This article introduces a nginx server anti-SQL injection/overflow attack/spam and Forbidden user-agents Instance code, there is a need to know the friend can enter the reference.
Add the following fields to the configuration file
| The code is as follows |
Copy Code |
server {
# # Forbidden SQL injection Block SQL injections
Set $block _sql_injections 0;
if ($query _string ~ "union.*select.* (") {
Set $block _sql_injections 1;
}
if ($query _string ~ "union.*all.*select.*") {
Set $block _sql_injections 1;
}
if ($query _string ~ "concat.* (") {
Set $block _sql_injections 1;
}
if ($block _sql_injections = 1) {
return 444;
}
# # Forbidden File Injection
Set $block _file_injections 0;
if ($query _string ~ "[a-za-z0-9_]=http://") {
Set $block _file_injections 1;
}
if ($query _string ~ "[a-za-z0-9_]= (.. //?) +") {
Set $block _file_injections 1;
}
if ($query _string ~ "[a-za-z0-9_]=/([a-z0-9_.] //?) +") {
Set $block _file_injections 1;
}
if ($block _file_injections = 1) {
return 444;
}
# # no overflow attack
Set $block _common_exploits 0;
if ($query _string ~ "(<|%3c). *script.* (>|%3e)") {
Set $block _common_exploits 1;
}
if ($query _string ~ "GLOBALS (=|[| %[0-9a-z]{0,2}) {
Set $block _common_exploits 1;
}
if ($query _string ~ "_request (=|[| %[0-9a-z]{0,2}) {
Set $block _common_exploits 1;
}
if ($query _string ~ "Proc/self/environ") {
Set $block _common_exploits 1;
}
if ($query _string ~ "mosconfig_[a-za-z_]{1,21} (=|%3d)") {
Set $block _common_exploits 1;
}
if ($query _string ~ "base64_ (en|de) code (. *)") {
Set $block _common_exploits 1;
}
if ($block _common_exploits = 1) {
return 444;
}
# # Forbidden spam Field
Set $block _spam 0;
if ($query _string ~ "B (ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo) b") {
Set $block _spam 1;
}
if ($query _string ~ "B (erections|hoodia|huronriveracres|impotence|levitra|libido) b") {
Set $block _spam 1;
}
if ($query _string ~ "B (ambien|bluespill|cialis|cocaine|ejaculation|erectile) b") {
Set $block _spam 1;
}
if ($query _string ~ "B (lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby) b") {
Set $block _spam 1;
}
if ($block _spam = 1) {
return 444;
}
# # Ban User-agents
Set $block _user_agents 0;
# Don ' t disable wget if you need it to run cron jobs!
#if ($http _user_agent ~ "Wget") {
# set $block _user_agents 1;
#}
# Disable Akeeba Remote Control 2.5 and earlier
if ($http _user_agent ~ "Indy Library") {
Set $block _user_agents 1;
}
# Common Bandwidth hoggers and hacking tools.
if ($http _user_agent ~ "Libwww-perl") {
Set $block _user_agents 1;
}
if ($http _user_agent ~ "GetRight") {
Set $block _user_agents 1;
}
if ($http _user_agent ~ "getweb!") {
Set $block _user_agents 1;
}
if ($http _user_agent ~ "go! Zilla ") {
Set $block _user_agents 1;
}
if ($http _user_agent ~ "Download Demon") {
Set $block _user_agents 1;
}
if ($http _user_agent ~ "Go-ahead-got-it") {
Set $block _user_agents 1;
}
if ($http _user_agent ~ "Turnitinbot") {
Set $block _user_agents 1;
}
if ($http _user_agent ~ "Grabnet") {
Set $block _user_agents 1;
}
if ($block _user_agents = 1) {
return 444;
}
} |
Nginx Server anti-SQL injection/overflow attack/spam and Forbidden User-agents
