Shared Hosting | Resellers | VPS Servers | Dedicated Servers | Services & Security | Special Offers | Domain Registration | I4SERV |



معهد الخدمات العربي ، نخدمك بكل ما نملك

معهد الخدمات العربي »  الاقسام العامة »  عالم السيرفرات
تسجيل الدخول |  التسجيل
التسجيلتسجيل الدخولبحث الأسئلة المتكررة

إرسال موضوع جديد الرد على الموضوع  صفحة 1 من 1
  [ 3 مشاركة ] 
| لوحة تحكم المشرف
  نسخة للطباعة الموضوع السابق | الموضوع التالي 

الأحد مارس 22, 2009 2:57 am
غير متصل أبو رودينا
 اقوي رولز حتي الان لحماية المود سيكيورتي modsecurity rules
مدير الموقع
اشترك في: الثلاثاء مارس 17, 2009 3:57 am
مشاركات: 32
 يشاهد الملف الشخصي  
السلام عليكم

اهداء مني لاعضاء المعهد


قم بأضافتها لكونفج المود سيكورتي

اقتباس:
#fake server banner - NOYB used - no one needs to know what we are using
SecServerSignature "Secured By </i><b>I4SERV Co.LTD.</b><i> <a href=http://www.i4serv.com>I4SERV</a>"

# Check Content-Length and reject all non numeric ones
SecRule REQUEST_HEADERS:Content-Length "!^\d+$" "deny,log,auditlog,msg:'Content-Length HTTP header is not numeric', severity:'2',id:'960016'"

# Do not accept GET or HEAD requests with bodies
SecRule REQUEST_METHOD "^(GET|HEAD)$" "chain,deny,log,auditlog,msg:'GET or HEAD requests with bodies', severity:'2',id:'960011'"
SecRule REQUEST_HEADERS:Content-Length "!^0?$"

# Require Content-Length to be provided with every POST request.
SecRule REQUEST_METHOD "^POST$" "chain,deny,log,auditlog,msg:'POST request must have a Content-Length header',id:'960012',severity:'4'"
SecRule &REQUEST_HEADERS:Content-Length "@eq 0"

# Restrict type of characters sent
SecRule REQUEST_FILENAME|REQUEST_HEADERS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer \
"@validateByteRange 1-255" \
"log,auditlog,msg:'Request Missing an Accept Header', severity:'2',id:'960015',t:urlDecodeUni,phase:1"

SecRule ARGS|ARGS_NAMES "@validateByteRange 1-255" \
"deny,log,auditlog,msg:'Invalid character in request',id:'960901',severity:'4',t:urlDecodeUni,phase:2"

# allow request methods
SecRule REQUEST_METHOD "!^((?:(?:POS|GE)T|OPTIONS|HEAD))$" \
"phase:1,log,auditlog,msg:'Method is not allowed by policy', severity:'2',id:'960032'"
# Basic rules with arbitrary command detection

SecRule REQUEST_URI "\.htgroup"
SecRule REQUEST_URI "\.htaccess"
SecRule REQUEST_URI "cd\.\."
SecRule REQUEST_URI "///cgi-bin"
SecRule REQUEST_URI "/cgi-bin///"
SecRule REQUEST_URI "/~root"
SecRule REQUEST_URI "/~ftp"
SecRule REQUEST_URI "/htgrep" chain
SecRule REQUEST_URI "/htgrep"
SecRule REQUEST_URI "/\.history"
SecRule REQUEST_URI "/\.bash_history"
SecRule REQUEST_URI "/~nobody"
SecRule REQUEST_URI "<script"
SecRule REQUEST_URI "psybnc"
SecRule REQUEST_URI "cmd=cd\x20/var"
SecRule REQUEST_URI "dir=http"
SecRule REQUEST_URI "\?STRENGUR"
SecRule REQUEST_URI "/etc/motd"
SecRule REQUEST_URI "/etc/passwd"
SecRule REQUEST_URI "conf/httpd\.conf"
SecRule REQUEST_URI "/bin/ps"
SecRule REQUEST_URI "bin/tclsh"
SecRule REQUEST_URI "tclsh8\x20"
SecRule REQUEST_URI "udp\.pl"
SecRule REQUEST_URI "linuxdaybot\.txt"
SecRule REQUEST_URI "wget\x20"
SecRule REQUEST_URI "bin/nasm"
SecRule REQUEST_URI "nasm\x20"
SecRule REQUEST_URI "/usr/bin/perl"
SecRule REQUEST_URI "links -dump "
SecRule REQUEST_URI "links -dump-(charset|width) "
SecRule REQUEST_URI "links (http|https|ftp)\:/"
SecRule REQUEST_URI "links -source "
SecRule REQUEST_URI "cd\x20/(tmp|var/tmp|etc/httpd/proxy|dev/shm)"
SecRule REQUEST_URI "cd\.\."
SecRule REQUEST_URI "///cgi-bin"
SecRule REQUEST_URI "/cgi-bin///"
SecRule REQUEST_URI "/~named(/| HTTP\/(0\.9|1\.0|1\.1)$)"
SecRule REQUEST_URI "/~guest(/| HTTP\/(0\.9|1\.0|1\.1)$)"
SecRule REQUEST_URI "/~logs(/| HTTP\/(0\.9|1\.0|1\.1)$)"
SecRule REQUEST_URI "/~sshd(/| HTTP\/(0\.9|1\.0|1\.1)$)"
SecRule REQUEST_URI "/~ftp(/| HTTP\/(0\.9|1\.0|1\.1)$)"
SecRule REQUEST_URI "/~bin(/| HTTP\/(0\.9|1\.0|1\.1)$)"
SecRule REQUEST_URI "/~nobody(/| HTTP\/(0\.9|1\.0|1\.1)$)"
SecRule REQUEST_URI "/\.history HTTP\/(0\.9|1\.0|1\.1)$"
SecRule REQUEST_URI "/\.bash_history HTTP\/(0\.9|1\.0|1\.1)$"
SecRule REQUEST_URI "lynx "
SecRule REQUEST_URI "Fhome"
SecRule REQUEST_URI "cvs"
SecRule REQUEST_URI "\.php\?phpinfo"
SecRule REQUEST_URI "\.php\?phpini"
SecRule REQUEST_URI "\.php\?mem"
SecRule REQUEST_URI "\.php\?cpu"
SecRule REQUEST_URI "\.php\?users"
SecRule REQUEST_URI "\.php\?tmp"


