# modsec.conf updates
# Last Update: 10/26/2006

    # Turn the filtering engine On or Off
    SecFilterEngine On

    # The audit engine works independently and
    # can be turned On of Off on the per-server or
    # on the per-directory basis
    SecAuditEngine RelevantOnly

    # Should only be on if the webserver is capable 
    SecFilterCheckUnicodeEncoding Off

    # Cookie format checks.
    SecFilterCheckCookieFormat On

    # The name of the audit log file
    SecAuditLog logs/audit_log

    # Should mod_security inspect POST payloads
    SecFilterScanPOST On

    # Default action set
    SecFilterDefaultAction "deny,log,status:406"


## FILE VERSION IMPORTANT!!!
# update this number anytime changes are made eg 1.0 becomes 1.01
# used to keep track of rule versions on servers
SecFilterSelective THE_REQUEST "modsecvercheck=1.06"

####################################
# FRONTPAGE from Josh
####################################
SecFilter "_vti_bin" allow
SecFilterSelective THE_REQUEST "/fpsrvadm\.exe" pass
SecFilterSelective THE_REQUEST "/fpremadm\.exe" pass
SecFilterSelective THE_REQUEST "/admisapi/fpadmin\.htm" pass
SecFilterSelective THE_REQUEST "/scripts/Fpadmcgi\.exe" pass
SecFilterSelective THE_REQUEST "/_private/orders\.txt" pass
SecFilterSelective THE_REQUEST "/_private/form_results\.txt" pass
SecFilterSelective THE_REQUEST "/_private/registrations\.htm" pass
SecFilterSelective THE_REQUEST "/cfgwiz\.exe" pass
SecFilterSelective THE_REQUEST "/authors\.pwd" pass
SecFilterSelective THE_REQUEST "/_vti_bin/_vti_aut/author\.exe" pass
SecFilterSelective THE_REQUEST "/administrators\.pwd" pass
SecFilterSelective THE_REQUEST "/_private/form_results\.htm" pass
SecFilterSelective THE_REQUEST "/_vti_pvt/access\.cnf" pass
SecFilterSelective THE_REQUEST "/_private/register\.txt" pass
SecFilterSelective THE_REQUEST "/_private/registrations\.txt" pass
SecFilterSelective THE_REQUEST "/_vti_pvt/service\.cnf" pass
SecFilterSelective THE_REQUEST "/service\.pwd" pass
SecFilterSelective THE_REQUEST "/_vti_pvt/service\.stp" pass
SecFilterSelective THE_REQUEST "/_vti_pvt/services\.cnf" pass
SecFilterSelective THE_REQUEST "/_vti_bin/shtml\.exe" pass
SecFilterSelective THE_REQUEST "/_vti_pvt/svcacl\.cnf" pass
SecFilterSelective THE_REQUEST "/users\.pwd" pass
SecFilterSelective THE_REQUEST "/_vti_pvt/writeto\.cnf" pass
SecFilterSelective THE_REQUEST "/dvwssr\.dll" pass
SecFilterSelective THE_REQUEST "/_private/register\.htm" pass
SecFilterSelective THE_REQUEST "/_vti_bin/" pass


# BEGIN RULES
#
# Basic rules with arbitrary command detection

#HG Compacted Rules
SecFilter "wget\x20"
SecFilter "uname\x20-a"
SecFilter "gcc\x20"
SecFilter "Bcc:"
SecFilter "Bcc:\x20"
SecFilter "bcc:"
SecFilter "bcc:\x20"
SecFilter "server_inc=http:"
SecFilterSelective THE_REQUEST "system\("
SecFilterSelective THE_REQUEST "exec\("
SecFilterSelective THE_REQUEST "popen\("
SecFilterSelective THE_REQUEST "passthru\("
SecFilterSelective THE_REQUEST "albacrew"
SecFilterSelective THE_REQUEST "dir\[inc\]\=http"

#END HG RULES



#TP ruleset below
SecFilterSelective THE_REQUEST "\.htgroup"
SecFilterSelective THE_REQUEST "\.htaccess"
SecFilterSelective THE_REQUEST "cd\.\."
SecFilterSelective THE_REQUEST "///cgi-bin"
SecFilterSelective THE_REQUEST "/cgi-bin///"
SecFilterSelective THE_REQUEST "/~root"
SecFilterSelective THE_REQUEST "/~ftp"
SecFilterSelective THE_REQUEST "/htgrep" chain
SecFilterSelective THE_REQUEST "/htgrep" log,pass
SecFilterSelective THE_REQUEST "/\.history"
SecFilterSelective THE_REQUEST "/\.bash_history"
SecFilterSelective THE_REQUEST "/~nobody"
SecFilterSelective THE_REQUEST "<script"
SecFilterSelective THE_REQUEST "psybnc"
SecFilterSelective THE_REQUEST "cmd=cd\x20/var"
SecFilterSelective THE_REQUEST "dir=http"
SecFilterSelective THE_REQUEST "\?STRENGUR"
SecFilterSelective THE_REQUEST "/etc/motd"
SecFilterSelective THE_REQUEST "/etc/passwd"
SecFilterSelective THE_REQUEST "conf/httpd\.conf"
SecFilterSelective THE_REQUEST "/bin/ps"
SecFilterSelective THE_REQUEST "bin/tclsh"
SecFilterSelective THE_REQUEST "tclsh8\x20"
SecFilterSelective THE_REQUEST "udp\.pl"
SecFilterSelective THE_REQUEST "linuxdaybot\.txt"
SecFilterSelective THE_REQUEST "wget\x20"
SecFilterSelective THE_REQUEST "bin/nasm"
SecFilterSelective THE_REQUEST "nasm\x20"
SecFilterSelective THE_REQUEST "/usr/bin/perl"
SecFilterSelective THE_REQUEST "links -dump "
SecFilterSelective THE_REQUEST "links -dump-(charset|width) "
SecFilterSelective THE_REQUEST "links (http|https|ftp)\:/"
SecFilterSelective THE_REQUEST "links -source "
SecFilterSelective THE_REQUEST "cd\x20/(tmp|var/tmp|etc/httpd/proxy|dev/shm)" 
SecFilterSelective THE_REQUEST "cd\.\." 
SecFilterSelective THE_REQUEST "///cgi-bin" 
SecFilterSelective THE_REQUEST "/cgi-bin///" 
SecFilterSelective THE_REQUEST "/~named(/| HTTP\/(0\.9|1\.0|1\.1)$)" 
SecFilterSelective THE_REQUEST "/~guest(/| HTTP\/(0\.9|1\.0|1\.1)$)" 
SecFilterSelective THE_REQUEST "/~logs(/| HTTP\/(0\.9|1\.0|1\.1)$)" 
SecFilterSelective THE_REQUEST "/~sshd(/| HTTP\/(0\.9|1\.0|1\.1)$)" 
SecFilterSelective THE_REQUEST "/~ftp(/| HTTP\/(0\.9|1\.0|1\.1)$)" 
SecFilterSelective THE_REQUEST "/~bin(/| HTTP\/(0\.9|1\.0|1\.1)$)" 
SecFilterSelective THE_REQUEST "/~nobody(/| HTTP\/(0\.9|1\.0|1\.1)$)"  
SecFilterSelective THE_REQUEST "/\.history HTTP\/(0\.9|1\.0|1\.1)$" 
SecFilterSelective THE_REQUEST "/\.bash_history HTTP\/(0\.9|1\.0|1\.1)$"
SecFilterSelective REQUEST_URI "/nessus_is_probing_you_"
SecFilterSelective REQUEST_URI "/NessusTest"
SecFilter "javascript\://"
SecFilter "img src=javascript"
SecFilter "_PHPLIB\[libdir\]"
SecFilter "hdr=/"



