class-disable-access-system-file-rules.php
1 year ago
class-time-based-one-time-password.php
2 years ago
class-waf-rules.php
1 year ago
class-waf-rules.php
509 lines
| 1 | <?php |
| 2 | |
| 3 | if ( ! defined( 'ABSPATH' ) ) { |
| 4 | exit; |
| 5 | } |
| 6 | |
| 7 | /** |
| 8 | * WAFで使用するルール設定用のクラス |
| 9 | */ |
| 10 | class CloudSecureWP_Waf_Rules { |
| 11 | // ルールの定義 |
| 12 | private const WAF_RULES = array( |
| 13 | array( |
| 14 | 'id' => '1000101', |
| 15 | 'skip' => 1, |
| 16 | 'skipafter' => '', |
| 17 | 'chain' => false, |
| 18 | 'variables' => array( 'request_filename', 'args', 'args_names', 'request_headers', 'xml' ), |
| 19 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 20 | 'attack' => '', |
| 21 | 'regex_pattern' => 'sys\.user_triggers|sys\.user_objects|@@spid|msysaces|instr|sys\.user_views|sys\.tab|charindex|sys\.user_catalog|constraint_type|locate|select|msysobjects|attnotnull|sys\.user_tables|sys\.user_tab_columns|sys\.user_constraints|waitfor|mysql\.user|sys\.all_tables|msysrelationships|msyscolumns|msysqueries', |
| 22 | 'transformations' => array( 'htmlentitydecode', 'lowercase', 'replacecomments', 'compresswhitespace' ), |
| 23 | ), |
| 24 | array( |
| 25 | 'id' => '1000102', |
| 26 | 'skip' => 0, |
| 27 | 'skipafter' => '959007', |
| 28 | 'chain' => false, |
| 29 | 'variables' => array(), |
| 30 | 'remove_variables' => array(), |
| 31 | 'attack' => '', |
| 32 | 'regex_pattern' => '', |
| 33 | 'transformations' => array(), |
| 34 | ), |
| 35 | array( |
| 36 | 'id' => '950007', |
| 37 | 'skip' => 0, |
| 38 | 'skipafter' => '', |
| 39 | 'chain' => false, |
| 40 | 'variables' => array( 'request_filename', 'args', 'args_names' ), |
| 41 | 'remove_variables' => array(), |
| 42 | 'attack' => 1, |
| 43 | 'regex_pattern' => '(?:\b(?:(?:s(?:ys\.(?:user_(?:(?:t(?:ab(?:_column|le)|rigger)|object|view)s|c(?:onstraints|atalog))|all_tables|tab)|elect\b.{0,40}\b(?:substring|ascii|user))|m(?:sys(?:(?:queri|ac)e|relationship|column|object)s|ysql\.user)|c(?:onstraint_type|harindex)|waitfor\b\W*?\bdelay|attnotnull)\b|(?:locate|instr)\W+\()|\@\@spid\b)', |
| 44 | 'transformations' => array( 'htmlentitydecode', 'lowercase', 'replacecomments', 'compresswhitespace' ), |
| 45 | ), |
| 46 | array( |
| 47 | 'id' => '959007', |
| 48 | 'skip' => 0, |
| 49 | 'skipafter' => '', |
| 50 | 'chain' => false, |
| 51 | 'variables' => array( 'request_headers', 'xml' ), |
| 52 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 53 | 'attack' => 1, |
| 54 | 'regex_pattern' => '(?:\b(?:(?:s(?:ys\.(?:user_(?:(?:t(?:ab(?:_column|le)|rigger)|object|view)s|c(?:onstraints|atalog))|all_tables|tab)|elect\b.{0,40}\b(?:substring|ascii|user))|m(?:sys(?:(?:queri|ac)e|relationship|column|object)s|ysql\.user)|c(?:onstraint_type|harindex)|waitfor\b\W*?\bdelay|attnotnull)\b|(?:locate|instr)\W+\()|\@\@spid\b)', |
| 55 | 'transformations' => array( 'htmlentitydecode', 'lowercase', 'replacecomments', 'compresswhitespace' ), |
| 56 | ), |
| 57 | array( |
| 58 | 'id' => '1000103', |
| 59 | 'skip' => 1, |
| 60 | 'skipafter' => '', |
| 61 | 'chain' => false, |
| 62 | 'variables' => array( 'request_filename', 'args', 'request_headers', 'xml' ), |
| 63 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 64 | 'attack' => '', |
| 65 | 'regex_pattern' => 'substr|xtype|textpos|all_objects|rownum|sysfilegroups|sysprocesses|user_group|sysobjects|user_tables|systables|pg_attribute|user_users|user_password|column_id|attrelid|user_tab_columns|table_name|pg_class|user_constraints|user_objects|object_type|dba_users|sysconstraints|mb_users|column_name|atttypid|object_id|substring|syscat|user_ind_columns|sysibm|syscolumns|sysdba|object_name', |
