1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

local jsonFilter = waf.jsonFilter

local function rMatch(v)
    if v == "@type" then
        return true, v
    end
    return false
end

local form = waf.form
if form then
    local raw = form["RAW"]
    local m = jsonFilter(raw, rMatch, false)
    if m then
        return m, raw, true
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

local form = waf.form
local rct = waf.reqContentType
local rgx = waf.rgxMatch

if rct and waf.contains(waf.toLower(rct), "application/json") and form then
    local raw = form["RAW"]
    if raw then
        if rgx(raw, "^\\s*$", "jos") then
            return false
        end
        local err = waf.checkJson(raw)
        if err then
            return true, err .. ":" .. raw, true
        end
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

local kvFilter = waf.kvFilter
local checkXSS = waf.checkXSS


local function sMatch(v)
    if v then
        local m = checkXSS(v)
        if m then
            return m, v
        end
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], sMatch)
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, sMatch)
    if m then
        return m, d, true
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, sMatch)
    if m then
        return m, d, true
    end
end

local m, d = sMatch(waf.userAgent)
if m then
    return m, d, true
end

local m, d = sMatch(waf.referer)
if m then
    return m, d, true
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

local kvFilter = waf.kvFilter
local rgx = waf.rgxMatch
local urlDecode = waf.urlDecode
local requestLine = waf.requestLine
local check = waf.plugins.javaClassDetection.check

local function sMatch(v)
    local m = rgx(v, "(?:\\$\\{)+(?:j(?:n|\\$\\{)|\\$\\{(?:\\w*:)+)", "joi")
    if m then
        return m, "Potential Log4j / Log4shell Attack: " .. v
    end
    m = rgx(v, "\\xac\\xed\\x00\\x05|rO0ABQ|KztAAU|Cs7QAF", "jo")
    if m then
        return m, "Magic bytes Detected, probable java serialization Attack: " .. v
    end
    m = rgx(v, "classLoader\\s*\\.\\s*resources\\s*\\.\\s*context\\s*\\.\\s*parent\\s*\\.\\s*pipeline|springframework\\s*\\.\\s*context\\s*\\.\\s*support\\s*\\.\\s*FileSystemXmlApplicationContext", "jos")
    if m then
        return m, "Spring Framework RCE(CVE-2022-22965): " .. v
    end
    m = check(v)
    if m then
        return m, "Potential dangerous java class: " .. v
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], sMatch)
    if m then
        return m, d, true
    end
    local raw = form["RAW"]
    m = rgx(raw, "\\xac\\xed\\x00\\x05|rO0ABQ|KztAAU|Cs7QAF", "jo")
    if m then
        return m, raw, true
    end
    m = check(raw)
    if m then
        return m, raw, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, sMatch)
    if m then
        return m, d, true
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, sMatch)
    if m then
        return m, d, true
    end
end

local m, d = kvFilter(waf.reqHeaders, sMatch)
if m then
    return m, d, true
end

local m = rgx(urlDecode(requestLine), "(?:\\$\\{)+(?:j(?:n|\\$\\{)|\\$\\{(?:\\w*:)+)", "joi")
if m then
    return m, requestLine, true
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

local kvFilter = waf.kvFilter
local rgx = waf.rgxMatch
local requestLine = waf.requestLine
local urlDecode = waf.urlDecode

local function rMatch(v)
    local m = rgx(urlDecode(v), "\\(\\s*\\)\\s+{", "jos")
    if m then
        return m, v
    end
    return false
end

local m, d = kvFilter(waf.reqHeaders, rMatch)
if m then
    return m, d, true
end

local m, d = rMatch(requestLine)
if m then
    return m, d, true
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

local kvFilter = waf.kvFilter
local rgx = waf.rgxMatch
local host = waf.host
local counter = waf.strCounter
local str_find = string.find
local str_sub = string.sub