SecRule REQUEST_URI "echo "
SecRule REQUEST_URI "links -dump-width "
SecRule REQUEST_URI "links http:// "
SecRule REQUEST_URI "links ftp:// "
SecRule REQUEST_URI "links -source "
SecRule REQUEST_URI "cd /tmp "
SecRule REQUEST_URI "cd /var/tmp "
SecRule REQUEST_URI "cd /etc/httpd/proxy "
SecRule REQUEST_URI "&highlight=%2527%252E "
SecRule REQUEST_URI "changedir=%2Ftmp%2F.php "
SecRule REQUEST_URI "arta\.zip "
SecRule REQUEST_URI "cmd=cd\x20/var "
SecRule REQUEST_URI "HCL_path=http "
SecRule REQUEST_URI "clamav-partial "
SecRule REQUEST_URI "vi\.recover "
SecRule REQUEST_URI "netenberg "
SecRule REQUEST_URI "psybnc "
SecRule REQUEST_URI "fantastico_de_luxe "
SecRule REQUEST_URI "2Fpublic_html&"
SecRule REQUEST_URI ".htaccess"
SecRule REQUEST_URI "c99sh_datapipe.pl"
SecRule REQUEST_URI "listDBs"
SecRule REQUEST_URI "%2home%2"
SecRule REQUEST_URI "%2home%"
SecRule REQUEST_URI "%home%"
SecRule REQUEST_URI "%home"
SecRule REQUEST_URI "home%"
SecRule REQUEST_URI "%2Fhome%2"
SecRule REQUEST_URI "%2Fhome%"
SecRule REQUEST_URI "%Fhome%"
SecRule REQUEST_URI "%Fhome"
SecRule REQUEST_URI "Fhome%"
SecRule REQUEST_URI "2Fpublic_html&"
SecRule REQUEST_URI "/etc/"
SecRule REQUEST_URI "sqlman"
SecRule REQUEST_URI "act=security"
SecRule REQUEST_URI "act=cmd"
SecRule REQUEST_URI "act=chmod"
SecRule REQUEST_URI "act=ls&d="
SecRule REQUEST_URI "act=f&f="
SecRule REQUEST_URI "act=sql"
SecRule REQUEST_URI "Bcc:"
SecRule REQUEST_URI "Bcc:\x20"
SecRule REQUEST_URI "cc:"
SecRule REQUEST_URI "cc:\x20"
SecRule REQUEST_URI "bcc:"
SecRule REQUEST_URI "bcc:\x20"
SecRule REQUEST_URI "bcc: "
SecRule REQUEST_URI "cd "

SecRule REQUEST_URI "\<IMG.*/\bonerror\b[\s]*=/Ri"
SecRule REQUEST_URI "TYPE\s*=\s*[\'\"]text\/javascript/i"
SecRule REQUEST_URI "TYPE\s*=\s*[\'\"]application\/x-javascript/i"
SecRule REQUEST_URI "TYPE\s*=\s*[\'\"]text\/jscript/i"
SecRule REQUEST_URI "TYPE\s*=\s*[\'\"]text\/vbscript/i"
SecRule REQUEST_URI "TYPE\s*=\s*[\'\"]application\/x-vbscript/i"
SecRule REQUEST_URI "TYPE\s*=\s*[\'\"]text\/ecmascript/i"
SecRule REQUEST_URI "STYLE[\s]*=[\s]*[^>]expression[\s]*\(/i"
SecRule REQUEST_URI "[\s]*expression[\s]*\([^}]}[\s]*<\/STYLE>/i"
SecRule REQUEST_URI "<!\[CDATA\[<\]\]>SCRIPT"
SecRule REQUEST_URI "perl .*\.pl(\s|\t)*\;"
SecRule REQUEST_URI "\;(\s|\t)*perl .*\.pl"
SecRule REQUEST_URI|REQUEST_BODY "perl (xpl\.pl|kut|viewde|httpd\.txt)"