| 66 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 67 | ), |
| 68 | array( |
| 69 | 'id' => '1000104', |
| 70 | 'skip' => 0, |
| 71 | 'skipafter' => '959904', |
| 72 | 'chain' => false, |
| 73 | 'variables' => array(), |
| 74 | 'remove_variables' => array(), |
| 75 | 'attack' => '', |
| 76 | 'regex_pattern' => '', |
| 77 | 'transformations' => array(), |
| 78 | ), |
| 79 | array( |
| 80 | 'id' => '950904', |
| 81 | 'skip' => 0, |
| 82 | 'skipafter' => '', |
| 83 | 'chain' => false, |
| 84 | 'variables' => array( 'request_filename', 'args' ), |
| 85 | 'remove_variables' => array(), |
| 86 | 'attack' => 1, |
| 87 | 'regex_pattern' => '\b(?:(?:s(?:ys(?:(?:(?:process|tabl)e|filegroup|object)s|c(?:o(?:nstraint|lumn)s|at)|dba|ibm)|ubstr(?:ing)?)|user_(?:(?:(?:constrain|objec)t|tab(?:_column|le)|ind_column|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|(?:dba|mb)_users|xtype\W+\bchar|rownum)\b|t(?:able_name\b|extpos\W+\())', |
| 88 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 89 | ), |
| 90 | array( |
| 91 | 'id' => '959904', |
| 92 | 'skip' => 0, |
| 93 | 'skipafter' => '', |
| 94 | 'chain' => false, |
| 95 | 'variables' => array( 'request_headers', 'xml' ), |
| 96 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 97 | 'attack' => 1, |
| 98 | 'regex_pattern' => '\b(?:(?:s(?:ys(?:(?:(?:process|tabl)e|filegroup|object)s|c(?:o(?:nstraint|lumn)s|at)|dba|ibm)|ubstr(?:ing)?)|user_(?:(?:(?:constrain|objec)t|tab(?:_column|le)|ind_column|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|(?:dba|mb)_users|xtype\W+\bchar|rownum)\b|t(?:able_name\b|extpos\W+\())', |
| 99 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 100 | ), |
| 101 | array( |
| 102 | 'id' => '1000105', |
| 103 | 'skip' => 1, |
| 104 | 'skipafter' => '', |
| 105 | 'chain' => false, |
| 106 | 'variables' => array( 'request_filename', 'args', 'args_names', 'request_headers', 'xml' ), |
| 107 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 108 | 'attack' => '', |
| 109 | 'regex_pattern' => 'insert|xp_enumdsn|infile|openrowset|nvarchar|autonomous_transaction|print|data_type|or|outfile|inner|shutdown|tbcreator|@@version|xp_filelist|sp_prepare|sql_longvarchar|xp_regenumkeys|xp_loginconfig|xp_dirtree|ifnull|sp_addextendedproc|xp_regaddmultistring|delete|sp_sqlexec|and|sp_oacreate|sp_execute|cast|xp_ntsec|xp_regdeletekey|drop|varchar|xp_execresultset|having|utl_file|xp_regenumvalues|xp_terminate|xp_availablemedia|xp_regdeletevalue|dumpfile|isnull|sql_variant|select|\'sa\'|xp_regremovemultistring|xp_makecab|\'msdasql\'|xp_cmdshell|openquery|sp_executesql|\'sqloledb\'|dbms_java|\'dbo\'|utl_http|sp_makewebtask|benchmark|xp_regread|xp_regwrite', |
| 110 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 111 | ), |
| 112 | array( |
| 113 | 'id' => '999501', |
| 114 | 'skip' => 0, |
| 115 | 'skipafter' => '959001', |
| 116 | 'chain' => false, |
| 117 | 'variables' => array(), |
| 118 | 'remove_variables' => array(), |
| 119 | 'attack' => '', |
| 120 | 'regex_pattern' => '', |
| 121 | 'transformations' => array(), |
| 122 | ), |
| 123 | array( |
| 124 | 'id' => '950001', |
| 125 | 'skip' => 0, |
| 126 | 'skipafter' => '', |
| 127 | 'chain' => false, |
| 128 | 'variables' => array( 'request_filename', 'args', 'args_names' ), |
| 129 | 'remove_variables' => array(), |
| 130 | 'attack' => 1, |