local function rMatch(v)
    local m = rgx(v, "^(?:url:)?file|ftps?|https?)://(?:[^@]+@)?([^/]+", "joi")
    if m then
        local i, j = str_find(v, host, 1, true)
        if i then
            if counter(str_sub(v, 1, j), "/") == 2 then
                return false
            end
        end
    end
    return m, v
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], rMatch)
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, rMatch)
    if m then
        return m, d, true
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

local checkRCE = waf.checkRCE
local jsonFilter = waf.jsonFilter

local function rMatch(v)
    local m = checkRCE(v)
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    local m, d = jsonFilter(form["RAW"], rMatch, false, true)
    if m then
        return m, d, true
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

local checkRCE = waf.checkRCE
local kvFilter = waf.kvFilter

local function rMatch(v)
    local m = checkRCE(v)
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], rMatch, true)
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, rMatch, true)
    if m then
        return m, d, true
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, rMatch, true)
    if m then
        return m, d, true
    end
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

local checkSQLI = waf.checkSQLI
local jsonFilter = waf.jsonFilter

local function rMatch(v)
    local m = checkSQLI(v)
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    local m, d = jsonFilter(form["RAW"], rMatch, false)
    if m then
        return m, d, true
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

local checkSQLI = waf.checkSQLI
local kvFilter = waf.kvFilter

local function sMatch(v)
    local m = checkSQLI(v)
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], sMatch)
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, sMatch)
    if m then
        return m, d, true
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, sMatch)
    if m then
        return m, d, true
    end
end

local m, d = kvFilter(waf.reqHeaders, sMatch)
if m then
    return m, d, true
end

return false

1
2
3
4

if waf.hErr and waf.hErr=="truncated" then
     return true,waf.hErr,true
end
return false

1
2
3
4
5
6
7

if waf.form and waf.form["RAW"] then
    local m = waf.rgxMatch(waf.form["RAW"], "<!(?:DOCTYPE|ENTITY)[^>]+?\\bSYSTEM\\b", "jos")
    if m then
        return m, waf.form["RAW"], true
    end
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13

local rgx = waf.rgxMatch
local function imgContentMatch(v)
    local m = rgx(v, "\\bpush\\s+graphic-context\\b|\\<\\s*image\\b", "joi")
    if m then
        return m, v
    end
    return false
end
if waf.form then
    local m, d = waf.knFilter(waf.form["FILES"], imgContentMatch, 0)
    return m, d, true
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13

if waf.reqHeaders.proxy ~= nil then
    return true, "Proxy: " .. waf.reqHeaders.proxy, true
end

if waf.reqHeaders.lock_token ~= nil then
    return true, "Lock-Token: " .. waf.reqHeaders.lock_token, true
end

if waf.reqHeaders["If"] ~= nil then
    return true, "If: " .. waf.reqHeaders["If"], true
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

local kvFilter = waf.kvFilter
local rgx = waf.rgxMatch
local htmlEntityDecode = waf.htmlEntityDecode

local function rMatch(v)
    local m = rgx(htmlEntityDecode(v), "^[^:\\(\\)\\&\\|\\!\\<\\>\\~]*\\)\\s*(?:\\((?:[^,\\(\\)\\=\\&\\|\\!\\<\\>\\~]+[><~]?=|\\s*[&!|]\\s*(?:\\)|\\()?\\s*)|\\)\\s*\\(\\s*[\\&\\|\\!]\\s*|[&!|]\\s*\\([^\\(\\)\\=\\&\\|\\!\\<\\>\\~]+[><~]?=[^:\\(\\)\\&\\|\\!\\<\\>\\~]*)", "jos")
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], rMatch)
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, rMatch)
    if m then
        return m, d, true
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, rMatch)
    if m then
        return m, d, true
    end
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13

local rgx = waf.rgxMatch
local function fMatch(v)
    local m = rgx(v, "[\\n\\r]", "jo")
    if m then
        return m, v
    end
    return false
end
local m, d = fMatch(waf.uri)
if m then
    return m, d, true
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

local rgx = waf.rgxMatch
local htmlEntityDecode = waf.htmlEntityDecode
local concat = table.concat