# Shell scripts, proxies and bittorrents
# Steves rules of known attacks found on our servers
##

#BitTorrent Attacks
SecFilterSelective THE_REQUEST "\?info_hash="

#Eggdrops
SecFilterSelective THE_REQUEST "eggdrop"

#Proxy
SecFilterSelective REQUEST_URI "nph-proxy.cgi"
SecFilterSelective REQUEST_URI "nph-p.cgi"

#c99shell
SecFilterSelective THE_REQUEST "/c99shell"
SecFilterSelective THE_REQUEST "/shell\.php\&cmd="
#top nav links
SecFilterSelective THE_REQUEST "\act=ls\&d=" chain
SecFilterSelective THE_REQUEST "\&sort=0a" "msg:'c99shell'"
SecFilterSelective THE_REQUEST "\act=(search|fsbuff|encoder|tools|processes|ftpquickbrute|security|sql|eval|update|feedback)\&d=" "msg:'c99shell'"
#File editing
SecFilterSelective THE_REQUEST "\act=f\&f=" chain
SecFilterSelective THE_REQUEST "\&d=" "msg:'c99shell'"
SecFilterSelective THE_REQUEST "\act=f\&f=" chain
SecFilterSelective THE_REQUEST "\&ft=(info|edit|download)\&d=" "msg:'c99shell'"
SecFilterSelective POST_PAYLOAD "\actarcbuff_path=" chain
SecFilterSelective POST_PAYLOAD "\act=" "msg:'c99shell'"
#functions
SecFilterSelective POST_PAYLOAD "act=cmd\&d=" chain
SecFilterSelective POST_PAYLOAD "\&cmd=" chain
SecFilterSelective POST_PAYLOAD "\&submit=Execute" "msg:'c99shell'"
SecFilterSelective POST_PAYLOAD "act=(search|upload|mkdir|mkfile|ls|gofile)" chain
#SecFilterSelective POST_PAYLOAD "(search_name_regexp|miniform|ft=edit|f=|d=)" "msg:'c99shell'"
SecFilterSelective POST_PAYLOAD "search_name_regexp=" chain
SecFilterSelective POST_PAYLOAD "search_name=" chain
SecFilterSelective POST_PAYLOAD "d=" "msg:'c99shell'"


#Other shells
SecFilter "/tmp/cmdtemp"
SecFilterSelective THE_REQUEST "cmdtemp"
SecFilter "/tmp/back"
SecFilter "/tmp/pi.pl"
SecFilterSelective THE_REQUEST "sess31002"
SecFilterSelective THE_REQUEST "ssh-scan"
SecFilterSelective THE_REQUEST "/<\?php\x20"
SecFilterSelective THE_REQUEST "r57shell"
SecFilterSelective THE_REQUEST "step57.info"
SecFilterSelective POST_PAYLOAD "step57.info"
#remote command 8/15/2006
SecFilterSelective THE_REQUEST "\&cmd=/usr/bin/pe"
#joomla/generic attack 8/17/2006
SecFilterSelective THE_REQUEST "cmd=echo\x20"


# r57shell Rules
#custom command
SecFilterSelective POST_PAYLOAD "cmd=" chain
SecFilterSelective POST_PAYLOAD "dir=" chain
SecFilterSelective POST_PAYLOAD "submit=" "msg:'r57shell 1'"

SecFilterSelective THE_REQUEST "wh4.whsrv.com" "msg:'r57shell 2'"
SecFilterSelective POST_PAYLOAD "wh4.whsrv.com" "msg:'r57shell 2'"
SecFilterSelective THE_REQUEST "rst.void.ru" "msg:'r57shell 3'"
SecFilterSelective POST_PAYLOAD "rst.void.ru" "msg:'r57shell 3'"


#upload
SecFilterSelective POST_PAYLOAD "dir" chain
SecFilterSelective POST_PAYLOAD "new_name" chain
SecFilterSelective POST_PAYLOAD "submit" "msg:'r57shell upload'"

SecFilterSelective POST_PAYLOAD "d_name=" chain
SecFilterSelective POST_PAYLOAD "cmd=" chain
SecFilterSelective POST_PAYLOAD "dir=" chain
SecFilterSelective POST_PAYLOAD "submit" "msg:'r57shell 4'"

#Find searches
SecFilterSelective POST_PAYLOAD "alias=(find|list|show|ls|uname|who|pwd|uptime)" chain
SecFilterSelective POST_PAYLOAD "submit=" "msg:'r57shell 5'"
#Commands
SecFilterSelective POST_PAYLOAD "cmd=(find|list|show|ls|uname|who|pwd|uptime|wget|GET|gcc|links|lynx|fetch|curl)" chain
SecFilterSelective POST_PAYLOAD "submit=" "msg:'r57shell 6'"
#Text for find
SecFilterSelective POST_PAYLOAD "s_text=" chain
SecFilterSelective POST_PAYLOAD "s_dir=" chain
SecFilterSelective POST_PAYLOAD "s_mask=" chain
SecFilterSelective POST_PAYLOAD "cmd=" chain
SecFilterSelective POST_PAYLOAD "submit=" "msg:'r57shell 7'"
#Remote File
SecFilterSelective POST_PAYLOAD "with=" chain
SecFilterSelective POST_PAYLOAD "rem_file=" chain
SecFilterSelective POST_PAYLOAD "loc_file=" chain
SecFilterSelective POST_PAYLOAD "submit=" "msg:'r57shell 8'"
#Binding & IRC BOTS
SecFilterSelective POST_PAYLOAD "bind_pass=" chain
SecFilterSelective POST_PAYLOAD "submit=" "msg:'r57shell 9'"
SecFilterSelective POST_PAYLOAD "use=(C|Perl)" chain
SecFilterSelective POST_PAYLOAD "submit=" "msg:'r57shell 10'"

#Zen Cart 1.3.02 0day 8/29/2006
SecFilterSelective THE_REQUEST "index.php\?autoLoadConfig\[999\]\[0\]\[autoType\]=include\&autoLoadConfig\[999\]\[0\]\[loadFile\]=http"

