diff --git a/.idea/.gitignore b/.idea/.gitignore new file mode 100644 index 0000000..13566b8 --- /dev/null +++ b/.idea/.gitignore @@ -0,0 +1,8 @@ +# Default ignored files +/shelf/ +/workspace.xml +# Editor-based HTTP Client requests +/httpRequests/ +# Datasource local storage ignored files +/dataSources/ +/dataSources.local.xml diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000..3ce3588 --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,6 @@ + + + + + \ No newline at end of file diff --git a/.idea/modsecurity.iml b/.idea/modsecurity.iml new file mode 100644 index 0000000..c956989 --- /dev/null +++ b/.idea/modsecurity.iml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 0000000..1b1da66 --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/php.xml b/.idea/php.xml new file mode 100644 index 0000000..f6159c8 --- /dev/null +++ b/.idea/php.xml @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000..94a25f7 --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/nginx-waf/00_asl_accesslist.conf b/nginx-waf/00_asl_accesslist.conf new file mode 100644 index 0000000..97d4379 --- /dev/null +++ b/nginx-waf/00_asl_accesslist.conf @@ -0,0 +1,32 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# +# Created by Prometheus Global (http://www.prometheus-group.com) +# Copyright 2005-2019 by Atomicorp, Inc. all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security + +# Disable rules for hosts on the always allow list +# Be *VERY* careful about whom is set to always allow +#Include IP list and do not scan or block +SecRule REMOTE_ADDR "@ipMatchFromFile /etc/asl/accesslist" "rev:1,id:345679,phase:1,t:none,nolog,noauditlog,allow,ctl:ruleEngine=Off,ctl:auditEngine=Off" diff --git a/nginx-waf/00_asl_whitelist.conf b/nginx-waf/00_asl_whitelist.conf new file mode 100644 index 0000000..77ae6ec --- /dev/null +++ b/nginx-waf/00_asl_whitelist.conf @@ -0,0 +1,38 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# +# Created by Prometheus Global (http://www.prometheus-group.com) +# Copyright 2005-2019 by Atomicorp, Inc. all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security + +####################################### +# +# This file has been deprecated by 00_asl_accesslist.conf +# +####################################### +# Disable rules for hosts on the whitelist +# Be *VERY* careful about whom is whitelisted. +#Include whitelisted IPs and do not scan or block +SecRule REMOTE_ADDR "@ipMatchFromFile /etc/asl/whitelist" "rev:1,id:345678,phase:1,t:none,nolog,noauditlog,allow,ctl:ruleEngine=Off,ctl:auditEngine=Off" +#SecRule REMOTE_ADDR "@pmFromFile /etc/asl/whitelist" "rev:1,id:345678,phase:1,t:none,nolog,noauditlog,allow,ctl:ruleEngine=Off,ctl:auditEngine=Off" diff --git a/nginx-waf/00_asl_x_searchengines.conf b/nginx-waf/00_asl_x_searchengines.conf new file mode 100644 index 0000000..d6c3fe5 --- /dev/null +++ b/nginx-waf/00_asl_x_searchengines.conf @@ -0,0 +1,39 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Application Security Rules for modsec 2.x +# +# Created by Prometheus Global (http://www.prometheus-group.com) +# Copyright 2012-2019 by Atomicorp, Inc. all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- +# + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security +# +# Note: These rules will not work without this apache setting +# +# HostnameLookups Double + +SecAction "phase:1,t:none,nolog,noauditlog,setvar:tx.WHITELIST_SEARCH_ENGINES=1,pass,id:318744,tag:'no_ar'" diff --git a/nginx-waf/00_asl_y_searchengines.conf b/nginx-waf/00_asl_y_searchengines.conf new file mode 100644 index 0000000..2a861db --- /dev/null +++ b/nginx-waf/00_asl_y_searchengines.conf @@ -0,0 +1,241 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Application Security Rules for modsec 2.x +# +# Copyright 2013-2017 Atomicorp, Inc., all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- +# + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security +# +# Note: These rules will not work without this apache setting +# +# HostnameLookups Double + +#Modsecurity 2.8.0 has a nasty bug that makes it not work with ipmatch rules +#so we cant let these rules load in 2.8.0 boxes +#SecRule MODSEC_BUILD "@gt 020777900" #phase:1,id:333772,rev:1,t:none,nolog,pass,skipAfter:END_SEARCH_ENGINE + +SecRule REQUEST_HEADERS:User-Agent "@pm googlebot bingbot yahoo yeti hailoobot technoratibot friendfeedbot newsgator blogscope gist bloglines/ netvibes yandex friendfeedbot/ baiduspider/ mediapartners-google Feedfetcher-Google Twitterbot" "id:318745,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:333722,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_SEARCH_ENGINE" + +#Twitterbot +#199.59.148.0/22 +SecRule REQUEST_HEADERS:User-Agent "Twitterbot" "id:338746,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:334904,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_TWITTER" + +SecRule REMOTE_HOST "@ipmatch 199.59.148.0/24" "id:343917,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecRule REMOTE_HOST "\.twttr\.com$" "id:303831,severity:'2',rev:1,t:none,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake twitter bot',phase:1" + +#Real MSN search engine +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'339331',t:none,nolog,noauditlog,allow" +SecMarker END_TWITTER + +#User-Agent: Feedly/1.0 (+http://www.feedly.com/fetcher.html; like FeedFetcher-Google) +SecRule REQUEST_HEADERS:User-Agent "^Feedly" "id:303990,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:303991,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_FEEDLY" + + +SecRule REMOTE_HOST "@ipmatch 65.19.138.0/26,8.29.198.0/24" "id:323978,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecRule REMOTE_HOST "!@endsWith .feedly.com" "capture,id:303890,severity:'2',rev:4,t:none,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: Fake Feedly webcrawler',phase:1,logdata:'%{TX.0}'" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303992',t:none,nolog,noauditlog,allow" + +SecMarker END_FEEDLY + + +#Google +SecRule REQUEST_HEADERS:User-Agent "^(?:Googlebot-richsnippets|OnPageBot)" "phase:1,id:323931,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_GOOGLE" + +SecRule REQUEST_HEADERS:User-Agent "@pm googlebot mediapartners-google" "id:323900,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:333901,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_GOOGLE" + +#74.125.0.0/16 is registered to google, but does not have a PTR record +#66.249.64.0/19 is google +SecRule REMOTE_HOST "@ipmatch 74.125.0.0/16,66.249.64.0/19,173.194.0.0/16" "id:323918,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecRule REMOTE_HOST "!@endsWith .googlebot.com" "capture,id:303800,rev:3,severity:'2',t:none,t:lowercase,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: Fake Googlebot webcrawler',phase:1,logdata:'%{TX.0}'" + +#Real Google Search Engine +#Allow all from google +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303902',t:none,nolog,noauditlog,allow" +SecMarker END_GOOGLE + +#Feedfetcher-Google +SecRule REQUEST_HEADERS:User-Agent "@contains Feedfetcher-Google" "id:303947,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:343948,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_GOOGLE2" + +SecRule REMOTE_HOST "@ipmatch 74.125.0.0/16,66.249.64.0/19" "id:323928,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecRule REMOTE_HOST "!@endsWith .google.com" "capture,id:303833,severity:'2',rev:5,t:none,t:lowercase,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: Fake Google Feedfetcher webcrawler',phase:1,logdata:'%{TX.0}'" + +#Allow all from google +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303935',t:none,nolog,noauditlog,allow" +SecMarker END_GOOGLE2 + +#MSN search engine +SecRule REQUEST_HEADERS:User-Agent "@pm msnbot bingbot" "id:318746,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:333904,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_MSN" + +SecRule REMOTE_HOST "@ipmatch 157.54.0.0/15,207.46.0.0/16,40.124.0.0/16,40.96.0.0/12,40.112.0.0/13,40.125.0.0/17,40.74.0.0/15,40.120.0.0/14,40.80.0.0/12,40.76.0.0/14" "id:323917,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecRule REMOTE_HOST "!(^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\.search\.msn\.com$)" "capture,id:303801,severity:'2',rev:6,t:none,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake msnbot/bingbot webcrawler',phase:1,logdata:'%{TX.0}'" +#SecRule REMOTE_HOST "!(^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\.search\.msn\.com$|^131\.253\.[2-4][0-9]\.[0-9]+$)" +#Real MSN search engine +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303903',t:none,nolog,noauditlog,allow" +SecMarker END_MSN + +#Yahoo Slurp engine +SecRule REQUEST_HEADERS:User-Agent "@contains yahoo! slurp" "id:323904,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:333905,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_YAHOO" + +#China Yahoo ranges +#110.75.160.0 - 110.75.191.255 +#110.75.171.0 - 110.75.176.255 +# +#Other yahoo ranges +#98.136.0.0/14 +SecRule REMOTE_HOST "@ipmatch 110.75.160.0/19,98.136.0.0/14,68.180.128.0/17,217.146.179.0/24" "id:323914,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecRule REMOTE_HOST "!(\.yahoo\.(?:net|com)$)" "id:303802,severity:'2',rev:5,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Yahoo! Slurp webcrawler',phase:1" + +#Real Yahoo Slurp engine +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303906',t:none,nolog,noauditlog,allow" +SecMarker END_YAHOO + +SecRule REQUEST_HEADERS:User-Agent "@contains yahoo pipes" "id:303907,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:333908,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_YAHOO2" + +SecRule REMOTE_HOST "!(\.yahoo\.(?:com|net)$)" "id:303803,severity:'2',rev:2,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Yahoo Pipes webcrawler',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303908',t:none,nolog,noauditlog,allow" +SecMarker END_YAHOO2 + +SecRule REQUEST_HEADERS:User-Agent "@beginsWith Yeti/" "id:303909,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:318749,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_YETI" + +#SecRule REMOTE_HOST "@ipmatch 61.247.192.0/19" # "id:323916,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecRule REMOTE_HOST "!(^crawl-[0-9]+-[0-9]+-[0-9]+-[0-9]+\.naver\.jp$)" "id:303804,severity:'2',rev:4,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Yeti webcrawler',phase:1" +#SecRule REMOTE_HOST "!(^crawl-[0-9]+-[0-9]+-[0-9]+-[0-9]+\.naver\.jp$|^61\.247\.(19[2-9]|2[0-2][0-3])\.[0-9]{1,3}$" # +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303910',t:none,nolog,noauditlog,allow" +SecMarker END_YETI + +SecRule REQUEST_HEADERS:User-Agent "@contains hailoobot" "id:303913,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:333911,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_HAIL" + +SecRule REMOTE_HOST "!@endswith webcrawler.hailoo.com" "id:303805,severity:'2',rev:1,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Hailoobot webcrawler.',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303912',t:none,nolog,noauditlog,allow" +SecMarker END_HAIL + +SecRule REQUEST_HEADERS:User-Agent "@contains technoratibot/" "id:303915,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:333915,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_TECHNO" + +SecRule REMOTE_HOST "!@endswith .crawler.technorati.com" "id:303806,severity:'2',rev:1,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Technoratibot webcrawler.',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303916',t:none,nolog,noauditlog,allow" +SecMarker END_TECHNO + +SecRule REQUEST_HEADERS:User-Agent "@contains friendfeedbot/" "id:303917,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:333918,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_FACEBOOK" + +SecRule REMOTE_HOST "!@endsWith .facebook.com" "id:303807,severity:'2',rev:1,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake FriendFeed/Facebook webcrawler',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303919',t:none,nolog,noauditlog,allow" +SecMarker END_FACEBOOK + +SecRule REQUEST_HEADERS:User-Agent "yandex(?:bot|images|blog)" "id:303920,rev:2,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:303921,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_YANDEX" + +SecRule REMOTE_HOST "@ipmatch 95.108.158.128/25" "id:323916,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecRule REMOTE_HOST "!(\.yandex\.(?:ru|com|net)$)" "id:303808,severity:'2',rev:2,t:none,t:lowercase,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Yandex webcrawler.',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303900',t:none,nolog,noauditlog,allow" +SecMarker END_YANDEX + +SecRule REQUEST_HEADERS:User-Agent "@contains bloglines/" "id:313921,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:313922,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_BLOGLINES" + +SecRule REMOTE_HOST "!@streq crawler.bloglines.com" "id:303810,severity:'2',rev:1,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Bloglines webcrawler.',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303901',t:none,nolog,noauditlog,allow" +SecMarker END_BLOGLINES + +SecRule REQUEST_HEADERS:User-Agent "@contains gist server" "id:303924,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:303925,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_GIST" + +SecRule REMOTE_HOST "!@endsWith .gist.com" "id:303811,severity:'2',rev:1,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Gist webcrawler',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303922',t:none,nolog,noauditlog,allow" +SecMarker END_GIST + +SecRule REQUEST_HEADERS:User-Agent "@contains blogscope" "id:303927,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:303928,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_BLOGSCOPE" + +SecRule REMOTE_HOST "!@endsWith .toronto.edu" "id:303812,severity:'2',rev:1,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake BlogScope webcrawler',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303923',t:none,nolog,noauditlog,allow" +SecMarker END_BLOGSCOPE + +SecRule REQUEST_HEADERS:User-Agent "newsgator/2\.0 bot" "id:303930,rev:2,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:303931,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_NEWSGATOR" + +SecRule REMOTE_HOST "!@endsWith .newsgator.com" "id:303813,severity:'2',rev:1,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake NewsGatorOnline webcrawler',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303904',t:none,nolog,noauditlog,allow" +SecMarker END_NEWSGATOR + +SecRule REQUEST_HEADERS:User-Agent "@contains netvibes" "id:303933,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:303934,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_NETVIBES" + +SecRule REMOTE_HOST "!@endsWith .netvibes.com" "id:303814,severity:'2',rev:1,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Netvibes webcrawler',phase:1" + +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303905',t:none,nolog,noauditlog,allow" +SecMarker END_NETVIBES + +#Baidu seems to have a broken resolver +#The forward record never resolves +# +#nslookup baiduspider-180-76-5-87.crawl.baidu.com +#** server can't find baiduspider-180-76-5-87.crawl.baidu.com: NXDOMAIN +#nslookup 180.76.5.87 +#87.5.76.180.in-addr.arpa name = baiduspider-180-76-5-87.crawl.baidu.com. +#So some known static ranges are added +#inetnum: 180.76.0.0 - 180.76.255.255 +#netname: Baidu +# +#inetnum: 123.125.71.0 - 123.125.71.255 +#netname: SADF +#123.122.0.0 - 123.122.15.255 +#119.63.192.0 - 119.63.199.255 +#202.46.32.0 - 202.46.63.255 +SecRule REQUEST_HEADERS:User-Agent "@contains baiduspider/" "id:303936,rev:1,phase:1,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:323937,rev:1,t:none,pass,nolog,noauditlog,skipAfter:END_BAIDU" + +SecRule REMOTE_HOST "@ipmatch 180.76.0.0/16,123.122.0.0/20,123.125.71.0/24,119.63.192.0/21,220.181.0.0/16,202.46.32.0/19,185.10.104.0/22" "id:323915,rev:1,phase:1,t:none,pass,nolog,noauditlog,skip:1" +SecRule REMOTE_HOST "!(\.crawl\.baidu\.com$)" "id:303937,severity:'2',rev:7,t:none,t:lowercase,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Fake Baidu webcrawler',phase:1" + +#SecRule REMOTE_HOST "!(\.crawl\.baidu\.com$|^180\.76\.[0-9]+\.[0-9]+$|^123\.125\.71\.[0-9]+$|^220\.181\.[0-9]+\.[0-9]+$|123\.122\.[0-15]\.[0-9]+$|^119\.63\.19[2-9]\.[0-9]+$)" +SecRule TX:WHITELIST_SEARCH_ENGINES "@eq 1" "phase:1,id:'303938',t:none,nolog,noauditlog,allow" +SecMarker END_BAIDU + +SecMarker END_SEARCH_ENGINE diff --git a/nginx-waf/00_asl_z_aa_threat_intelligence.conf b/nginx-waf/00_asl_z_aa_threat_intelligence.conf new file mode 100644 index 0000000..de1870c --- /dev/null +++ b/nginx-waf/00_asl_z_aa_threat_intelligence.conf @@ -0,0 +1,52 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# TI rules +# +# Created by Prometheus Global (http://www.prometheus-group.com) +# Copyright 2014-2019 by Atomicorp, all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security + +SecAction "phase:1,id:343699,t:none,pass,nolog,noauditlog,initcol:ip=%{remote_addr}" + +#Skip on broken 2.8.0 boxes +#SecRule MODSEC_BUILD "@gt 020777900" #phase:1,id:333777,rev:1,t:none,nolog,pass,skipAfter:END_TI + +SecRule REMOTE_ADDR "@ipMatchFromFile /etc/asl/whitelist" "phase:1,pass,t:none,id:328745,nolog,noauditlog,skipAfter:END_TI" + +SecRule REMOTE_ADDR "@ipMatch 127.0.0.1,::1" "phase:1,pass,t:none,id:328746,nolog,noauditlog,skipAfter:END_TI" + +#Is already on the threat1 RBL, dont bother looking it up, DROP the connection +SecRule IP:threat1 "@eq 1" "phase:1,t:none,deny,status:403,log,auditlog,msg:'Atomicorp.com WAF Rules: Threat Intelligence Match for known Worm Source on Atomicorp Threat Intelligence RBL. See this URL for details http://www.atomicrbl.com (Previous TI Match)',severity:'1',id:350051,rev:1" + +#Dont look up the IP if we've checked it in the last 3m +SecRule IP:PREVIOUS_LOOKUP "@eq 1" "phase:1,id:313134,t:none,pass,nolog,noauditlog,skipAfter:END_TI" +SecAction "phase:1,t:none,id:343698,nolog,noauditlog,pass,setvar:ip.previous_lookup=1,expirevar:ip.previous_lookup=180" + +SecRule REMOTE_ADDR "@rbl threat1.atomicrbl.com." "phase:1,t:none,deny,status:403,log,auditlog,msg:'Atomicorp.com WAF Rules: Threat Intelligence Match for known Worm Source on Atomicorp Threat Intelligence RBL (TI-1). See this URL for details http://www.atomicrbl.com',severity:'1',setvar:ip.threat1=1,expirevar:ip.threat1=900,id:355500,rev:1" + +SecMarker END_TI diff --git a/nginx-waf/00_asl_z_antievasion.conf b/nginx-waf/00_asl_z_antievasion.conf new file mode 100644 index 0000000..3fc0943 --- /dev/null +++ b/nginx-waf/00_asl_z_antievasion.conf @@ -0,0 +1,60 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +SecRule REQUEST_FILENAME "/modules/addon_file_editor/action_handler\.php" "phase:2,id:91001,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390700" + +SecRule REQUEST_FILENAME "/imp/compose\.php" "phase:2,id:91002,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390700" + +SecRule REQUEST_FILENAME "/file/ajax/" "phase:2,id:91003,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390700" + +SecRule REQUEST_FILENAME "/ajax/actions\.hsp" "phase:2,id:91004,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390700" + +SecRule REQUEST_FILENAME "/hallinta/hallinta-tiedostot\.php" "phase:2,id:91005,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390700" + +SecRule REQUEST_FILENAME "/toolbox_nb/" "phase:2,id:91006,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=330791" + +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Application Security Rules for modsec 2.x +# +# Copyright 2005-2019 by Atomicorp, Inc., all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- +# + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security +# +#Detect request body processing errors +SecRule REQBODY_ERROR "!@eq 0" "phase:2,deny,t:none,status:400,msg:'Failed to parse request body. This may be an impedence mismatch attack, a broken application or a broken connection. This is not a false positive. Check your application or client for errors.',id:'330791',rev:3,auditlog,log,logdata:'%{reqbody_error_msg}',severity:2,tag:'no_ar'" + +#Block malformed bodies +#Workaround for Plesk HSP multipart messages which are really broken +SecRule REQUEST_URI "^/supportcenter/server/" "id:334356,t:none,t:lowercase,pass,nolog,noauditlog,ctl:requestBodyAccess=off,tag:'no_ar'" + +SecRule REQBODY_PROCESSOR_ERROR "!