local function hMatch(v)
    local m = rgx(htmlEntityDecode(v), "[\\n\\r]", "jo")
    if m then
        return m, v
    end
    return false
end

local function vMatch(v)
    local m = rgx(htmlEntityDecode(v), "[\\n\\r]+(?:\\s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))\\s*:", "josi")
    if m then
        return m, v
    end
    return false
end

local m, d = waf.kvFilter(waf.reqHeaders, hMatch)
if m then
    return m, d, true
end

local queryString = waf.queryString
if queryString then
    for k, v in pairs(waf.queryString) do
        m, d = hMatch(k)
        if m then
            return m, d, true
        end
        if type(v)=="table" then
            v = concat(v,",")
        end
        m, d = vMatch(v)
        if m then
            return m, d, true
        end
    end
end

local form = waf.form
if form then
    for k, _ in pairs(form["FORM"]) do
        m, d = hMatch(k)
        if m then
            return m, d, true
        end
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11

local ct = waf.reqContentType

if ct then
    if type(ct) ~= "string" then
        return true, "Malform Content-Type", true
    elseif waf.contains(ct, "boundary") and (waf.strCounter(ct, "boundary") > 1 or not waf.rgxMatch(ct, "boundary=[\\w\\-]+$", "jo")) then
        return true, ct, true
    end
end

return false

1
2
3
4

if waf.rgxMatch(waf.reqUri,"%u00(?:aa|ba|d0|de|e2|f0|fe)","i") then
 return true,waf.reqUri,true
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

local kvFilter = waf.kvFilter
local rgx = waf.rgxMatch
local htmlEntityDecode = waf.htmlEntityDecode

local function rMatch(v)
    local m = rgx(v, "[\\r\\n]\\W*?(?:content-(?:type|length)|set-cookie|location):\\s*\\w", "josi")
    if m then
        return m, v
    end
    return false
end

local function hMatch(v)
    local m = rgx(htmlEntityDecode(v), "(?:\\bhttp/\\d|<(?:html|meta)\\b)", "josi")
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], rMatch)
    if m then
        return m, d, true
    end
    m, d = kvFilter(form["FORM"], hMatch)
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, rMatch)
    if m then
        return m, d, true
    end
    m, d = kvFilter(queryString, hMatch)
    if m then
        return m, d, true
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, rMatch)
    if m then
        return m, d, true
    end
    m, d = kvFilter(cookies, hMatch)
    if m then
        return m, d, true
    end
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

local kvFilter = waf.kvFilter
local rgx = waf.rgxMatch
local htmlEntityDecode = waf.htmlEntityDecode

local function rMatch(v)
    local m = rgx(htmlEntityDecode(v), "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\\s+[^\\s]+\\s+http/\\d", "josi")
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], rMatch)
    if m then
        return m, d, true
    end
    m, d = rMatch(form["RAW"])
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, rMatch)
    if m then
        return m, d, true
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, rMatch)
    if m then
        return m, d, true
    end
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13

local rgx = waf.rgxMatch
local function fileContentMatch(v)
    local m = rgx(v, "<\\?.+?\\$(?:GLOBALS|_(?:GET|POST|COOKIE|REQUEST|SERVER|FILES|SESSION|ENV))|<\\?php|<jsp:|<%(?i:!|\\s*@|.*?\\brequest\\s*(?:\\.|\\())", "jos")
    if m then
        return m, v
    end
    return false
end
if waf.form then
    local m, d = waf.knFilter(waf.form["FILES"], fileContentMatch, 0)
    return m, d, true
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

local rgx = waf.rgxMatch

local function fileNameMatch(v)
    local m = rgx(v, "\\.(?:as|cer\\b|cdx|ph|jsp|war|class|exe|ht|env|user\\.ini)|php\\.ini", "joi")
    if m then
        return m, v
    end
    return false
end
if waf.form then
    local m, d = waf.knFilter(waf.form["FILES"], fileNameMatch, 1)
    return m, d, true
end

return false

1
2
3
4
5
6
7

local ib = waf.ipBlock
local c = ib:get(waf.ip)
if c and c >= 100 then
    ib:set(waf.ip, c, 600, 1)
    return true, "ip blocked for continue attack: " .. waf.ip, true
end
return false