#phpBB 2.0.21 (alltopics.php) SQL Injection Exploit 8/24/2006
SecFilterSelective THE_REQUEST "alltopics.php\?mode=\&order=ASC&start=-1\x20UNION\x20SELECT"
# VistaBB 2.x file inclusion 8/24/2006
SecFilterSelective THE_REQUEST "functions_mod_user.php\?phpbb_root_path=(http|/etc/passwd|ftp)"
SecFilterSelective THE_REQUEST "functions_portal.php\?phpbb_root_path=(http|/etc/passwd|ftp)"
#PHP Live Helper <= 2.0 (abs_path) Remote File Inclusion  8/24/2006
SecFilterSelective THE_REQUEST "/global.php\?abs_path=http"
#PHP Simple Shop <= 2.0 (abs_path) Remote File Inclusion 8/24/2006
SecFilterSelective THE_REQUEST "/admin/index.php\?abs_path=http"
SecFilterSelective THE_REQUEST "/admin/adminindex.php\?abs_path=http"
SecFilterSelective THE_REQUEST "/admin/adminglobal.php\?abs_path=http"
SecFilterSelective THE_REQUEST "/admin/login.php\?abs_path=http"
SecFilterSelective THE_REQUEST "/admin/menu.php\?abs_path=http"
SecFilterSelective THE_REQUEST "/admin/header.php\?abs_path=http"
# artlinks Mambo Component <=  Remote Include Vulnerability 8/24/2006
SecFilterSelective THE_REQUEST "com_artlinks/artlinks.dispnew.php\?mosConfig_absolute_path=http"
#Blog:Cms <= 4.1.0 Remote Inclusion File  8/24/2006
SecFilterSelective THE_REQUEST "/index.php\?DIR_PLUGINS=http"
SecFilterSelective THE_REQUEST "/admin/media.php\?DIR_PLUGINS=http"
SecFilterSelective THE_REQUEST "/extras/fancyurls/archive.php\?DIR_PLUGINS=http"
SecFilterSelective THE_REQUEST "/extras/fancyurls/archives.php\?DIR_PLUGINS=http"
SecFilterSelective THE_REQUEST "/extras/fancyurls/blog.php\?DIR_PLUGINS=http"
#PHPAuction 2.1 with phpAdsNew 2.0.5 Remote File Inclusion  8/24/2006
SecFilterSelective THE_REQUEST "/phpAdsNew/view.inc.php\?phpAds_path=http" chain
SecFilterSelective THE_REQUEST "dblib.php/&cmd="
#ShoutBox Remote Command Execution 8/24/2006
SecFilterSelective THE_REQUEST "/index.php\?SB_INCLUDE_PATH=http"
#modernbill ver 1.6 (DIR) Remote File Inclusion 8/24/2006
SecFilterSelective THE_REQUEST "modernbill/include/html/config.php\?DIR=http"

# TinyWebGallery 8/15/2006
SecFilterSelective THE_REQUEST "examples/image.php\?image=http"
# BosClassifieds
# found on jeep with xss exploit
SecFilterSelective THE_REQUEST "index.php\?insPath=(http|https|ftp)"
# CuteNews
SecFilterSelective THE_REQUEST "show_news.php\?cutepath=(http|https|ftp)"
# PHPMailer
SecFilterSelective THE_REQUEST "class.cs_phpmailer.php\?classes_dir=(http|https|ftp)"
#Mambo
SecFilterSelective THE_REQUEST "log.php\?s=(http|https|ftp)"
# Mambo 8/17/2006
SecFilterSelective THE_REQUEST "admin_events.php\?CONFIG_EXT\[LANGUAGES_DIR\]=http"
#CubeCart
SecFilterSelective THE_REQUEST "orderSuccess.inc.php\?\&glob=1\&cart_order_id=1\&glob\[rootDir\]=(http|https|ftp)"
#PHPNuke squery.com teamspeak 8/17/2006
SecFilterSelective THE_REQUEST "gore.php\?libpath=http"
#PHPNuke
SecFilterSelective THE_REQUEST "admin_ug_auth.php\?phpbb_root_path=(http|https|ftp)"
#OsTicket
SecFilterSelective THE_REQUEST "main.php\?config\[search_disp\]=true\&include_dir=(http|https|ftp)"
#PHPLive 3.2 Remote Injection Vulnerability
SecFilterSelective THE_REQUEST "help.php\?css_path=(http|https|ftp)"
SecFilterSelective THE_REQUEST "header.php\?css_path=(http|https|ftp)"
#PHPlist
SecFilterSelective THE_REQUEST "admin/help/index.php\?include=(http|ftp|https)"

#
## End Steves rules

# Miscellaneous malicious requests
# These rules can be very effective, however "general" rules such as the following
# have issues with false positives in some environments. Comment out as needed.
##

#XSS attempts for STYLE, VBSCRIPT, JAVASCRIPT, EXPRESSION, and XML
SecFilterSelective THE_REQUEST "\<IMG.*/\bonerror\b[\s]*=/Ri"
SecFilterSelective THE_REQUEST "TYPE\s*=\s*[\'\"]text\/javascript/i"
SecFilterSelective THE_REQUEST "TYPE\s*=\s*[\'\"]application\/x-javascript/i"
SecFilterSelective THE_REQUEST "TYPE\s*=\s*[\'\"]text\/jscript/i"
SecFilterSelective THE_REQUEST "TYPE\s*=\s*[\'\"]text\/vbscript/i"
SecFilterSelective THE_REQUEST "TYPE\s*=\s*[\'\"]application\/x-vbscript/i"
SecFilterSelective THE_REQUEST "TYPE\s*=\s*[\'\"]text\/ecmascript/i"
SecFilterSelective THE_REQUEST "STYLE[\s]*=[\s]*[^>]expression[\s]*\(/i"
SecFilterSelective THE_REQUEST "[\s]*expression[\s]*\([^}]}[\s]*<\/STYLE>/i"
SecFilterSelective THE_REQUEST "<!\[CDATA\[<\]\]>SCRIPT"

#XSS insertion into Content-Type
SecFilterSelective THE_REQUEST "Content-Type\:.*(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|onmouseover=|javascript\:)"
#Not included by default for safer config
#SecFilterSelective REQUEST_METHOD "!^(GET|HEAD)$" chain
#SecFilterSelective HTTP_Content-Type "!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)"

#Require Content-Length to be provided with every POST request
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"
SecFilterSelective HTTP_Transfer-Encoding "!^$"

#Generic PHP remote file inclusion attack signature
SecFilter "(cmd|command)=(cd|\;|perl |python |rpm |yum |apt-get |emerge |lynx |links |mkdir |elinks |cmd|pwd|wget |lwp-(download|request|mirror|rget) |id|uname|cvs |svn |(s|r)(cp|sh) |net(stat|cat) |rexec |smbclient |t?ftp |ncftp |curl |telnet |gcc |cc |g\+\+ |whoami|\./|killall |rm \-[a-z|A-Z])"
#SecFilterSelective REQUEST_URI "\.php\?" chain
#SecFilter "(http|https|ftp)\:/" chain
#SecFilter "(cmd|command)=.*(cd|\;|perl |python |rpm |yum |apt-get |emerge |lynx |links |mkdir |elinks |cmd|pwd|wget |lwp-(download|request|mirror|rget) |id|uname|cvs |svn |(s|r)(cp|sh) |net(stat|cat) |rexec |smbclient |t?ftp |ncftp |curl |telnet |gcc |cc |g\+\+ |whoami|\./|killall |rm \-[a-z|A-Z])"