@eq 0" "t:none,phase:2,deny,log,auditlog,status:400,msg:'Request Body Parsing Failed. %{REQBODY_PROCESSOR_ERROR_MSG}: check your application or client for errors, this is not a false positive.',id:'340152',rev:1,severity:'5'" + +# multipart/form-data name evasion attempts +SecRule FILES|FILES_NAMES|!FILES:pic|!FILES:/tablerate/|!FILES:async-upload|!FILES:/^ticketattachment/ "[\";=]" "capture,phase:2,deny,log,auditlog,id:390700,rev:7,t:none,t:urlDecodeUni,deny,status:403,msg:'Atomicorp.com WAF Rules: Evasion Attack: Invalid filename in FILES argument. Which may be a possible attempt at multipart/form-data bypass',logdata:'%{matched_var}'" + + + + diff --git a/nginx-waf/00_asl_zz_strict.conf b/nginx-waf/00_asl_zz_strict.conf new file mode 100644 index 0000000..5eb3c4c --- /dev/null +++ b/nginx-waf/00_asl_zz_strict.conf @@ -0,0 +1,218 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +SecRule REQUEST_FILENAME "/wp-admin/user-new\.php" "phase:2,id:91007,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703" + +SecRule REQUEST_FILENAME "/wp-admin/options-permalink\.php" "phase:2,id:91008,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703" + +SecRule REQUEST_FILENAME "/shop/remote\.php" "phase:2,id:91009,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703" + +SecRule REQUEST_FILENAME "/administrator/ajax-tab\.php" "phase:2,id:91010,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/livezilla/server\.php" "phase:2,id:91011,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/wp-admin/options\.php" "phase:2,id:91012,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/shop/admin/remote\.php" "phase:2,id:91013,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/ts_manage\.php" "phase:2,id:91014,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/phpmyadmin/import\.php" "phase:2,id:91015,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=330792" + +SecRule REQUEST_FILENAME "csfileshare/csfileshare\.cgi" "phase:2,id:91016,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=330792" + +SecRule REQUEST_FILENAME "/ajax\.php" "phase:2,id:91017,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/beheer\.php" "phase:2,id:91018,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703" + +SecRule REQUEST_FILENAME "/wp-admin/async-upload\.php" "phase:2,id:91019,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=330791" + +SecRule REQUEST_FILENAME "/wp-admin/post\.php" "phase:2,id:91020,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/newreply\.php" "phase:2,id:91021,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/showmail\.php" "phase:2,id:91022,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/parsechecker\.php" "phase:2,id:91023,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704,ctl:ruleRemovebyID=390708" + +SecRule REQUEST_FILENAME "/limesurvey/index\.php" "phase:2,id:91024,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/modules/v7_pages_engine\.php" "phase:2,id:91025,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/tce_file\.php" "phase:2,id:91026,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/admin/updatepage\.php" "phase:2,id:91027,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/redaxo/index\.php" "phase:2,id:91028,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/colors\.css\.php" "phase:2,id:91029,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703" + +SecRule REQUEST_FILENAME "/cgi-bin/potd/ir_potd_enter\.pl" "phase:2,id:91030,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703,ctl:ruleRemovebyID=330793" + +SecRule REQUEST_FILENAME "/multilang/" "phase:2,id:91031,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703" + +SecRule REQUEST_FILENAME "/soap\.hsp" "phase:2,id:91032,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/index\.php/api/xmlrpc" "phase:2,id:91033,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/amember/admin-users" "phase:2,id:91034,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390721" + +SecRule REQUEST_FILENAME "/v2c/json/" "phase:2,id:91035,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390721" + +SecRule REQUEST_FILENAME "/v2a/json/" "phase:2,id:91036,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390721" + +SecRule REQUEST_FILENAME "/v1c/json/" "phase:2,id:91037,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390721" + +SecRule REQUEST_FILENAME "/services/bmsubscribers\.json" "phase:2,id:91038,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390721" + +SecRule REQUEST_FILENAME "/phpmyadmin/index\.php" "phase:2,id:91039,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390722" + +SecRule REQUEST_FILENAME "/ipac20/ipac\.jsp" "phase:2,id:91040,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390722" + +SecRule REQUEST_FILENAME "/toolbox_nb/" "phase:2,id:91041,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=330791,ctl:ruleRemovebyID=330792,ctl:ruleRemovebyID=390722" + +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Application Security Rules for modsec 2.x +# +# Copyright 2005-2019 by Atomicorp, Inc., all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- +# + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security +# + +#Detect possible evasion attempt +SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" "phase:2,log,auditlog,t:none,pass,msg:'Multipart parser detected a possible unmatched boundary. This may be an impedence mismatch attack, a broken application or a broken connection. This is not a false positive. Check your application or client for errors.',id:'330792',rev:3,severity:5,tag:'no_ar'" + +#Disable below rule if filename contains a single quote +SecRule MULTIPART_BOUNDARY_QUOTED "@eq 0" "t:none,id:330794,nolog,noauditlog,phase:1,chain,pass,ctl:ruleRemoveById=330793" + SecRule REQBODY_PROCESSOR_ERROR "@eq 0" "t:none,chain" + SecRule MULTIPART_BOUNDARY_WHITESPACE "@eq 0" "t:none,chain" + SecRule MULTIPART_DATA_BEFORE "@eq 0" "t:none,chain" + SecRule MULTIPART_DATA_AFTER "@eq 0" "t:none,chain" + SecRule MULTIPART_HEADER_FOLDING "@eq 0" "t:none,chain" + SecRule MULTIPART_LF_LINE "@eq 0" "t:none,chain" + SecRule MULTIPART_INVALID_QUOTING "@eq 1" "t:none,chain" + SecRule MULTIPART_INVALID_HEADER_FOLDING "@eq 0" "t:none,chain" + SecRule MULTIPART_INVALID_PART "@eq 0" "t:none,chain" + SecRule MULTIPART_FILE_LIMIT_EXCEEDED "@eq 0" "t:none" + +#Enforce strict multipart body checks +SecRule MULTIPART_STRICT_ERROR "!@eq 0" "phase:2,log,auditlog,t:none,deny,status:403,msg:'Multipart request body failed strict validation: PE %{REQBODY_PROCESSOR_ERROR}, BQ %{MULTIPART_BOUNDARY_QUOTED}, BW %{MULTIPART_BOUNDARY_WHITESPACE}, DB %{MULTIPART_DATA_BEFORE}, DA %{MULTIPART_DATA_AFTER}, HF %{MULTIPART_HEADER_FOLDING}, LF %{MULTIPART_LF_LINE}, SM %{MULTIPART_SEMICOLON_MISSING}, IQ %{MULTIPART_INVALID_QUOTING}, IH %{MULTIPART_INVALID_HEADER_FOLDING}, IP %{MULTIPART_INVALID_PART}, FL %{MULTIPART_FILE_LIMIT_EXCEEDED}',id:'330793',rev:3,severity:2" + +SecRule TX:/^MSC_/ "!@streq 0" "id:'350708',severity:'3',phase:2,log,auditlog,t:none,deny,status:403,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'" + +SecRule INBOUND_DATA_ERROR "@eq 1" "phase:1,id:350709,deny,status:403,t:none,auditlog,log,msg:'Request Body Larger than SecRequestBodyLimit Setting',severity:'4'" +SecRule OUTBOUND_DATA_ERROR "@eq 1" "phase:1,id:350710,deny,status:403,t:none,auditlog,log,msg:'Response Body Larger than SecResponseBodyLimit Setting',severity:'4'" + +SecRule REQUEST_METHOD "COOK" "capture,deny,log,auditlog,status:403,t:none,phase:1,id:314681,rev:1,severity:3,msg:'Atomicorp.com WAF Rules: Invalid HTTP method detected',logdata:'%{TX.0}'" + +SecRule REQUEST_URI "\%((?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" "chain,phase:2,t:none,log,auditlog,deny,status:400,msg:'Atomicorp.com WAF Rules: Possible URL Encoding Abuse Attack Attempt',id:'390703',rev:5,severity:'5'" +SecRule REQUEST_URI "@validateUrlEncoding" + +SecRule REQUEST_HEADERS:Content-Type "^(text/xml|application/(soap|xml))" "chain,id:374357,rev:3,phase:1,t:none,t:lowercase,pass,nolog,noauditlog" + SecRule REQBODY_PROCESSOR "!@streq XML" "ctl:requestBodyProcessor=XML" + + +SecRule REQUEST_HEADERS:Content-Type "^(application\/x-www-form-urlencoded|text\/xml)(?:;(?:\s?charset\s?=\s?[\w\d\-]{1,18})?)??$" "chain,phase:2,t:none,log,auditlog,deny,status:400,msg:'Atomicorp.com WAF Rules: Possible Encoding Abuse Attack Attempt',id:'390704',rev:1,severity:'5'" +SecRule REQUEST_BODY|XML:/* "\%((?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" "chain" +SecRule REQUEST_BODY|XML:/* "@validateUrlEncoding" + +#Check for suspiscious indicators, such as missing Host: headers, empty headers, numeric, etc. +SecRule &REQUEST_HEADERS:Host "@eq 0" "chain,skipAfter:END_HOST_CHECK,phase:2,rev:2,t:none,pass,msg:'Atomicorp.com WAF Rules: Suspicious activity detected - HTTP Request Missing a Host Header',id:'331030',severity:'5',tag:'no_ar'" +SecRule REMOTE_ADDR "!@ipMatch 127.0.0.1,::1" "t:none" + +SecRule REQUEST_HEADERS:Host "^$" "phase:2,rev:1,log,auditlog,t:none,pass,msg:'Atomicorp.com WAF Rules: Suspicious activity detected - Empty Host Header detected in HTTP request',id:'331031',severity:'5',tag:'no_ar'" + +SecRule REQUEST_HEADERS:Host "^[\d.:]+$" "chain,phase:2,rev:4,log,auditlog,t:none,pass,msg:'Atomicorp.com WAF Rules: Suspicious activity detected - Host header is a numeric IP address', severity:'2',id:'331032',severity:'5',tag:'no_ar'" +SecRule REMOTE_ADDR "!@ipMatch 127.0.0.1,::1" "t:none" + +SecMarker END_HOST_CHECK + +SecRule REQUEST_URI "^/eprocservice/supplierinboundservice" "phase:2,pass,t:none,t:lowercase,nolog,noauditlog,id:373944,skipAfter:END_390717" + +#SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "%0[ad]content-(type|length) ?:" "log,auditlog,deny,log,status:403,phase:2,rev:3,t:none,t:lowercase,t:compressWhitespace,capture,ctl:auditLogParts=+E,auditlog,msg:'Atomicorp.com WAF Rules: HTTP Response Splitting Attack',id:'390713',logdata:'%{TX.0}',severity:'2'" +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx [\r\n]\W*?(?:content-(?:type|length)|set-cookie|location):\s*\w" "log,auditlog,deny,log,status:403,phase:2,rev:4,t:none,t:lowercase,t:compressWhitespace,capture,ctl:auditLogParts=+E,auditlog,msg:'Atomicorp.com WAF Rules: HTTP Response Splitting Attack',id:'390713',logdata:'%{TX.0}',severity:'2'" + +SecRule REQUEST_FILENAME "@rx [\n\r]" "id:390714,rev:2,severity:2,phase:1,deny,status:403,t:none,t:urlDecodeUni,msg:'Atomicorp.com WAF Rules: HTTP Splitting (CR/LF in request filename detected)',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',log,auditlog" + +SecAction "phase:2,id:'391009',t:none,nolog,noauditlog,pass,setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsx/'" + +SecRule REQUEST_BASENAME "@rx \.([^.]+)$" "id:390716,rev:2,phase:2,deny,status:403,severity:3,capture,t:none,msg:'Atomicorp.com WAF Rules: URL file extension is restricted by policy',logdata:'%{TX.0}',setvar:'tx.extension=.%{tx.1}/',log,auditlog,chain" + SecRule TX:EXTENSION "@within %{tx.restricted_extensions}" "t:none,t:urlDecodeUni,t:lowercase" + +SecRule REQUEST_BODY|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie "\%u[fF]{2}[0-9a-fA-F]{2}" "log,auditlog,deny,log,status:403,chain,t:none,capture,phase:2,msg:'Atomicorp.com WAF Rules: Unicode Width Attack Attempt',id:'390621',rev:5,severity:'4',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!(%uFFFD)" "t:none" + +#bash style encoding evasion +#/??? +SecRule REQUEST_URI|ARGS "\/\?\?\?/" "phase:2,t:none,t:urlDecodeUni,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: Command Line style Encoding Abuse Attack Attempt',id:'390763',rev:5,severity:'2'" + + +#SecRule REQUEST_BODY "content-type ?:.*content-type ?:" "log,auditlog,deny,status:403,phase:2,rev:2,t:none,t:lowercase,t:compressWhitespace,capture,ctl:auditLogParts=+E,auditlog,msg:'Atomicorp.com WAF Rules: HTTP Response Splitting Attack',id:'390717',logdata:'%{TX.0}',severity:'2'" + +#session fixation attacks +SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "@pm set-cookie .cookie jsessionid aspsessionid asp.net_sessionid phpsession phpsessid weblogicsession session_id session-id cfid cftoken cfsid jservsession jwsession" "phase:2,id:'333795',t:none,t:urlDecodeUni,t:htmlEntityDecode,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:334360,t:none,pass,nolog,noauditlog,skipAfter:END_SESSION_FIX_PROTECTION" + + SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|!ARGS:text "(?:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=|\bhttp-equiv\W+set-cookie\b)" "phase:2,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Atomicorp.com WAF Rules: Session Fixation Attack',id:'390708',rev:5,logdata:'%{TX.0}',severity:'2'" + SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "(?:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=|\bhttp-equiv\W+set-cookie\b)" "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Atomicorp.com WAF Rules: Session Fixation Attack',id:'390718',rev:1,logdata:'%{TX.0}',severity:'2'" + + +SecRule ARGS_NAMES "@pm jsessionid aspsessionid asp.net_sessionid phpsession phpsessid weblogicsession session_id session-id cfid cftoken cfsid jservsession jwsession" "log,auditlog,chain,phase:2,rev:1,t:none,t:lowercase,capture,ctl:auditLogParts=+E,deny,log,status:403,msg:'Atomicorp.com WAF Rules: Possible Session Fixation attack',id:390739,logdata:'%{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2'" +SecRule REQUEST_HEADERS:Referer "^(?:ht|f)tps?://(.*?)\/" "chain,capture" +SecRule TX:1 "!@beginsWith %{request_headers.host}" + +SecMarker END_SESSION_FIX_PROTECTION + +SecMarker END_390717 + +#Enforce proper requests per HTTP RFC +SecRule REQUEST_LINE "!^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" "chain,deny,status:403,t:none,t:lowercase,capture,phase:2,rev:2,log,auditlog,msg:'Atomicorp.com WAF Rules: Invalid HTTP Request Line in violation of RFC (if you do not wish to follow HTTP RFCs, disable this rule)',id:'330700',severity:'4',logdata:'%{TX.0}'" +#Java 1.6 doesnt seem to follow the RFC correctly +SecRule REQUEST_HEADERS:User-Agent "^java/1\.6" + +SecRule &REQUEST_HEADERS:Proxy "@gt 0" "deny,status:403,t:none,capture,phase:2,rev:2,log,auditlog,msg:'Atomicorp.com WAF Rules: client redefining HTTP_PROXY value denied',id:'330773',severity:'4',logdata:'%{TX.0}'" + +#Header sanitization +#php code injection in select headers +SecRule REQUEST_HEADERS:X-Forwarded-For|REQUEST_HEADERS:X-Real-IP|REQUEST_HEADERS:Reverse-Via|REQUEST_HEADERS:X-Varnish|REQUEST_HEADERS:X-UA-Compatible|REQUEST_HEADERS:X-Powered-By|REQUEST_HEADERS:TE|REQUEST_HEADERS:X-REQUESTED-WITH|REQUEST_HEADERS:X-PIPER-ID|REQUEST_HEADERS:X-UCBROWSER-UA|REQUEST_HEADERS:X-WAP-PROFILE|REQUEST_HEADERS:X-EBO-UA|REQUEST_HEADERS:X-OPERAMINI-*|REQUEST_HEADERS:DEVICE-STOCK-UA|REQUEST_HEADERS:FORWARDED|REQUEST_HEADERS:WAP-CONNECTION|REQUEST_HEADERS:X-CONTENT-OPT "< ?\? ?" "deny,status:403,phase:2,t:none,t:urlDecodeUni,t:compressWhiteSpace,rev:2,log,auditlog,msg:'Atomicorp.com WAF Rules: Code injection in HTTP header attack blocked',id:'356331',severity:'1',logdata:'%{TX.0}'" + +#SecRule REQUEST_HEADERS:X-Forwarded-For "%" #SecRule REQUEST_HEADERS:X-Forwarded-For|REQUEST_HEADERS:X-ProxyUser-Ip "^[a-z0-9/ ,\:]+$" # "phase:2,deny,status:403,id:356332,rev:3,t:none,t:lowercase,log,auditlog,msg:'Atomicorp.com WAF Rules: invalid character in X-Forwarded for header',severity:'3'" + +SecRule REQUEST_HEADERS:User-Agent "(?:><|\{\:\:)" "phase:2,deny,status:403,id:356332,rev:1,t:none,t:urlDecodeUni,t:removewhitespace,log,auditlog,msg:'Atomicorp.com WAF Rules: invalid characters in User-Agent header',severity:'2'" + +#SecRule ARGS|!ARGS:_wp_http_referer|!ARGS:jsess|!ARGS:wp_http_referer|!ARGS:selection|!ARGS:permalink_structure|!ARGS:message|!ARGS:/post/|!ARGS:/dformat/|!ARGS:_u_b|!ARGS:state "@rx %[0-9a-fA-F]{2}" "id:390721,rev:5,phase:2,status:403,deny,log,auditlog,t:none,msg:'Atomicorp.com WAF Rules: Multiple URL Encoding Detected',logdata:'%{MATCHED_VAR}',severity:2" + +#Vpatching add on +#Prevent Impedence mismatches on ARG names +SecRule REQUEST_FILENAME "\.php" "chain,capture,t:none,t:utf8toUnicode,t:urlDecodeUni,t:lowercase,phase:2,deny,status:403,id:390720,rev:6,msg:'Atomicorp.com WAF Rules: Possible Impedence Mismatch attack on PHP appliction using space to start argument name',logdata:'%{TX.0}',severity:'1',tag:'no_ar',log,auditlog" +SecRule ARGS_NAMES "^ " "t:none,t:utf8toUnicode,t:urlDecodeUni,t:removenulls,multimatch" +#SecRule ARGS_NAMES "!^[\^\$0-9a-zA-Z\#_-\.@\{\}\[\]\(\)]+$" "t:none,t:utf8toUnicode,t:urlDecodeUni" + +SecRule ARGS_GET|!ARGS_GET:enhancedcontentdata "@rx [\n\r]" "id:390722,rev:5,phase:2,status:403,deny,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,msg:'Atomicorp.com WAF Rules: HTTP Header Injection Attack via payload (CR/LF detected)',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,severity:'CRITICAL'" + + + + diff --git a/nginx-waf/01_asl_content.conf b/nginx-waf/01_asl_content.conf new file mode 100644 index 0000000..1757d4f --- /dev/null +++ b/nginx-waf/01_asl_content.conf @@ -0,0 +1,68 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +SecRule REQUEST_FILENAME "/remote\.php/webdav/" "phase:2,id:91042,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=391213" + +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Application Security Rules for modsec 2.x +# +# Copyright 2005-2022 by Atomicorp, Inc., all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- +# + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security +# +SecAction "phase:1,id:'333792',t:none,nolog,noauditlog,pass, setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf|text/html|application/x-mal-client-data|application/octet-stream|text/plain|application/soap xml|application/soap+xml|application/json|application/json-rpc|application/vnd.svn-svndiff|image/jpeg|application/vnd.ms-sync.wbxml|message/rfc822|application/x-java-serialized-object|text/calendar|image/png|image/gif|image/jpg|application/x-fcs|application/vnd.svn-skel|text/vcard|application/vnd.open|application/x-git-upload-pack-request|application/dns-message'" + + +#restrict content types to prevent possible bypass attacks +SecRule REQUEST_HEADERS:Content-Type "^([^;\s]+)" "phase:1,t:none,chain,pass,nolog,noauditlog,id:'333791',severity:'4'" +SecRule TX:0 "!@within %{tx.allowed_request_content_type}" "t:none,ctl:forceRequestBodyVariable=On" + +SecRule REQUEST_HEADERS:Content-Type "^(text/xml|application/(soap|xml))" "chain,id:334357,rev:3,phase:1,t:none,t:lowercase,pass,nolog,noauditlog" + SecRule REQBODY_PROCESSOR "!@streq XML" "ctl:requestBodyProcessor=XML" + + +#El5 doesnt have modsec 2.9, so this can only be enabled on EL6 and above +#SecRule REQUEST_HEADERS:Content-Type "application/json" # "id:'334367',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON" +# +# + +#Skip binary/octect for nginx amplify +#User-Agent: nginx-amplify-agent/0.34-2 +#Content-Type: binary/octet-stream +SecRule REQUEST_HEADERS:Content-Type "^binary/octet-stream$" "phase:2,t:none,id:336719,pass,nolog,noauditlog,chain,skipAfter:END_391213" +SecRule REQUEST_HEADERS:User-Agent "^nginx-amplify-agent" "t:none" + +#ModSecurity parses only three content types: +# application/x-www-form-urlencoded, multipart/form-data request and +# text/xml. +# +# The protection provided for any other type is inferior. +SecRule REQUEST_METHOD "!^(?:GET|HEAD|PROPFIND|OPTIONS)$" "phase:2,chain,t:none,deny,log,auditlog,status:403,msg:'Atomicorp.com WAF Rules: Request content type is not allowed by policy',id:'391213',severity:'4',logdata:'%{matched_var}'" + SecRule REQUEST_HEADERS:Content-Type "^([^;\s]+)" "chain,capture" + SecRule TX:0 "!^%{tx.allowed_request_content_type}$" "t:none,ctl:forceRequestBodyVariable=On" + +SecMarker END_391213 + diff --git a/nginx-waf/01_asl_content_smuggling.conf b/nginx-waf/01_asl_content_smuggling.conf new file mode 100644 index 0000000..6e81340 --- /dev/null +++ b/nginx-waf/01_asl_content_smuggling.conf @@ -0,0 +1,42 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Application Security Rules for modsec 2.x +# +# Copyright 2005-2023 by Atomicorp, Inc. all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- +# +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security +# Detect HTTP Smuggling attempts by checking for multiple conflicting headers +# Rule to detect multiple Content-Length headers +SecRule &REQUEST_HEADERS:Content-Length "@ge 2" "id:300111,rev:1,phase:2,t:none,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: HTTP Smuggling Attack: Multiple Content-Length headers detected',severity:CRITICAL" +# Rule to detect multiple Transfer-Encoding headers +SecRule &REQUEST_HEADERS:Transfer-Encoding "@ge 2" "id:300112,rev:1,phase:2,t:none,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: HTTP Smuggling Attack: Multiple Transfer-Encoding headers detected',severity:CRITICAL" +# Rule to detect both Content-Length and Transfer-Encoding headers in the same request +SecRule REQUEST_HEADERS:Content-Length "[0-9]+" "chain,id:300113,rev:2,phase:2,t:none,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: HTTP Smuggling Attack: Both Content-Length and Transfer-Encoding headers detected',severity:CRITICAL" +SecRule REQUEST_HEADERS:Transfer-Encoding "chunked" "t:none,t:lowercase" +# Rule to detect inconsistent Content-Length and Transfer-Encoding headers +SecRule REQUEST_HEADERS:Content-Length "[0-9]+" "chain,id:300114,rev:2,phase:2,t:none,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: HTTP Smuggling Attack: Inconsistent Content-Length and Transfer-Encoding headers detected',severity:CRITICAL" +SecRule REQUEST_HEADERS:Transfer-Encoding "!@rx ^(identity|chunked)$" "t:none,t:lowercase" diff --git a/nginx-waf/01_asl_content_z.conf b/nginx-waf/01_asl_content_z.conf new file mode 100644 index 0000000..c882396 --- /dev/null +++ b/nginx-waf/01_asl_content_z.conf @@ -0,0 +1,35 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Application Security Rules for modsec 2.9 and up +# +# Created by Atomicorp (http://www.atomicorp.com) +# Copyright 2015-2019 by Atomicorp, Inc., all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- +# + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security +# +SecRule REQUEST_HEADERS:Content-Type "application/json" "id:'354367',phase:1,t:none,t:lowercase,pass,nolog,noauditlog,ctl:requestBodyProcessor=JSON" diff --git a/nginx-waf/03_asl_dos.conf b/nginx-waf/03_asl_dos.conf new file mode 100644 index 0000000..8a49bf6 --- /dev/null +++ b/nginx-waf/03_asl_dos.conf @@ -0,0 +1,97 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Application Security Rules for modsec 2.x +# +# Copyright 2005-2019 by Atomicorp, Inc., all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- +# + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security + + +SecRule RESPONSE_STATUS "@streq 408" "phase:5,t:none,log,auditlog,pass,rev:1,id:343434,msg:'Atomicorp.com WAF Rules: Client Connection dropped by Apache due to slow connection, possible Slowaris attack',severity:'4'" + +#/?CtrlFunc_ +SecRule REQUEST_METHOD "@streq POST" "chain,severity:2,log,t:none,deny,status:403,auditlog,phase:1,id:331215,rev:1,msg:'Atomicorp.com WAF Rules: CtrlFunc Brute Force Attack Dropped'" +SecRule REQUEST_URI "@beginsWith /?CtrlFunc_" "t:none" + +#DOS Rules go right up front +#Wordpress Resource Exhaustion attack +SecRule REQUEST_URI "@pm /wp-trackback\.php" "phase:1,id:'393939',t:none,pass,nolog,noauditlog,skip:1" + SecAction "phase:1,id:393940,t:none,pass,nolog,noauditlog,skipAfter:END_DOS_CHECKS_WP" + + SecRule ARGS:charset "(?:utf-8,utf-8,utf-8,utf-8,utf-8,utf-8|,.*,.*,.*,.