1
2
3
4
5
6
7

if waf.form == nil then
    if waf.contains(waf.fErr, "content_type") then
        return true, waf.fErr .. ": " .. waf.reqContentType, true
    end
    return true, waf.fErr, true
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

local check = waf.plugins.sqlErrorDetection.check
local rb = waf.respBody
local rgx = waf.rgxMatch
local has = waf.contains

if waf.status == 500 then
    local m = check(rb)
    if m then
        if rgx(rb, "JET Database Engine|Access Database Engine|\\[Microsoft\\]\\[ODBC Microsoft Access Driver\\]", "jo") then
            return m, "Microsoft Access SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "ORA-[0-9][0-9][0-9][0-9]|java\\.sql\\.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*", "jo") then
            return m, "Oracle SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "DB2 SQL error:|\\[IBM\\]\\[CLI Driver\\]\\[DB2/6000\\]|CLI Driver.*DB2|DB2 SQL error|db2_\\w+\\(", "jo") then
            return m, "DB2 SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "\\[DM_QUERY_E_SYNTAX\\]|has occurred in the vicinity of:", "jo") then
            return m, "EMC SQL Information Leakage: " .. rb, true
        end
        if has(rb, "Dynamic SQL Error") then
            return m, "firebird SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "Exception (?:condition )?\\d+\\. Transaction rollback\\.", "jo") then
            return m, "Frontbase SQL Information Leakage: " .. rb, true
        end
        if has(rb, "org.hsqldb.jdbc") then
            return m, "hsqldb SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "An illegal character has been found in the statement|com\\.informix\\.jdbc|Exception.*Informix", "jo") then
            return m, "informix SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "Warning.*ingres_|Ingres SQLSTATE|Ingres\\W.*Driver", "jo") then
            return m, "ingres SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "<b>Warning</b>: ibase_|Unexpected end of command in statement", "jo") then
            return m, "interbase SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "SQL error.*POS[0-9]+|Warning.*maxdb", "jo") then
            return m, "maxDB SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "System\\.Data\\.OleDb\\.OleDbException|\\[Microsoft\\]\\[ODBC SQL Server Driver\\]|\\[Macromedia\\]\\[SQLServer JDBC Driver\\]|\\[SqlException|System\\.Data\\.SqlClient\\.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query\\(\\)|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression\\.|ADODB\\.Field \\(0x800A0BCD\\)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*\\WSystem\\.Data\\.SqlClient\\.", "jo") then
            return m, "Mssql SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "MyS(?:QL server version for the right syntax to use|qlClient\\.)|(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|You have an error in your SQL syntax(?: near|;)|Warning.{1,10}mysql_(?:[a-z_()]{1,26})?|ERROR [0-9]{4} \\([a-z0-9]{5}\\):|mysql_fetch_array\\(\\)|on MySQL result index|\\[MySQL\\]\\[ODBC", "jo") then
            return m, "Mysql SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "PostgreSQL query failed:|pg_query\\(\\) \\[:|pg_exec\\(\\) \\[:|PostgreSQL.{1,20}ERROR|Warning.*\\bpg_.*|valid PostgreSQL result|Npgsql\\.|PG::[a-zA-Z]*Error|Supplied argument is not a valid PostgreSQL .*? resource|Unable to connect to PostgreSQL server", "jo") then
            return m, "Postgres SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "Warning.*sqlite_|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite\\.Exception|System\\.Data\\.SQLite\\.SQLiteException", "jo") then
            return m, "SQLite SQL Information Leakage: " .. rb, true
        end
        if rgx(rb, "Sybase message:|Warning.{2,20}sybase|Sybase.*Server message", "jo") then
            return m, "Sybase SQL Information Leakage: " .. rb, true
        end
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14

