1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
|
# http://www.gotroot.com/mod_security+rules
# Gotroot.com ModSecurity rules
# User Agent Security Rules for modsec 2.x
#
# Download from: http://www.gotroot.com/downloads/ftp/mod_security/2.0/useragents.conf
#
# Created by Michael Shinn of the Prometheus Group (http://www.prometheus-group.com)
# Copyright 2005 and 2006 by the Michael Shinn and the Prometheus Group, all rights reserved.
# Redistribution is strictly prohibited in any form, including whole or in part.
#
# Version: N-20061022-01
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
# THE POSSIBILITY OF SUCH DAMAGE.
#Comment spam header line
SecRule REQUEST_HEADERS "x-aaaaaa.*"
SecRule REQUEST_BODY "X-AAAAAA.*"
#check for bad meta characters in User-Agent field
#SecRule HTTP_User-Agent ".*\'"
#XSS in the UA field
SecRule HTTP_User-Agent "<(.|\s|\n)?(script|about|applet|activex|chrome|object)(.|\s|\n)?>.*<(.|\s|\n)?(script|about|applet|activex|chrome|object)"
#PHP code injection attack
SecRule HTTP_User-Agent "(<\?php|<[[:space:]]*\?[[:space:]]*php)"
SecRule HTTP_User-Agent ".*HTTP_GET_VARS"
#recursion attack in UA field
SecRule HTTP_User-Agent "\.\./\.\."
#May cause false positives with some software, comment out if it does
#SecRule REMOTE_ADDR "!^127\.0\.0\.1$" "chain,id:390000,rev:1,severity:1,msg:'Suspicious Automated or Manual Request'"
#SecRule "HTTP_User-Agent|HTTP_HOST|HTTP_Accept" "^$"
#Exploit agent
SecRule HTTP_User-Agent "Mosiac 1\.*"
#Bad agent
SecRule HTTP_User-Agent "Brutus/AET"
#CGI vuln scan tool
SecRule HTTP_User-Agent cgichk
SecRule HTTP_User-Agent "DataCha0s/2\.0"
#Damn fine UA
SecRule HTTP_User-Agent ".*THIS IS AN EXPLOIT*"
SecRule HTTP_User-Agent "Morzilla"
#CIRT.DK Webroot auditing tool
SecRule HTTP_User-Agent ".*WebRoot "
#Exploit UA
SecRule HTTP_User-Agent ".*T H A T \' S G O T T A H U R T*"
#XML RPC exploit tool
SecRule HTTP_User-Agent "xmlrpc exploit*"
#A friendly little exploit banner for a WP vuln
SecRule HTTP_User-Agent "Wordpress Hash Grabber"
#Blocks scripts
SecRule HTTP_User-Agent lwp
#Web leaches
SecRule HTTP_User-Agent "Web Downloader"
SecRule HTTP_User-Agent WebZIP
SecRule HTTP_User-Agent WebCopier
SecRule HTTP_User-Agent Webster
SecRule HTTP_User-Agent WebZIP
SecRule HTTP_User-Agent WebStripper
SecRule HTTP_User-Agent "teleport pro"
SecRule HTTP_User-Agent combine
SecRule HTTP_User-Agent "Black Hole"
SecRule HTTP_User-Agent "SiteSnagger"
SecRule HTTP_User-Agent "ProWebWalker"
SecRule HTTP_User-Agent "CheeseBot"
#Bogus Mozilla UA lines
SecRule HTTP_User-Agent "Mozilla/(4|5)\.0$"
SecRule HTTP_User-Agent "Mozilla/3\.Mozilla/2\.01$"
#Bogus IE UA line
SecRule HTTP_User-Agent "Microsoft Internet Explorer/5\.0$"
#Bogus UA
SecRule HTTP_User-Agent "FooBar/42"
#Nessus Vuln scanner UA
SecRule HTTP_User-Agent "Mozilla.*Nessus"
#Nikto vuln scanner UA
SecRule HTTP_User-Agent ".*Nikto"
#BAd/Bogus UAs
SecRule HTTP_User-Agent "Indy Library"
SecRule HTTP_User-Agent "Faxobot"
SecRule HTTP_User-Agent ".*SAFEXPLORER TL"
#Spam spinder UAs
SecRule HTTP_User-Agent ".*fantomBrowser"
SecRule HTTP_User-Agent ".*fantomCrew Browser"
#VB development library used by many spammers, might block legite VBscripts
#comment out if you have problems
SecRule HTTP_User-Agent "Crescent Internet ToolPak"
#Borland Delphi signature, as above, comment out if it gives you problems
#spammers sometimes use these UAs
SecRule HTTP_User-Agent "NEWT ActiveX\; Win32"
SecRule HTTP_User-Agent "Mozilla.*NEWT"
#Part of the Microsoft MSINET.OCX, as above, spammers sometimes use this, if
#it causes problems, comment out. If you are a member of the Microsoft Site
#Builder Network, you probably do NOT want to block this ID.