#Specific XML-RPC attacks on xmlrpc.php
SecFilterSelective THE_REQUEST "(/xmlrpc|.*xmlrpc_services)\.php" chain
SecFilter "(\<xml|\<.*xml)" chain
SecFilter "(echo( |\(|\').*\;|chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\)\;"

#XML-RPC SQL injection generic signature
SecFilterSelective THE_REQUEST "(/xmlrpc|.*xmlrpc_services)\.php" chain
SecFilter "<methodName>.*</methodName>.*<value><string>.*(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](from|into|table|database|index|view).*methodName\>"



# Application specific rules
# This is a compilation of rulesets made for specific vulnerabilities that exist
# in out-dated, popular web-applications.
###


#
# Mambo: General Defense

#Mambo 'com_contents' Input Validation Hole in 'user_rating' SQL Injection 
SecFilterSelective REQUEST_URI "/index\.php\?option=com_content&task=vote&id=.*&Itemid=.*&cid=.*&user_rating=.*\((select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+(from|into|table|database|index|view)"

#Mambo "user_rating" SQL Injection Vulnerability
SecFilterSelective REQUEST_URI "/content\.php" chain
SecFilterSelective ARG_user_rating ".*(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](from|into|table|database|index|view)"

#Mambo "register_globals" Emulation Layer Overwrite Vulnerability
SecFilterSelective ARG_mosConfig_absolute_path "(\.\./\.\.|/|(http|https|ftp)\:/)"
SecFilterSelective REQUEST_URI "/index(2?)\.php\?.*mosConfig_absolute_path=(http|https|ftp)\:\/"
SecFilterSelective REQUEST_URI "/emailfriend/(emailarticle|emailfaq|emailnews)\.php\?id=\"(\<script|(http|https|ftp)\:/)"


#
# phpBB: General Defense

#phpbb XSS
SecFilterSelective REQUEST_URI "/posting\.php\?mode=reply\&t=.*userid.*phpbb2mysql_t=(<[[:space:]]*script|(http|https|ftp)\:/)"
SecFilterSelective REQUEST_URI "/posting\.php\\?.*(<[[:space:]]*script|(http|https|ftp)\:/)"
SecFilterSelective THE_REQUEST "changedir=%2Ftmp%2F.php"
SecFilter "^/viewtopic\.php\?" chain
SecFilter "chr\(([0-9]{1,3})\)"
SecFilterSelective THE_REQUEST "viewtopic\.php" chain

# Removed cmd from line below causing issues with XSS - DaveC
SecFilterSelective "THE_REQUEST|ARG_VALUES" "(passthru|fopen|exit|fwrite)"


SecFilter "phpbb_root_path="
SecFilterSelective THE_REQUEST "/calendar_scheduler\.php\?start=(<[[:space:]]*script|(http|https|ftp)\:/)"
SecFilterSelective REQUEST_URI "/groupcp\.php\?g=.*sid=\'"
SecFilterSelective REQUEST_URI "/index\.php\?(c|mark)=*\'"
SecFilterSelective REQUEST_URI "/portal\.php\?article=*\'"
SecFilterSelective REQUEST_URI "/viewforum.php?f=.*sid=\'"
SecFilterSelective REQUEST_URI "/viewtopic.php?p=.*sid=\'"
SecFilterSelective REQUEST_URI "/album_search\.php\?mode=\'"
SecFilterSelective REQUEST_URI "/album_cat\.php\?cat_id=.*sid=\'"
SecFilterSelective REQUEST_URI "/album_comment\.php\?pic_id=.*sid=\'"
SecFilterSelective REQUEST_URI "calendar_scheduler\.php\?d=.*&mode=&start=\'\">"
SecFilterSelective REQUEST_URI "/profile\.php\?mode=viewprofile&u=.*((script|script|about|applet|activex|chrome)\>|html|(http|https|ftp)\:/)"
SecFilterSelective REQUEST_URI "/viewtopic\.php\?p=.*&highlight=.*((script|script|about|applet|activex|chrome)\>|html|(http|https|ftp)\:/)"

#phpbb Session Cookie
SecFilterSelective COOKIE_sessionid  "phpbb2mysql_data=a\x3A2\x3A\x7Bs\x3A11\x3A\x22autologinid\x22\x3Bb\x3A1\x3Bs\x3A6\x3A\x22userid\x22\x3Bs\x3A1\x3A\x222\x22\x3B\x7D"
SecFilter "phpbb2mysql_data=a\x3A2\x3A\x7Bs\x3A11\x3A\x22autologinid\x22\x3Bb\x3A1\x3Bs\x3A6\x3A\x22userid\x22\x3Bs\x3A1\x3A\x222\x22\x3B\x7D"
SecFilterSelective SCRIPT_FILENAME "viewtopic\.php$" chain
SecFilterSelective ARG_highlight "%27"

#Exploit phpBB Highlighting Code Execution/SQL Injection - Santy.A Worm
SecFilter "&highlight=\'\.fwrite\(fopen\("
SecFilter "&highlight=\x2527\x252Esystem\("
SecFilter "&highlight=\'\.mysql_query\("
SecFilterSelective THE_REQUEST "/quick-reply\.php" chain
SecFilterSelective THE_REQUEST "(\;|\&)highlight=\'\.system\("
SecFilterSelective THE_REQUEST "&highlight=\'\.mysql_query\("
SecFilterSelective THE_REQUEST "&highlight=\'\.fwrite\(fopen\("
SecFilterSelective THE_REQUEST "&highlight=%2527%252E"
SecFilterSelective THE_REQUEST "&highlight=\x2527\x252Esystem\("
SecFilterSelective THE_REQUEST "/viewtopic\.php\?.*(highlight.*(\'\.|\x2527|\x27)|include\(.*GET\[.*\]\)|=(http|https|ftp)\:/|(printf|system)\()"

#phpBB remote command execution exploit
SecFilterSelective REQUEST_URI "profile\.php\?GLOBALS\[signature_bbcode_uid\]=\(\.\x2B\)/e\x00"
SecFilterSelective REQUEST_URI|POST_PAYLOAD "r57phpBB2017xpl"
SecFilterSelective POST_PAYLOAD "_bill_gates@microsoft\.com"
SecFilterSelective THE_REQUEST "/admin/admin_forums\.php\?sid=.*" chain
SecFilter "(forumname|forumdesc)=*\<[[:space:]]*(script|about|applet|activex|chrome)"

#phpbb xss, sql injection and PHP code injection
SecFilterSelective REQUEST_URI "usercp_register\.php" chain
SecFilterSelective ARG_error_msg "<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>"
SecFilterSelective REQUEST_URI "login\.php" chain
SecFilterSelective ARG_forward_page "<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>"
SecFilterSelective REQUEST_URI "search\.php" chain
SecFilterSelective ARG_list_cat "<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>"
SecFilterSelective REQUEST_URI "usercp_register\.php" chain
SecFilterSelective ARG_signature_bbcode_uid "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"
SecFilterSelective ARG_signature_bbcode_uid "(<.*php|<php)"
SecFilterSelective REQUEST_URI "/downloads\.php\?cat=.*(UNION|SELECT|delete|insert)*user_password.*phpbb_users"

