","tags":{"tag":["id","rfe","lfi"]},"impact":"5"},{"id":"62","rule":"(?:function[^(]*\\([^)]*\\))|(?:(?:delete|void|throw|instanceof|new|typeof)\\W+\\w+\\s*[([])|([)\\]]\\s*\\.\\s*\\w+\\s*=)|(?:\\(\\s*new\\s+\\w+\\s*\\)\\.)","description":"Detects common function declarations and special JS operators","tags":{"tag":["id","rfe","lfi"]},"impact":"5"},{"id":"63","rule":"(?:[\\w.-]+@[\\w.-]+%(?:[01][\\db-ce-f])+\\w+:)","description":"Detects common mail header injections","tags":{"tag":["id","spam"]},"impact":"5"},{"id":"64","rule":"(?:\\.pl\\?\\w+=\\w?\\|\\w+;)|(?:\\|\\(\\w+=\\*)|(?:\\*\\s*\\)+\\s*;)","description":"Detects perl echo shellcode injection and LDAP vectors","tags":{"tag":["lfi","rfe"]},"impact":"5"},{"id":"65","rule":"(?:(^|\\W)const\\s+[\\w\\-]+\\s*=)|(?:(?:do|for|while)\\s*\\([^;]+;+\\))|(?:(?:^|\\W)on\\w+\\s*=[\\w\\W]*(?:on\\w+|alert|eval|print|confirm|prompt))|(?:groups=\\d+\\(\\w+\\))|(?:(.)\\1{128,})","description":"Detects basic XSS DoS attempts","tags":{"tag":["rfe","dos"]},"impact":"5"},{"id":"67","rule":"(?:\\({2,}\\+{2,}:{2,})|(?:\\({2,}\\+{2,}:+)|(?:\\({3,}\\++:{2,})|(?:\\$\\[!!!\\])","description":"Detects unknown attack vectors based on PHPIDS Centrifuge detection","tags":{"tag":["xss","csrf","id","rfe","lfi"]},"impact":"7"},{"id":"68","rule":"(?:[\\s\\\/\"]+[-\\w\\\/\\\\\\*]+\\s*=.+(?:\\\/\\s*>))","description":"finds attribute breaking injections including obfuscated attributes","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"69","rule":"(?:(?:msgbox|eval)\\s*\\+|(?:language\\s*=\\*vbscript))","description":"finds basic VBScript injection attempts","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"70","rule":"(?:\\[\\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|or)\\])","description":"finds basic MongoDB SQL injection attempts","tags":{"tag":"sqli"},"impact":"4"}]}} 

  • trunk/plugins/phpids/IDS/default_filter.xml

    r13571 r14722  
    2222    <filter> 
    2323        <id>69</id> 
    24         <rule><![CDATA[(?:[\s\d\/"]+(?:on\w+|style)=[$"\w])]]></rule> 
     24        <rule><![CDATA[(?:[\s\d\/"]+(?:on\w+|style|poster|background)=[$"\w])]]></rule> 
    2525        <description>finds malicious attribute injection attempts</description> 
    2626        <tags> 
    … …  
    6161    </filter> 
    6262    <filter> 
     63        <id>6</id> 
     64        <rule><![CDATA[(?:with\s*\(\s*.+\s*\)\s*\w+\s*\()|(?:(?:do|while|for)\s*\([^)]*\)\s*\{)|(?:\/[\w\s]*\[\W*\w)]]></rule> 
     65        <description>Detects self contained xss via with(), common loops and regex to string conversion</description> 
     66        <tags> 
     67            <tag>xss</tag> 
     68            <tag>csrf</tag> 
     69        </tags> 
     70        <impact>5</impact> 
     71    </filter> 
     72    <filter> 
    6373        <id>7</id> 
    64         <rule><![CDATA[(?:\d\s*[|&]{2}\s*\w)|(?:[=(].+\?.+:)|(?:with\([^)]*\)\))|(?:\.\s*source\W)|(?:\?[^:=]+:[^;]+(;|$))]]></rule> 