| 131 | 'regex_pattern' => '(?:\b(?:(?:s(?:elect\b(?:.{1,100}?\b(?:(?:length|count|top)\b.{1,100}?\bfrom|from\b.{1,100}?\bwhere)|.*?\b(?:d(?:ump\b.*\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_(?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebtask)|ql_(?:longvarchar|variant))|xp_(?:reg(?:re(?:movemultistring|ad)|delete(?:value|key)|enum(?:value|key)s|addmultistring|write)|e(?:xecresultset|numdsn)|(?:terminat|dirtre)e|availablemedia|loginconfig|cmdshell|filelist|makecab|ntsec)|u(?:nion\b.{1,100}?\bselect|tl_(?:file|http))|group\b.*\bby\b.{1,100}?\bhaving|d(?:elete\b\W*?\bfrom|bms_java)|load\b\W*?\bdata\b.*\binfile|(?:n?varcha|tbcreato)r)\b|i(?:n(?:to\b\W*?\b(?:dump|out)file|sert\b\W*?\binto|ner\b\W*?\bjoin)\b|(?:f(?:\b\W*?\(\W*?\bbenchmark|null\b)|snull\b)\W*?\()|a(?:nd\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|utonomous_transaction\b)|o(?:r\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|pen(?:rowset|query)\b)|having\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|print\b\W*?\@\@|cast\b\W*?\()|(?:;\W*?\b(?:shutdown|drop)|\@\@version)\b|\'(?:s(?:qloledb|a)|msdasql|dbo)\')', |
| 132 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 133 | ), |
| 134 | array( |
| 135 | 'id' => '959001', |
| 136 | 'skip' => 0, |
| 137 | 'skipafter' => '', |
| 138 | 'chain' => false, |
| 139 | 'variables' => array( 'request_headers', 'xml' ), |
| 140 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 141 | 'attack' => 1, |
| 142 | 'regex_pattern' => '(?:\b(?:(?:s(?:elect\b(?:.{1,100}?\b(?:(?:length|count|top)\b.{1,100}?\bfrom|from\b.{1,100}?\bwhere)|.*?\b(?:d(?:ump\b.*\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_(?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebtask)|ql_(?:longvarchar|variant))|xp_(?:reg(?:re(?:movemultistring|ad)|delete(?:value|key)|enum(?:value|key)s|addmultistring|write)|e(?:xecresultset|numdsn)|(?:terminat|dirtre)e|availablemedia|loginconfig|cmdshell|filelist|makecab|ntsec)|u(?:nion\b.{1,100}?\bselect|tl_(?:file|http))|group\b.*\bby\b.{1,100}?\bhaving|d(?:elete\b\W*?\bfrom|bms_java)|load\b\W*?\bdata\b.*\binfile|(?:n?varcha|tbcreato)r)\b|i(?:n(?:to\b\W*?\b(?:dump|out)file|sert\b\W*?\binto|ner\b\W*?\bjoin)\b|(?:f(?:\b\W*?\(\W*?\bbenchmark|null\b)|snull\b)\W*?\()|a(?:nd\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|utonomous_transaction\b)|o(?:r\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|pen(?:rowset|query)\b)|having\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|print\b\W*?\@\@|cast\b\W*?\()|(?:;\W*?\b(?:shutdown|drop)|\@\@version)\b|\'(?:s(?:qloledb|a)|msdasql|dbo)\')', |
| 143 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 144 | ), |
| 145 | array( |
| 146 | 'id' => '950901', |
| 147 | 'skip' => 0, |
| 148 | 'skipafter' => '', |
| 149 | 'chain' => false, |
| 150 | 'variables' => array( 'request_filename', 'args', 'args_names' ), |
| 151 | 'remove_variables' => array(), |
| 152 | 'attack' => 1, |
| 153 | 'regex_pattern' => '\b(?<![\w]{1}[_\-]{1})(\d+) ?= ?\1\b|[\'\"](\w+)[\'\"] ?= ?[\'\"]\2\b', |
| 154 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 155 | ), |
| 156 | array( |
| 157 | 'id' => '959901', |
| 158 | 'skip' => 0, |
| 159 | 'skipafter' => '', |
| 160 | 'chain' => false, |
| 161 | 'variables' => array( 'request_headers', 'xml' ), |
| 162 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 163 | 'attack' => 1, |
| 164 | 'regex_pattern' => '\b(?<![\w]{1}[_\-]{1})(\d+) ?= ?\1\b|[\'\"](\w+)[\'\"] ?= ?[\'\"]\2\b', |
| 165 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 166 | ), |
| 167 | array( |
| 168 | 'id' => '1000106', |