local rgx = waf.rgxMatch
local rb = waf.respBody

local m = rgx(rb, "<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>\\[To Parent Directory\\]</[Aa]><br>", "jo")
if m then
    return m, "Directory Listing: " .. rb, true
end

m = rgx(rb, "^\\s*(?:#\\!\\s?/|<%|<\\?\\s*[^x]|<jsp:)", "jo")
if m then
    return m, "Source code leak: " .. rb, true
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

local kvFilter = waf.kvFilter
local rgx = waf.rgxMatch
local referer = waf.referer
local host = waf.host
local endWith = waf.endWith

local function sMatch(v)
    local m = rgx(v, "\\bhttp-equiv\\W+set-cookie\\b", "joi")
    if m then
        return m, v
    end
    return false
end

local function nMatch(v)
    local m = rgx(v, "^(?:jsessionid|aspsessionid|asp\\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$", "joi")
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], sMatch)
    if m then
        return m, d, true
    end
    for k, v in pairs(form["FORM"]) do
        m, d = nMatch(k)
        if m then
            if not referer then
                if type(v) == "table" then
                    v = table.concat(v)
                end
                return m, d .. ":" .. v, true
            else
                m = ngx.re.match(referer, "^https?://(.*?)/", "jo")
                if m and not endWith(m[1], host) then
                    if type(v) == "table" then
                        v = table.concat(v)
                    end
                    return m, d .. ":" .. v, true
                end
            end
        end
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, sMatch)
    if m then
        return m, d, true
    end
    for k, v in pairs(queryString) do
        m, d = nMatch(k)
        if m then
            if not referer then
                if type(v) == "table" then
                    v = table.concat(v)
                end
                return m, d .. ":" .. v, true
            else
                m = ngx.re.match(referer, "^https?://(.*?)/", "jo")
                if m and not endWith(m[1], host) then
                    if type(v) == "table" then
                        v = table.concat(v)
                    end
                    return m, d .. ":" .. v, true
                end
            end
        end
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, sMatch)
    if m then
        return m, d, true
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

