How to configure a waf rule to block a exploit

[humantech]

What is the name of the domain?

example

What is the issue you’re encountering

The waf rule doesn’t work

What steps have you taken to resolve the issue?

HI
I want to block these requests that appears in my nginx server. How do I must setup WAF rules?

/index.php?lang=…/…/…/…/…/…/…/…/tmp/index1 HTTP Response 200
/index.php?lang=…/…/…/…/…/…/…/…/usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\x22hi\x22));?>+/tmp/index1.php HTTP Response 200

[fritex]

@humantech

The waf rule doesn’t work

May I ask if you could share a screenshot of the WAF Custom Rule which you’ve created and tried with?

@humantech

How

Example to block by some terms being used in the URI path:

(http.request.uri.path contains "tmp") or (http.request.uri.path contains "config") or (http.request.uri.path contains "echo") or (http.request.uri.path contains "md5") or (http.request.uri.path contains "pearcmd")

@humantech

appears in my nginx server

Make sure to setup WAF rules and that your DNS records for your domain are proxied so the WAF rule would apply and work as expected.

You can combine even with adding ?%00 or eval or %3Cscript or (0x or shell or DROP, even block HTTP 1/0 requests, user-agents such as python etc.

Combine for URI Path where contains, between use OR for operator to catch them and do not forget to select action “block” at the end, save and make sure it’s active and enabled rule.

Some useful resources and examples:

Top 50 user agents to block

Here’s a list from the perishablepress.com 7G .htaccess firewall: (360Spider|acapbot|acoonbot|ahrefs|alexibot|asterias|attackbot|backdorbot|becomebot|binlar|blackwidow|blekkobot|blexbot|blowfish|bullseye|bunnys|butterfly|careerbot|casper|checkpriv|cheesebot|cherrypick|chinaclaw|choppy|clshttp|cmsworld|copernic|copyrightcheck|cosmos|crescent|cy_cho|datacha|demon|diavol|discobot|dittospyder|dotbot|dotnetdotcom|dumbot|emailcollector|emailsiphon|emailwolf|exabot|extract|eyenetie|feedfinder|flaming|…

Top 50 user agents to block

Good list, thanks. I have deployed that but removed python and demon (those seem to block some RSS feedreaders, YMMV). What I also have in place is this: (http.user_agent contains “SemrushBot”) or (http.user_agent contains “AhrefsBot”) or (http.user_agent contains “DotBot”) or (http.user_agent contains “WhatCMS”) or (http.user_agent contains “Rogerbot”) or (http.user_agent contains “trendictionbot”) or (http.user_agent contains “BLEXBot”) or (http.user_agent contains “linkfluence”) or (http.us…

Help Needed Please To Exempt Google Bots From Firewall Rules

There’s a list of ASN belongs to hosting providers:

Mitigating an HTTP DDoS Attack manually with Cloudflare

This guide is for those users of Cloudflare who experience medium-high level complexity DDoS attacks. Continue reading if you want to accomplish the following: Becoming more familiar with the Cloudflare Dashboard and crafting custom firewall rules. Understanding the standard behavior of DDoS attacks and deploying effective firewall rules. Realizing how powerful and valuable Cloudflare Firewall Rules are. I initially thought of making a more complex guide (I will). However, I realized that no…

[humantech]

These are the rules I have configured, but it stills appears those messages in my nginx log:

(http.request.uri.path contains “…/”) or (http.request.uri.path contains “/etc/”) or (http.request.uri.path contains “/usr/”) or (http.request.uri.path contains “/tmp/”)

[fritex]

@humantech

in my nginx log

General nginx error log or rather vhost for some domain?

Are DNS records proxied ?

[humantech]

It’s not the error log. It’s the access.log of a vhost.

The DNS are proxied.

[fritex]

May I ask if you’ve tested yourself the WAF Custom Rules which you have with your domain and URL example?

[humantech]

Yes, I have tested, and it works for me. For example, if I write www.example.com/md5/, it appears a cloudflare advice that I have been blocked. But then, every day, I see those messages in the nginx log that seems that someone is bypassing the rule.