mirror of
https://github.com/joglomedia/LEMPer.git
synced 2026-04-13 08:28:21 +00:00
136 lines
3.5 KiB
Plaintext
136 lines
3.5 KiB
Plaintext
## Security rules to block any HTTP attacks.
|
|
# Designed to be included in any server{} block.
|
|
|
|
# Add Security Headers.
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Xss-Protection "1; mode=block" always;
|
|
|
|
# Security Rules
|
|
limit_req_status 444;
|
|
if ($args ~ CtrlFunc_*) { return 444; }
|
|
|
|
set $my_var 0;
|
|
set $the_var 2;
|
|
if ($request_method = POST) { set $my_var 1; }
|
|
if ($args = /) { set $the_var 1; }
|
|
if ($my_var = $the_var) { return 444; }
|
|
|
|
## Block Injections attacks
|
|
# Ref: http://www.howtoforge.com/nginx-how-to-block-exploits-sql-injections-file-injections-spam-user-agents-etc
|
|
|
|
# Block SQL injections.
|
|
set $block_sql_injections 0;
|
|
|
|
if ($query_string ~* "union.*select.*\(") {
|
|
set $block_sql_injections 1;
|
|
}
|
|
if ($query_string ~* "union.*all.*select.*") {
|
|
set $block_sql_injections 1;
|
|
}
|
|
if ($query_string ~* "concat.*\(") {
|
|
set $block_sql_injections 1;
|
|
}
|
|
|
|
if ($block_sql_injections = 1) {
|
|
return 403;
|
|
}
|
|
|
|
# Block file injections.
|
|
set $block_file_injections 0;
|
|
|
|
if ($query_string ~ "[a-zA-Z0-9_]=http://") {
|
|
set $block_file_injections 1;
|
|
}
|
|
if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") {
|
|
set $block_file_injections 1;
|
|
}
|
|
if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") {
|
|
set $block_file_injections 1;
|
|
}
|
|
|
|
if ($block_file_injections = 1) {
|
|
return 403;
|
|
}
|
|
|
|
# Block common exploits.
|
|
set $block_common_exploits 0;
|
|
|
|
if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
|
|
set $block_common_exploits 1;
|
|
}
|
|
if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
|
|
set $block_common_exploits 1;
|
|
}
|
|
if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
|
|
set $block_common_exploits 1;
|
|
}
|
|
if ($query_string ~ "proc/self/environ") {
|
|
set $block_common_exploits 1;
|
|
}
|
|
if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") {
|
|
set $block_common_exploits 1;
|
|
}
|
|
if ($query_string ~ "base64_(en|de)code\(.*\)") {
|
|
set $block_common_exploits 1;
|
|
}
|
|
|
|
if ($block_common_exploits = 1) {
|
|
return 403;
|
|
}
|
|
|
|
# Block spammy comment.
|
|
set $block_spam 0;
|
|
|
|
if ($query_string ~* "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") {
|
|
set $block_spam 1;
|
|
}
|
|
if ($query_string ~* "\b(condom|erections|hoodia|huronriveracres|impotence|levitra|libido)\b") {
|
|
set $block_spam 1;
|
|
}
|
|
if ($query_string ~* "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") {
|
|
set $block_spam 1;
|
|
}
|
|
if ($query_string ~* "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") {
|
|
set $block_spam 1;
|
|
}
|
|
if ($query_string ~* "\b(kontol|peli|kimpet|kimcil|bispak|bisyar|memek|pecun|ngentot|bokep|judi|togel|bet|webcam)\b") {
|
|
set $block_spam 1;
|
|
}
|
|
if ($query_string ~* "\b(amateur|anal|ass|babes|bisexual|blowjob|cock|creampie|cum|handjob|fuck|fucking|gay|lesbian|pussy|speculum|squirting|tits)\b") {
|
|
set $block_spam 1;
|
|
}
|
|
|
|
if ($block_spam = 1) {
|
|
return 403;
|
|
}
|
|
|
|
## Block suspicious user agents.
|
|
set $block_user_agents 0;
|
|
|
|
# Do not disable wget if you need it to run cron jobs!
|
|
#if ($http_user_agent ~ "Wget") {
|
|
# set $block_user_agents 1;
|
|
#}
|
|
|
|
# Disable Akeeba Remote Control 2.5 and earlier.
|
|
if ($http_user_agent ~* "Indy Library") {
|
|
set $block_user_agents 1;
|
|
}
|
|
|
|
# Common bandwidth hoggers and hacking tools.
|
|
if ($http_user_agent ~* "(libwww-perl|GetRight|GetWeb!|Go!Zilla|Download Demon|Go-Ahead-Got-It|TurnitinBot|GrabNet)") {
|
|
set $block_user_agents 1;
|
|
}
|
|
|
|
# SEO tools robot (hide your site from competitors SEO tool)
|
|
if ($http_user_agent ~* "(Rogerbot|SemrushBot|MJ12bot|AhrefsBot|Xenu)") {
|
|
set $block_user_agents 1;
|
|
}
|
|
|
|
if ($block_user_agents = 1) {
|
|
return 403;
|
|
}
|
|
|
|
## You may add your own security rules and blocking condition here...
|