| 169 | 'skip' => 1, |
| 170 | 'skipafter' => '', |
| 171 | 'chain' => false, |
| 172 | 'variables' => array( 'request_filename', 'args', 'request_headers', 'xml' ), |
| 173 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 174 | 'attack' => '', |
| 175 | 'regex_pattern' => 'user_objects|object_type|substr|all_objects|mb_users|column_name|rownum|atttypid|substring|object_id|user_group|user_tables|pg_attribute|user_users|column_id|user_password|attrelid|object_name|table_name|pg_class', |
| 176 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 177 | ), |
| 178 | array( |
| 179 | 'id' => '1000107', |
| 180 | 'skip' => 0, |
| 181 | 'skipafter' => '959906', |
| 182 | 'chain' => false, |
| 183 | 'variables' => array(), |
| 184 | 'remove_variables' => array(), |
| 185 | 'attack' => '', |
| 186 | 'regex_pattern' => '', |
| 187 | 'transformations' => array(), |
| 188 | ), |
| 189 | array( |
| 190 | 'id' => '950906', |
| 191 | 'skip' => 0, |
| 192 | 'skipafter' => '', |
| 193 | 'chain' => false, |
| 194 | 'variables' => array( 'request_filename', 'args' ), |
| 195 | 'remove_variables' => array(), |
| 196 | 'attack' => 1, |
| 197 | 'regex_pattern' => '\b(?:user_(?:(?:object|table|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|substr(?:ing)?|table_name|mb_users|rownum)\b', |
| 198 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 199 | ), |
| 200 | array( |
| 201 | 'id' => '959906', |
| 202 | 'skip' => 0, |
| 203 | 'skipafter' => '', |
| 204 | 'chain' => false, |
| 205 | 'variables' => array( 'request_headers', 'xml' ), |
| 206 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 207 | 'attack' => 1, |
| 208 | 'regex_pattern' => '\b(?:user_(?:(?:object|table|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|substr(?:ing)?|table_name|mb_users|rownum)\b', |
| 209 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 210 | ), |
| 211 | array( |
| 212 | 'id' => '950908', |
| 213 | 'skip' => 0, |
| 214 | 'skipafter' => '', |
| 215 | 'chain' => false, |
| 216 | 'variables' => array( 'request_filename', 'args', 'args_names' ), |
| 217 | 'remove_variables' => array(), |
| 218 | 'attack' => 1, |
| 219 | 'regex_pattern' => '\b(?:coalesce\b|root\@)', |
| 220 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 221 | ), |
| 222 | array( |
| 223 | 'id' => '959908', |
| 224 | 'skip' => 0, |
| 225 | 'skipafter' => '', |
| 226 | 'chain' => false, |
| 227 | 'variables' => array( 'request_headers', 'xml' ), |
| 228 | 'remove_variables' => array( 'request_headers' => array( 'Referer', 'via' ) ), |
| 229 | 'attack' => 1, |
| 230 | 'regex_pattern' => '\b(?:coalesce\b|root\@)', |
| 231 | 'transformations' => array( 'htmlentitydecode', 'replacecomments', 'compresswhitespace', 'lowercase' ), |
| 232 | ), |
| 233 | array( |
| 234 | 'id' => '1000201', |
| 235 | 'skip' => 1, |
| 236 | 'skipafter' => '', |
| 237 | 'chain' => false, |
| 238 | 'variables' => array( 'request_filename', 'args', 'args_names', 'request_headers', 'xml' ), |
| 239 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 240 | 'attack' => '', |
| 241 | 'regex_pattern' => 'jscript|onsubmit|copyparentfolder|javascript|meta|onmove|onkeydown|onchange|onkeyup|activexobject|expression|onmouseup|ecmascript|onmouseover|vbscript:|<!\[cdata\[|http:|settimeout|onabort|shell:|\.innerhtml|onmousedown|onkeypress|asfunction:|onclick|\.fromcharcode|background-image:|\.cookie|ondragdrop|onblur|x-javascript|mocha:|onfocus|javascript:|getparentfolder|lowsrc|onresize|@import|alert|onselect|script|onmouseout|onmousemove|background|application|\.execscript|livescript:|getspecialfolder|vbscript|iframe|\.addimport|onunload|createtextrange|onload|<input', |
