基于 nginx 和 modsecurity 的 WAF 防火墙实现
第一部分 简单规则
引擎：使用 nginx 内置变量及正则表达式实现
作用范围：站点 server 字段
有部分规则重复进行注释处理，当 modsecurity 模块不可用时取消注释使其生效
1.过滤文件和路径
阻止 /~ 这种带有波浪线的路径
#阻止文件类型（扩展名、后缀）
.(bzr|cvs|git|svn)
.(bak|backup|bzr|cfg|conf|cvs|doc|docx|DS_Store|ear|git|gitignore|hg|htaccess|htpasswd|ini|in
c|jar|log|online|production|project|properties|pl|pm|py|pyc|pyo|sh|sql|svn|swp|war)$
#阻止常见 windows 文件格式
.(ade|adp|app|asa|ascx|ashx|asmx|asp|aspx|axd|bas|bat|cdx|cer|chm|class|cmd|com|config|cpl|
crt|cs|csproj|csh|csr|dat|dbf|dll|dos|exe|fxp|hlp|hta|htr|htw|ida|idc|idq|ins|isp|its|jse|key|ksh|licx|l
nk|mad|maf|mag|mam|maq|mar|mas|mat|mau|mav|maw|mda|mdb|mde|mdt|mdw|mdz|msc|
msh|msh1|msh1xml|msh2|msh2xml|mshxml|msi|msp|mst|old|ops|pass|pcd|pdb|pif|pol|prf|prg
|printer|pst|pwd|resources|resx|reg|rem|scf|scr|sct|shb|shs|shtm|shtml|soap|stm|sys|url|vb|vbe|
vbs|vbproj|vsdisco|webinfo|xsd|xsx|ws|wsc|wsf|wsh)$
2.过滤 http 请求方法 仅允许 GET HEAD POST OPTIONS
3.过滤用户代理
阻止各种机器人（robot），爬虫（spider），下载器，测试工具，注入工具，扫描器
BTWebClient|FlashGet|FreshDownload|JetCar|PycURL|wget
audit|BabyKrokodil|BBBike|httrack|httperf|harvest|hydra|netsparker|Nikto|owasp|parser
Alligator|Azureus|BackStreet Browser|BW-C-2.0|Charon|LWP::Simple
ApacheBench|GetRight|github|GrabNet|Havij|Jmeter|JoeDog|masscan|mail2000|TurnitinBot|
WebBench
CPython|libwww|libwww-perl|python-httplib2|python-requests|Python-urllib
arachni|absinthe|bilbo|black
widow|blackwidow|brutus|bsqlbf|cgichk|dirbuster|fimap|grabber|grendel-
scan|havij|hydra|jaascois|jbrofuzz|libwhisker|metis|n-
stealth|netsparker|nasl|nmap|nse|nsauditor|nikto|nessus|Openvas|pmafin
d|paros|pangolin|sqlmap|sqlninja|sql power
injector|webinspect|wifinder|w3af|whatweb|webtrends security analyzer|webshag|Win
Http
AhrefsBot|AltaVista|aiHitBot|BBScan|BLEXBot|CSS Certificate Spider|COMODO SSL
Checker|Dataprovider|
electricmonk|eMusic|Exabot|FeedBurner|Feedskycrawler|ia_archiver|ips-
agent|NgSpider|panscient.com|Plukkie|SemrushBot|Seznam
Bot|spiderman|seoscanners.net|SafeDNSBot|scrapbot|SurveyBot|semanticbot|SiteExplorer|Scr
apy|Uptimebot|Wotbox|YRSpider
4.过滤变量:强制规范特定类型变量，比如禁止数值变量传递文本字串
剩余15页未读，继续阅读
评论0