local kvFilter = waf.kvFilter
local rgx = waf.rgxMatch

local function sMatch(v)
    local m = rgx(v, "Process\\s*\\.\\s*spawn\\s*\\(", "jos")
    if m then
        return m, "Ruby Injection Attack: "..v
    end
    m = rgx(v, "t(?:his\\.constructor|runcateSync\\s*\\()|\\b(?:spawn|eval)\\s*\\(|_(?:\\$\\$ND_FUNC\\$\\$_|_js_function)|String\\s*\\.\\s*fromCharCode", "jos")
    if m then
        return m, "Node.js Injection Attack: "..v
    end
    m = rgx(v, "__proto__|constructor\\s*(?:\\.|\\[)\\s*prototype", "jos")
    if m then
        return m, "JavaScript Prototype Pollution: "..v
    end
    m = rgx(v, "(?:s(?:sh(?:2(?:.(?:s(?:(?:ft|c)p|hell)|tunnel|exec))?)?|m(?:[bs]|tps?)|vn(?:\\+ssh)?|n(?:ews|mp)|ips?|ftp|3)|p(?:op(?:3s?|2)|r(?:oxy|es)|h(?:ar|p)|aparazzi|syc)|c(?:ompress.(?:bzip2|zlib)|a(?:llto|p)|id|vs)|t(?:e(?:amspeak|lnet)|urns?|ftp)|f(?:i(?:nger|sh)|(?:ee)?d|tps?)|i(?:rc[6s]?|maps?|pps?|cap|ax)|d(?:a(?:ta|v)|n(?:tp|s)|ict)|m(?:a(?:ilto|ven)|umble|ms)|n(?:e(?:tdoc|ws)|ntps?|fs)|r(?:tm(?:f?p)?|sync|ar|mi)|v(?:iew-source|entrilo|nc)|a(?:ttachment|f[ps]|cap)|b(?:eshare|itcoin|lob)|g(?:o(?:pher)?|lob|it)|u(?:nreal|t2004|dp)|e(?:xpect|d2k)|h(?:ttps?|323)|w(?:ebcal|s?s)|ja(?:bbe)?r|x(?:mpp|ri)|ldap[is]?|ogg|zip):\\/\\/(?:(?:[\\d.]{0,11}(?:(?:\\xe2(?:\\x92(?:[\\x9c\\x9d\\x9e\\x9f\\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\xa7\\xa8\\xa9\\xaa\\xab\\xac\\xad\\xae\\xaf\\xb0\\xb1\\xb2\\xb3\\xb4\\xb5]|[\\x88\\x89\\x8a\\x8b\\x8c\\x8d\\x8e\\x8f\\x90\\x91\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9a\\x9b]|[\\xb6\\xb7\\xb8\\xb9\\xba\\xbb\\xbc\\xbd\\xbe\\xbf]|[\\x80\\x81\\x82\\x83\\x84\\x85\\x86\\x87])|\\x93(?:[\\x80\\x81\\x82\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8a\\x8b\\x8c\\x8d\\x8e\\x8f]|[\\x9c\\x9d\\x9e\\x9f\\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\xa7\\xa8\\xa9]|[\\x90\\x91\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9a\\x9b]|[\\xbf\\xb5\\xb6\\xb7\\xb8\\xb9\\xba\\xbb\\xbc\\xbd\\xbe]|[\\xab\\xac\\xad\\xae\\xaf\\xb0\\xb1\\xb2\\xb3\\xb4])|\\x91(?:[\\xaa\\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\xa7\\xa8\\xa9\\xaa\\xab\\xac\\xad\\xae\\xaf\\xb0\\xb1\\xb2\\xb3]|[\\xb4\\xb5\\xb6\\xb7\\xb8\\xb9\\xba\\xbb\\xbc\\xbd\\xbe\\xbf]))|\\xe3\\x80\\x82))+)|[a-z][\\w\\-\\.]{1,255}:\\d{1,5}(?:#?\\s*&?@(?:(?:\\d{1,3}\\.){3,3}\\d{1,3}|[a-z][\\w\\-\\.]{1,255}):\\d{1,5}\\/?)+|(?:0x[a-f0-9]{2}\\.){3}0x[a-f0-9]{2}|(?:0{1,4}\\d{1,3}\\.){3}0{1,4}\\d{1,3}|\\d{1,3}\\.(?:\\d{1,3}\\.\\d{5}|\\d{8})|0x(?:[a-f0-9]{16}|[a-f0-9]{8})|\\[[a-f\\d:]+(?:[\\d.]+|%\\w+)?\\]|(?:\\x5c\\x5c[a-z\\d-]\\.?_?)+|\\d{10})", "josi")
    if m then
        return m, "Possible Server Side Request Forgery (SSRF) Attack: "..v
    end
    m = rgx(v, "\\@\\{.*?\\}", "jos")
    if m then
        return m, "Perl Injection Attack: "..v
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], sMatch)
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, sMatch)
    if m then
        return m, d, true
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, sMatch)
    if m then
        return m, d, true
    end
end

local m, d = kvFilter(waf.reqHeaders, sMatch)
if m then
    return m, d, true
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

local kvFilter = waf.kvFilter
local rgx = waf.rgxMatch

local function sMatch(v)
    local m = rgx(v, "php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)|(?:ssh2(?:.(?:s(?:(?:ft|c)p|hell)|tunnel|exec))?|z(?:lib|ip)|(?:ph|r)ar|expect|bzip2|glob|ogg)://", "joi")
    if m then
        return m, v
    end
    m = rgx(v, "[oOcC]:\\d+:\"\\w+\":\\d+:{.*?}", "jos")
    if m then
        return m, v
    end
    return false
end