     74        <rule><![CDATA[(?:[=(].+\?.+:)|(?:with\([^)]*\)\))|(?:\.\s*source\W)]]></rule> 
    6575        <description>Detects JavaScript with(), ternary operators and XML predicate attacks</description> 
    6676        <tags> 
    … …  
    7282    <filter> 
    7383        <id>8</id> 
    74         <rule><![CDATA[(?:\([\w\s]+\([\w\s]+\)[\w\s]+\))|(?:(?<!(?:mozilla\/\d\.\d\s))\([^)[]+\[[^\]]+\][^)]*\))|(?:[^\s!][{([][^({[]+[{([][^}\])]+[}\])][\s+",\d]*[}\])])|(?:"\)?\]\W*\[)|(?:=\s*[^\s:;]+\s*[{([][^}\])]+[}\])];)]]></rule> 
     84        <rule><![CDATA[(?:\/\w*\s*\)\s*\()|(?:\(.*\/.+\/\w*\s*\))|(?:\([\w\s]+\([\w\s]+\)[\w\s]+\))|(?:(?<!(?:mozilla\/\d\.\d\s))\([^)[]+\[[^\]]+\][^)]*\))|(?:[^\s!][{([][^({[]+[{([][^}\])]+[}\])][\s+",\d]*[}\])])|(?:"\)?\]\W*\[)|(?:=\s*[^\s:;]+\s*[{([][^}\])]+[}\])];)]]></rule> 
    7585        <description>Detects self-executing JavaScript functions</description> 
    7686        <tags> 
    … …  
    135145    <filter> 
    136146        <id>14</id> 
    137         <rule><![CDATA[(?:\w+script:|@import[^\w]|;base64|base64,)|(?:\w+\s*\([\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+\))]]></rule> 
    138         <description>Detects possible includes and packed functions</description> 
     147        <rule><![CDATA[(?:#@~\^\w+)|(?:\w+script:|@import[^\w]|;base64|base64,)|(?:\w+\s*\([\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+\))]]></rule> 
     148        <description>Detects possible includes, VBSCript/JScript encodeed and packed functions</description> 
    139149        <tags> 
    140150            <tag>xss</tag> 
    … …  
    159169    <filter> 
    160170        <id>16</id> 
    161         <rule><![CDATA[([^*\s\w,.\/?+-]\s*)?(?<![a-mo-z]\s)(?<![a-z\/_@>\-\|])(\s*return\s*)?(?:alert|inputbox|showmodaldialog|infinity|isnan|isnull|msgbox|expression|prompt|write(?:ln)?|confirm|dialog|urn|(?:un)?eval|exec|execscript|tostring|status|execute|window|unescape|navigate|jquery|getscript|extend|prototype)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.:\/+\-]))]]></rule> 
     171        <rule><![CDATA[([^*\s\w,.\/?+-]\s*)?(?<![a-mo-z]\s)(?<![a-z\/_@>])(\s*return\s*)?(?:alert|inputbox|showmodaldialog|infinity|isnan|isnull|iterator|msgbox|expression|prompt|write(?:ln)?|confirm|dialog|urn|(?:un)?eval|exec|execscript|tostring|status|execute|window|unescape|navigate|jquery|getscript|extend|prototype)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.:\/+\-]))]]></rule> 
    162172        <description>Detects possible includes and typical script methods</description> 
    163173        <tags> 
    … …  
    171181    <filter> 
    172182        <id>17</id> 
    173         <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@>\|])(\s*return\s*)?(?:hash|name|href|navigateandfind|source|pathname|close|constructor|port|protocol|assign|replace|back|forward|document|ownerdocument|window|self|parent|frames|_?content|date|cookie|innerhtml|innertext|csstext+?|outerhtml|print|moveby|resizeto|createstylesheet|stylesheets)(?(1)[^\w%"]|(?:\s*[^@\/\s\w%,.+\-]))]]></rule> 