*,)" "phase:1,deny,status:403,log,deny,auditlog,t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,id:390639,rev:2,severity:2,msg:'Atomicorp.com WAF Rules - Just In Time Patch: WordPRess trackback resource exhaustion attack'" + + #Wordpress Resource Exhaustion attack exploit + SecRule ARGS:title "abcedfgabcedfgabcedfgabcedfg" "phase:1,deny,status:403,log,auditlog,t:none,t:urlDecodeUni,t:lowercase,id:390640,rev:1,severity:2,msg:'Atomicorp.com WAF Rules - Just In Time Patch: WordPRess trackback resource exhaustion attack'" + + SecMarker END_DOS_CHECKS_WP + + +#Another variant of a DOS attack +SecRule REQUEST_URI "\?(?:ptrxcz|xclzve)_" "log,auditlog,phase:1,deny,log,status:403,t:none,t:urlDecodeUni,t:lowercase,id:370145,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Known wormsign'" + +#/?CtrlFunc_ +SecRule REQUEST_URI "\?-?[0-9]{3,6}=-?[0-9]{3,6}" "severity:2,log,auditlog,t:none,deny,status:403,phase:1,id:331216,rev:2,msg:'Atomicorp.com WAF Rules: Wordpress DOS Attack Dropped',chain" +SecRule REQUEST_URI "!(^/administrator/)" "t:none,t:lowercase" + +#long lines +SecRule REQUEST_METHOD "@streq HEAD" "chain,severity:2,log,auditlog,t:none,deny,phase:1,id:331217,rev:1,msg:'Atomicorp.com WAF Rules: Possible DOS Attack Dropped'" +SecRule REQUEST_URI "\?[0-9a-z]{2000,}" "t:none,t:lowercase" + +#xmlrpc DOS attacks +SecRule &REQUEST_HEADERS:Content-Type "@eq 0" "log,auditlog,chain,phase:1,rev:3,t:none,deny,log,status:403,msg:'Atomicorp.com WAF Rules: xmlrpc DOS attack',id:'392331',severity:'2'" + SecRule REQUEST_HEADERS:Content-Length "!^0$" "t:none,chain" + SecRule REQUEST_URI "xmlrpc\.php" "t:none,t:urlDecodeUni,t:lowercase" + +#Per count DOS checks +SecAction "nolog,noauditlog,pass,id:350115,phase:1,t:none,setvar:'tx.dos_burst_time_slice=60',setvar:'tx.dos_counter_threshold=5',setvar:'tx.dos_block_timeout=600'" + +SecRule IP:DOS_BLOCK "@eq 1" "log,auditlog,chain,phase:1,id:350116,deny,log,status:404,severity:2,msg:'Atomicorp.com WAF Rules: Potential Denial of Service (DoS) Attack Identified from %{tx.real_ip} (%{tx.dos_block_counter} hits since last alert)',setvar:ip.dos_block_counter=+1" + SecRule &IP:DOS_BLOCK_FLAG "@eq 0" "setvar:ip.dos_block_flag=1,expirevar:ip.dos_block_flag=60,setvar:tx.dos_block_counter=%{ip.dos_block_counter},setvar:ip.dos_block_counter=0" + +# Block and track # of requests but don't log, then skip because its already blocked +SecRule IP:DOS_BLOCK "@eq 1" "phase:1,id:'350117',t:none,deny,status:404,noauditlog,nolog,severity:2,nolog,setvar:ip.dos_block_counter=+1" +SecRule IP:DOS_BLOCK "@eq 1" "phase:5,id:'350118',t:none,nolog,noauditlog,pass,skipAfter:END_DOS_PROTECTION_CHECKS" + +# Count the number of requests to the protected resoures +#SecRule REQUEST_FILENAME "@pmFromFile dos_protected.txt" +SecRule REQUEST_FILENAME "xmlrpc\.php" "phase:5,id:'350112',t:none,t:urlDecodeUni,t:lowercase,nolog,noauditlog,pass,setvar:ip.dos_counter=+1" + +# If the request count is greater than or equal to our thresholds +# then set the burst counter +SecRule IP:DOS_COUNTER "@gt %{tx.dos_counter_threshold}" "phase:5,id:'350113',t:none,nolog,noauditlog,pass,t:none,setvar:ip.dos_burst_counter=+1,expirevar:ip.dos_burst_counter=%{tx.dos_burst_time_slice},setvar:!ip.dos_counter" + +# Check DOS Burst Counter +# Check the burst counter - if greater than or equal to 2, then we set the IP +# block variable for 5 mins and issue an alert. +SecRule IP:DOS_BURST_COUNTER "@ge 2" "log,auditlog,phase:5,id:'350114',rev:1,severity:3,t:none,log,pass,msg:'Atomicorp.com WAF Rules: Potential Denial of Service (DoS) Attack from %{tx.real_ip} - # of Request Bursts: %{ip.dos_burst_counter}',setvar:ip.dos_block=1,expirevar:ip.dos_block=%{tx.dos_block_timeout},tag:'no_ar'" + + +SecMarker END_DOS_PROTECTION_CHECKS + +#SecRule REQUEST_BASENAME "xmlrpc\.php" # "chain,phase:2,deny,log,auditlog,severity:2,id:'350116',rev:1,msg:'Atomicorp.com WAF Rules: Wodpress XML Pingback (Disable if you want to allow pingbacks to Wordpress)',t:none,t:lowercase,t:urlDecodeUni" +#SecRule REQUEST_BODY|XML:/* "pingback\.ping" "t:none,t:lowercase" diff --git a/nginx-waf/05_asl_exclude.conf b/nginx-waf/05_asl_exclude.conf new file mode 100644 index 0000000..231e688 --- /dev/null +++ b/nginx-waf/05_asl_exclude.conf @@ -0,0 +1,12 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +SecRule REQUEST_FILENAME "\.*" "phase:2,id:91043,t:none,t:lowercase,pass,nolog,noauditlog" + + +# Current Sigs with known issues. +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# DO NOT MODIFY THIS FILE +# Make your own exclude list as 00_asl_custom_exclude.conf +# ---ASL-CONFIG-FILE--- diff --git a/nginx-waf/10_asl_antimalware.conf b/nginx-waf/10_asl_antimalware.conf new file mode 100644 index 0000000..b2901ec --- /dev/null +++ b/nginx-waf/10_asl_antimalware.conf @@ -0,0 +1,87 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Anti Malware rules +# +# Created by Prometheus Global (http://www.prometheus-group.com) +# Copyright 2005-2019 by Atomicorp, Inc. all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security + +# Phase 2 rules + + +#skip this for certain file types +SecRule REQUEST_FILENAME "\.((m|j)pe?g4?|bmp|tiff?|p((p|g|b)m|n(g|m))|gif|js|css|ico|avi|w(mv|ebp)|mp(3|4)|cgm|svg|swf|og(m|v|x))$" "phase:2,pass,t:none,t:lowercase,nolog,noauditlog,id:333946,skipAfter:END_ANTI_MALWARE" + +SecRule REQUEST_URI "/imp/compose\.php" "phase:2,pass,id:333947,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_ANTI_MALWARE" + +SecRule ARGS|REQUEST_URI|!ARGS:/description/|!ARGS:resolution|!ARGS:/subject/|!ARGS:/body/|!ARGS:SAMLResponse|!ARGS:SAMLResponse|!ARGS:message|!ARGS:/txt/|!ARGS:/solution/|XML:/* "@pm http:// https:// ftp:// ftps:// ogg:// data:// php:// zlib:// gopher://" "phase:2,id:338812,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceNulls,t:compressWhiteSpace,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:338370,t:none,pass,nolog,noauditlog,skipAfter:END_ANTI_MALWARE" + + +# Broadcheck +#SecRule REQUEST_HEADERS:Referer|ARGS "!@pmFromFile malware-exclusion-local.txt" # "t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:360000,rev:2,severity:2,msg:'Blocklist Malware Site (AE)'" +SecRule REQUEST_URI|ARGS|!ARGS:wpReason|!ARGS:/description/|!ARGS:resolution|!ARGS:/subject/|!ARGS:/body/|!ARGS:SAMLResponse|!ARGS:message|!ARGS:/txt/|!ARGS:/solution/|XML:/* "(?:ogg|gopher|data|php|zlib|(?:ht|f)tps?):/" "log,auditlog,phase:2,deny,log,status:403,chain,capture,t:none,t:urlDecodeUni,t:replaceNulls,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,id:360000,rev:7,severity:2,msg:'Atomicorp.com Malware Blocklist: Malware Site detected in URL/Argument (AE)',logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|!ARGS:wpReason|!ARGS:resolution|!ARGS:/description/|!ARGS:/subject/|!ARGS:/body/|!ARGS:SAMLResponse|!ARGS:/txt/|!ARGS:message|XML:/* "@pmFromFile malware-blacklist.txt" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace" + +# Rule 330002: Blocklist of known malware sites w/ Anti-evasion features +#SecRule REQUEST_URI "!(?:/imp/compose\.php)" # "capture,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:360002,rev:1,severity:2,msg:'Atomicorp.com Malware Blocklist: Malware Site detected in ARGS/Body (AE)',chain,logdata:'%{TX.0}'" +#SecRule REQUEST_BODY|ARGS|!ARGS:resolution|!ARGS:/description/|!ARGS:/subject/|!ARGS:/body/|!ARGS:/txt/|XML:/* "(?:ogg|zlib|(?:ht|f)tps?)\:/" "chain" +##SecRule REQUEST_BODY|ARGS "!@pmFromFile malware-exclusion-local.txt" chain +#SecRule REQUEST_BODY|ARGS|!ARGS:/description/|!ARGS:/subject/|!ARGS:/body/|!ARGS:/txt/|XML:/* "@pmFromFile malware-blacklist.txt" + +# Rule 330003: Blocklist of known malware sites +#SecRule REQUEST_URI "!(?:/imp/compose\.php)" # "capture,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:360003,rev:5,severity:2,msg:'Atomicorp.com Malware Blocklist: Malware Site detected in URI',chain,logdata:'%{TX.0}'" +#SecRule REQUEST_URI "(?:ogg|zlib|(?:ht|f)tps?)\:/.*" "chain" +##SecRule REQUEST_URI "!@pmFromFile malware-exclusion-local.txt" "chain" +#SecRule REQUEST_URI "@pmFromFile malware-blacklist.txt" + +#Rule 330004: Blocklist suspicious sites in referral +#SecRule REQUEST_HEADERS:Referer "@pmFromFile malware-blacklist.txt" # "capture,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:360004,rev:2,severity:2,msg:'Atomicorp.com Malware Blocklist: Suspicious Blocklist Malware Site detected in Referral',logdata:'%{TX.0}'" +# + +# Rule 330005: Blocklist of known malware sites w/ Anti-evasion features +SecRule REQUEST_BODY|REQUEST_URI|ARGS|!ARGS:wpReason|!ARGS:/description/|!ARGS:resolution|!ARGS:/subject/|!ARGS:/body/|!ARGS:SAMLResponse|!ARGS:/txt/|XML:/* "(?:ogg|gopher|data|php|zlib|(?:ht|f)tps?):/" "log,auditlog,phase:2,deny,log,status:403,capture,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,id:360005,rev:1,severity:2,msg:'Atomicorp.com Malware Blocklist: Malware Site detected in ARGS/Body (AE)',chain,logdata:'%{TX.0}'" +#SecRule REQUEST_BODY|ARGS "!@pmFromFile malware-exclusion-local.txt" chain +SecRule REQUEST_BODY|REQUEST_URI|ARGS|!ARGS:wpReason|!ARGS:/description/|!ARGS:/subject/|!ARGS:/body/|!ARGS:/txt/|!ARGS:SAMLResponse "@pmFromFile malware-blacklist.txt" "t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace" + +##Rule 360005: Local malware lists +##SecRule REQUEST_HEADERS:Referer|ARGS "!@pmFromFile malware-exclusion-local.txt" ## "t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:360000,rev:2,severity:2,msg:'Blocklist Malware Site (AE)'" +#SecRule ARGS "@pmFromFile malware-blacklist-local.txt" # "t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:360005,rev:2,severity:2,msg:'Local Blocklist Malware Site (AE)'" +# +## Rule 330006: Blocklist of known malware sites w/ Anti-evasion features +#SecRule REQUEST_URI "!(?:/imp/compose\.php)" # "t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:360006,rev:1,severity:2,msg:'Local Malware Site in ARGS/Body (AE)',chain" +#SecRule REQUEST_BODY|ARGS "(?:ogg|zlib|(?:ht|f)tps?)\:/.*" "chain" +##SecRule REQUEST_BODY|ARGS "!@pmFromFile malware-exclusion-local.txt" chain +#SecRule REQUEST_BODY|ARGS "@pmFromFile malware-blacklist-local.txt" +# +## Rule 330003: Blocklist of known malware sites +#SecRule REQUEST_URI "!(?:/imp/compose\.php)" # "t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:360007,rev:4,severity:2,msg:'Local Malware Site in URI',chain" +#SecRule REQUEST_URI "(?:ogg|zlib|(?:ht|f)tps?)\:/.*" "chain" +##SecRule REQUEST_URI "!@pmFromFile malware-exclusion-local.txt" "chain" +#SecRule REQUEST_URI "@pmFromFile malware-blacklist-local.txt" +# +##Rule 330004: Blocklist suspicious sites in referral +#SecRule REQUEST_HEADERS:Referer "@pmFromFile malware-blacklist-local.txt" # "t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:360008,rev:2,severity:2,msg:'Suspicious Local Blocklist Malware Site in Referral'" +# +SecMarker END_ANTI_MALWARE diff --git a/nginx-waf/10_asl_rules.conf b/nginx-waf/10_asl_rules.conf new file mode 100644 index 0000000..f818fdc --- /dev/null +++ b/nginx-waf/10_asl_rules.conf @@ -0,0 +1,6585 @@ +SecDefaultAction "log,deny,auditlog,phase:2,status:403" +SecRule REQUEST_FILENAME "/modules\.php" "phase:2,id:91044,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91045,t:none,pass,nolog,skipAfter:END_RULES_91045" + +SecRule ARGS|!ARGS:/target/|!ARGS:/redirect/|!ARGS:cforms_action_page|!ARGS:storyext|!ARGS:/^config/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:message|!ARGS:/^config/|!ARGS:SitePath|!ARGS:PreviewImage|!ARGS:Exlink|!ARGS:story|!ARGS:/page/|!ARGS:user_website|!ARGS:configuration[MODULE_PAYMENT_GOOGLECHECKOUT_MODE]|!ARGS:configParams[api][configParamValue]|!ARGS:q|!ARGS:stories_topics|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:lowercase,t:replaceNulls,t:compressWhitespace,t:urlDecodeUni,t:lowercase,t:htmlEntityDecode,multimatch,id:340463,rev:9,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (modules.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/target/|!ARGS:/redirect/|!ARGS:cforms_action_page|!ARGS:storyext|!ARGS:/^config/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:message|!ARGS:/^config/|!ARGS:SitePath|!ARGS:PreviewImage|!ARGS:Exlink|!ARGS:story|!ARGS:/page/|!ARGS:user_website|!ARGS:configuration[MODULE_PAYMENT_GOOGLECHECKOUT_MODE]|!ARGS:configParams[api][configParamValue]|!ARGS:q|!ARGS:stories_topics|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:lowercase,t:replaceNulls,t:compressWhitespace,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340462,rev:9,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (modules.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91045 + +SecRule REQUEST_FILENAME "/installatron/index\.cgi" "phase:2,id:91046,t:none,t:lowercase,pass,nolog,noauditlog" + + +SecRule REQUEST_FILENAME "/admin\.php" "phase:2,id:91047,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=390709,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91048,t:none,pass,nolog,skipAfter:END_RULES_91048" + + +#Skips +#/wp-admin/admin.php?page=w3tc_cdn +SecRule REQUEST_URI "(?:/wp-admin/admin\.php\?(?:page=(?:w3tc_cdn|ngg_other_options|wplinkdir_editlinks_page|settings|theme-options|gf_edit_forms|theme(?:-panel|_general)|wpi_page_manage_invoice|incipiens_options|layerslider|ch_header|(?:functions|under-construction)\.php|cmp-settings\.php)|frm_action=|cf/cf\.php)|^/admin\.php\?action=streambox)" "phase:2,id:'336793',rev:8,t:none,pass,nolog,noauditlog,skipAfter:END_RFI" + +SecRule ARGS|!ARGS:/dt_Header/|!ARGS:/fancybox/|!ARGS:/mp3/|!ARGS:subject|!ARGS:/theme/|!ARGS:/wpcf/|!ARGS:scope|!ARGS:slide[thumbnail]|!ARGS:cancel|!ARGS:search|!ARGS:/woocommerce/|!ARGS:/calendar/|!ARGS:/image/|!ARGS:/email/|!ARGS:/fb/|!ARGS:/cmodsar_custom/|!ARGS:/^woo/|!ARGS:/^gf_/|!ARGS:/^acf/|!ARGS:u_2|!ARGS:file_remote/|!ARGS:/skype/|!ARGS:/_uri/|!ARGS:/theone/|!ARGS:/^custom/|!ARGS:/thumbnail_adr/|!ARGS:default_value|!ARGS:value|!ARGS:/lightbox/|!ARGS:/zone/|!ARGS:/cloudflare/|!ARGS:/sidebar/|!ARGS:/html/|!ARGS:/flickr/|!ARGS:/^wpcrown_/|!ARGS:/vimeo/|!ARGS:postbody|!ARGS:podcast|!ARGS:/^exposed/|!ARGS:/^ke_/|!ARGS:flickr|!ARGS:msg|!ARGS:/link/|!ARGS:/skipjs/|!ARGS:/source/|!ARGS:wordpressbling_mail|!ARGS:/^hotec/|!ARGS:pp_set_bg|!ARGS:/^item_meta/|!ARGS:solution|!ARGS:/^sapWP/|!ARGS:/^cp_/|!ARGS:dribbble|!ARGS:sugarroot|!ARGS:minify.cache.files|!ARGS:name|!ARGS:/banner/|!ARGS:/form_action/|!ARGS:/option/|!ARGS:/stream/|!ARGS:/analytics_code/|!ARGS:/endpoint/|!ARGS:_local|!ARGS:lookup|!ARGS:/hostname/|!ARGS:/cdn/|!ARGS:/^ad/|!ARGS:/image/|!ARGS:/target/|!ARGS:shrbase|!ARGS:facebook|!ARGS:/twitter/|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:youtube|!ARGS:myspace|!ARGS:form|!ARGS:/_fav/|!ARGS:_gen_gmap|!ARGS:/logo/|!ARGS:/img/|!ARGS:unsubscribe|!ARGS:/^dest_to/|!ARGS:/rss/|!ARGS:/lm_slide/|!ARGS:/feed/|!ARGS:/footer/|!ARGS:/^jsfiles/|!ARGS:/include/|!ARGS:/pagination/|!ARGS:/link/|!ARGS:/image/|!ARGS:/path/|!ARGS:/page/|!ARGS:field_b|!ARGS:/refer/|!ARGS:/^gbu0_/|!ARGS:/site/|!ARGS:/button/|!ARGS:guestbookLink|!ARGS:xmlpath|!ARGS:/^update/|!ARGS:/^woo_ad/|!ARGS:act_filepath|!ARGS:/domain/|!ARGS:opphomepage|!ARGS:echi_google_analytics|!ARGS:/^echi_block_/|!ARGS:/^echi_ad/|!ARGS:/icon/|!ARGS:descripcion|!ARGS:xcont_priv|!ARGS:/comments/|!ARGS:email|!ARGS:/video/|!ARGS:hometext|!ARGS:/text/|!ARGS:web|!ARGS:/^config/|!ARGS:/^g2_manualpath/|!ARGS:/^sDescription/|!ARGS:hidepost_content_text|!ARGS:sText|!ARGS:sfhome|!ARGS:homepage|!ARGS:field_3_name|!ARGS:cforms_cmsg|!ARGS:bcontent|!ARGS:form_location|!ARGS:footer|!ARGS:field_4_name|!ARGS:cforms_redirect_page|!ARGS:cforms_action_page|!ARGS:ecards_more_pic_target|!ARGS:message|!ARGS:/^xfoot/|!ARGS:/^FCKeditor/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/redirect/|!ARGS:content|!ARGS:/linkedin/|!ARGS:outbound|!ARGS:out|!ARGS:/twitter/|!ARGS:/^field/|!ARGS:/button/|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/youtube/|!ARGS:/affredir/|!ARGS:helpbox|!ARGS:return|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:thelink|!ARGS:params[altTag]|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:oldmsg|!ARGS:lk_url|!ARGS:config[latestNewsRRS]|!ARGS:sponsor|!ARGS:config[ftp_server]|!ARGS:listViewerCode|!ARGS:/element/|!ARGS:/google/|!ARGS:courier_tracking|!ARGS:/field_id/|!ARGS:/social_profile/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340464,rev:58,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (admin.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/dt_Header/|!ARGS:/fancybox/|!ARGS:/mp3/|!ARGS:/email/|!ARGS:subject|!ARGS:/wpcf/|!ARGS:scope|!ARGS:cancel|!ARGS:slide[thumbnail]|!ARGS:/^hotec/|!ARGS:search|!ARGS:/^woo/|!ARGS:/calendar/|!ARGS:/theme/|!ARGS:/fb/|!ARGS:/^gf_/|!ARGS:/cmodsar_custom/|!ARGS:/^acf/|!ARGS:u_2|!ARGS:/woocommerce/|!ARGS:file_remote/|!ARGS:/skype/|!ARGS:/^custom/|!ARGS:/theone/|!ARGS:/_uri/|!ARGS:/thumbnail_adr/|!ARGS:default_value|!ARGS:value|!ARGS:/lightbox/|!ARGS:/zone/|!ARGS:/cloudflare/|!ARGS:/sidebar/|!ARGS:/html/|!ARGS:/^wpcrown_/|!ARGS:object\[submit_background\]|!ARGS:postbody|!ARGS:podcast|!ARGS:/flickr/|!ARGS:/image/|!ARGS:/vimeo/|!ARGS:page|!ARGS:msg|!ARGS:/link/|!ARGS:/skipjs/|!ARGS:/source/|!ARGS:/^ke_/|!ARGS:flickr|!ARGS:wordpressbling_mail|!ARGS:pp_set_bg|!ARGS:/^item_meta/|!ARGS:solution|!ARGS:/^sapWP/|!ARGS:/^cp_/|!ARGS:dribbble|!ARGS:sugarroot|!ARGS:minify.cache.files|!ARGS:name|!ARGS:/banner/|!ARGS:/form_action/|!ARGS:/option/|!ARGS:/button/|!ARGS:/stream/|!ARGS:/analytics_code/|!ARGS:/endpoint/|!ARGS:_local|!ARGS:lookup|!ARGS:/hostname/|!ARGS:/cdn/|!ARGS:/^ad/|!ARGS:/image/|!ARGS:/target/|!ARGS:shrbase|!ARGS:/twitter/|!ARGS:/domain/|!ARGS:linkedin|!ARGS:myspace|!ARGS:form|!ARGS:/logo/|!ARGS:/img/|!ARGS:unsubscribe|!ARGS:/^dest_to/|!ARGS:/_fav/|!ARGS:_gen_gmap|!ARGS:/rss/|!ARGS:/lm_slide/|!ARGS:/feed/|!ARGS:/footer/|!ARGS:/^jsfiles/|!ARGS:/pagination/|!ARGS:/include/|!ARGS:/link/|!ARGS:/image/|!ARGS:/logo/|!ARGS:/path/|!ARGS:/page/|!ARGS:field_b|!ARGS:/refer/|!ARGS:/^gbu0_/|!ARGS:/site/|!ARGS:guestbookLink|!ARGS:xmlpath|!ARGS:/^update/|!ARGS:/^woo_ad/|!ARGS:act_filepath|!ARGS:act_link|!ARGS:opphomepage|!ARGS:event_link|!ARGS:echi_google_analytics|!ARGS:/^echi_block_/|!ARGS:/^echi_ad/|!ARGS:/^permalink/|!ARGS:/icon/|!ARGS:descripcion|!ARGS:xcont_priv|!ARGS:email|!ARGS:/video/|!ARGS:hometext|!ARGS:/text/|!ARGS:web|!ARGS:/^config/|!ARGS:/^g2_manualpath/|!ARGS:/^sDescription/|!ARGS:hidepost_content_text|!ARGS:sText|!ARGS:homepage|!ARGS:field_3_name|!ARGS:cforms_cmsg|!ARGS:bcontent|!ARGS:form_location|!ARGS:sslloginlink|!ARGS:footer|!ARGS:field_4_name|!ARGS:cforms_redirect_page|!ARGS:ecards_more_pic_target|!ARGS:cforms_action_page|!ARGS:message/|!ARGS:/^xfoot/|!ARGS:/^FCKeditor/|!ARGS:/page/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/redirect/|!ARGS:content|!ARGS:q|!ARGS:/linkedin/|!ARGS:outbound|!ARGS:out|!ARGS:/twitter/|!ARGS:/^field/|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/youtube/|!ARGS:helpurl|!ARGS:helpbox|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:ajaxurl|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:install_url|!ARGS:/comments/|!ARGS:resource|!ARGS:thelink|!ARGS:/affredir/|!ARGS:params[altTag]|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:oldmsg|!ARGS:lk_url|!ARGS:config[latestNewsRRS]|!ARGS:sfhome|!ARGS:sponsor|!ARGS:config[ftp_server]|!ARGS:/element/|!ARGS:/google/|!ARGS:listViewerCode|!ARGS:/field_id/|!ARGS:/social_profile/|!ARGS:courier_tracking "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340465,rev:58,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (admin.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecMarker END_RFI + + + +SecMarker END_RULES_91048 + +SecRule REQUEST_FILENAME "/cpinquiry\.php" "phase:2,id:91049,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91050,t:none,pass,nolog,skipAfter:END_RULES_91050" + +SecRule ARGS|!ARGS:comments|!ARGS:content|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340466,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (cpinquiry.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:comments|!ARGS:content|!ARGS:q|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340467,phase:2,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (cpinquiry.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91050 + +SecRule REQUEST_FILENAME "/admin/area/save-page\.php" "phase:2,id:91051,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91052,t:none,pass,nolog,skipAfter:END_RULES_91052" + +SecRule ARGS|!ARGS:signature|!ARGS:website|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:page-content|!ARGS:comments|!ARGS:content|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340468,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (save-page.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:signature|!ARGS:website|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:page-content|!ARGS:comments|!ARGS:content|!ARGS:q|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340469,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (save-page.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91052 + +SecRule REQUEST_FILENAME "/cgi-bin/guestbook\.pl" "phase:2,id:91053,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91054,t:none,pass,nolog,skipAfter:END_RULES_91054" + +SecRule ARGS|!ARGS:FOOTER|!ARGS:MESSAGE|!ARGS:header|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340470,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (guestbook.pl)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:FOOTER|!ARGS:MESSAGE|!ARGS:header|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340471,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (guestbook.pl)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91054 + +SecRule REQUEST_FILENAME "/wysiwyg/save\.php" "phase:2,id:91055,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91056,t:none,pass,nolog,skipAfter:END_RULES_91056" + +SecRule ARGS|!ARGS:/^Dialog/|!ARGS:/^content/|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340472,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/modules/wysiwyg/save.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/^Dialog/|!ARGS:/^content/|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340473,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/modules/wysiwyg/save.