#SecRule HTTP_User-Agent "Microsoft URL Control"
#SecRule HTTP_User-Agent "^Microsoft URL"
#e-mail collectors and spammers
SecRule HTTP_User-Agent "WebBandit"
SecRule HTTP_User-Agent "WEBMOLE"
SecRule HTTP_User-Agent "Telesoft*"
SecRule HTTP_User-Agent "WebEMailExtractor"
SecRule HTTP_User-Agent "CherryPicker*"
SecRule HTTP_User-Agent NICErsPRO
SecRule HTTP_User-Agent "Advanced Email Extractor*"
SecRule HTTP_User-Agent EmailSiphon
SecRule HTTP_User-Agent Extractorpro
SecRule HTTP_User-Agent webbandit
SecRule HTTP_User-Agent EmailCollector
SecRule HTTP_User-Agent "WebEMailExtrac*"
SecRule HTTP_User-Agent EmailWolf
#Spiders that eat up bandwidth for their customers
#Not a spammer, just a spider, comment out if you like
SecRule HTTP_User-Agent "CopyRightCheck"
SecRule HTTP_User-Agent "CopyGuard"
SecRule HTTP_User-Agent "Digimarc WebReader"
#MArketing spiders
SecRule HTTP_User-Agent "Zeus .*Webster Pro*"
#Poker spam
SecRule HTTP_User-Agent "8484 Boston Project"
#collectors
SecRule HTTP_User-Agent "autoemailspider"
SecRule HTTP_User-Agent "ecollector"
SecRule HTTP_User-Agent "grub crawler"
#referrer spam, not the real weblogs
SecRule HTTP_User-Agent "^www\.weblogs\.com"
#spam bots
SecRule HTTP_User-Agent "DTS Agent"
SecRule HTTP_User-Agent "POE-Component-Client"
SecRule HTTP_User-Agent "WISEbot"
SecRule HTTP_User-Agent "^Shockwave Flash"
SecRule HTTP_User-Agent "Missigua"
#comment spam sign
SecRule HTTP_User-Agent "compatible \; MSIE"
#Some regexps to catch silly bots
SecRule REQUEST_URI "!/ps(zones\|comp).txt1" chain
SecRule HTTP_User-Agent "^(google|i?explorer?\.exe|(MS)?IE( [0-9.]+)?[ ]?(Compatible( Browser)?)?)$"
SecRule HTTP_User-Agent "^(Mozilla( [0-9.]+)?[ ]?\((Windows|Linux|(IE )?Compatible)\))$"
SecRule HTTP_User-Agent "^Mozilla/5\.0 \(X11; U; Linux i686; en-US; rv\:0\.9\.6\+\) Gecko/2001112$"
SecRule HTTP_User-Agent "^Mozilla/[0-9.]+ \(compatible; MSIE [0-9.]+; Windows( NT)?( [0-9.]*)?;[0-9./ ]*\)?$"
SecRule HTTP_User-Agent "^Mozilla/.+[. ]+$"
#spammer
SecRule HTTP_User-Agent "Butch__2\.1\.1"
SecRule HTTP_User-Agent "agdm79@mail\.ru"
#Fake Gameboy UA
SecRule HTTP_User-Agent "GameBoy\, Powered by Nintendo"
#bogus amiga UA
SecRule HTTP_User-Agent "Amiga-AWeb/3\.4"
#exploit UA
SecRule HTTP_User-Agent "Internet Ninja x\.0"
#bogus googlebot UA
SecRule HTTP_User-Agent "Nokia-WAPToolkit.* googlebot.*googlebot"
#recently caught sending spam referrals, from their actual crawler IP
SecRule HTTP_User-Agent "BecomeBot"
#Suverybot
#SecRule HTTP_User-Agent "SurveyBot"
#exploit
SecRule HTTP_User-Agent "S\.T\.A\.L\.K\.E\.R\."
SecRule HTTP_User-Agent "NeuralBot/0\.2"
SecRule HTTP_User-Agent "Kenjin Spider"
#WebvulnScan
SecRule HTTP_User-Agent "WebVulnScan"
#broken spam tool
SecRule HTTP_User-Agent "Mozilla/4\.0 \(compatible\; MSIE 6\.0\; Windows NT 5\.1$"
#PHPBB worm UA
SecRule HTTP_User-Agent "INTERNET EXPLOITER SUX"
#fake UA
SecRule HTTP_User-Agent "Windows-Update-Agent"
#exploit
SecRule HTTP_User-Agent "Internet-exprorer"
# Bad Spider
SecRule HTTP_User-Agent "hl_ftien_spider"
# PMAFind
SecRule HTTP_User-Agent "PMAFind"
|