#
# PHPNuke: General Defense

#PHP-Nuke Web_Links Multiple Variable SQL Injection
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_email "(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_ratenum "(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_min "(dselect|grant|elete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_show "(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_orderby "(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_url "(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_email "(delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+(from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_ratenum "(delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+(from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_min "(delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+(from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_show "(delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+(from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_orderby "(delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+(from|into|table|database|index|view)"
SecFilterSelective SCRIPT_FILENAME "modules\.php$" chain
SecFilterSelective ARG_url "(delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+(from|into|table|database|index|view)"

#PHPNuke SQL injection attempt
SecFilterSelective REQUEST_URI "/modules\.php\?*name=*\<*(script|about|applet|activex|chrome)*\>"
SecFilterSelective REQUEST_URI "/modules\.php\?op=modload&name=News&file=article&sid=*\<*(script|about|applet|activex|chrome)*\>"
SecFilterSelective REQUEST_URI "/modules\.php\?name=Search&type=comments&query=.*&instory=.*UNION.*SELECT.*pwd.*FROM.*nuke_authors"
SecFilterSelective REQUEST_URI  "/modules\.php\?*name=Search*instory="
SecFilterSelective REQUEST_URI  "/modules\.php\?*name=(Search|Web_Links).*\'"
SecFilterSelective THE_REQUEST "/modules\.php\?*name=<[[:space:]]*script"
SecFilterSelective THE_REQUEST "/modules\.php\?name=Bookmarks\&file=(del_cat\&catname|del_mark\&markname|edit_cat\&catname|edit_cat\&catcomment|marks\&catname|uploadbookmarks\&category)=(<[[:space:]]*script|(http|https|ftp)\:/)"
SecFilterSelective THE_REQUEST "modules\.php\?name=Bookmarks\&file=marks\&catname=.*\&category=.*/\*\*/(union|select|delete|insert)"
SecFilterSelective THE_REQUEST "/index\.php*file=*(http|https|ftp)"
SecFilterSelective THE_REQUEST  "/modules\.php\?*name=Search*instory="
SecFilterSelective THE_REQUEST "/modules\.php*name=Forums.*file=viewtopic*/forum=.*\'/"

#PhpNuke 7.6=>x Multiple vulnerabilities cXIb8O3.12
SecFilterSelective REQUEST_URI "/banners\.php\?op=EmailStats&name=.*&bid=.*((javascript|script|about|applet|activex|chrome)*\>|(http|https|ftp)\:/)"
SecFilterSelective REQUEST_URI "/modules\.php\?name=.*((javascript|script|about|applet|activex|chrome)*\>|(http|https|ftp)\:/)"

#PHP-Nuke Input Validation Flaws in Search, FAQ, and Banners Modules Permit Cross-Site Scripting Attacks
SecFilterSelective REQUEST_URI "/modules\.php\?name=Search&author=.*&topic=.*&min.*((javascript|script|about|applet|activex|chrome)*\>|(http|https|ftp)\:/)"
SecFilterSelective REQUEST_URI "/modules\.php\?name=FAQ&.*=.*&id_cat=.*&categories=.*((javascript|script|about|applet|activex|chrome)*\>|(http|https|ftp)\:/)"
SecFilterSelective REQUEST_URI "/modules\.php\?op=EmailStats&login=.*&cid=.*&bid=.*((javascript|script|about|applet|activex|chrome)*\>|(http|https|ftp)\:/)"
SecFilterSelective REQUEST_URI "/modules\.php\?name=Encyclopedia&file=.*&op=.*&eid.*1&ltr=.*((javascript|script|about|applet|activex|chrome)*\>|(http|https|ftp)\:/)"


#
# Vbulletin Protections

#vbulletin vulnerabilities, SQL injection
SecFilterSelective REQUEST_URI "/joinrequests\.php" chain
SecFilter "do=processjoinrequests&usergroupid=.*&request.*(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"
SecFilterSelective REQUEST_URI "/admincp/user\.php" chain
SecFilter "do=find&orderby=username&limit.*(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"
SecFilterSelective REQUEST_URI "/admincp/(usertitle|usertools)\.php" chain
SecFilter "(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"
SecFilterSelective REQUEST_URI "/modcp/announcement\.php" chain
SecFilter "do=update&announcementid=.*&start=.*&end=.*&announcement.*(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"
SecFilterSelective REQUEST_URI "/admincp/admincalendar\.php" chain
SecFilter "do=update&calendarid=.*&calendar\[.*\]=.*&calendar.*(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"
SecFilterSelective REQUEST_URI "/admincp/email\.php" chain
SecFilter "do=makelist&user\[.*\].*(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"
SecFilterSelective REQUEST_URI "/admincp/help\.php" chain
SecFilter "do=doedit&help\[.*\]=.*&help\[.*\].*(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"
SecFilterSelective REQUEST_URI "admincp/language\.php" chain
SecFilter "do=update&rvt\[.*\].*(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"
SecFilterSelective REQUEST_URI "/admincp/phrase\.php" chain
SecFilter "do=completeorphans&keep\[.*\].*(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

#vBulletin calendar.php comma Parameter Arbitrary Command Execution
SecFilterSelective REQUEST_URI "calendar\.php\?calbirthdays=.*&action=.*&day=.*&comma=*(cd|\;|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|lwp-(download|request|mirror|rget)|id|uname|cvs|svn|(r|s)sh|(s|r)cp|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g\+\+|\./)"
SecFilterSelective REQUEST_URI "/calendar\.php\?calbirthdays=.*&action=getday&day=.*&comma=\x22;"

#vBulletin Remote Command Execution Attempt
SecFilterSelective REQUEST_URI "/forumdisplay\.php?[^\r\n]*comma=[^\r\n\x26]*system\x28.*\x29/Ui"
SecFilterSelective REQUEST_URI "/forumdisplay\.php\?" chain
SecFilter "\.system\(.+\)\."
SecFilterSelective REQUEST_URI "/forumdisplay\.php\?*comma="


#
# Invision Board: General Defense

# WEB-PHP Invision Board emailer.php file include
SecFilterSelective REQUEST_URI "/ad_member\.php" chain
SecFilter "emailer\.php"
#Invision Board ipchat.php file include
SecFilterSelective REQUEST_URI "/ipchat\.php*root_path*conf_global\.php"

# WEB-PHP Invision Board ipchat.php file include
SecFilterSelective REQUEST_URI  "/ipchat\.php" chain
SecFilter "conf_global\.php"

#Invision Power Board SQL injection
SecFilterSelective REQUEST_URI "/forums/index\.php\?act=.*&max_results=.*&filter=.*&sort_order=.*&sort_key=.*&st=*(UNION|SELECT|DELETE|INSERT)"