     183        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@>])(\s*return\s*)?(?:hash|name|href|navigateandfind|source|pathname|close|constructor|port|protocol|assign|replace|back|forward|document|ownerdocument|window|top|this|self|parent|frames|_?content|date|cookie|innerhtml|innertext|csstext+?|outerhtml|print|moveby|resizeto|createstylesheet|stylesheets)(?(1)[^\w%"]|(?:\s*[^@\/\s\w%.+\-]))]]></rule> 
    174184        <description>Detects JavaScript object properties and methods</description> 
    175185        <tags> 
    … …  
    207217    <filter> 
    208218        <id>20</id> 
    209         <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z_@>\|])(\s*return\s*)?(?:globalstorage|sessionstorage|postmessage|callee|constructor|content|domain|prototype|try|catch|top|call|apply|url|function|object|array|string|math|if|elseif|case|switch|regex|boolean|location|settimeout|setinterval|void|setexpression|namespace|while)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.+\-]))]]></rule> 
     219        <rule><![CDATA[(?:\)\s*\[)|(?:\/\w*\s*\)\s*\W)|([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z_@>\|])(\s*return\s*)?(?:globalstorage|sessionstorage|postmessage|callee|constructor|content|domain|prototype|try|catch|top|call|apply|url|function|object|array|string|math|if|for\s*(?:each)?|elseif|case|switch|regex|boolean|location|settimeout|setinterval|void|setexpression|namespace|while)(?(1)[^\w%"]|(?:\s*[^@\s\w%".+\-]))]]></rule> 
    210220        <description>Detects JavaScript language constructs</description> 
    211221        <tags> 
    … …  
    219229    <filter> 
    220230        <id>21</id> 
    221         <rule><![CDATA[(?:,\s*(?:alert|showmodaldialog|eval)\s*,)|(?::\s*eval\s*[^\s])|([^:\s\w,.\/?+-]\s*)?(?<![a-z\/_@])(\s*return\s*)?(?:(?:document\s*\.)?(?:.+\/)?(?:alert|eval|msgbox|showmodaldialog|prompt|write(?:ln)?|confirm|dialog|open))\s*(?(1)[^\w]|(?:\s*[^\s\w,.@\/+-]))|(?:java[\s\/]*\.[\s\/]*lang)|(?:\w\s*=\s*new\s+\w+)|(?:&\s*\w+\s*\)[^,])|(?:\+[\W\d]*new\s+\w+[\W\d]*\+)|(?:document\.\w)]]></rule> 
     231        <rule><![CDATA[(?:,\s*(?:alert|showmodaldialog|eval)\s*,)|(?::\s*eval\s*[^\s])|([^:\s\w,.\/?+-]\s*)?(?<![a-z\/_@])(\s*return\s*)?(?:(?:document\s*\.)?(?:.+\/)?(?:alert|eval|msgbox|showmodaldialog|prompt|write(?:ln)?|confirm|dialog|open))\s*(?:[^a-z\s]|(?:\s*[^\s\w,.@\/+-]))|(?:java[\s\/]*\.[\s\/]*lang)|(?:\w\s*=\s*new\s+\w+)|(?:&\s*\w+\s*\)[^,])|(?:\+[\W\d]*new\s+\w+[\W\d]*\+)|(?:document\.\w)]]></rule> 
    222232        <description>Detects very basic XSS probings</description> 
    223233        <tags> 
    … …  
    231241    <filter> 
    232242        <id>22</id> 
    233         <rule><![CDATA[(?:[^\s]\s*=\s*script)|(?:\.\s*constructor)|(?:default\s+xml\s+namespace\s*=)|(?:\/\s*\+[^+]+\s*\+\s*\/)]]></rule> 
