From ee3c2e71d07512721d7eb8e4cd8fa5bd82a210f1 Mon Sep 17 00:00:00 2001 From: Mitchell Krog Date: Fri, 28 Jun 2019 10:57:33 +0200 Subject: [PATCH] UPDATE blacklist-user-agents.conf include file [ci skip] --- bots.d/blacklist-user-agents.conf | 32 +++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/bots.d/blacklist-user-agents.conf b/bots.d/blacklist-user-agents.conf index 7150a8a2e..bafe0ff97 100644 --- a/bots.d/blacklist-user-agents.conf +++ b/bots.d/blacklist-user-agents.conf @@ -1,11 +1,13 @@ # EDIT THIS FILE AS YOU LIKE TO BLACKLIST OR WHITELIST ANY BAD USER-AGENT STRINGS YOU WANT TO SCAN FOR # **************************************************************************************************** +# THIS IS BOTH YOUR WHITELIST AND BLACKLIST FOR USER-AGENTS + ### VERSION INFORMATION # -################################################### -### Version: V4.2019.06 -### Updated: 2019-06-24 -################################################### +#------------------------ +### Version: V4.2019.07 +### Updated: 2019-06-28 +#------------------------- ### VERSION INFORMATION ## ############################################################################## @@ -38,9 +40,9 @@ # Make sure any words that contain special characters are escaped and include word boundaries as per the Regex examples below. -# Example the User-Agent name "someverybaduseragentname1" is entered as "\bsomeverybaduseragentname1\b" -# Example the User-Agent name "some-very-bad-useragentname2" is entered as "\bsome\-very\-bad\-useragentname1\b" -# the "\b" are word boundaries which prevents partial matching and false positives. +# Example the User-Agent name "someverybaduseragentname1" is entered as "(?:\b)someverybaduseragentname1(?:\b|)" +# Example the User-Agent name "some-very-bad-useragentname2" is entered as "(?:\b)some\-very\-bad\-useragentname1(?:\b|)" +# the "(?:\b)" and "(?:\b|)" are word boundaries which prevents partial matching and false positives. # BY DEFAULT ALL THE EXAMPLES BELOW ARE COMMENTED OUT AND HENCE NOT ENABLED @@ -59,7 +61,17 @@ # "~*(?:\b)some\-very\-bad\-useragentname2(?:\b|)" 3; # Here are some default things I block on my own server, these appear in various types of injection attacks -# You can disable them if you have problems or don't agree by switching thir value to 0 +# You can disable them if you have problems or don't agree by switching thir value to 0 or moving them into the whitelist section first and then making their value 0 - "~*(?:\b)x22(?:\b|)" 3; - "~*({|})" 3; + +# ------------ +# MY WHITELIST +# ------------ + + +# ------------ +# MY BLACKLIST +# ------------ + +"~*(?:\b)x22(?:\b|)" 3; +"~*(?:\b){|}(?:\b|)" 3;