#SQL injection in jPortal version 2.3.1
SecFilterSelective REQUEST_URI "/jportal/banner\.php*(UNION|SELECT|DELETE|INSERT)"

#Invision Gallery SQL Injection Vulnerabilities
SecFilterSelective REQUEST_URI "/index\.php" chain
SecFilterSelective ARG_comment "(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"

#Invision Community Blog Module SQL injection
SecFilterSelective REQUEST_URI "/index.php" chain
SecFilterSelective ARG_mid ".*(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"

#Invision PowerBoard 1.3.x - 2.0 SQL injection
SecFilterSelective THE_REQUEST "/index\.php\?act=Login&CODE=autologin.*((select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](from|into|table|database|index|view)|user\+AND\+MID\(password)"

#Invision Gallery "st" SQL Injection Vulnerability
SecFilterSelective REQUEST_URI "index\.php" chain
SecFilterSelective ARG_st "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"


#
# phpMyadmin: general defense

#Parameter Arbitrary Command Execution
SecFilterSelective REQUEST_URI "calendar\.php\?calbirthdays=.*&action=.*&day=.*&comma=*(cd|\;|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|lwp-(download|request|mirror|rget)|id|uname|cvs|svn|(r|s)sh|(s|r)cp|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g\+\+|\./)"
SecFilterSelective REQUEST_URI "/calendar\.php\?calbirthdays=.*&action=getday&day=.*&comma=\x22;"

#phpMyAdmin Export.PHP File Disclosure Vulnerability
SecFilterSelective SCRIPT_FILENAME "export\.php$" chain
SecFilterSelective ARG_what "\.\."

#phpMyAdmin path vln
SecFilterSelective REQUEST_URI "/css/phpmyadmin\.css\.php\?GLOBALS\[cfg\]\[ThemePath\]=/etc"

#phpMyAdmin convcharset Parameter Cross Site Scripting
SecFilterSelective REQUEST_URI "/phpmyadmin/index\.php\?pma_username=*&pma_password=*&server=.*&lang=.*&convcharset=.*((javascript|script|about|applet|activex|chrome)*\>|(http|https|ftp)\:/)"


#
# OSCommerce: General Defense

#oscommerce XSS vulnerabilities
SecFilterSelective REQUEST_URI "/default\.php\?(error_message|info_message)=.*((javascript|script|about|applet|activex|chrome)*\>|(http|https|ftp)\:/)"

#osCommerce "products_id" Additional Images Module SQL Injection
SecFilterSelective REQUEST_URI "/product_info\.php" chain
SecFilterSelective ARG_products_id  "(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"


#
# Coppermine: General Defense

#Coppermine Photo Gallery "relocate_server.php" Exposure of Configuration
SecFilterSelective REQUEST_URI "/relocate_server\.php"

#coppermine remote file inclusion
SecFilterSelective REQUEST_URI "/theme\.php\?THEME_DIR=(http|https|ftp)/:/"

#Coppermine Photo Gallery Multiple XSS
SecFilterSelective REQUEST_URI "/index\.php\?lang=.*((javascript|script|about|applet|activex|chrome)*\>|html|(http|https|ftp)\:/)"


#
# AWStats: General Defense

#awstats XSS vulnerabilities
SecFilterSelective THE_REQUEST "awstats" chain
SecFilterSelective ARGS "(pluginmode|loadplugin|debug|configdir|perl|cgi|chmod|exec|print)"
SecFilterSelective REQUEST_URI  "/awstats\.pl\?(configdir|update|pluginmode|cgi)=(\||echo|\:system\()"
SecFilterSelective REQUEST_URI  "/awstats\.pl\?(debug=1|pluginmode=rawlog\&loadplugin=rawlog|update=1\&logfile=\|)"
SecFilterSelective REQUEST_URI  "/awstats\.pl\?[^\r\n]*logfile=\|"
SecFilterSelective REQUEST_URI  "/awstats\.pl\?configdir="
SecFilterSelective REQUEST_URI  "awstats\.pl\?" chain
SecFilterSelective ARGS "(debug|configdir|perl|chmod|exec|print|cgi)"

#awstats probe
SecFilterSelective THE_REQUEST  "/awstats\.pl HTTP\/(0\.9|1\.0|1\.1)$"


#
# OSTicket: General Defense

#osTicket directory traversal
SecFilterSelective REQUEST_URI "/attachments\.php\?file=\.\./\.\."

#osticket remote file inclusion
SecFilterSelective REQUEST_URI "/include/main\.php\?config.*=.*&include_dir=(http|https|ftp)\:/"

#osticket SQL injection
SecFilterSelective REQUEST_URI "/admin\.php\?a=view&id=*(delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]]+(from|into|table|database|index|view|select)"
SecFilterSelective REQUEST_URI "/view\.php\?s=.*&query=*&cat=*(delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view|select)"

# osTicket "t" SQL Injection Vulnerability
SecFilterSelective THE_REQUEST "/view\.php" chain
SecFilterSelective ARG_t ".*(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](from|into|table|database|index|view)"


#
# PostNuke General Protection

#PostNuke "func" Local File Inclusion Vulnerability
SecFilterSelective REQUEST_URI "/index\.php.*func=*(\.\./|(http|https|ftp)\:/)"

#PostNuke version : x=> 0.750 SQL injection
SecFilterSelective REQUEST_URI "/modules\.php\?op=modload&name=Messages&file=readpmsg&start=*(delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe|select|union)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view|select)"

#PostNuke "show" Parameter SQL Injection Vulnerability
SecFilterSelective REQUEST_URI "modules/Downloads/dl-viewdownload\.php" chain
SecFilterSelective ARG_show "(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](from|into|table|database|index|view)"

#postnuke Local file inclusion via GeSHi library
SecFilterSelective REQUEST_URI "/modules/pn_bbcode/pnincludes/contrib/example\.php"


#
# Misc. Web-app filters

#ModernBill XSS and file include
SecFilterSelective REQUEST_URI "/samples/news\.php\?DIR=(http|https|ftp)\:/"
SecFilterSelective THE_REQUEST "/order/orderwiz\.php\?v=.*&aid=.*(<[[:space:]]*(script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome)[[:space:]]*>|(http|https|ftp)\:/)"

#Wordpress SQL injection
SecFilterSelective REQUEST_URI "/wp-trackback\.php\?tb_id=*(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"
SecFilterSelective REQUEST_URI "/wp-trackback\.php" chain
SecFilterSelective ARG_tb_id "(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| ]+[[:space:]](from|into|table|database|index|view)"
SecFilterSelective REQUEST_URI "/index\.php\?cat=.*(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](from|into|table|database|index|view)"

#Wordpress cat vuln
SecFilterSelective REQUEST_URI  "/wordpress/" chain
SecFilterSelective ARG_cat "!^[0-9]*$"

#WordPress "cache_lastpostdate" PHP Code Insertion
SecFilterSelective ARG_cache_lastpostdate "<\?php"

#WordPress SQL Injection Vulnerabilities
SecFilterSelective REQUEST_URI  "/index\.php" chain
SecFilterSelective ARG_poll|ARG_category|ARG_ctg "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