     243        <rule><![CDATA[(?:=\s*(?:top|this|window|content|self|frames|_content))|(?:\/\s*\w*\s*[)}])|(?:[^\s]\s*=\s*script)|(?:\.\s*constructor)|(?:default\s+xml\s+namespace\s*=)|(?:\/\s*\+[^+]+\s*\+\s*\/)]]></rule> 
    234244        <description>Detects advanced XSS probings via Script(), RexExp, constructors and XML namespaces</description> 
    235245        <tags> 
    … …  
    316326    <filter> 
    317327        <id>30</id> 
    318         <rule><![CDATA[(?:\+=\s*\(\s")|(?:!+\s*[\d.,]+\w?\d*\s*\?)|(?:=\s*\[s*\])|(?:"\s*\+\s*")|(?:[^\s]\[\s*\d+\s*\]\s*[;+])|(?:"\s*[&|]+\s*")|(?:\/\s*\?\s*")|(?:\/\s*\)\s*\[)|(?:\d\?.+:\d)|(?:]\s*\[\W*\w)|(?:[^\s]\s*=\s*\/)]]></rule> 
     328        <rule><![CDATA[(?:=\s*\w+\s*\+\s*")|(?:\+=\s*\(\s")|(?:!+\s*[\d.,]+\w?\d*\s*\?)|(?:=\s*\[s*\])|(?:"\s*\+\s*")|(?:[^\s]\[\s*\d+\s*\]\s*[;+])|(?:"\s*[&|]+\s*")|(?:\/\s*\?\s*")|(?:\/\s*\)\s*\[)|(?:\d\?.+:\d)|(?:]\s*\[\W*\w)|(?:[^\s]\s*=\s*\/)]]></rule> 
    319329        <description>Detects common XSS concatenation patterns 1/2</description> 
    320330        <tags> 
    … …  
    379389    </filter> 
    380390    <filter> 
    381         <id>36</id> 
    382         <rule><![CDATA[(?:--.*[^-]>)|(?:opera\s*\.\s*\w+\s*\()]]></rule> 
    383         <description>Detects comments to exploit firefox' faulty rendering and proprietary opera attacks</description> 
    384         <tags> 
    385             <tag>xss</tag> 
    386             <tag>csrf</tag> 
    387             <tag>id</tag> 
    388         </tags> 
    389         <impact>3</impact> 
    390     </filter> 
    391     <filter> 
    392391        <id>37</id> 
    393392        <rule><![CDATA[(?:\<base\s+)|(?:<!(?:element|entity|\[CDATA))]]></rule> 
    … …  
    414413    </filter>    
    415414    <filter> 
     415        <id>39</id> 
     416        <rule><![CDATA[(?:\\x[01fe][\db-ce-f])|(?:%[01fe][\db-ce-f])|(?:&#[01fe][\db-ce-f])|(?:\\[01fe][\db-ce-f])|(?:&#x[01fe][\db-ce-f])]]></rule> 
     417        <description>Detects nullbytes and other dangerous characters</description> 
     418        <tags> 
     419            <tag>id</tag> 
     420            <tag>rfe</tag> 
     421            <tag>xss</tag> 
     422        </tags> 
     423        <impact>5</impact> 
     424    </filter>    
     425    <filter> 
    416426        <id>40</id> 
    417         <rule><![CDATA[(?:"\s*(?:#|--|{))|(?:\/\*!\s?\d+)|(?:ch(?:a)?r\s*\(\s*\d)|(?:(?:(n?and|x?or|not)\s+|\|\||\&\&)\s*\w+\()]]></rule> 
     427        <rule><![CDATA[(?:\)\s*when\s*\d+\s*then)|(?:"\s*(?:#|--|{))|(?:\/\*!\s?\d+)|(?:ch(?:a)?r\s*\(\s*\d)|(?:(?:(n?and|x?or|not)\s+|\|\||\&\&)\s*\w+\()]]></rule> 
    418428        <description>Detects MySQL comments, conditions and ch(a)r injections</description> 
    419429        <tags> 
    … …  
    426436    <filter> 
    427437        <id>41</id> 
