Ticket #2181: naxsi_core.rules

File naxsi_core.rules, 5.7 KB (added by pandey.brbhushan@…, 5 years ago)
Line 
1##################################
2## INTERNAL RULES IDS:1-999 ##
3##################################
4#@MainRule "msg:weird request, unable to parse" id:1;
5#@MainRule "msg:request too big, stored on disk and not parsed" id:2;
6#@MainRule "msg:invalid hex encoding, null bytes" id:10;
7#@MainRule "msg:unknown content-type" id:11;
8#@MainRule "msg:invalid formatted url" id:12;
9#@MainRule "msg:invalid POST format" id:13;
10#@MainRule "msg:invalid POST boundary" id:14;
11
12##################################
13## SQL Injections IDs:1000-1099 ##
14##################################
15##Enabled 1000 but without 'from'
16MainRule "rx:select|union|update|delete|insert|table|ascii|hex|unhex|drop" "msg:sql keywords" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1000;
17MainRule "str:\"" "msg:double quote" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8,$XSS:8" id:1001;
18#These are commented as 0x is a legitimate base64 string
19#MainRule "str:0x" "msg:0x, possible hex encoding" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:2" id:1002;
20## Hardcore rules
21MainRule "str:/*" "msg:mysql comment (/*)" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1003;
22MainRule "str:*/" "msg:mysql comment (*/)" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1004;
23MainRule "str:|" "msg:mysql keyword (|)" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1005;
24MainRule "str:&&" "msg:mysql keyword (&&)" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1006;
25## end of hardcore rules
26MainRule "str:--" "msg:mysql comment (--)" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1007;
27MainRule "str:;" "msg:semicolon" "mz:URL|ARGS" "s:$SQL:4,$XSS:8" id:1008;
28#The '=' sign is a legitimate base64 padding
29#MainRule "str:=" "msg:equal sign in var, probable sql/xss" "mz:ARGS|BODY" "s:$SQL:2" id:1009;
30MainRule "str:(" "msg:open parenthesis, probable sql/xss" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1010;
31MainRule "str:)" "msg:close parenthesis, probable sql/xss" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1011;
32MainRule "str:'" "msg:simple quote" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1013;
33MainRule "str:," "msg:comma" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
34MainRule "str:#" "msg:mysql comment (#)" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1016;
35
36###############################
37## OBVIOUS RFI IDs:1100-1199 ##
38###############################
39MainRule "str:http://" "msg:http:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1100;
40MainRule "str:https://" "msg:https:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1101;
41MainRule "str:ftp://" "msg:ftp:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1102;
42MainRule "str:php://" "msg:php:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1103;
43MainRule "str:sftp://" "msg:sftp:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1104;
44MainRule "str:zlib://" "msg:zlib:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1105;
45MainRule "str:data://" "msg:data:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1106;
46MainRule "str:glob://" "msg:glob:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1107;
47MainRule "str:phar://" "msg:phar:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1108;
48MainRule "str:file://" "msg:file:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1109;
49MainRule "str:gopher://" "msg:gopher:// scheme" "mz:ARGS|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1110;
50
51#######################################
52## Directory traversal IDs:1200-1299 ##
53#######################################
54MainRule "str:.." "msg:double dot" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1200;
55MainRule "str:/etc/passwd" "msg:obvious probe" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1202;
56MainRule "str:c:\\" "msg:obvious windows path" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1203;
57MainRule "str:cmd.exe" "msg:obvious probe" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1204;
58MainRule "str:\\" "msg:backslash" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1205;
59#Also a legitimate character in base64 encoded strings
60#MainRule "str:/" "msg:slash in args" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:2" id:1206;
61
62########################################
63## Cross Site Scripting IDs:1300-1399 ##
64########################################
65MainRule "str:<" "msg:html open tag" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1302;
66MainRule "str:>" "msg:html close tag" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1303;
67MainRule "str:[" "msg:open square backet ([), possible js" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1310;
68MainRule "str:]" "msg:close square bracket (]), possible js" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1311;
69MainRule "str:~" "msg:tilde (~) character" "mz:URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1312;
70MainRule "str:`" "msg:grave accent (`)" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1314;
71MainRule "rx:%[23]." "msg:double encoding" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1315;
72
73####################################
74## Evading tricks IDs: 1400-1500 ##
75####################################
76MainRule negative "rx:multipart/form-data|application/x-www-form-urlencoded|application/json" "msg:Content is neither mulipart/x-www-form.." "mz:$HEADERS_VAR:Content-type" "s:$EVADE:4" id:1402;
77MainRule "str:&#" "msg:utf7/8 encoding" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1400;
78MainRule "str:%U" "msg:M$ encoding" "mz:ARGS|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1401;
79
80#############################
81## File uploads: 1500-1600 ##
82#############################
83MainRule "rx:\.ph|\.asp|\.ht" "msg:asp/php file upload" "mz:FILE_EXT" "s:$UPLOAD:8" id:1500;