#cubecart SQL injection
SecFilterSelective REQUEST_URI "/index\.php\?&PHPSESSID=\'"
SecFilterSelective REQUEST_URI "/tellafriend\.php\?&product=\'"
SecFilterSelective REQUEST_URI "/view_cart\.php\?add=\'"
SecFilterSelective REQUEST_URI "/view_product\.php\?product=\'"

#phpAdsNew path disclosure
SecFilterSelective REQUEST_URI "/libraries/lib-xmlrpcs.inc\.php"
SecFilterSelective REQUEST_URI "/maintenance/maintenance-activation\.php"
SecFilterSelective REQUEST_URI "/maintenance/maintenance-cleantables\.php"
SecFilterSelective REQUEST_URI "/maintenance/maintenance-autotargeting\.php"
SecFilterSelective REQUEST_URI "/maintenance/maintenance-reports\.php"
SecFilterSelective REQUEST_URI "/misc/backwards\x20compatibility/phpads\.php"
SecFilterSelective REQUEST_URI "/misc/backwards\x20compatibility/remotehtmlview\.php"
SecFilterSelective REQUEST_URI "/misc/backwards\x20compatibility/click\.php"
SecFilterSelective REQUEST_URI "/adframe\.php\?refresh=securityreason\.com\'\>"

#phpAdsNew SQL Injection Vulnerability
SecFilterSelective REQUEST_URI  "/logout\.php" chain
SecFilterSelective ARG_sessiodID "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"

#Xoops XML sql injection
SecFilterSelective THE_REQUEST "(/xmlrpc|.*xmlrpc_services)\.php" chain
SecFilterSelective POST_PAYLOAD "<methodName>blogger\.getUsersBlogs</methodName>" chain
SecFilter ".*\' AND ascii\(substring\(pass"

#Drupal remote command execution vulnerability exploit signature
SecFilter "\<.*php .*\(.*\)\;system\(.*\).*php*\>"
#Slightly stronger version of the above
SecFilter "\<.*php .*\(.*\)\;(chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\).*php*\>"

#Serendipity exit.php SQL injection
SecFilterSelective REQUEST_URI "exit\.php\?entry_id=.*&url_id=.*\x20UNION\x20SELECT\x20(password|username)\x20FROM"

#Comdev eCommerce File Inclusion Vulnerability
SecFilterSelective REQUEST_URI "/config\.php\?path\[docroot\]=((\.\./|(http|https|ftp)\:/)|.*(\.\./|(http|https|ftp)\:/))"

#Comdevn eCommerce Form Handler Vulnerabilities
SecFilterSelective THE_REQUEST "/index\.php\?homeinclude=catalog&category_id=&parent_id=.*" chain
SecFilter "<[[:space:]]*(href|script|about|applet|activex|chrome)*>.*(script|about|applet|activex|chrome|a)[[:space:]]*>"

#Comdev Vote Caster "campaign_id" SQL Injection Vulnerability
SecFilterSelective REQUEST_URI  "/index\.php" chain
SecFilterSelective ARG_campaign_id "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|\'|UNION.*SELECT.*INTO.*FROM)"


# Rootkits - Added by David Collins

SecFilterSelective REQUEST_URI "!(horde/services/go\.php)" "chain,id:390144,rev:1,severity:2,msg:'Rootkit attack: Generic Attempt to install rootkit'"
SecFilterSelective REQUEST_URI "=(http|www|ftp)\:/(.+)\.(c|dat|kek|gif|jpe?g|jpeg|png|sh|txt|bmp|dat|txt|js|html?|tmp|asp)\x20?\?"
SecFilterSelective REQUEST_URI "!(horde/services/go\.php)" "chain,id:390145,rev:1,severity:2,msg:'Rootkit attack: Generic Attempt to install rootkit'"
SecFilterSelective REQUEST_URI "=(http|www|ftp)\:/(.+)\.(c|dat|kek|gif|jpe?g|jpeg|png|sh|txt|bmp|dat|txt|js|html?|tmp|asp)\?"

SecFilterSelective REQUEST_URI "/(cse|cmd)\.(c|dat|gif|jpe?g|jpeg|png|sh|txt|bmp|dat|txt|js|html?|tmp|php|asp)\?"
SecFilterSelective THE_REQUEST "/(cse|cmd)\.(c|dat|gif|jpe?g|jpeg|png|sh|txt|bmp|dat|txt|js|html?|tmp|php|asp) "
SecFilterSelective REQUEST_URI "/terminatorX-exp.*\.(gif|jpe?g|txt|bmp|php|png)\?"
SecFilterSelective REQUEST_URI "/\.it/viewde"
SecFilterSelective REQUEST_URI "/cmd\?&(command|cmd)="
SecFilterSelective REQUEST_URI "/cmd\.php\.ns\?&(command|cmd)="
SecFilterSelective REQUEST_URI "/cmd\.(php|dat)\?&(command|cmd)="
SecFilterSelective REQUEST_URI "/(a|ijoo|oinc|s|sep|pro18|shell|(o|0|p)wn(e|3)d)\.(c|dat|gif|jpe?g|jpeg|png|sh|txt|bmp|dat|txt|js|htm|html|tmp|php|asp).\?&(cmd|command)="
SecFilterSelective REQUEST_URI "/(new(cmd|command)|(cmd|command)[0-9]+|pro18|shell|sh|bash|get|root|spy|nmap|asc|lila)\.(c|dat|gif|jpe?g|jpeg|png|sh|txt|bmp|dat|txt|js|htm|html|tmp|php|asp)\?"
SecFilterSelective REQUEST_URI "/[a-z]?(cmd|command)[0-9]?\.(gif|jpe?g|txt|bmp|png)\?"
SecFilterSelective REQUEST_URI "/(gif|jpe?g|ion|lala|shell|phpshell)\.ph(p(3|4)?|tml)\?"
SecFilterSelective REQUEST_URI "/tool[12][0-9]?\.(ph(p(3|4)?|tml)|js)\?"