    428         <rule><![CDATA[(?:\)\s*like\s*\()|(?:having\s+[\d\w\-"]+\s*[(=<>~])|(?:if\s?\([\d\w]\s*[=<>~])]]></rule> 
     438        <rule><![CDATA[(?:[\s()]case\s*\()|(?:\)\s*like\s*\()|(?:having\s*[^\s]+\s*[^\w\s])|(?:if\s?\([\d\w]\s*[=<>~])]]></rule> 
    429439        <description>Detects conditional SQL injection attempts</description> 
    430440        <tags> 
    … …  
    433443            <tag>lfi</tag> 
    434444        </tags> 
    435         <impact>4</impact> 
     445        <impact>6</impact> 
    436446    </filter>    
    437447    <filter> 
    438448        <id>42</id> 
    439         <rule><![CDATA[(?:\\x(?:23|27|3d))|(?:^.?"$)|(?:^.*\\".+(?<!\\)")|(?:(?:^["\\]*(?:[\d"]+|[^"]+"))+\s*(?:n?and|x?or|not|\|\||\&\&)\s*[\w"[+&!@(),.-])|(?:[^\w\s]\w+\s*[|-]\s*"\s*\w)|(?:@\w+\s+(and|or)\s*["\d]+)|(?:@[\w-]+\s(and|or)\s*[^\w\s])|(?:[^\w\s:]\s*\d\W+[^\w\s]\s*".)]]></rule> 
     449        <rule><![CDATA[(?:"\s*or\s*\d)|(?:\\x(?:23|27|3d))|(?:^.?"$)|(?:^.*\\".+(?<!\\)")|(?:(?:^["\\]*(?:[\d"]+|[^"]+"))+\s*(?:n?and|x?or|not|\|\||\&\&)\s*[\w"[+&!@(),.-])|(?:[^\w\s]\w+\s*[|-]\s*"\s*\w)|(?:@\w+\s+(and|or)\s*["\d]+)|(?:@[\w-]+\s(and|or)\s*[^\w\s])|(?:[^\w\s:]\s*\d\W+[^\w\s]\s*".)]]></rule> 
    440450        <description>Detects classic SQL injection probings 1/2</description> 
    441451        <tags> 
    … …  
    456466        </tags> 
    457467        <impact>6</impact> 
    458     </filter> 
     468    </filter>  
     469    <filter> 
     470        <id>44</id> 
     471        <rule><![CDATA[(?:\d"\s+"\s+\d)|(?:^admin\s*"|(\/\*)+"+\s?(?:--|#|\/\*|{)?)|(?:"\s*or[\w\s-]+\s*[+<>=(),-]\s*[\d"])|(?:"\s*[^\w\s]?=\s*")|(?:"\W*[+=]+\W*")|(?:"\s*[!=|][\d\s!=+-]+.*["(].*$)|(?:"\s*[!=|][\d\s!=]+.*\d+$)|(?:"\s*like\W+[\w"(])|(?:\sis\s*0\W)|(?:where\s[\s\w\.,-]+\s=)|(?:"[<>~]+")]]></rule> 
     472        <description>Detects basic SQL authentication bypass attempts 1/3</description> 
     473        <tags> 
     474            <tag>sqli</tag> 
     475            <tag>id</tag> 
     476            <tag>lfi</tag> 
     477        </tags> 
     478        <impact>7</impact> 
     479    </filter>  
     480    <filter> 
     481        <id>45</id> 
     482        <rule><![CDATA[(?:union\s*(?:all|distinct|[(!@]*)?\s*[([]*\s*select)|(?:\w+\s+like\s+\")|(?:like\s*"\%)|(?:"\s*like\W*["\d])|(?:"\s*(?:n?and|x?or|not |\|\||\&\&)\s+[\s\w]+=\s*\w+\s*having)|(?:"\s*\*\s*\w+\W+")|(?:"\s*[^?\w\s=.,;)(]+\s*[(@"]*\s*\w+\W+\w)|(?:select\s*[\[\]()\s\w\.,-]+from)]]></rule> 
     483        <description>Detects basic SQL authentication bypass attempts 2/3</description> 
     484        <tags> 
     485            <tag>sqli</tag> 
     486            <tag>id</tag> 
     487            <tag>lfi</tag> 
     488        </tags> 
     489        <impact>7</impact> 
     490    </filter> 
     491     <filter> 
     492        <id>46</id> 