# For deny Shells opening
SecRule REQUEST_FILENAME "/(r0nin|TrYaG|TrYg|m0rtix|r57shell|c99shell|phpshell|void\.ru|phpremoteview|directmail|bash_history|\.ru/|brute|c991)\.php"
SecRule REQUEST_FILENAME "\.pl"
SecRule REQUEST_FILENAME "perl .*\.pl(\s|\t)*\;"
SecRule REQUEST_FILENAME "\;(\s|\t)*perl .*\.pl"
SecRule RESPONSE_BODY "TrYaG"
SecRule RESPONSE_BODY "SnIpEr_SA"
SecRule RESPONSE_BODY "Sniper"
SecRule RESPONSE_BODY "shell"

#Generic PHP exploit signatures
SecRule REQUEST_BODY "(chr|fwrite|fopen|system|e?chr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\)\;" "id:330001,rev:1,severity:2,msg:'Generic PHP exploit pattern denied'"

#Generic PHP exploit signatures
SecRule REQUEST_BODY|REQUEST_URI "<\?php (chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\)\;" "id:330002,rev:1,severity:2,msg:'Generic PHP exploit pattern denied'"

#slightly tighter rules with narrower focus
SecRule REQUEST_URI|REQUEST_BODY "(chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\)\;" "id:300008,rev:1,severity:2,msg:'Generic PHP exploit pattern denied'"

#Prevent SQL injection in cookies
SecRule REQUEST_COOKIES "((select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]|UNION SELECT.*\'.*\'.*,[0-9].*INTO.*FROM)" "id:300011,rev:1,severity:2,msg:'Generic SQL injection in cookie'"

#Genenric PHP body attack
SecRule REQUEST_BODY "(chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)" chain
SecRule REQUEST_BODY "^PHP\:*((cd|mkdir)[[:space:]]+(/|[A-Z|a-z|0-9]|\.)*|perl |killall |python |rpm |yum |apt-get |emerge |lynx |links |mkdir |elinks |cmd|pwd|wget |lwp-(download|request|mirror|rget) |id|uname |cvs |svn |(s|r)(cp|sh) |net(stat|cat)|rexec |smbclient |t?ftp |ncftp |chmod |curl |telnet |gcc |cc |g\+\+ |whoami|\./|killall |rm \-[a-z|A-Z])"

#Generic PHP remote file injection
SecRule REQUEST_URI "!(/do_command)" chain
SecRule REQUEST_URI "\.php\?.*=(https?|ftp|http)\:/.*(cmd|command)="
SecRule REQUEST_URI "\.php\?.*=(https?|ftp|http)\:/.*"
#script, perl, etc. code in HTTP_Referer string
SecRule HTTP_Referer "\#\!.*/"

#wormsign
SecRule REQUEST_URI "Hacked.*by.*member.*of.*SCC"

SecRule REQUEST_FILENAME "\.pl"
SecRule REQUEST_FILENAME "perl .*\.pl(\s|\t)*\;"
 أعلى
 يشاهد الملف الشخصي  
 

الخميس مارس 26, 2009 8:15 pm
غير متصل أبو سراج
 Re: اقوي رولز حتي الان لحماية المود سيكيورتي modsecurity rules
اشترك في: الجمعة مارس 20, 2009 3:56 am
مشاركات: 6
 يشاهد الملف الشخصي  
الله يجزاك كل خير أبو رودينا :clap:


 أعلى
 يشاهد الملف الشخصي  
 

الجمعة مارس 27, 2009 5:40 am
غير متصل أبو رودينا
 Re: اقوي رولز حتي الان لحماية المود سيكيورتي modsecurity rules
مدير الموقع
اشترك في: الثلاثاء مارس 17, 2009 3:57 am
مشاركات: 32
 يشاهد الملف الشخصي  
الله يسلم عمرك يابو سراج ،، تسلم
 أعلى
 يشاهد الملف الشخصي  
 
عرض مشاركات سابقة منذ:  مرتبة بواسطة  
إرسال موضوع جديد الرد على الموضوع  صفحة 1 من 1
  [ 3 مشاركة ] 

معهد الخدمات العربي » الاقسام العامة » عالم السيرفرات

جميع الأوقات تستخدم GMT + ساعتين [ DST ]

المتواجدون الآن

المستخدمون المتصفحون لهذا المنتدى: لا يوجد أعضاء مسجلين متصلين و 4 زائر/زوار

لا تستطيع كتابة مواضيع جديدة في هذا المنتدى
لا تستطيع كتابة ردود في هذا المنتدى
لا تستطيع تعديل مشاركاتك في هذا المنتدى
لا تستطيع حذف مشاركاتك في هذا المنتدى
لا تستطيع إرفاق ملف في هذا المنتدى

البحث عن:
الانتقال الى:  
cron

Powered by phpBB © I4SERV Co.LTD.
Designed By : Abo Rodina | Translated by phpBBArabia | SEO By phpbbSEO