local function fileContentMatch(v)
    local m = rgx(v, "<\\?.+?\\$_(?:GET|POST|COOKIE|REQUEST|SERVER|FILES|SESSION)|<\\?php", "jos")
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], sMatch)
    if m then
        return m, d, true
    end
    m, d = waf.knFilter(form["FILES"], fileContentMatch, 0)
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, sMatch)
    if m then
        return m, d, true
    end
end

local cookies = waf.cookies
if cookies then
    local m, d = kvFilter(cookies, sMatch)
    if m then
        return m, d, true
    end
end

local m, d = kvFilter(waf.reqHeaders, sMatch)
if m then
    return m, d, true
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

local checkPT = waf.checkPT
local kvFilter = waf.kvFilter

local function ptMatch(v)
    local m = checkPT(v)
    if m then
        return m, v
    end
    return false
end

local url = waf.urlDecode(waf.reqUri)
if checkPT(url) then
    return true, url, true
end

local form = waf.form
if form then
    local m, d = kvFilter(form["FORM"], ptMatch)
    if m then
        return m, d, true
    end
    m, d = waf.knFilter(waf.form["FILES"], ptMatch, 1)
    if m then
        return m, d, true
    end
end

local queryString = waf.queryString
if queryString then
    local m, d = kvFilter(queryString, ptMatch)
    if m then
        return m, d, true
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11

local rct = waf.reqContentType
local has = waf.contains
local counter = waf.strCounter
local rgx = waf.rgxMatch
if rct then
    rct = waf.toLower(rct)
    if has(rct, "charset") and (not rgx(rct, "charset\\s*=\\s*(utf\\-8|gbk|gb2312|iso\\-8859\\-1|iso\\-8859\\-15|windows\\-1252)","jo") or counter(rct, "charset") > 1) then
        return true, rct, true
    end
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

local rip=waf.reqHeaders.x_forwarded_for
if rip then
if type(rip) ~= "string" then
return true,"Malform X-Forwarded-For",true
elseif waf.contains(rip,"'") then
return true,rip,true
end
end
rip=waf.reqHeaders.client_ip
if rip then
if type(rip) ~= "string" then
return true,"Malform Client-IP",true
elseif waf.contains(rip,"'") then
return true,rip,true
end
end
return false

1
2
3
4

if waf.cookies==nil then
     return true,waf.cErr,true
end
return false

1
2
3
4

if waf.queryString==nil then
     return true,waf.qErr,true
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

local sh = ngx.shared.ipCache
local robotIp = 'rb:' .. waf.ip
local c, f = sh:get(robotIp)

-- 如果是静态页面且没有进行滑动旋转验证码验证则返回
if not (waf.isQueryString or waf.reqContentLength > 0) and f ~= 2 then
    return false
end

if not c then
    sh:set(robotIp, 1, 60, 1)  -- 设置1分钟也就是60秒访问计数时间段
else
    if f == 2 then
        return waf.checkRobot(waf)     -- 启动机器人滑动旋转验证码验证
    end
    sh:incr(robotIp, 1)
    if c + 1 >= 360 then
        sh:set(robotIp, c + 1, 1800, 2)  -- 达到了60秒内请求超过360次的阈值，进入机器人验证模式
        return true, robotIp, true
    end
end

return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

local check = waf.plugins.weakPwdDetection.check
local toLower = waf.toLower
local has = waf.contains

local form = waf.form
local uri = toLower(waf.uri)
if form and (has(uri, "login") or has(uri, "logon") or has(uri, "signin")) then
    local f = form["FORM"]
    if f then
        for k, v in pairs(f) do
            k = toLower(k)
            if (k == "pass" or has(k, "pwd") or has(k, "passwd") or has(k, "password")) and check(v) then
                return true, form["RAW"], false
            end
        end
    end
end

return false

1
2
3
4
5

local m, d = waf.plugins.fileLeakDetection.check()
if m then
    return true, d, true
end
return false

1
2
3
4

if waf.reqContentLength>8388608 then
    return true,"reqBody length is "..waf.reqContentLength ,true
end
return false

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49