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91056 + +SecRule REQUEST_FILENAME "/admin/index\.php" "phase:2,id:91057,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=390613,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91058,t:none,pass,nolog,skipAfter:END_RULES_91058" + +SecRule ARGS|!ARGS:/description/|!ARGS:keywords|!ARGS:tiny_vals|!ARGS:info|!ARGS:postpagetext|!ARGS:display_query|!ARGS:Db_submit|!ARGS:Post|!ARGS:text|!ARGS:pagetext|!ARGS:action|!ARGS:op|!ARGS:setup_db|!ARGS:wptextbox1|!ARGS:message|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:query_string|!ARGS:query|!ARGS:description|!ARGS:/teaser/ "(?:\b(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table) |delete[[:space:]] .{,100} update.+set.+=|union all select |\bunion\b.{1,100}?\bselect\b.[a-z][0-9]+ |select (?:load_file|char\()|(?:insert|remark)test;|insert[[:space:]]+[a-z|0-9|\*|\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+\()" "phase:2,capture,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:370144,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection 2',logdata:'%{TX.0}',deny,log,auditlog,status:403" + +SecRule REQUEST_URI|ARGS|XML:/*|!ARGS:comment|!ARGS:keywords|!ARGS:info|!ARGS:/description/|!ARGS:/sql/|!ARGS:prefix|!ARGS:wysiwyg|!ARGS:query|!ARGS:/desc/|!ARGS:movie_brief|!ARGS:/text/|!ARGS:/message/|!ARGS:ncontent|!ARGS:/body/|!ARGS:/content/|!ARGS:searchword|!ARGS:add_keywords|!ARGS:comments|!ARGS:text|!ARGS:contactMessage|!ARGS:cts|!ARGS:meta_descr|!ARGS:text|!ARGS:edited|!ARGS:content|!ARGS:introtext|!ARGS:Post|!ARGS:itembigtext|!ARGS:body|!ARGS:mytextarea|!ARGS:ll_content_message|!ARGS:page-content|!ARGS:reply|!ARGS:xml|!ARGS:content_en|!ARGS:filecontent|!ARGS:message|!ARGS:content_en|!ARGS:response[14]|!ARGS:/article/|!ARGS:/teaser/ "(?:\b(?:select|grant|delete|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[a-z|0-9|\*|\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[a-z|0-9|\*| |\,]|\bunion\b.{1,100}?\bselect\b.*[a-z0-9].*into.*from|select (?:load_file|char\()|(?:insert|remark)test;|insert[[:space:]]+[a-z|0-9|\*|\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+\()" "phase:2,capture,t:none,t:urlDecodeUni,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:370016,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection',logdata:'%{TX.0}',deny,log,auditlog,status:403" +# Rule 340147: Generic XSS filter +SecRule ARGS "!(^(submit\+>>|>>)$)" "phase:2,t:none,t:urlDecodeUni,t:lowercase,capture,id:340247,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',chain,logdata:'%{TX.0},%{matched_var_name}',deny,log,auditlog,status:403" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/catDesc/|!ARGS:/^blog_/|!ARGS:/^information/|!ARGS:/pDesc/|!ARGS:infoDescription|!ARGS:output|!ARGS:ad|!ARGS:notice|!ARGS:/custom_block/|!ARGS:/google/|!ARGS:/^information_description/|!ARGS:/category_description/|!ARGS:/formcode/|!ARGS:val333|!ARGS:/module/|!ARGS:stylesheet|!ARGS:wysiwyg|!ARGS:/embed/|!ARGS:udesc|!ARGS:description|!ARGS:ldesc|!ARGS:xdescription|!ARGS:desc|!ARGS:design_description|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/cms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:descr|!ARGS:/products_description/|!ARGS:match_report|!ARGS:/product_desc/|!ARGS:description_short_1|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:phpcode|!ARGS:intro|!ARGS:Snippet|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:input[Desarrollo]|!ARGS:move2|!ARGS:hoperation|!ARGS:login_form|!ARGS:/product_benefits/|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:bbcode_tpl|!ARGS:Right_photo_1|!ARGS:embedVideo|!ARGS:/^K2ExtraField/|!ARGS:mentorhelp|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/footer/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:java|vb)?script|about|applet|activex|chrome) ?>|< ?/?i?frame|\%env)" "t:none,t:removeNulls,t:utf8tounicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:lowercase,t:compressWhitespace" + +SecRule ARGS "!(^(submit\+>>|>>)$)" "phase:2,deny,status:403,log,auditlog,chain,t:none,t:urlDecodeUni,t:lowercase,capture,id:340248,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/catDesc/|!ARGS:/^blog_/|!ARGS:/^pdesc/|!ARGS:/^information/|!ARGS:ad|!ARGS:/pDesc/|!ARGS:/module/|!ARGS:/custom_block/|!ARGS:/google/|!ARGS:/embed/|!ARGS:/category_description/|!ARGS:notice|!ARGS:/formcode/|!ARGS:val333|!ARGS:wysiwyg|!ARGS:onlineusers|!ARGS:offlineusers|!ARGS:description|!ARGS:fdesc|!ARGS:ldesc|!ARGS:/footer/|!ARGS:xdescription|!ARGS:desc|!ARGS:design_description|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/wyscms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:descr|!ARGS:/products_description/|!ARGS:match_report|!ARGS:/product_desc/|!ARGS:description_short_1|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:eip_value|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:move2|!ARGS:input[Desarrollo]|!ARGS:hoperation|!ARGS:arg2|!ARGS:login_form|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:/submitcode/|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?(?:i?frame ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(ht|f)tps?)\:/|alert ?\(||< ?/?i?frame|\% ?env)" "t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,multiMatch" + +# Rule 340249: XSS injection +SecRule ARGS "!(^(submit\+>>|>>)$)" "phase:2,chain,t:none,t:removeNulls,t:urlDecodeUni,t:lowercase,t:compressWhitespace,capture,id:340249,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}',deny,log,auditlog,status:403" +SecRule REQUEST_URI "!(^/admin/index\.php\?route=module/)" chain +SecRule REQUEST_URI|ARGS|!ARGS:/catDesc/|!ARGS:/^pdesc/|!ARGS:/welcome_module/|!ARGS:onlineusers|!ARGS:offlineusers|!ARGS:stylesheet|!ARGS:stylesheet|!ARGS:/category_description/|!ARGS:notice|!ARGS:wysiwyg|!ARGS:/formcode/|!ARGS:val333|!ARGS:ldesc|!ARGS:fdesc|!ARGS:/footer/|!ARGS:xdescription|!ARGS:description|!ARGS:/embed/|!ARGS:desc|!ARGS:design_description|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/wyscms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:descr|!ARGS:/products_description/|!ARGS:match_report|!ARGS:/product_desc/|!ARGS:description_short_1|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:pay_inst_1|!ARGS:sml_prt_1|!ARGS:/form/|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:input[Desarrollo]|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:move2|!ARGS:hoperation|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:mes|!ARGS:signature|!ARGS:paepdc|!ARGS:/VB_announce/|!ARGS:/^autoDS/|!ARGS:newyddionc|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/header/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:i?frame ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|(?:\.add|\@)import|asfunction\:|background-image\:|\be(?:cma|xec)script\b|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc ?=|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|event|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|shell\:|window\.location|asfunction:_root\.launch|\%env)" "t:none,t:removeNulls,t:utf8tounicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:lowercase,t:compressWhitespace" +SecRule REQUEST_URI|ARGS|!ARGS:form[pagina_text]|!ARGS:descripcion|!ARGS:description|!ARGS:message|!ARGS:comments|!ARGS:content "(?:(\w+)and(\w+)char\([0-9]+\)|(?:execute|convert)\(|(?:\;delete.{1,100};(?:insert|declare @|varchar) ?|(?:and .{1,100} \(select |\b(?:drop|create)(\w+)table |declare .{1,100} varchar\())|convert\(varchar|null,(?:null,(?:null|accesslevel|user_name),|concat\()|union select |union all select)" "phase:2,id:340457,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:lowercase,t:replaceComments,t:compressWhiteSpace,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection (/admin/index.php exclude)',deny,log,auditlog,status:403" + +SecRule REQUEST_URI "!(pagemode=link_index|^/admin/index\.php\?fuse=admin)" "phase:2,chain,t:none,t:urlDecodeUni,t:lowercase,id:340476,rev:32,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/index.php exclude)',deny,log,auditlog,status:403" +SecRule ARGS|!ARGS:/^go/|!ARGS:/catDesc/|!ARGS:/corvuspay/|!ARGS:config_name|!ARGS:config_owner|!ARGS:/ssl/|!ARGS:/^adjust/|!ARGS:/ULTIMATUMControl/|!ARGS:/youtube/|!ARGS:/web/|!ARGS:u|!ARGS:logo|!ARGS:/popup/|!ARGS:liketext|!ARGS:feed|!ARGS:/^field_/|!ARGS:/ping/|!ARGS:/service/|!ARGS:/img/|!ARGS:pp_path|!ARGS:vidid|!ARGS:/^field_id/|!ARGS:/^smeg_serv/|!ARGS:/website/|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/app_update/|!ARGS:/gplus/|!ARGS:/twitter/|!ARGS:/google/|!ARGS:bic|!ARGS:cubecart4_path|!ARGS:field_vals|!ARGS:osc_path|!ARGS:events_map|!ARGS:xmlpath|!ARGS:homepage|!ARGS:input|!ARGS:email_contents|!ARGS:/link/|!ARGS:page_content|!ARGS:feed_copyright|!ARGS:/image/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:comments|!ARGS:/^opts/|!ARGS:text|!ARGS:code|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:referrer|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url|!ARGS:SitePath|!ARGS:Exlink|!ARGS:contents|!ARGS:PreviewImage|!ARGS:pagelink|!ARGS:pagefeed|!ARGS:ShopPath|!ARGS:content|!ARGS:right|!ARGS:left|!ARGS:/^myDevEditControl_/|!ARGS:/link/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule REQUEST_URI "!(pagemode=link_index|^/admin/index\.php\?fuse=admin)" "phase:2,chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340477,rev:30,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/index.php exclude)',deny,log,auditlog,status:403" +SecRule ARGS|!ARGS:/ssl/|!ARGS:/catDesc/|!ARGS:/corvuspay/|!ARGS:/highslide/|!ARGS:config_name|!ARGS:config_owner|!ARGS:/^adjust/|!ARGS:/^go/|!ARGS:/ULTIMATUMControl/|!ARGS:/youtube/|!ARGS:/web/|!ARGS:u|!ARGS:logo|!ARGS:/popup/|!ARGS:feed|!ARGS:liketext|!ARGS:/img/|!ARGS:/^field_/|!ARGS:/ping/|!ARGS:/service/|!ARGS:pp_path|!ARGS:vidid|!ARGS:bic|!ARGS:/^field_id/|!ARGS:/^smeg_serv/|!ARGS:/twitter/|!ARGS:/gplus/|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/website/|!ARGS:/app_update/|!ARGS:/google/|!ARGS:cubecart4_path|!ARGS:osc_path|!ARGS:field_vals|!ARGS:events_map|!ARGS:xmlpath|!ARGS:homepage|!ARGS:input|!ARGS:email_contents|!ARGS:/link/|!ARGS:page_content|!ARGS:feed_copyright|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/image/|!ARGS:/page/|!ARGS:code|!ARGS:comments|!ARGS:/^opts/|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url|!ARGS:SitePath|!ARGS:Exlink|!ARGS:contents|!ARGS:PreviewImage|!ARGS:pagelink|!ARGS:pagefeed|!ARGS:ShopPath|!ARGS:content|!ARGS:right|!ARGS:left|!ARGS:/^myDevEditControl_/|!ARGS:/link/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" chain +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91058 + +SecRule REQUEST_FILENAME "/admincp/user\.php" "phase:2,id:91059,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" +SecAction "phase:2,id:91060,t:none,pass,nolog,skipAfter:END_RULES_91060" + +SecRule ARGS|!ARGS:/css/|!ARGS:site_details|!ARGS:/homepage/|!ARGS:/^userfield/|!ARGS:olduser|!ARGS:user[signature]|!ARGS:userfield[field10]|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340478,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forums/admincp/user.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/css/|!ARGS:/homepage/|!ARGS:/^userfield/|!ARGS:olduser|!ARGS:user[signature]|!ARGS:userfield[field10]|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340479,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forums/admincp/user.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91060 + +SecRule REQUEST_FILENAME "/admincp/template\.php" "phase:2,id:91061,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91062,t:none,pass,nolog,skipAfter:END_RULES_91062" + +SecRule ARGS|!ARGS:searchstring|!ARGS:template|!ARGS:olduser|!ARGS:user[signature]|!ARGS:userfield[field10]|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340482,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forum/admincp/template.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:searchstring|!ARGS:template|!ARGS:olduser|!ARGS:user[signature]|!ARGS:userfield[field10]|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340483,phase:2,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forum/admincp/template.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91062 + +SecRule REQUEST_FILENAME "/contact\.php" "phase:2,id:91063,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91064,t:none,pass,nolog,skipAfter:END_RULES_91064" + +SecRule ARGS|!ARGS:/domain/|!ARGS:fm_comments|!ARGS:contact_message|!ARGS:homepage|!ARGS:field4|!ARGS:Page|!ARGS:msg|!ARGS:comments|!ARGS:yourmessage|!ARGS:howhear|!ARGS:information|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:/website/|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:/link/|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url|!ARGS:Message "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340484,phase:2,rev:8,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (contact.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/domain/|!ARGS:fm_comments|!ARGS:contact_message|!ARGS:Page|!ARGS:msg|!ARGS:comments|!ARGS:yourmessage|!ARGS:howhear|!ARGS:information|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:/website/|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:/link/|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url|!ARGS:Message "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340485,phase:2,rev:8,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (contact.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91064 + +SecRule REQUEST_FILENAME "/admin/conf\.php" "phase:2,id:91065,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91066,t:none,pass,nolog,skipAfter:END_RULES_91066" + +SecRule ARGS|!ARGS:/^opts/|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340486,phase:2,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/conf.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/^opts/|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340487,phase:2,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/conf.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91066 + +SecRule REQUEST_FILENAME "/admin/posted/edit_listing\.php" "phase:2,id:91067,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91068,t:none,pass,nolog,skipAfter:END_RULES_91068" + +SecRule ARGS|!ARGS:my_description|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340488,phase:2,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/posted/edit_listing.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:my_description|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340489,phase:2,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/posted/edit_listing.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91068 + +SecRule REQUEST_FILENAME "/forums/private\.php" "phase:2,id:91069,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91070,t:none,pass,nolog,skipAfter:END_RULES_91070" + +SecRule ARGS|!ARGS:message|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340490,phase:2,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forums/private.php)',deny,log,auditlog,status:403" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:message|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340491,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forums/private.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91070 + +SecRule REQUEST_FILENAME "/forums/newreply\.php" "phase:2,id:91071,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91072,t:none,pass,nolog,skipAfter:END_RULES_91072" + +SecRule ARGS|!ARGS:weblink|!ARGS:weblink_title|!ARGS:message|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340492,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forums/newreply.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:weblink|!ARGS:weblink_title|!ARGS:message|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340493,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forums/newreply.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +# Rule 340444: Generic SQL sigs +SecRule ARGS|!ARGS:message "(?:\b(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table) |delete[[:space:]]*update.+set.+=)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhitespace,t:lowercase,id:340444,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection (/forums/newreply.php)',deny,log,auditlog,status:403,phase:2" + +SecMarker END_RULES_91072 + +SecRule REQUEST_FILENAME "/admin/area/add-edit\.php" "phase:2,id:91073,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91074,t:none,pass,nolog,skipAfter:END_RULES_91074" + +SecRule ARGS|!ARGS:descripcion|!ARGS:description|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340494,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forums/newreply.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:descripcion|!ARGS:description|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340495,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forums/newreply.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91074 + +SecRule REQUEST_FILENAME "/links\.php" "phase:2,id:91075,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91076,t:none,pass,nolog,skipAfter:END_RULES_91076" + +SecRule ARGS|!ARGS:S1|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:website|!ARGS:reciprocal|!ARGS:/link/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340496,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/links.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:S1|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:website|!ARGS:reciprocal|!ARGS:/link/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340497,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/links.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91076 + +SecRule REQUEST_FILENAME "/forums/newreply\.php" "phase:2,id:91077,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340156" +SecAction "phase:2,id:91078,t:none,pass,nolog,skipAfter:END_RULES_91078" + +#Always bad SQL injection case w/ antievasion +SecRule ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|!ARGS:topicseen|!ARGS:message "\b(\d+) ?= ?\1\b|[\'\"](\w+)[\'\"] ?= ?[\'\"]\2\b" "id:340498,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,rev:7,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection (/forums/newreply.php)',logdata:'%{TX.0}',deny,log,auditlog,status:403,phase:2" + +SecMarker END_RULES_91078 + +SecRule REQUEST_FILENAME "/wysiwyg-edit" "phase:2,id:91079,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91080,t:none,pass,nolog,skipAfter:END_RULES_91080" + +SecRule ARGS|!ARGS:PageCopy|!ARGS:S1 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340499,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/wysiwyg-edit)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:PageCopy|!ARGS:S1 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340500,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/wysiwyg-edit)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91080 + +SecRule REQUEST_FILENAME "/mt-comments\.cgi" "phase:2,id:91081,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91082,t:none,pass,nolog,skipAfter:END_RULES_91082" + +SecRule ARGS|!ARGS:static|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340503,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/mt4/mt-comments.cgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:static|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340504,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/mt4/mt-comments.cgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91082 + +SecRule REQUEST_FILENAME "/ajax/check_mandatory_fields\.php" "phase:2,id:91083,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/admin/dogen_display\.php" "phase:2,id:91084,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340014,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340021,ctl:ruleRemovebyID=340027,ctl:ruleRemovebyID=340193,ctl:ruleRemovebyID=340011,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340131,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854,ctl:ruleRemovebyID=390715,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91085,t:none,pass,nolog,skipAfter:END_RULES_91085" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:/referrer/|!ARGS:headerfile|!ARGS:footerfile|!ARGS:insertfile|!ARGS:/file$/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340505,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/ubbthreads/admin/dogen_display.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:/referrer/|!ARGS:headerfile|!ARGS:footerfile|!ARGS:insertfile|!ARGS:/file$/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340506,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/ubbthreads/admin/dogen_display.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91085 + +SecRule REQUEST_FILENAME "/mail\.cgi" "phase:2,id:91086,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/app-modernbill-admin/clients\.php" "phase:2,id:91087,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91088,t:none,pass,nolog,skipAfter:END_RULES_91088" + +SecRule ARGS|!ARGS:emailBody "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340509,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/modernbill5/app-modernbill-admin/clients.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:emailBody "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340510,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/modernbill5/app-modernbill-admin/clients.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91088 + +SecRule REQUEST_FILENAME "/cgi-bin/database/dbpro\.cgi" "phase:2,id:91089,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91090,t:none,pass,nolog,skipAfter:END_RULES_91090" + +SecRule ARGS|!ARGS:admin_email_text "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340511,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/database/dbpro.cgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:admin_email_text "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340512,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/database/dbpro.cgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91090 + +SecRule REQUEST_FILENAME "/admin/patch\.php" "phase:2,id:91091,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=340157" +SecAction "phase:2,id:91092,t:none,pass,nolog,skipAfter:END_RULES_91092" + +SecRule ARGS|!ARGS:patch_query "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table) |delete[[:space:]]*update.