     493        <rule><![CDATA[(?:in\s*\(+\s*select)|(?:(?:n?and|x?or|not |\|\||\&\&)\s+[\s\w+]+(?:regexp\s*\(|sounds\s+like\s*"|[=\d]+x))|("\s*\d\s*(?:--|#))|(?:"[%&<>^=]+\d\s*(=|or))|(?:"\W+[\w+-]+\s*=\s*\d\W+")|(?:"\s*is\s*\d.+"?\w)|(?:"\|?[\w-]{3,}[^\w\s.,]+")|(?:"\s*is\s*[\d.]+\s*\W.*")]]></rule> 
     494        <description>Detects basic SQL authentication bypass attempts 3/3</description> 
     495        <tags> 
     496            <tag>sqli</tag> 
     497            <tag>id</tag> 
     498            <tag>lfi</tag> 
     499        </tags> 
     500        <impact>7</impact> 
     501    </filter>  
    459502    <filter> 
    460503        <id>47</id> 
    461         <rule><![CDATA[(?:^\s*[;>"]\s*(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc))|(?:(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s+(?:concat|char|load_file)\s?\(?)|(?:end\s*\);)|("\s+regexp\W)]]></rule> 
     504        <rule><![CDATA[(?:[\d\W]\s+as\s*["\w]+\s*from)|(?:^[\W\d]+\s*(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc))|(?:(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s+(?:concat|char|load_file)\s?\(?)|(?:end\s*\);)|("\s+regexp\W)|(?:[\s(]load_file\s*\()]]></rule> 
    462505        <description>Detects concatenated basic SQL injection and SQLLFI attempts</description> 
    463506        <tags> 
    … …  
    470513    <filter> 
    471514        <id>48</id> 
    472         <rule><![CDATA[(?:\/\w+;?\s+(?:having|and|or|select))|(?:\d\s+group\s+by.+\()|(?:(?:;|#|--)\s*(?:drop|alter))|(?:(?:;|#|--)\s*(?:update|insert)\s*\w{2,})|(?:[^\w]SET\s*@\w+)|(?:(?:n?and|x?or|not |\|\||\&\&)\s+\w+[!=+]+[\s\d]*["=(])]]></rule> 
     515        <rule><![CDATA[(?:\d+\s*or\s*\d+\s*[\-+])|(?:\/\w+;?\s+(?:having|and|or|select))|(?:\d\s+group\s+by.+\()|(?:(?:;|#|--)\s*(?:drop|alter))|(?:(?:;|#|--)\s*(?:update|insert)\s*\w{2,})|(?:[^\w]SET\s*@\w+)|(?:(?:n?and|x?or|not |\|\||\&\&)[\s(]+\w+[\s)]*[!=+]+[\s\d]*["=()])]]></rule> 
    473516        <description>Detects chained SQL injection attempts 1/2</description> 
    474517        <tags> 
    … …  
    480523    <filter> 
    481524        <id>49</id> 
    482         <rule><![CDATA[(?:\*\/from)|(?:\+\s*\d+\s*\+\s*@)|(?:\w"\s*(?:[-+=|@]+\s*)+[\d(])|(?:coalesce\s*\(|@@\w+\s*[^\w\s])|(?:\W!+"\w)|(?:";\s*(?:if|while|begin))|(?:"[\s\d]+=\s*\d)|(?:order\s+by\s+if\w*\s*\()]]></rule> 
     525        <rule><![CDATA[(?:"\s+and\s*=\W)|(?:\(\s*select\s*\w+\s*\()|(?:\*\/from)|(?:\+\s*\d+\s*\+\s*@)|(?:\w"\s*(?:[-+=|@]+\s*)+[\d(])|(?:coalesce\s*\(|@@\w+\s*[^\w\s])|(?:\W!+"\w)|(?:";\s*(?:if|while|begin))|(?:"[\s\d]+=\s*\d)|(?:order\s+by\s+if\w*\s*\()|(?:[\s(]+case\d*\W.+[tw]hen[\s(])]]></rule> 
    483526        <description>Detects chained SQL injection attempts 2/2</description> 
    484527        <tags> 
    … …  
    490533    <filter> 
    491534        <id>50</id> 
    492         <rule><![CDATA[(?:(select|;)\s+(?:benchmark|if|sleep)\s?\(\s?\(?\s?\w+)]]></rule> 
     535        <rule><![CDATA[(?:(select|;)\s+(?:benchmark|if|sleep)\s*?\(\s*\(?\s*\w+)]]></rule> 