| 242 | 'transformations' => array( 'htmlentitydecode', 'compresswhitespace', 'lowercase' ), |
| 243 | ), |
| 244 | array( |
| 245 | 'id' => '1000202', |
| 246 | 'skip' => 0, |
| 247 | 'skipafter' => '959004', |
| 248 | 'chain' => false, |
| 249 | 'variables' => array(), |
| 250 | 'remove_variables' => array(), |
| 251 | 'attack' => '', |
| 252 | 'regex_pattern' => '', |
| 253 | 'transformations' => array(), |
| 254 | ), |
| 255 | array( |
| 256 | 'id' => '950004', |
| 257 | 'skip' => 0, |
| 258 | 'skipafter' => '', |
| 259 | 'chain' => false, |
| 260 | 'variables' => array( 'request_filename', 'args', 'args_names' ), |
| 261 | 'remove_variables' => array(), |
| 262 | 'attack' => 2, |
| 263 | 'regex_pattern' => '(?:\b(?:(?:type\b\W*?\b(?:text\b\W*?\b(?:j(?:ava)?|ecma|vb)|application\b\W*?\bx-(?:java|vb))script|c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder|iframe\b.{0,100}?\bsrc)\b|on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|up)|ve)|key(?:press|down|up)|c(?:hange|lick)|s(?:elec|ubmi)t|(?:un)?load|dragdrop|resize|focus|blur)\b\W*?=|abort\b)|(?:l(?:owsrc\b\W*?\b(?:(?:java|vb)script|shell|http)|ivescript)|(?:href|url)\b\W*?\b(?:(?:java|vb)script|shell)|background-image|mocha):|s(?:(?:tyle\b\W*=.*\bexpression\b\W*|ettimeout\b\W*?)\(|rc\b\W*?\b(?:(?:java|vb)script|shell|http):)|a(?:ctivexobject\b|lert\b\W*?\(|sfunction:))|<(?:(?:body\b.*?\b(?:backgroun|onloa)d|input\b.*?\btype\b\W*?\bimage)\b| ?(?:(?:script|meta)\b|iframe)|!\[cdata\[)|(?:\.(?:(?:execscrip|addimpor)t|(?:fromcharcod|cooki)e|innerhtml)|\@import)\b)', |
| 264 | 'transformations' => array( 'htmlentitydecode', 'compresswhitespace', 'lowercase' ), |
| 265 | ), |
| 266 | array( |
| 267 | 'id' => '959004', |
| 268 | 'skip' => 0, |
| 269 | 'skipafter' => '', |
| 270 | 'chain' => false, |
| 271 | 'variables' => array( 'request_headers', 'xml' ), |
| 272 | 'remove_variables' => array( 'request_headers' => array( 'Referer' ) ), |
| 273 | 'attack' => 2, |
| 274 | 'regex_pattern' => '(?:\b(?:(?:type\b\W*?\b(?:text\b\W*?\b(?:j(?:ava)?|ecma|vb)|application\b\W*?\bx-(?:java|vb))script|c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder|iframe\b.{0,100}?\bsrc)\b|on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|up)|ve)|key(?:press|down|up)|c(?:hange|lick)|s(?:elec|ubmi)t|(?:un)?load|dragdrop|resize|focus|blur)\b\W*?=|abort\b)|(?:l(?:owsrc\b\W*?\b(?:(?:java|vb)script|shell|http)|ivescript)|(?:href|url)\b\W*?\b(?:(?:java|vb)script|shell)|background-image|mocha):|s(?:(?:tyle\b\W*=.*\bexpression\b\W*|ettimeout\b\W*?)\(|rc\b\W*?\b(?:(?:java|vb)script|shell|http):)|a(?:ctivexobject\b|lert\b\W*?\(|sfunction:))|<(?:(?:body\b.*?\b(?:backgroun|onloa)d|input\b.*?\btype\b\W*?\bimage)\b| ?(?:(?:script|meta)\b|iframe)|!\[cdata\[)|(?:\.(?:(?:execscrip|addimpor)t|(?:fromcharcod|cooki)e|innerhtml)|\@import)\b)', |
| 275 | 'transformations' => array( 'htmlentitydecode', 'compresswhitespace', 'lowercase' ), |
| 276 | ), |
| 277 | array( |
| 278 | 'id' => '950002', |
| 279 | 'skip' => 0, |
| 280 | 'skipafter' => '', |
| 281 | 'chain' => false, |
| 282 | 'variables' => array( 'request_filename' ), |
| 283 | 'remove_variables' => array(), |
| 284 | 'attack' => 4, |
| 285 | 'regex_pattern' => '\b(?:n(?:map|et|c)|w(?:guest|sh)|cmd(?:32)?|telnet|rcmd|ftp)\.exe\b', |
| 286 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 287 | ), |
| 288 | array( |
| 289 | 'id' => '1000401', |