+set.+=)" "phase:2,deny,status:403,log,auditlog,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,id:340515,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection (/admin/patch.php)'" +SecRule REQUEST_URI|ARGS|!ARGS:patch_query "(?:(\w+)and(\w+)char\([0-9]+\)|(?:execute|convert)\(|(?:\;delete.*;(?:insert|declare|varchar)|(?:and .* \(select |(?:drop|create)(\w+)table|declare .* varchar\())|convert\(varchar|null,(?:null,(?:null|accesslevel|user_name),|concat\()|union select |union all select )" "phase:2,deny,status:403,log,auditlog,id:344516,t:none,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,t:replaceComments,t:compressWhiteSpace,rev:11,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection (/admin/patch.php)',deny,log,auditlog,status:403,phase:2" + +SecMarker END_RULES_91092 + +SecRule REQUEST_FILENAME "/images/logdnet\.php" "phase:2,id:91093,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91094,t:none,pass,nolog,skipAfter:END_RULES_91094" + +SecRule ARGS|!ARGS:a|!ARGS:u "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340517,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/images/logdnet.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:a|!ARGS:u "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340518,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/images/logdnet.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91094 + +SecRule REQUEST_FILENAME "/contact_form\.php" "phase:2,id:91095,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91096,t:none,pass,nolog,skipAfter:END_RULES_91096" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:Comments|!ARGS:/^Explain_/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340519,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/contact_form.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:Comments|!ARGS:/^Explain_/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340520,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/contact_form.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91096 + +SecRule REQUEST_FILENAME "/forum/register\.php" "phase:2,id:91097,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91098,t:none,pass,nolog,skipAfter:END_RULES_91098" + +SecRule ARGS|!ARGS:s|!ARGS:/page/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/userfield/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340521,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forum/register.ph)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:s|!ARGS:/page/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/userfield/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340522,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/forum/register.ph)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91098 + +SecRule REQUEST_FILENAME "/manager/index\.php" "phase:2,id:91099,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340131,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340855,ctl:ruleRemovebyID=390715,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156" +SecAction "phase:2,id:91100,t:none,pass,nolog,skipAfter:END_RULES_91100" + +SecRule REQUEST_URI|ARGS|!ARGS:post "< ?\?" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,chain,id:360128,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote PHP command exection',deny,log,auditlog,status:403,phase:2" +SecRule REQUEST_URI|ARGS|!ARGS:/^layout/ "(?:(?:chr|fwrite|fopen|system|echr|passthru|serialize|include|php_uname|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo|preg_\w+) ?(?:\(|@|\: ?'?)|system\( ?getenv ?\( ?http_php ?\) ?\))" + +SecRule ARGS|!ARGS:/prefix/|!ARGS:/text/|!ARGS:description|!ARGS:suitability|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/website/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:ta|!ARGS:post|!ARGS:/video/|!ARGS:/^tv/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340523,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/manager/index.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/text/|!ARGS:/prefix/|!ARGS:description|!ARGS:suitability|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/website/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:ta|!ARGS:post|!ARGS:/video/|!ARGS:/^tv/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340524,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/manager/index.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:post|!ARGS:filecontent|!ARGS:/gen_header/|!ARGS:/template/|!ARGS:newcontent|!ARGS:/description/|!ARGS:/text/|!ARGS:/txt/ "include ?\(" "capture,id:350855,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Include File Injection attempt in argument',logdata:'%{TX.0}',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/.*\)" + + +SecRule ARGS|!ARGS:post|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/description/|!ARGS:/text/|!ARGS:Db_submit|!ARGS:/table/|!ARGS:EXPORTTABLE|!ARGS:message|!ARGS:previous_field|ARGS_NAMES|REQUEST_FILENAME|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:X-PageView|!ARGS_NAMES:/varchar/|!ARGS_NAMES:cfg_xsp_password|!ARGS:/body/|!ARGS:runQuery|!ARGS:field_type[]|!ARGS:/^field_type/|!ARGS:/^fieldtype_/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/subject/ "@pmFromFile sql.txt" "capture,id:350160,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,multimatch,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL Injection protection',logdata:'%{TX.0}',deny,log,auditlog,status:403,phase:2" + +SecRule ARGS|XML:/*|!ARGS:post|!ARGS:data|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/descr/|!ARGS:/body/|!ARGS:/text/|!ARGS:fck_tw_body|!ARGS:sub|!ARGS:msg_body|!ARGS:saved_data|!ARGS:fck_body|!ARGS:text|!ARGS:form[pagina_text]|!ARGS:description|!ARGS:message|!ARGS:content "(?:(\w+)(?:user|and)(\w+)char\([0-9]+\)|\b(?:execute|convert)\(|; ?delete.*;(?:insert|declare|varchar)|and .* \( ?select |(?:drop|create)(\w+)table|(?:declare|convert) .* varchar\(|null ?, ?(?:null ?, ?(?:null|accesslevel|user_name)) ?,|concat\(|union select |union all select|\b\W*?cast\b\W*?\(.* as |xecresultset|' ?; ?declare\b\W*?|; ?set @|select (?:load_file|char\()|(?:insert|remark)test;)" "capture,id:350159,t:none,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:replaceComments,t:lowercase,t:compressWhiteSpace,rev:28,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection (MM)',logdata:'%{TX.0}',multiMatch,deny,log,auditlog,status:403,phase:2" + +SecRule REQUEST_URI|XML:/*|ARGS|!ARGS:elements|!ARGS:post|!ARGS:keywords|!ARGS:/sql/|!ARGS:prefix|!ARGS:data|!ARGS:description|!ARGS:alternate1|!ARGS:comment|!ARGS:body|!ARGS:fulldescr|!ARGS:article_content|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/text/|!ARGS:txt|!ARGS:action|!ARGS:Db_submit|!ARGS:saved_data|!ARGS:form[pagina_text]|!ARGS:description|!ARGS:message|!ARGS:steps|!ARGS:fck_body "(?:(\w+)(?:user|and)(\w+)char\([0-9]+\)|(?:execute|convert)\(|; ?delete.*;(?:insert|declare|varchar)|and .* \(select |(?:drop|create)(\w+)table|(?:declare|convert) .* varchar\(|null ?, ?(?:null ?, ?(?:null|accesslevel|user_name)) ?,|concat\(|union select |union all select|\b\W*?cast\b\W*?\(.* as|xecresultset|' ?; ?declare\b\W*?|; ?set @|select (?:load_file|char\()|(?:insert|remark)test;)" "capture,id:350157,t:none,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,rev:32,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection',logdata:'%{TX.0}',deny,log,auditlog,status:403,phase:2" + + +SecMarker END_RULES_91100 + +SecRule REQUEST_FILENAME "/cgi-bin/class/class_add\.pl" "phase:2,id:91101,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91102,t:none,pass,nolog,skipAfter:END_RULES_91102" + +SecRule ARGS|!ARGS:description|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340525,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/class/class_add.pl)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:description|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340526,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/class/class_add.pl)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91102 + +SecRule REQUEST_FILENAME "/insert_image" "phase:2,id:91103,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91104,t:none,pass,nolog,skipAfter:END_RULES_91104" + +SecRule ARGS|!ARGS:DirName "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340527,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/insert_image)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:DirName "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340528,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/insert_uimage)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91104 + +SecRule REQUEST_FILENAME "/administration/news\.php" "phase:2,id:91105,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91106,t:none,pass,nolog,skipAfter:END_RULES_91106" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:body2|!ARGS:/page/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340529,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS ( /administration/news.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:body2|!ARGS:/page/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340530,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/administration/news.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91106 + +SecRule REQUEST_FILENAME "/admin/editor\.php" "phase:2,id:91107,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91108,t:none,pass,nolog,skipAfter:END_RULES_91108" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:/^Dialog/|!ARGS:/textarea/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340531,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/editor.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/page/|!ARGS:/^Dialog/|!ARGS:/textarea/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340532,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/editor.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91108 + +SecRule REQUEST_FILENAME "/cgi-sys/formmail\.cgi" "phase:2,id:91109,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91110,t:none,pass,nolog,skipAfter:END_RULES_91110" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:Recommendations|!ARGS:Comments|!ARGS:background|!ARGS:redirect|!ARGS:/site/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340533,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-sys/FormMail.cgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:Recommendations|!ARGS:Comments|!ARGS:background|!ARGS:redirect|!ARGS:/site/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340544,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-sys/FormMail.cgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91110 + +SecRule REQUEST_FILENAME "/frame\.aspx" "phase:2,id:91111,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91112,t:none,pass,nolog,skipAfter:END_RULES_91112" + +SecRule ARGS|!ARGS:u "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340545,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/frame.aspx)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:u "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340546,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/frame.aspx)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91112 + +SecRule REQUEST_FILENAME "/spaw/gethref\.php" "phase:2,id:91113,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91114,t:none,pass,nolog,skipAfter:END_RULES_91114" + +SecRule ARGS|!ARGS:img "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340547,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/spaw/gethref.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:img "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340548,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/spaw/gethref.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91114 + +SecRule REQUEST_FILENAME "/cgi-bin/mt/mt\.fcgi" "phase:2,id:91115,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91116,t:none,pass,nolog,skipAfter:END_RULES_91116" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/text/|!ARGS:/description/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340549,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/mt/mt.fcgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/text/|!ARGS:/description/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340550,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/mt/mt.fcgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91116 + +SecRule REQUEST_FILENAME "/modules/google_cse/google_cse\.js" "phase:2,id:91117,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371" + +SecRule REQUEST_FILENAME "/runmodule\.php" "phase:2,id:91118,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91119,t:none,pass,nolog,skipAfter:END_RULES_91119" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^item_number/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340551,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/runmodule.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^item_number/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340552,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/runmodule.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91119 + +SecRule REQUEST_FILENAME "/admin/frame\.php" "phase:2,id:91120,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91121,t:none,pass,nolog,skipAfter:END_RULES_91121" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:pagina "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340553,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/frame.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^item_number/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340554,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/frame.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91121 + +SecRule REQUEST_FILENAME "/videos/install" "phase:2,id:91122,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91123,t:none,pass,nolog,skipAfter:END_RULES_91123" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:sitefolder "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340555,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/videos/install)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:sitefolder "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340556,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/videos/install)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91123 + +SecRule REQUEST_FILENAME "/support/staff/index\.php" "phase:2,id:91124,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91125,t:none,pass,nolog,skipAfter:END_RULES_91125" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/contents/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340557,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/support/staff/index.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/contents/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340558,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/support/staff/index.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91125 + +SecRule REQUEST_FILENAME "/cgi-bin/procform\.pl" "phase:2,id:91126,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91127,t:none,pass,nolog,skipAfter:END_RULES_91127" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:banner|!ARGS:backlink|!ARGS:Requests/Comments "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340559,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/procform.pl)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:banner|!ARGS:backlink|!ARGS:Requests/Comments "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340560,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/procform.pl)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91127 + +SecRule REQUEST_FILENAME "/editcontent\.php" "phase:2,id:91128,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340161" +SecAction "phase:2,id:91129,t:none,pass,nolog,skipAfter:END_RULES_91129" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^content_/|!ARGS:/link/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340561,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/editcontent.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^content_/|!ARGS:/link/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340562,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/admin/editcontent.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91129 + +SecRule REQUEST_FILENAME "/html2rss/rss\.aspx" "phase:2,id:91130,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91131,t:none,pass,nolog,skipAfter:END_RULES_91131" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:U "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340563,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/html2rss/rss.aspx)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:U "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340564,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/html2rss/rss.aspx)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91131 + +SecRule REQUEST_FILENAME "/winnder_step2\.1\.php" "phase:2,id:91132,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91133,t:none,pass,nolog,skipAfter:END_RULES_91133" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:rules|!ARGS:terms "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340565,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS ( /winnder_step2.1.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:rules|!ARGS:terms "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340566,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS ( /winnder_step2.1.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91133 + +SecRule REQUEST_FILENAME "/contact/website\.php" "phase:2,id:91134,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91135,t:none,pass,nolog,skipAfter:END_RULES_91135" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:txtComments "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340567,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/contact/website.php )',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:txtComments "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340568,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/contact/website.php )',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91135 + +SecRule REQUEST_FILENAME "/acp/template\.php" "phase:2,id:91136,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91137,t:none,pass,nolog,skipAfter:END_RULES_91137" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:template "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340569,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/wbb/acp/template.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:template "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340570,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/wbb/acp/template.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91137 + +SecRule REQUEST_FILENAME "/sregister2-p\.php" "phase:2,id:91138,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019" +SecAction "phase:2,id:91139,t:none,pass,nolog,skipAfter:END_RULES_91139" + + +SecRule ARGS|!ARGS:message|!ARGS:/^SQL/|!ARGS:query_string|!ARGS:query|!ARGS:description|!ARGS:skills "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table)|delete[[:space:]]*update.+set.+=)" "t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:346144,rev:12,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection (/sregister2-p.php)',deny,log,auditlog,status:403,phase:2" + +SecMarker END_RULES_91139 + +SecRule REQUEST_FILENAME "/posting\.php" "phase:2,id:91140,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=390711" +SecAction "phase:2,id:91141,t:none,pass,nolog,skipAfter:END_RULES_91141" + +SecRule ARGS|ARGS_NAMES|REQUEST_FILENAME|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|!ARGS:/message/|!ARGS:/post/|!ARGS:/body/|!ARGS:/msg/|!ARGS:/text/|!ARGS:/txt/|!ARGS:topicseen|!ARGS_NAMES:posted_data[product_substring] "\b(\d+) ?= ?\1\b|[\'\"](\w+)[\'\"] ?= ?[\'\"]\2\b" "id:344156,capture,t:none,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection (/posting.php)',logdata:'%{TX.0}',deny,log,auditlog,status:403,phase:2" + +SecMarker END_RULES_91141 + +SecRule REQUEST_FILENAME "/phpmysupport/trackerimage\.php" "phase:2,id:91142,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340026,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91143,t:none,pass,nolog,skipAfter:END_RULES_91143" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:base "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340571,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/phpmysupport/trackerimage.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:base "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340572,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/phpmysupport/trackerimage.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91143 + +SecRule REQUEST_FILENAME "/chat\.php" "phase:2,id:91144,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91145,t:none,pass,nolog,skipAfter:END_RULES_91145" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:dep|!ARGS:protocol "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340573,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/chat.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:prfl|!ARGS:prtcl|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:dep|!ARGS:protocol|!ARGS:psswrd "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340574,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/chat.