#Known rootkits
SecFilterSelective THE_REQUEST "perl (xpl\.pl|kut|viewde|httpd\.txt)"
SecFilterSelective THE_REQUEST "\./xkernel\;"
SecFilterSelective THE_REQUEST "/kaiten\.c"
SecFilterSelective THE_REQUEST "/mampus\?&(cmd|command)"

#Generic remote perl execution with .pl extension
SecFilterSelective REQUEST_URI "perl .*\.pl(\s|\t)*\;"
SecFilterSelective REQUEST_URI "\;(\s|\t)*perl .*\.pl"

#Known rootkit Defacing Tool 2.0
SecFilterSelective REQUEST_URI "/tool(12)?[0-9]?\.(d(ao)t|gif|jpe?g|bmp|txt|png|asp)\?&?(cmd|command)="
SecFilterSelective REQUEST_URI "/tool\.(d(ao)t|gif|jpe?g|bmp|txt|png|asp)\?&?(cmd|command)="
SecFilterSelective REQUEST_URI "/tool25\.(d(ao)t|gif|jpe?g|bmp|txt|png|asp)\?&?(cmd|command)="
SecFilterSelective REQUEST_URI "/therules25\.(d(ao)t|gif|jpe?g|bmp|txt|png|asp)\?&?(cmd|command)="

#other known tools
SecFilterSelective REQUEST_URI "/xpl\.php\?&(cmd|command)="
SecFilterSelective REQUEST_URI "/(ssh2?|sfdg2)\.php"

#New kit
SecFilterSelective THE_REQUEST "/\.dump/(bash|httpd)(\;|\w)"
SecFilterSelective THE_REQUEST "/\.dump/(bash|httpd)\.(txt|php|gif|jpe?g|dat|bmp|png)(\;|\w)"

#new kir
SecFilterSelective REQUEST_URI "/dblib\.php\?&(cmd|command)="

#suntzu
SecFilterSelective THE_REQUEST|HTTP_Content-Disposition "/(suntzu.*|suntzu)\.php\?cmd="

#proxysx.gif?
SecFilterSelective THE_REQUEST "/proxysx\.(gif|jpe?g|bmp|txt|asp|png)\?"

#phpbackdoor
SecFilterSelective THE_REQUEST "/(phpbackdoor|phpbackdoor.*)\.php\?cmd="

#new unknown kit
SecFilterSelective REQUEST_URI "/oops?&"

# known PHP attack shells
#value of these sigs, pretty low, but here to catch
# any lose threads, honeypoting, etc.
SecFilterSelective THE_REQUEST   "wiki_up/.*\.(php(3|4)?|tml|cgi|sh)"
SecFilterSelective THE_REQUEST   "(wiki_up|temp)/(gif|ion|jpe?g|lala)\.ph(p(3|4)?|tml)"
SecFilterSelective THE_REQUEST   "/(too20|phpshell|shell)\.ph(p(3|4)?|tml)"
SecFilterSelective REQUEST_URI   "/phpterm"

#Frantastico worm
SecFilterSelective THE_REQUEST "(netenberg |psybnc |fantastico_de_luxe |arta\.zip )"

#new unknown kits
SecFilterSelective REQUEST_URI   "/iblis\.htm\?" 
SecFilterSelective REQUEST_URI   "/gif\.gif\?" 
SecFilterSelective REQUEST_URI   "/go\.php\.txt\?" 
SecFilterSelective REQUEST_URI   "/sh[0-9]\.(gif|jpe?g|txt|bmp|png)\?" 
SecFilterSelective REQUEST_URI   "/iys\.(gif|jpe?g|txt|bmp|png)\?" 
SecFilterSelective REQUEST_URI   "/shell[0-9]\.(gif|jpe?g|txt|bmp|png)\?" 
SecFilterSelective REQUEST_URI   "/zehir\.asp"
SecFilterSelective REQUEST_URI   "/aflast\.txt\?"
SecFilterSelective REQUEST_URI   "/sikat\.txt\?&cmd" 
SecFilterSelective REQUEST_URI   "/t\.gif\?" 
SecFilterSelective REQUEST_URI   "/phpbb_patch\?&"
SecFilterSelective REQUEST_URI   "/phpbb2_patch\?&"
SecFilterSelective REQUEST_URI   "/lukka\?&"

#new kit
SecFilterSelective REQUEST_URI   "/c99shell\.txt"
SecFilterSelective REQUEST_URI   "/c99\.txt\?"

#remote bash shell
SecFilterSelective REQUEST_URI "/shell\.php\&cmd="
SecFilterSelective ARGS "/shell\.php\&cmd="

#zencart exploit
SecFilterSelective REQUEST_URI "/ipn\.php\?cmd="

#new pattern
SecFilterSelective REQUEST_URI "btn_lists\.(gif|jpe?g|txt|bmp|png)\?"
SecFilterSelective REQUEST_URI "dsoul/tool\?"

#generic suntzu payload
SecFilterSelective THE_REQUEST   "HiMaster\!\<\?php system\("
SecFilterSelective THE_REQUEST   "error_reporting\(.*\)\;if\(isset\(.*\)\)\{system"
SecFilterSelective REQUEST_URI   "help_text_vars\.php\?suntzu="

#25dec new one
SecFilterSelective REQUEST_URI   "anggands\.(gif|jpe?g|txt|bmp|png)\?"

#26dec new kit
SecFilterSelective REQUEST_URI   "newfile[0-9]\.(gif|jpe?g|txt|bmp|png)\?"
SecFilterSelective REQUEST_URI   "/vsf\.vsf\?&"

#27dec
SecFilterSelective REQUEST_URI   "/scan1\.0/scan/"
SecFilterSelective REQUEST_URI   "test\.txt\?&"

#30dec
SecFilterSelective REQUEST_URI   "\.k4ka\.txt\?"
#31dec
SecFilterSelective REQUEST_URI   "/php\.txt\?"

#1 jan
SecFilterSelective REQUEST_URI   "/sql\.txt\?"
SecFilterSelective REQUEST_URI   "bind\.(gif|jpe?g|txt|bmp|png)\?"

#22feb
SecFilterSelective REQUEST_URI   "/juax\.(gif|jpe?g|txt|bmp|png)\?"
SecFilterSelective REQUEST_URI   "/linuxdaybot/\.(gif|jpe?g|txt|bmp|png)\?"

#24mar
SecFilterSelective REQUEST_URI   "/docLib/cmd\.asp"
SecFilterSelective REQUEST_URI   "\.asp\?pageName=AppFileExplorer"
SecFilterSelective REQUEST_URI   "\.asp\?.*showUpload&thePath="
SecFilterSelective REQUEST_URI   "\.asp\?.*theAct=inject&thePath="

#some broken attack program
SecFilterSelective THE_REQUEST "PUT /.*_@@RNDSTR@@"
SecFilterSelective THE_REQUEST "trojan\.htm"

SecFilterSelective REQUEST_URI "/r57en\.php"

#c99 rootshell
SecFilterSelective REQUEST_URI "\.php\?act=(chmod&f|cmd|f&f=|ls|img&img=)"

#generic shell
SecFilterSelective REQUEST_URI "shell\.txt"

#bad scanner
SecFilterSelective REQUEST_URI "w00tw00t\.at\.ISC\.SANS\.DFind"

#wormsign
SecFilterSelective POST_PAYLOAD "((stripslashes|passthru)\(\$_REQUEST\[\"|if \(get_magic_quotes_gpc\()"

#New SEL attack seen
SecFilterSelective THE_REQUEST "select.*from.*information_schema\.tables"

#New SQL attack seen
SecFilterSelective REQUEST_URI "and.+char\(.*\).+user.+char\(.*\)"


# TorrentFlux Rules added By David Collins
SecFilterSelective REQUEST_URI "torrentSearch\.php"
SecFilterSelective REQUEST_URI "torrent=.*"
SecFilterSelective POST_PAYLOAD "iamhim"
SecFilterSelective REQUEST_URI "downloaddetails\.php\?alias=.*"



# END RULES