| 290 | 'skip' => 1, |
| 291 | 'skipafter' => '', |
| 292 | 'chain' => false, |
| 293 | 'variables' => array( 'args' ), |
| 294 | 'remove_variables' => array(), |
| 295 | 'attack' => '', |
| 296 | 'regex_pattern' => 'uname|wguest\.exe|\/perl|\/nasm|rcmd\.exe|nc|tclsh|\/xterm|finger|tftp|chown|\/echo|nmap\.exe|ping|\/passwd|\/chsh|ps|\/uname|telnet\.exe|\/ftp|ls|tclsh8|lsof|\/ping|echo|cmd\.exe|\/kill|python|traceroute|\/ps|perl|passwd|wsh\.exe|\/rm|\/cpp|chgrp|\/telnet|localgroup|kill|\/chgrp|\/finger|nasm|\/ls|nc\.exe|id|\/chmod|\/nc|\/g\+\+|\/id|\/chown|cmd|\/nmap|chsh|\/gcc|net\.exe|\/python|\/lsof|ftp\.exe|ftp|xterm|mail|\/mail|tracert|nmap|rm|cd|chmod|cpp|telnet|cmd32\.exe|gcc|g\+\+', |
| 297 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 298 | ), |
| 299 | array( |
| 300 | 'id' => '1000402', |
| 301 | 'skip' => 0, |
| 302 | 'skipafter' => '950006', |
| 303 | 'chain' => false, |
| 304 | 'variables' => array(), |
| 305 | 'remove_variables' => array(), |
| 306 | 'attack' => '', |
| 307 | 'regex_pattern' => '', |
| 308 | 'transformations' => array(), |
| 309 | ), |
| 310 | array( |
| 311 | 'id' => '950006', |
| 312 | 'skip' => 0, |
| 313 | 'skipafter' => '', |
| 314 | 'chain' => false, |
| 315 | 'variables' => array( 'args' ), |
| 316 | 'remove_variables' => array(), |
| 317 | 'attack' => 4, |
| 318 | 'regex_pattern' => '(?:\b(?:(?:n(?:et(?:\b\W+?\blocalgroup|\.exe)|(?:map|c)\.exe)|t(?:racer(?:oute|t)|elnet\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\.exe|echo\b\W*?\by+)\b|c(?:md(?:(?:32)?\.exe\b|\b\W*?\/c)|d(?:\b\W*?[\/\\\\]|\W*?\.\.)|hmod.{0,40}?\+.{0,3}x))|[\;\|\`]\W*?\b(?:(?:c(?:h(?:grp|mod|own|sh)|md|pp)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)\b|g(?:\+\+|cc\b))|\/(?:c(?:h(?:grp|mod|own|sh)|pp)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|g(?:\+\+|cc)|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)(?:[\'\"\|\;\`\-\s]|$))', |
| 319 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 320 | ), |
| 321 | array( |
| 322 | 'id' => '1000403', |
| 323 | 'skip' => 1, |
| 324 | 'skipafter' => '', |
| 325 | 'chain' => false, |
| 326 | 'variables' => array( 'request_headers', 'xml', 'request_cookies', 'request_cookies_names' ), |
| 327 | 'remove_variables' => array( 'request_headers' => array( 'Cookie', 'Referer', 'X-OS-Prefs' ) ), |
| 328 | 'attack' => '', |
| 329 | 'regex_pattern' => 'uname|wguest\.exe|\/perl|\/nasm|rcmd\.exe|nc|tclsh|\/xterm|finger|tftp|chown|\/echo|nmap\.exe|ping|\/passwd|\/chsh|ps|\/uname|telnet\.exe|\/ftp|ls|tclsh8|lsof|\/ping|echo|cmd\.exe|\/kill|python|traceroute|\/ps|perl|passwd|wsh\.exe|\/rm|\/cpp|chgrp|\/telnet|localgroup|kill|\/chgrp|\/finger|nasm|\/ls|nc\.exe|id|\/chmod|\/nc|\/g\+\+|\/id|\/chown|cmd|\/nmap|chsh|\/gcc|net\.exe|\/python|\/lsof|ftp\.exe|ftp|xterm|mail|\/mail|tracert|nmap|rm|cd|chmod|cpp|telnet|cmd32\.exe|gcc|g\+\+', |
| 330 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 331 | ), |
| 332 | array( |
| 333 | 'id' => '1000404', |
| 334 | 'skip' => 0, |
| 335 | 'skipafter' => '959006', |
| 336 | 'chain' => false, |
| 337 | 'variables' => array(), |
| 338 | 'remove_variables' => array(), |
| 339 | 'attack' => '', |
| 340 | 'regex_pattern' => '', |
| 341 | 'transformations' => array(), |
| 342 | ), |
| 343 | array( |
| 344 | 'id' => '959006', |
| 345 | 'skip' => 0, |
| 346 | 'skipafter' => '', |
| 347 | 'chain' => false, |
| 348 | 'variables' => array( 'request_headers', 'xml', 'request_cookies', 'request_cookies_names' ), |