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91145 + +SecRule REQUEST_FILENAME "/wp-admin/edit\.php" "phase:2,id:91146,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=390707,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91147,t:none,pass,nolog,skipAfter:END_RULES_91147" + +#SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:wpau-ftphost|!ARGS:adsensem-code|!ARGS:addresses|!ARGS:referredby|!ARGS:adrotate_bannercode "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340575,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/wp-admin/edit.php)'" +#SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +#SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:wpau-ftphost|!ARGS:adsensem-code|!ARGS:addresses|!ARGS:referredby|!ARGS:adrotate_bannercode "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340576,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/wp-admin/edit.php)'" +#SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91147 + +SecRule REQUEST_FILENAME "/egroupware/etemplate/process_exec\.php" "phase:2,id:91148,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91149,t:none,pass,nolog,skipAfter:END_RULES_91149" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:exec[text]|!ARGS:/link/|!ARGS:/referer/|!ARGS:/site/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340577,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/egroupware/etemplate/process_exec.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:exec[text]|!ARGS:/link/|!ARGS:/referer/|!ARGS:/site/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340578,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/egroupware/etemplate/process_exec.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91149 + +SecRule REQUEST_FILENAME "/install\.php" "phase:2,id:91150,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854,ctl:ruleRemovebyID=341057,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/acollab/install/install\.php" "phase:2,id:91151,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91152,t:none,pass,nolog,skipAfter:END_RULES_91152" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:upload_dir "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340581,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/acollab/install/install.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:upload_dir "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340582,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/acollab/install/install.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91152 + +SecRule REQUEST_FILENAME "/includes/popup\.php" "phase:2,id:91153,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91154,t:none,pass,nolog,skipAfter:END_RULES_91154" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:z "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340583,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/includes/popup.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:z "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340584,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/includes/popup.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91154 + +SecRule REQUEST_FILENAME "/cgi-bin/cgiemail/testform\.txt" "phase:2,id:91155,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91156,t:none,pass,nolog,skipAfter:END_RULES_91156" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:success "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340585,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/cgiemail/testform.txt)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:success "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340586,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-bin/cgiemail/testform.txt)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91156 + +SecRule REQUEST_FILENAME "/admin/doeditboard\.php" "phase:2,id:91157,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91158,t:none,pass,nolog,skipAfter:END_RULES_91158" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:headerfile|!ARGS:intro_body "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340587,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/ubbthreads/admin/doeditboard.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:headerfile|!ARGS:intro_body "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340588,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/ubbthreads/admin/doeditboard.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91158 + +SecRule REQUEST_FILENAME "/admin/item_processor\.php" "phase:2,id:91159,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91160,t:none,pass,nolog,skipAfter:END_RULES_91160" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:pictureremote "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340589,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/anyinventory/admin/item_processor.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:pictureremote "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340590,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/anyinventory/admin/item_processor.php)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91160 + +SecRule REQUEST_FILENAME "/modules/fckeditor/fckeditor/editor/filemanager/browser/default/browser\.html" "phase:2,id:91161,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91162,t:none,pass,nolog,skipAfter:END_RULES_91162" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:Connector "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340591,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/default/browser.html)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:Connector "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340592,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/default/browser.html)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91162 + +SecRule REQUEST_FILENAME "/modules/mod_shoutbox\.php" "phase:2,id:91163,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91164,t:none,pass,nolog,skipAfter:END_RULES_91164" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:c|!ARGS:metodista "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:341592,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:c|!ARGS:metodista "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340593,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91164 + +SecRule REQUEST_FILENAME "/wp-admin/options\.php" "phase:2,id:91165,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=380026" + +SecRule REQUEST_FILENAME "/wp-admin/options-general\.php" "phase:2,id:91166,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340213,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/app-modernbill-admin/configs\.php" "phase:2,id:91167,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91168,t:none,pass,nolog,skipAfter:END_RULES_91168" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^settings/|!ARGS:/^configParams/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340596,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^settings/|!ARGS:/^configParams/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340597,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91168 + +SecRule REQUEST_FILENAME "/cgi-bin/formmail\.pl" "phase:2,id:91169,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cgi-bin/formmail\.pl" "phase:2,id:91170,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91171,t:none,pass,nolog,skipAfter:END_RULES_91171" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:Recommendations|!ARGS:Comments|!ARGS:background|!ARGS:redirect|!ARGS:/site/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340598,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-sys/FormMail.cgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:Recommendations|!ARGS:Comments|!ARGS:background|!ARGS:redirect|!ARGS:/site/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340599,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (/cgi-sys/FormMail.cgi)',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91171 + +SecRule REQUEST_FILENAME "/mainsettings\.php" "phase:2,id:91172,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91173,t:none,pass,nolog,skipAfter:END_RULES_91173" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^settings/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340600,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^settings/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340601,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91173 + +SecRule REQUEST_FILENAME "/site\.php" "phase:2,id:91174,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91175,t:none,pass,nolog,skipAfter:END_RULES_91175" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:dict "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340602,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:dict "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340603,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91175 + +SecRule REQUEST_FILENAME "/admin/ciadmin\.php" "phase:2,id:91176,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91177,t:none,pass,nolog,skipAfter:END_RULES_91177" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:securebase1|!ARGS:base1 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340604,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:securebase1|!ARGS:base1 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340605,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91177 + +SecRule REQUEST_FILENAME "/category\.php" "phase:2,id:91178,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91179,t:none,pass,nolog,skipAfter:END_RULES_91179" + +SecRule ARGS|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/page/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:desc|!ARGS:template "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340607,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/page/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:desc|!ARGS:template "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340608,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91179 + +SecRule REQUEST_FILENAME "/modules/newbbex/post\.php" "phase:2,id:91180,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91181,t:none,pass,nolog,skipAfter:END_RULES_91181" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:hidden|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340609,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:hidden|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340610,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91181 + +SecRule REQUEST_FILENAME "/cgi-bin/mb/index2\.cgi" "phase:2,id:91182,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91183,t:none,pass,nolog,skipAfter:END_RULES_91183" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:index|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340611,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:index|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340612,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91183 + +SecRule REQUEST_FILENAME "/cerberus/parser\.php" "phase:2,id:91184,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91185,t:none,pass,nolog,skipAfter:END_RULES_91185" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:xml|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340613,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:xml|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340614,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91185 + +SecRule REQUEST_FILENAME "/imp/expand\.php" "phase:2,id:91186,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91187,t:none,pass,nolog,skipAfter:END_RULES_91187" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:field_value|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340615,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:field_value|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340616,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91187 + +SecRule REQUEST_FILENAME "/livehelp/mastersettings\.php" "phase:2,id:91188,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91189,t:none,pass,nolog,skipAfter:END_RULES_91189" + +SecRule ARGS|!ARGS:server|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:newwebpath|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340617,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:server|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:newwebpath|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340618,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91189 + +SecRule REQUEST_FILENAME "/manager/edit_template\.php" "phase:2,id:91190,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91191,t:none,pass,nolog,skipAfter:END_RULES_91191" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:template|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340619,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:template|!ARGS:message|!ARGS:subject "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340620,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91191 + +SecRule REQUEST_FILENAME "/clip/index\.php" "phase:2,id:91192,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91193,t:none,pass,nolog,skipAfter:END_RULES_91193" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:route_to "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340621,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:route_to "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340622,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91193 + +SecRule REQUEST_FILENAME "/moduleinterface\.php" "phase:2,id:91194,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91195,t:none,pass,nolog,skipAfter:END_RULES_91195" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/template/|!ARGS:/^m1/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340623,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/template/|!ARGS:/^m1/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340624,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91195 + +SecRule REQUEST_FILENAME "/cpanel/savetype\.php" "phase:2,id:91196,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91197,t:none,pass,nolog,skipAfter:END_RULES_91197" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:embed "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340625,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:embed "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340626,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91197 + +SecRule REQUEST_FILENAME "/admin/basic_settings\.php" "phase:2,id:91198,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91199,t:none,pass,nolog,skipAfter:END_RULES_91199" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:custom_promo_code "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340627,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:custom_promo_code "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340628,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91199 + +SecRule REQUEST_FILENAME "/admin/site_setup\.php" "phase:2,id:91200,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91201,t:none,pass,nolog,skipAfter:END_RULES_91201" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:site_path "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340629,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:site_path "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340630,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91201 + +SecRule REQUEST_FILENAME "/shopadmin/core\.php" "phase:2,id:91202,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91203,t:none,pass,nolog,skipAfter:END_RULES_91203" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:offer_copyright|!ARGS:offerDomain|!ARGS:con|!ARGS:offer_contactus|!ARGS:content|!ARGS:mail_content|!ARGS:reply "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340631,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:offer_copyright|!ARGS:offerDomain|!ARGS:con|!ARGS:offer_contactus|!ARGS:content|!ARGS:mail_content|!ARGS:reply "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340632,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91203 + +SecRule REQUEST_FILENAME "/system/index\.php" "phase:2,id:91204,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91205,t:none,pass,nolog,skipAfter:END_RULES_91205" + +SecRule ARGS|!ARGS:/location/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^template/|!ARGS:/^field_id/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,deny,log,auditlog,status:403,id:340633,phase:2,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/location/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^template/|!ARGS:/^field_id/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340634,phase:2,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91205 + +SecRule REQUEST_FILENAME "/mailer/truefm\.php" "phase:2,id:91206,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91207,t:none,pass,nolog,skipAfter:END_RULES_91207" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:forward|!ARGS:body_tag|!ARGS:http_referer|!ARGS:Address|!ARGS:Comment "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340635,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:forward|!ARGS:body_tag|!ARGS:http_referer|!ARGS:Address|!ARGS:Comment "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340636,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91207 + +SecRule REQUEST_FILENAME "/ummmanager\.cgi" "phase:2,id:91208,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91209,t:none,pass,nolog,skipAfter:END_RULES_91209" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:login "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340637,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:login "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340638,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91209 + +SecRule REQUEST_FILENAME "/install/step6\.php" "phase:2,id:91210,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91211,t:none,pass,nolog,skipAfter:END_RULES_91211" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^site_/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340639,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^site_/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340640,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91211 + +SecRule REQUEST_FILENAME "/homecounter\.php" "phase:2,id:91212,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340024,ctl:ruleRemovebyID=340028,ctl:ruleRemovebyID=340151" + +SecRule REQUEST_FILENAME "/admincp/options\.php" "phase:2,id:91213,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91214,t:none,pass,nolog,skipAfter:END_RULES_91214" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:site_path|!ARGS:/^setting/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340641,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:site_path|!ARGS:/^setting/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340642,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91214 + +SecRule REQUEST_FILENAME "/media/hochron\.html" "phase:2,id:91215,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91216,t:none,pass,nolog,skipAfter:END_RULES_91216" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:MemberSelectList "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340643,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:MemberSelectList "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340644,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91216 + +SecRule REQUEST_FILENAME "/admin/settings/index\.php" "phase:2,id:91217,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91218,t:none,pass,nolog,skipAfter:END_RULES_91218" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^settings/|!ARGS:metaDescription "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340645,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^settings/|!ARGS:metaDescription "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340646,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91218 + +SecRule REQUEST_FILENAME "/cmspopouts/shortcuts\.php" "phase:2,id:91219,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91220,t:none,pass,nolog,skipAfter:END_RULES_91220" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:target_title "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340647,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:target_title "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340648,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91220 + +SecRule REQUEST_FILENAME "/manufacturers_edit\.php" "phase:2,id:91221,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91222,t:none,pass,nolog,skipAfter:END_RULES_91222" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^edit/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340649,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^edit/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340650,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91222 + +SecRule REQUEST_FILENAME "/admin/contactmanage\.php" "phase:2,id:91223,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91224,t:none,pass,nolog,skipAfter:END_RULES_91224" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:response "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340651,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:response "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340652,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91224 + +SecRule REQUEST_FILENAME "/giftcert\.php" "phase:2,id:91225,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91226,t:none,pass,nolog,skipAfter:END_RULES_91226" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:recipient_address "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340653,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:recipient_address "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340654,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91226 + +SecRule REQUEST_FILENAME "/pages/news\.htm" "phase:2,id:91227,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91228,t:none,pass,nolog,skipAfter:END_RULES_91228" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:store "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340655,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:store "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340656,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91228 + +SecRule REQUEST_FILENAME "/bb-login\.php" "phase:2,id:91229,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91230,t:none,pass,nolog,skipAfter:END_RULES_91230" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:re|!ARGS:_wp_http_referer "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340657,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:re|!ARGS:_wp_http_referer "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340658,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91230 + +SecRule REQUEST_FILENAME "/adview\.php" "phase:2,id:91231,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91232,t:none,pass,nolog,skipAfter:END_RULES_91232" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:target1 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340659,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:target1 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340660,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91232 + +SecRule REQUEST_FILENAME "/ajcart/cart\.php" "phase:2,id:91233,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91234,t:none,pass,nolog,skipAfter:END_RULES_91234" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:CARTDIR "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340661,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:CARTDIR "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340662,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91234 + +SecRule REQUEST_FILENAME "/index\.php/install/-/configure" "phase:2,id:91235,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91236,t:none,pass,nolog,skipAfter:END_RULES_91236" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:DIR_REL "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:341661,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:DIR_REL "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:341662,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91236 + +SecRule REQUEST_FILENAME "/store/zc_install/index\.php" "phase:2,id:91237,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin_config\.php" "phase:2,id:91238,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91239,t:none,pass,nolog,skipAfter:END_RULES_91239" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:pagename "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340663,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:pagename "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340664,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91239 + +SecRule REQUEST_FILENAME "/cutenews/index\.php" "phase:2,id:91240,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91241,t:none,pass,nolog,skipAfter:END_RULES_91241" + +SecRule ARGS|!ARGS:/http_script_dir/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:change_avatar|!ARGS:short_story "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340665,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/http_script_dir/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:change_avatar|!ARGS:short_story "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340666,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91241 + +SecRule REQUEST_FILENAME "/data/nanoadmin\.php" "phase:2,id:91242,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91243,t:none,pass,nolog,skipAfter:END_RULES_91243" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^areaContent/|!ARGS:content "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340667,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^areaContent/|!ARGS:content "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340668,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91243 + +SecRule REQUEST_FILENAME "/auctions/rsstml\.php" "phase:2,id:91244,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91245,t:none,pass,nolog,skipAfter:END_RULES_91245" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:XML "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340669,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:XML "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340670,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91245 + +SecRule REQUEST_FILENAME "/install/util\.php" "phase:2,id:91246,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340157" + +SecRule REQUEST_FILENAME "/egroupware/index\.php" "phase:2,id:91247,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91248,t:none,pass,nolog,skipAfter:END_RULES_91248" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^newssettings/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340672,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^newssettings/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340673,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91248 + +SecRule REQUEST_FILENAME "/lclaccounts/setup/config\.php" "phase:2,id:91249,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91250,t:none,pass,nolog,skipAfter:END_RULES_91250" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^newssettings/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:341672,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^newssettings/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:341673,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91250 + +SecRule REQUEST_FILENAME "/admin/post_property\.php" "phase:2,id:91251,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91252,t:none,pass,nolog,skipAfter:END_RULES_91252" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:map|!ARGS:photo "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340674,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:map|!ARGS:photo "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340675,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91252 + +SecRule REQUEST_FILENAME "/filemanager/browser/default/browser\.html" "phase:2,id:91253,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91254,t:none,pass,nolog,skipAfter:END_RULES_91254" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:Connector "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340676,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:Connector "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340677,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91254 + +SecRule REQUEST_FILENAME "/admin\.mvc" "phase:2,id:91255,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91256,t:none,pass,nolog,skipAfter:END_RULES_91256" + +SecRule ARGS|!ARGS:/description/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/CFM_Fields/|!ARGS:Store_MvUPS_Server|!ARGS:/^Store_CustomerEmail_/|!ARGS:Store_OUI_GlobalHeader|!ARGS:Store_OUI_GlobalFooter|!ARGS:Store_OUI_InvoiceFooter "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340678,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/description/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/CFM_Fields/|!ARGS:Store_MvUPS_Server|!ARGS:/^Store_CustomerEmail_/|!ARGS:Store_OUI_GlobalHeader|!ARGS:Store_OUI_GlobalFooter|!ARGS:Store_OUI_InvoiceFooter "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340679,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91256 + +SecRule REQUEST_FILENAME "/delivery/ck\.php" "phase:2,id:91257,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91258,t:none,pass,nolog,skipAfter:END_RULES_91258" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:oaparam__bannerid|!ARGS:oaparams "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340680,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:oaparam__bannerid|!ARGS:oaparams "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340681,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91258 + +SecRule REQUEST_FILENAME "/proxy/index\.php" "phase:2,id:91259,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91260,t:none,pass,nolog,skipAfter:END_RULES_91260" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:q "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340682,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:q "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340683,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91260 + +SecRule REQUEST_FILENAME "^/imp/" "phase:2,id:91261,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91262,t:none,pass,nolog,skipAfter:END_RULES_91262" + +SecRule ARGS|!ARGS:DefaultZDM|!ARGS:/http/|!ARGS:/refer/|!ARGS:/redirect/|!ARGS:subject|!ARGS:imapuser|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:u|!ARGS:message|!ARGS:/msg/|!ARGS:formData|!ARGS:form_img "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340684,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:9,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:DefaultZDM|!ARGS:/http/|!ARGS:/refer/|!ARGS:/redirect/|!ARGS:subject|!ARGS:imapuser|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:u|!ARGS:message|!ARGS:/msg/|!ARGS:formData|!ARGS:form_img "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340685,rev:9,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91262 + +SecRule REQUEST_FILENAME "modules/mod_wowstatus/wowserverstatus\.php" "phase:2,id:91263,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/ucp\.php" "phase:2,id:91264,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91265,t:none,pass,nolog,skipAfter:END_RULES_91265" + +SecRule ARGS|!ARGS:/website/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/twitter/|!ARGS:/google/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:mode|!ARGS:message|!ARGS:remotelink|!ARGS:website|!ARGS:signature "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340686,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,deny,log,auditlog,status:403,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/website/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/twitter/|!ARGS:/google/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:mode|!ARGS:message|!ARGS:remotelink|!ARGS:website|!ARGS:signature "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,deny,log,auditlog,status:403,multimatch,id:340687,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91265 + +SecRule REQUEST_FILENAME "/app-modernbill-admin/configs\.php" "phase:2,id:91266,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91267,t:none,pass,nolog,skipAfter:END_RULES_91267" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^configParams/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340690,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^configParams/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340691,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91267 + +SecRule REQUEST_FILENAME "/sysadminarea\.php" "phase:2,id:91268,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91269,t:none,pass,nolog,skipAfter:END_RULES_91269" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^configParams/|!ARGS:/^update/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340692,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^configParams/|!ARGS:/^update/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340693,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91269 + +SecRule REQUEST_FILENAME "/download\.php" "phase:2,id:91270,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91271,t:none,pass,nolog,skipAfter:END_RULES_91271" + +SecRule ARGS|!ARGS:/link/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:file|!ARGS:referer "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340694,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/link/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:file|!ARGS:referer "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340695,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91271 + +SecRule REQUEST_FILENAME "/net2ftp_installer\.php" "phase:2,id:91272,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91273,t:none,pass,nolog,skipAfter:END_RULES_91273" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:package "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340696,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:package "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340697,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91273 + +SecRule REQUEST_FILENAME "/mediaplayer\.swf" "phase:2,id:91274,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91275,t:none,pass,nolog,skipAfter:END_RULES_91275" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:file "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340698,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:file "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340699,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91275 + +SecRule REQUEST_FILENAME "/adm-misc\.php" "phase:2,id:91276,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91277,t:none,pass,nolog,skipAfter:END_RULES_91277" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:3|!ARGS:body|!ARGS:/txt/|!ARGS:/text/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340700,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:3|!ARGS:body|!ARGS:/txt/|!ARGS:/text/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340701,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91277 + +SecRule REQUEST_FILENAME "/piwik\.php" "phase:2,id:91278,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91279,t:none,pass,nolog,skipAfter:END_RULES_91279" + +SecRule ARGS|!ARGS:action_name|!ARGS:q|!ARGS:/ref/|!ARGS:link|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:download "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340702,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:action_name|!ARGS:q|!ARGS:/ref/|!ARGS:link|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:download "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:urlDecodeUni,t:none,t:htmlEntityDecode,multimatch,id:340703,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91279 + +SecRule REQUEST_FILENAME "/admin/file_edit\.php" "phase:2,id:91280,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91281,t:none,pass,nolog,skipAfter:END_RULES_91281" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:download|!ARGS:filebody "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340704,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:download|!ARGS:filebody "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340705,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91281 + +SecRule REQUEST_FILENAME "/wp-admin/plugin-editor\.php" "phase:2,id:91282,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=380006,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=390715,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020" +SecAction "phase:2,id:91283,t:none,pass,nolog,skipAfter:END_RULES_91283" + +SecRule ARGS "(?:(?:eval|passthru) ?\( ?(?:base64_decode|gz(?:inflate|decode|encode)) ?\(|str_rot13 ?\()" "t:none,t:urlDecodeUni,t:htmlEntityDecode,multimatch,id:344729,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Potentially malicious code injection via WP plugin-editor',deny,log,auditlog,status:403,phase:2" +SecRule ARGS "(?:(?:eval|passthru) ?\( ?(?:base64_decode|gz(?:inflate|decode|encode)) ?\(|str_rot13 ?\()" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhitespace,id:344730,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Potentially malicious code injection via WP plugin-editor',deny,log,auditlog,status:403,phase:2" +SecRule ARGS "(?:(?:eval|passthru) ?\( ?(?:base64_decode|gz(?:inflate|decode|encode)) ?\(|str_rot13 ?\()" "t:none,t:compressWhitespace,id:344731,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Potentially malicious code injection via WP plugin-editor',deny,log,auditlog,status:403,phase:2" + +SecMarker END_RULES_91283 + +SecRule REQUEST_FILENAME "/fplayer\.swf" "phase:2,id:91284,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91285,t:none,pass,nolog,skipAfter:END_RULES_91285" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:config "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340706,chain,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:config "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340707,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91285 + +SecRule REQUEST_FILENAME "/mailer/images\.php" "phase:2,id:91286,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340084" + +SecRule REQUEST_FILENAME "/mailer/redir\.php" "phase:2,id:91287,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340084" + +SecRule REQUEST_FILENAME "/sqlpatch\.php" "phase:2,id:91288,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/tbl_select\.php" "phase:2,id:91289,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/cgi-bin/cart\.cgi" "phase:2,id:91290,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91291,t:none,pass,nolog,skipAfter:END_RULES_91291" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/image/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340708,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/image/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340709,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91291 + +SecRule REQUEST_FILENAME "/tce_file\.php" "phase:2,id:91292,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91293,t:none,pass,nolog,skipAfter:END_RULES_91293" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/file/|!ARGS:redirect "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340710,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/file/|!ARGS:redirect "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340711,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91293 + +SecRule REQUEST_FILENAME "/writetosfdc\.php" "phase:2,id:91294,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91295,t:none,pass,nolog,skipAfter:END_RULES_91295" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/file/|!ARGS:redirect|!ARGS:/write/|!ARGS:/Past/|!ARGS:Reference_1_Contact_Info__c "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340712,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/file/|!ARGS:redirect|!ARGS:/write/|!ARGS:/Past/|!ARGS:Reference_1_Contact_Info__c "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340713,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91295 + +SecRule REQUEST_FILENAME "/admin/nmanage\.php" "phase:2,id:91296,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91297,t:none,pass,nolog,skipAfter:END_RULES_91297" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/file/|!ARGS:redirect|!ARGS:news "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "id:340714,t:none,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/file/|!ARGS:redirect|!ARGS:news "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340715,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91297 + +SecRule REQUEST_FILENAME "/login\.php" "phase:2,id:91298,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=390709,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340148" +SecAction "phase:2,id:91299,t:none,pass,nolog,skipAfter:END_RULES_91299" + + +SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|!ARGS:pass "(?:\b(?:\.(?:ht(?:access|passwd|group)|www_?acl)|global\.asa|httpd\.conf|boot\.ini)\b|\/etc\/)" "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,msg:'Atomicorp.com WAF Rules: Attempt to Access protect file Remotely',id:'320465',rev:1,logdata:'%{TX.0}',severity:'2',deny,status:403,phase:2" +SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie "(?:\b(?:\.(?:ht(?:access|passwd|group)|www_?acl)|global\.asa|httpd\.conf|boot\.ini)\b|\/etc\/)" "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,msg:'Atomicorp.com WAF Rules: Attempt to Access protect file Remotely',id:'320466',rev:1,logdata:'%{TX.0}',severity:'2',deny,status:403,phase:2" + +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:X-PageView|!REQUEST_HEADERS:Cookie|!REQUEST_HEADERS:REFERER|ARGS|!ARGS:pass|!ARGS:returnto|!ARGS:php|!ARGS:nextpage "(?:/(?:etc|proc|var/tmp|usr|opt|s?bin|dev|kern|[br]oot|sys|windows|winnt)/|(?:\/|\\\\)+inetpub|localstart\.asp|boot\.ini)" "t:normalisePath,capture,id:320464,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Protected Path Access denied in URI/ARGS',logdata:'%{TX.0}',deny,log,auditlog,status:403,phase:2" + +SecRule ARGS|!ARGS:scope|!ARGS:/link/|!ARGS:/openid/|!ARGS:/contact_map/|!ARGS:server|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/return/|!ARGS:password|!ARGS:ref|!ARGS:location|!ARGS:takeback|!ARGS:return|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:referrer|!ARGS:/homepage/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)\:/" "id:340716,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:8,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:scope|!ARGS:/link/|!ARGS:/openid/|!ARGS:/contact_map/|!ARGS:server|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/return/|!ARGS:password|!ARGS:ref|!ARGS:location|!ARGS:takeback|!ARGS:return|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:referrer|!ARGS:/homepage/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)\:/" "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340717,rev:8,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',deny,log,auditlog,status:403,phase:2" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/[head]/|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:move2|!ARGS:input[Desarrollo]|!ARGS:hoperation|!ARGS:arg2|!ARGS:login_form|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:/submitcode/|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(ht|f)tps?)\:/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|< ?