    493536        <description>Detects SQL benchmark and sleep injection attempts including conditional queries</description> 
    494537        <tags> 
    … …  
    528571        <impact>7</impact> 
    529572    </filter> 
    530  
    531     <!-- cut: not releted injections --> 
    532  
     573    <filter> 
     574        <id>54</id> 
     575        <rule><![CDATA[(?:select\s*pg_sleep)|(?:waitfor\s*delay\s?"+\s?\d)|(?:;\s*shutdown\s*(?:;|--|#|\/\*|{))]]></rule> 
     576        <description>Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts</description> 
     577        <tags> 
     578            <tag>sqli</tag> 
     579            <tag>id</tag> 
     580        </tags> 
     581        <impact>5</impact> 
     582    </filter> 
     583    <filter> 
     584        <id>55</id> 
     585        <rule><![CDATA[(?:\sexec\s+xp_cmdshell)|(?:"\s*!\s*["\w])|(?:from\s+information_schema\W)|(?:(?:(?:current_)?user|database|schema|connection_id)\s*\([^\)]*)|(?:";?\s*(?:select|union|having)\s*[^\s])|(?:\wiif\s*\()|(?:exec\s+master\.)|(?:union select @)|(?:union[\w(\s]*select)|(?:select.*\w?user\()|(?:into[\s+]+(?:dump|out)file\s*")]]></rule> 
     586        <description>Detects MSSQL code execution and information gathering attempts</description> 
     587        <tags> 
     588            <tag>sqli</tag> 
     589            <tag>id</tag> 
     590        </tags> 
     591        <impact>5</impact> 
     592    </filter> 
    533593    <filter> 
    534594        <id>56</id> 
    535         <rule><![CDATA[(?:merge.*using\s*\()|(execute\s*immediate\s*")|(?:\W+\d*\s+having\s+\d)|(?:match\s*[\w(),+-]+\s*against\s*\()]]></rule> 
     595        <rule><![CDATA[(?:merge.*using\s*\()|(execute\s*immediate\s*")|(?:\W+\d*\s*having\s*[^\s])|(?:match\s*[\w(),+-]+\s*against\s*\()]]></rule> 
    536596        <description>Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections</description> 
    537597        <tags> 
    … …  
    636696        <impact>5</impact> 
    637697    </filter> 
    638     <!--         
    639698    <filter> 
    640699        <id>67</id> 
    … …  
    650709        <impact>7</impact> 
    651710    </filter> 
    652     -->     
    653711    <filter> 
    654712        <id>68</id> 
    … …  
    670728        </tags> 
    671729        <impact>4</impact> 
    672     </filter>    
     730    </filter> 
     731    <filter> 
     732        <id>70</id> 
     733        <rule><![CDATA[(?:\[\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|or)\])]]></rule> 
     734        <description>finds basic MongoDB SQL injection attempts</description> 
     735        <tags> 
     736            <tag>sqli</tag> 
     737        </tags> 
     738        <impact>4</impact> 
     739    </filter>       
    673740</filters> 
Note: See TracChangeset for help on using the changeset viewer.
 
 

Site Search

Market

Notes

Websites

About BoonEx• Contacts• © BoonEx (ACN 127966581)