| 349 | 'remove_variables' => array( 'request_headers' => array( 'Cookie', 'Referer', 'X-OS-Prefs' ) ), |
| 350 | 'attack' => 4, |
| 351 | 'regex_pattern' => '(?:\b(?:(?:n(?:et(?:\b\W+?\blocalgroup|\.exe)|(?:map|c)\.exe)|t(?:racer(?:oute|t)|elnet\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\.exe|echo\b\W*?\by+)\b|c(?:md(?:(?:32)?\.exe\b|\b\W*?\/c)|d(?:\b\W*?[\/\\\\]|\W*?\.\.)|hmod.{0,40}?\+.{0,3}x))|[\;\|\`]\W*?\b(?:(?:c(?:h(?:grp|mod|own|sh)|md|pp)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)\b|g(?:\+\+|cc\b))|\/(?:c(?:h(?:grp|mod|own|sh)|pp)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|g(?:\+\+|cc)|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)(?:[\'\"\|\;\`\-\s]|$))', |
| 352 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 353 | ), |
| 354 | array( |
| 355 | 'id' => '950907', |
| 356 | 'skip' => 0, |
| 357 | 'skipafter' => '', |
| 358 | 'chain' => false, |
| 359 | 'variables' => array( 'args' ), |
| 360 | 'remove_variables' => array(), |
| 361 | 'attack' => 4, |
| 362 | 'regex_pattern' => '(?:(?:[\;\|\`]\W*?\bcc|\bwget)\b|\/cc(?:[\'\"\|\;\`\-\s]|$))', |
| 363 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 364 | ), |
| 365 | array( |
| 366 | 'id' => '959907', |
| 367 | 'skip' => 0, |
| 368 | 'skipafter' => '', |
| 369 | 'chain' => false, |
| 370 | 'variables' => array( 'request_headers', 'xml', 'request_cookies', 'request_cookies_names' ), |
| 371 | 'remove_variables' => array( 'request_headers' => array( 'Cookie', 'Referer', 'X-OS-Prefs', 'User-Agent' ) ), |
| 372 | 'attack' => 4, |
| 373 | 'regex_pattern' => '(?:(?:[\;\|\`]\W*?\bcc|\bwget)\b|\/cc(?:[\'\"\|\;\`\-\s]|$))', |
| 374 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 375 | ), |
| 376 | array( |
| 377 | 'id' => '1000501', |
| 378 | 'skip' => 1, |
| 379 | 'skipafter' => '', |
| 380 | 'chain' => false, |
| 381 | 'variables' => array( 'request_filename', 'args', 'args_names', 'request_headers', 'xml' ), |
| 382 | 'remove_variables' => array(), |
| 383 | 'attack' => '', |
| 384 | 'regex_pattern' => '<\?fgets|move_uploaded_file|\$_session|readfile|ftp_put|ftp_fget|gzencode|ftp_nb_put|bzopen|readdir|\$_post|fopen|gzread|ftp_nb_fput|ftp_nb_fget|ftp_get|\$_get|scandir|fscanf|readgzfile|fread|proc_open|fgetc|fgetss|ftp_fput|ftp_nb_get|session_start|fwrite|gzwrite|gzopen|gzcompress', |
| 385 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 386 | ), |
| 387 | array( |
| 388 | 'id' => '1000502', |
| 389 | 'skip' => 0, |
| 390 | 'skipafter' => '959013', |
| 391 | 'chain' => false, |
| 392 | 'variables' => array(), |
| 393 | 'remove_variables' => array(), |
| 394 | 'attack' => '', |
| 395 | 'regex_pattern' => '', |
| 396 | 'transformations' => array(), |
| 397 | ), |
| 398 | array( |
| 399 | 'id' => '950013', |
| 400 | 'skip' => 0, |
| 401 | 'skipafter' => '', |
| 402 | 'chain' => false, |
| 403 | 'variables' => array( 'request_filename', 'args', 'args_names' ), |
| 404 | 'remove_variables' => array(), |
| 405 | 'attack' => 8, |
| 406 | 'regex_pattern' => '(?:(?:\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open)|\$_(?:(?:pos|ge)t|session))\b|<\?(?!xml))', |
| 407 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 408 | ), |
| 409 | array( |
| 410 | 'id' => '959013', |
| 411 | 'skip' => 0, |
| 412 | 'skipafter' => '', |
| 413 | 'chain' => false, |
| 414 | 'variables' => array( 'request_headers', 'xml' ), |
| 415 | 'remove_variables' => array(), |
| 416 | 'attack' => 8, |
| 417 | 'regex_pattern' => '(?:(?:\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open)|\$_(?:(?:pos|ge)t|session))\b|<\?(?!xml))', |
| 418 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 419 | ), |
| 420 | array( |
| 421 | 'id' => '950019', |
| 422 | 'skip' => 0, |
| 423 | 'skipafter' => '', |
| 424 | 'chain' => false, |
| 425 | 'variables' => array( 'request_filename', 'args', 'args_names' ), |
| 426 | 'remove_variables' => array(), |
| 427 | 'attack' => 16, |
| 428 | 'regex_pattern' => '[\n\r]\s*\b(?:to|b?cc)\b\s*:.*?\@', |
| 429 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 430 | ), |
| 431 | array( |
| 432 | 'id' => '959019', |
| 433 | 'skip' => 0, |
| 434 | 'skipafter' => '', |
| 435 | 'chain' => false, |
| 436 | 'variables' => array( 'request_headers', 'xml' ), |
| 437 | 'remove_variables' => array(), |
| 438 | 'attack' => 16, |
| 439 | 'regex_pattern' => '[\n\r]\s*\b(?:to|b?cc)\b\s*:.*?\@', |
| 440 | 'transformations' => array( 'htmlentitydecode', 'lowercase' ), |
| 441 | ), |
| 442 | array( |
| 443 | 'id' => 'm333827', |
| 444 | 'skip' => 1, |
| 445 | 'skipafter' => '', |
| 446 | 'chain' => false, |
| 447 | 'variables' => array( 'args' ), |
| 448 | 'remove_variables' => array(), |
| 449 | 'attack' => '', |
| 450 | 'regex_pattern' => 'php|chr|fopen|fwrite|globals|system|passthru|serialize|include|php_uname|popen|proc_open|mysql_query|exec|eval|create_function|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo|preg_|decode_base64|base64_decode|base64_url_decode|rot13|<\?|mfunc|mclude|dynamic-cached-content|md5|die|sha', |
| 451 | 'transformations' => array(), |
| 452 | ), |
| 453 | array( |
| 454 | 'id' => 'm334377', |
| 455 | 'skip' => 0, |
| 456 | 'skipafter' => 'm340095', |
| 457 | 'chain' => false, |
| 458 | 'variables' => array(), |
| 459 | 'remove_variables' => array(), |
| 460 | 'attack' => '', |
| 461 | 'regex_pattern' => '', |
| 462 | 'transformations' => array(), |
| 463 | ), |
| 464 | array( |
| 465 | 'id' => 'm340095', |
| 466 | 'skip' => 0, |
| 467 | 'skipafter' => '', |
| 468 | 'chain' => false, |
| 469 | 'variables' => array( 'args' ), |
| 470 | 'remove_variables' => array( 'args' => array( 'wpSummary', 'post_content' ) ), |
| 471 | 'attack' => 8, |
| 472 | 'regex_pattern' => '(?:\b(?:eval|rot13|strrev|passthru|serialize|php(?:_uname|info)|(?:preg|zlib)_\w+|mysql_query|(?:shell_)?exec|base64_(?:url_)?decode|create_function|decode_base64|gzinflate|gzdecode|gzuncompress)\b\s?(?:\(|\:)|\(chr\s?\(\s?[0-9]{1,3}\s?\)|\s?=\s?(?:fopen|fwrite)\s?\(|\b(?:system|include)\b\s?\((?:\'|\"|\$)|<\s?\?\s?=\s?system\s?\(\s?\$_|die\(\@md5|die\(\@sha)', |
| 473 | 'transformations' => array( 'lowercase' ), |
| 474 | ), |
| 475 | ); |
| 476 | |
| 477 | |
| 478 | private const LOCATIONMATCH_RULES = array( |
| 479 | array( |
| 480 | 'path' => '\/wp-admin\/(setup-config|install|profile|user-edit|user-new|post|admin-ajax|nav-menus|options|options-permalink|load-scripts|load-style)\.php', |
| 481 | 'remove_rule_ids' => array( '950004', '959004', '1000201', '1000202' ), |
| 482 | ), |
| 483 | array( |
| 484 | 'path' => 'wp-login\.php\?vaultpress=true', |
| 485 | 'remove_rule_ids' => array( 'm340095' ), |
| 486 | ), |
| 487 | ); |
| 488 | |
| 489 | |
| 490 | /** |
| 491 | * ルールの取得 |
| 492 | * |
| 493 | * @return array |
| 494 | */ |
| 495 | public function get_waf_rules(): array { |
| 496 | return self::WAF_RULES; |
| 497 | } |
| 498 | |
| 499 | /** |
| 500 | * LocationMatchルールの取得 |
| 501 | * |
| 502 | * @return array |
| 503 | */ |
| 504 | public function get_locationmatch_rules(): array { |
| 505 | return self::LOCATIONMATCH_RULES; |
| 506 | } |
| 507 | } |
| 508 | |
| 509 |