/?i?frame|\%env)" "t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,multiMatch,capture,id:360030,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}',deny,log,auditlog,status:403,phase:2" + + +SecMarker END_RULES_91299 + +SecRule REQUEST_FILENAME "/amember/admin/email\.php" "phase:2,id:91300,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91301,t:none,pass,nolog,skipAfter:END_RULES_91301" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:vars "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340718,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:vars "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340719,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91301 + +SecRule REQUEST_FILENAME "/webinstall\.php" "phase:2,id:91302,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91303,t:none,pass,nolog,skipAfter:END_RULES_91303" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:mirror|!ARGS:ftp_server "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340720,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:mirror|!ARGS:ftp_server "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340721,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91303 + +SecRule REQUEST_FILENAME "/pap\.swf" "phase:2,id:91304,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91305,t:none,pass,nolog,skipAfter:END_RULES_91305" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:v1 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340722,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:v1 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340723,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91305 + +SecRule REQUEST_FILENAME "/fckeditor\.html" "phase:2,id:91306,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91307,t:none,pass,nolog,skipAfter:END_RULES_91307" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:CustomConfigurationsPath "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,id:340724,phase:2,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:CustomConfigurationsPath "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340725,phase:2,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91307 + +SecRule REQUEST_FILENAME "/timthumb\.php" "phase:2,id:91308,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91309,t:none,pass,nolog,skipAfter:END_RULES_91309" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,id:340726,chain,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340727,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + + +SecMarker END_RULES_91309 + +SecRule REQUEST_FILENAME "/phpthumb\.php" "phase:2,id:91310,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91311,t:none,pass,nolog,skipAfter:END_RULES_91311" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,id:375726,chain,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:375737,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + + +SecMarker END_RULES_91311 + +SecRule REQUEST_FILENAME "/phpthumb/phpthumb\.php" "phase:2,id:91312,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91313,t:none,pass,nolog,skipAfter:END_RULES_91313" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,id:376726,chain,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:375727,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecMarker END_RULES_91313 + +SecRule REQUEST_FILENAME "/upload\.php" "phase:2,id:91314,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + + +SecRule REQUEST_FILENAME "/idevaffiliate/admin/setup\.php" "phase:2,id:91315,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91316,t:none,pass,nolog,skipAfter:END_RULES_91316" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:full_path "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,id:340730,phase:2,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:full_path "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340731,phase:2,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91316 + +SecRule REQUEST_FILENAME "/install/index\.php" "phase:2,id:91317,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/tbl_create\.php" "phase:2,id:91318,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/view_create\.php" "phase:2,id:91319,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/tbl_select\.php" "phase:2,id:91320,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/tbl_addfield\.php" "phase:2,id:91321,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/tbl_change\.php" "phase:2,id:91322,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/phpmyadmin/" "phase:2,id:91323,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/movieonline\.php" "phase:2,id:91324,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91325,t:none,pass,nolog,skipAfter:END_RULES_91325" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:list "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340732,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:list "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340733,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91325 + +SecRule REQUEST_FILENAME "/listings/client\.php" "phase:2,id:91326,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91327,t:none,pass,nolog,skipAfter:END_RULES_91327" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:line3 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340734,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:line3 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340735,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91327 + +SecRule REQUEST_FILENAME "/test_index\.php" "phase:2,id:91328,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91329,t:none,pass,nolog,skipAfter:END_RULES_91329" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:rf "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340736,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:rf "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340737,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91329 + +SecRule REQUEST_FILENAME "/recommend\.cgi" "phase:2,id:91330,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91331,t:none,pass,nolog,skipAfter:END_RULES_91331" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:name "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340738,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:name "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340739,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91331 + +SecRule REQUEST_FILENAME "/goodscounter\.php" "phase:2,id:91332,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340151" +SecAction "phase:2,id:91333,t:none,pass,nolog,skipAfter:END_RULES_91333" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:u|!ARGS:cof|!ARGS:ureferrer "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340740,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:u|!ARGS:cof|!ARGS:ureferrer "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340741,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91333 + +SecRule REQUEST_FILENAME "/fla_video\.swf" "phase:2,id:91334,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/admin/admin_board\.php" "phase:2,id:91335,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91336,t:none,pass,nolog,skipAfter:END_RULES_91336" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:sql|!ARGS:address_whois "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340742,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:sql|!ARGS:address_whois "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340743,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91336 + +SecRule REQUEST_FILENAME "/search_results\.php" "phase:2,id:91337,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91338,t:none,pass,nolog,skipAfter:END_RULES_91338" + +SecRule ARGS|!ARGS:server_protocol|!ARGS:databasehost|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:act "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:341744,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:server_protocol|!ARGS:databasehost|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:act "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:341745,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91338 + +SecRule REQUEST_FILENAME "/wp-content/plugins/wordtube/lib/statistic\.php" "phase:2,id:91339,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91340,t:none,pass,nolog,skipAfter:END_RULES_91340" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:file "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340746,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:file "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340747,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91340 + +SecRule REQUEST_FILENAME "/paadmin/categories\.php" "phase:2,id:91341,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380011" + +SecRule REQUEST_FILENAME "/alt_clickmenu\.php" "phase:2,id:91342,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/get\.php" "phase:2,id:91343,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/admin-ajax\.php" "phase:2,id:91344,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340855,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=390703,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=380006,ctl:ruleRemovebyID=390614,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340213,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340158,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=340018,ctl:ruleRemovebyID=390708,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" +SecAction "phase:2,id:91345,t:none,pass,nolog,skipAfter:END_RULES_91345" + + + +# Rule 340029: script, perl, etc. code +SecRule REQUEST_URI|ARGS|!ARGS:/thumbnail/|!ARGS:image|!ARGS:screenshot_png|!ARGS:/^acf/|!ARGS:fileContent|!ARGS:/_edit_/|!ARGS:/details/|!ARGS:/block_value/|!ARGS:/News/|!ARGS:/products_/|!ARGS:/article/|!ARGS:/template/|!ARGS:editor1|!ARGS:prefix|!ARGS:suffix|!ARGS:/info/|!ARGS:payment_extrainfo|!ARGS:file|!ARGS:thecode|!ARGS:/chat/|!ARGS:snippet|!ARGS:/phpcode/|!ARGS:intro|!ARGS:/title/|!ARGS:/data_parent/|!ARGS:code|!ARGS:lajmi|!ARGS:/content/|!ARGS:/desc/|!ARGS:/hilit/|!ARGS:/hilight/|!ARGS:/highlight/|!ARGS:/body/|!ARGS:/post/|!ARGS:/txt|!ARGS:/content/|!ARGS:/keyword/|!ARGS:/summary/|!ARGS:/note/|!ARGS:/solution/|!ARGS:/msg/|!ARGS:/highlight/|!ARGS:/text/|!ARGS:/subject/|!ARGS:/message/|!ARGS:/post/|!ARGS:/resolution/|!ARGS:/problem/|!ARGS:ibsf|!ARGS:/disallowed/ "(?:;|/|\| )(?:\b(?:cat|ls|perl|uname|pwd|cp|tclsh8?|cpp|f(?:etch|tp)|python|chown|rm|ping|rsync|rdiff-backup|scp|(?:w|ftp)get|curl|links|g\+\+|ch(?:grp|own)|passwd|r?(?:b|d)ash|t?c?sh|telnet|clang|nc)\b |\b(?:sleep|benchmark)\b \(? ?[0-9]|powershell -w|\bkill(?: (?:[0-9]|-)|all\ ))" "log,auditlog,phase:2,deny,log,status:403,capture,id:360029,t:none,t:utf8toUnicode,t:urlDecodeUni,t:replaceNulls,t:cmdLine,rev:38,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - command in REQUEST_URI or Argument',logdata:'%{TX.0}'" + + +# Rule 340006: generic recursion signatures +SecRule REQUEST_FILENAME|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|ARGS|!ARGS:Answer|!ARGS:site_details|!ARGS:/ultra_/|!ARGS:/icon/|!ARGS:Inhalt|!ARGS:/fields_prev/|!ARGS:Details|!ARGS:Lead|!ARGS:changes|!ARGS:/editfile/|!ARGS:thecode|!ARGS:/sourcedir/|!ARGS:elm1|!ARGS:/EditorZone/|!ARGS:file_private_path|!ARGS:/form_data/|!ARGS:code|!ARGS:/^wpm_o_plugin/|!ARGS:/^jform/|!ARGS:/^resp/|!ARGS:rpath|!ARGS:data|!ARGS:/template/|!ARGS:/content/|!ARGS:/sidebar/|!ARGS:editor1|!ARGS:resolution|!ARGS:/logo/|!ARGS:/^style_options/|!ARGS:manager_image_path|!ARGS:prefix|!ARGS:suffix|!ARGS:/CACHE_PATH/|!ARGS:connector|!ARGS:/comment/|!ARGS:/desc/|!ARGS:videoplayer|!ARGS:css_data|!ARGS:/txt/|!ARGS:/body/|!ARGS:wysiwyg_input|!ARGS:backPath|!ARGS:/text/|!ARGS:/message/|!ARGS:/^fck_/|!ARGS:htmlSource|!ARGS:path_to_lzx|!ARGS:trk|!ARGS:advHTMLEdit1|!ARGS:modules "\.\./\.\./" "deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:cmdline,capture,id:347006,phase:2,rev:69,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied in URI/ARGS',logdata:'%{TX.0},%{matched_var_name}'" + +SecRule REQUEST_URI|ARGS|!ARGS:site_details|!ARGS:content|!ARGS:res|!ARGS:/autosave/|!ARGS:/css/|!ARGS:/^widget-my_requestquotewidget/|!ARGS:/wp_autosave/|!ARGS:po|!ARGS:modules "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" "deny,status:403,phase:2,log,auditlog,t:none,t:lowercase,id:340748,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied'" + +SecMarker END_RULES_91345 + +SecRule REQUEST_FILENAME "/administrator/index\.php" "phase:2,id:91346,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340027,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=390620,ctl:ruleRemovebyID=340077,ctl:ruleRemovebyID=380011,ctl:ruleRemovebyID=380012,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854" +SecAction "phase:2,id:91347,t:none,pass,nolog,skipAfter:END_RULES_91347" + +SecRule REQUEST_URI|ARGS|XML:/*|!ARGS:templatecode|!ARGS:areas "(?:< ?[?%] ?|\[ ?php|m(?:func|clude)|dynamic-cached-content)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,capture,chain,id:342128,rev:21,severity:2,msg:'Atomicorp.com WAF Rules: Remote PHP command exection',logdata:'%{TX.0}'" +SecRule REQUEST_URI|XML:/*|ARGS|!ARGS:/code/|!ARGS:areas|!ARGS:file|!ARGS:/script/|!ARGS:description|!ARGS:/prefix/|!ARGS:/suffix/|!ARGS:solution|!ARGS:problem|!ARGS:view|!ARGS:/^body/|!ARGS:payment_extrainfo|!ARGS:server_validation|!ARGS:solution|!ARGS:/suffix/|!ARGS:/prefix/|!ARGS:resolution|!ARGS:message|!ARGS:/template/|!ARGS:msg|!ARGS:/php/|!ARGS:gen_header|!ARGS:/layout/|!ARGS:post|!ARGS:/description/|!ARGS:/text/|!ARGS:/txt/|!ARGS:footerfile|!ARGS:/descr/|!ARGS:titleMetatags|!ARGS:/content/|!ARGS:/^eip_/|!ARGS:/jform/ "(?:(?:chr|fwrite|fopen|system|echr|passthru|serialize|include|php_uname|popen|proc_open|shell_exec|mysql_query|eval|create_function|str_rot13|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo|preg_\w+|base64_decode|base64_url_decode|decode_base64) ?(?:\(|\: ?'?)|system\( ?getenv ?\( ?http_php|(?:fputs|fread) ?\(|chr ?\(.{1,255}\).chr ?\(.{1,255}\).chr\()" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase" + +SecRule REQUEST_URI "!(^/administrator/index\.php\?option=com_(?:ganalytics|install|config&tmpl|easyblog|form2content))" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:lowercase,id:336142,rev:13,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{MATCHED_VAR}',chain" +SecRule REQUEST_URI|ARGS|!ARGS:state|!ARGS:ix0|!ARGS:/source_code/|!ARGS:/location/|!ARGS:/coupon/|!ARGS:alias|!ARGS:forSale_path|!ARGS:login|!ARGS:/^m2u/|!ARGS:misc|!ARGS:gallerylist|!ARGS:pathubr_upload|!ARGS:custom_email|!ARGS:extra_info|!ARGS:/source_code/|!ARGS:junkWords|!ARGS:name_ip|!ARGS:marker|!ARGS:marker_select|!ARGS:conf_DOWNLOADROOT|!ARGS:/custom_field/|!ARGS:search_all|!ARGS:/^zcck/|!ARGS:/^tzfields/|!ARGS:contact_info|!ARGS:log_path|!ARGS:tmp_path|!ARGS:pathadmin|!ARGS:/stream/|!ARGS:canonical|!ARGS:/addy/|!ARGS:/video/|!ARGS:/biography/|!ARGS:/sermon/|!ARGS:notes|!ARGS:competitor|!ARGS:/^currentValue/|!ARGS:protocol_select|!ARGS:/constant_contact/|!ARGS:/^plugin/|!ARGS:/^params/|!ARGS:extern_file|!ARGS:rel_path|!ARGS:aim|!ARGS:/^field/|!ARGS:details|!ARGS:/^complete_action/|!ARGS:profile_id|!ARGS:api|!ARGS:/^option_value/|!ARGS:button_src|!ARGS:cc_list_id|!ARGS:/buzz/|!ARGS:/jform/|!ARGS:/liveUpdate/|!ARGS:/service/|!ARGS:marqueur|!ARGS:/vertex/|!ARGS:metavalue|!ARGS:binary|!ARGS:snippet|!ARGS:/^ZA_ARTICLE/|!ARGS:obr|!ARGS:back|!ARGS:^/xcpr_/|!ARGS:/pic/|!ARGS:/plaatje/|!ARGS:profile|!ARGS:repository|!ARGS:/export/|!ARGS:os|!ARGS:ticketmaster|!ARGS:/destination/|!ARGS:r|!ARGS:/speedtest/|!ARGS:voice|!ARGS:/tripadvisor/|!ARGS:/iTunes/|!ARGS:lang_default_value|!ARGS:weather|!ARGS:/metakey/|!ARGS:/target/|!ARGS:/password/|!ARGS:/note/|!ARGS:form_profile|!ARGS:/theme/|!ARGS:ip|!ARGS:/afbeelding/|!ARGS:/screenshot/|!ARGS:embed_code|!ARGS:/^input_/|!ARGS:/^flb/|!ARGS:gwefan|!ARGS:/xthreads/|!ARGS:flv|!ARGS:dest|!ARGS:languageChange|!ARGS:/^perch_/|!ARGS:music|!ARGS:/^p_posts/|!ARGS:input_50|!ARGS:/resolv/|!ARGS:/^install_package/|!ARGS:/address/|!ARGS:wlp|!ARGS:hp|!ARGS:refsrc|!ARGS:/censor/|!ARGS:UpdateNote|!ARGS:regx_root|!ARGS:textfetch|!ARGS:input_3|!ARGS:file|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:value_string_9|!ARGS:/^cf/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:/return/|!ARGS:fromp|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:/home/|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/^obj_/|!ARGS:/photo/|!ARGS:/media/|!ARGS:/icon/|!ARGS:back|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/linkedin/|!ARGS:/twitter/|!ARGS:/flickr/|!ARGS:/youtube/|!ARGS:parent_name|!ARGS:/blog/|!ARGS:/vid/|!ARGS:_update_failure|!ARGS:_update_success|!ARGS:hdwok|!ARGS:hdwnook|!ARGS:OpenID|!ARGS:/^hilit/|!ARGS:/reciprocal/|!ARGS:importremote|!ARGS:/callback/|!ARGS:/sponsors/|!ARGS:/^akID/|!ARGS:service|!ARGS:want2Read|!ARGS:search_string|!ARGS:/preview/|!ARGS:/thumb/|!ARGS:subject|!ARGS:direct|!ARGS:fflv|!ARGS:direct|!ARGS:source_location/|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:/openid/|!ARGS:/adres/|!ARGS:/logo/|!ARGS:go|!ARGS:resolution|!ARGS:catalogue_search_code|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:path[alias]|!ARGS:/message/|!ARGS:/^utm/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:clickTag1|!ARGS:rf|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:lec_rm|!ARGS:n-state|!ARGS:Stream|!ARGS:CP_email|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:/^clickTagFrame/|!ARGS:/^attr/|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:/^V_feed/|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:/^GARS_existing/|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:loc|!ARGS:/body/|!ARGS:/^product_long/|!ARGS:/server/|!ARGS:/content/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:address|!ARGS:board_msg|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/desc/|!ARGS:/footer/|!ARGS:FAQTitle|!ARGS:host|!ARGS:/text/|!ARGS:whereto|!ARGS:pathToPiwik|!ARGS:email_sig|!ARGS:feed|!ARGS:/^artsee_banner_/|!ARGS:fetch|!ARGS:pingback_service|!ARGS:/hostname/|!ARGS:/http/|!ARGS:email_forward|!ARGS:bannercode|!ARGS:RTServerName|!ARGS:mesg|!ARGS:forward|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:advBannerMessage|!ARGS:thumb|!ARGS:u|!ARGS:header|!ARGS:action|!ARGS:cptpl_dir|!ARGS:Stream|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:stretch|!ARGS:cat_sponsor|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:contactMessage|!ARGS:var_value[usps_labels_help_2]|!ARGS:short_story|!ARGS:vinculo|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:headers-28|!ARGS:soundname|!ARGS:bbcode_tpl|!ARGS:faqText|!ARGS:/google/|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:from_href|!ARGS:Comentario|!ARGS:/^dynadata/|!ARGS:paypal_ipn|!ARGS:title|!ARGS:right_frame|!ARGS:l1_bdy|!ARGS:theMessage|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:/^ViewState/|!ARGS:postvars|!ARGS:vars[DBhostname]|!ARGS:base1|!ARGS:cart_header|!ARGS:layout|!ARGS:GMAP_KEY|!ARGS:full_story|!ARGS:source|!ARGS:Infos|!ARGS:rev_you_tube|!ARGS:ret_address|!ARGS:GMAP_KEY|!ARGS:newsBody|!ARGS:user_sig|!ARGS:cur|!ARGS:yahoo|!ARGS:sig|!ARGS:KT_Update1|!ARGS:flds[Message]|!ARGS:EditorHTML|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:sm_b_style|!ARGS:success|!ARGS:short_story|!ARGS:/^css/|!ARGS:vthumb|!ARGS:introduction|!ARGS:register_at|!ARGS:statusaddress|!ARGS:revnews_ad_120|!ARGS:/sponsor_banner/|!ARGS:newText|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:f_header|!ARGS:option[78]|!ARGS:agendWebPage|!ARGS:/ftp/|!ARGS:gen_header|!ARGS:button_dir|!ARGS:x_organizational|!ARGS:href|!ARGS:form_element3|!ARGS:answer|!ARGS:intro|!ARGS:c_msg|!ARGS:note|!ARGS:domain|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:clickTAG|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:thm|!ARGS:_RW_|!ARGS:/rss/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:helpbox|!ARGS:basehref|!ARGS:redir|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:inc|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:Post|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:oldmsg|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:bbcode_replace|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:goto|!ARGS:from|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:fb_ref|!ARGS:notes|!ARGS:pn_domain|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^rsargs/|!ARGS:op|!ARGS:ret|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:area|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:st_widget|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:Store_OUI_GlobalFooter|!ARGS:map|!ARGS:dynafield[_SIGNATURE]|!ARGS:payment_extrainfo|!ARGS:wysiwyg|!ARGS:banner|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:code|!ARGS:/^k2extra/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "t:none,t:urlDecodeUni,t:lowercase,multimatch,chain" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecRule REQUEST_URI "!(^/administrator/index\.php\?option=com_(?:ganalytics|install|config|easyblog|form2content))" "phase:2,deny,log,auditlog,status:403,capture,id:336141,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,chain,rev:13,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{MATCHED_VAR}'" +SecRule ARGS|!ARGS:misc|!ARGS:ix0|!ARGS:state|!ARGS:/source_code/|!ARGS:alias|!ARGS:/coupon/|!ARGS:/location/|!ARGS:forSale_path|!ARGS:login|!ARGS:/^m2u/|!ARGS:pathubr_upload|!ARGS:gallerylist|!ARGS:junkWords|!ARGS:extra_info|!ARGS:custom_email|!ARGS:name_ip|!ARGS:/source_code/|!ARGS:search_all|!ARGS:/stream/|!ARGS:marker|!ARGS:marker_select|!ARGS:conf_DOWNLOADROOT|!ARGS:/custom_field/|!ARGS:/^zcck/|!ARGS:log_path|!ARGS:/^tzfields/|!ARGS:contact_info|!ARGS:tmp_path|!ARGS:pathadmin|!ARGS:canonical|!ARGS:/addy/|!ARGS:/sermon/|!ARGS:/video/|!ARGS:/biography/|!ARGS:notes|!ARGS:competitor|!ARGS:/^currentValue/|!ARGS:protocol_select|!ARGS:/constant_contact/|!ARGS:/^plugin/|!ARGS:/^params/|!ARGS:extern_file|!ARGS:rel_path|!ARGS:aim|!ARGS:/^field/|!ARGS:details|!ARGS:/^complete_action/|!ARGS:profile_id|!ARGS:api|!ARGS:/^option_value/|!ARGS:button_src|!ARGS:cc_list_id|!ARGS:/buzz/|!ARGS:/jform/|!ARGS:/liveUpdate/|!ARGS:/service/|!ARGS:marqueur|!ARGS:/vertex/|!ARGS:metavalue|!ARGS:binary|!ARGS:snippet|!ARGS:/^ZA_ARTICLE/|!ARGS:obr|!ARGS:back|!ARGS:^/xcpr_/|!ARGS:/pic/|!ARGS:/plaatje/|!ARGS:profile|!ARGS:repository|!ARGS:/export/|!ARGS:os|!ARGS:ticketmaster|!ARGS:/destination/|!ARGS:r|!ARGS:/speedtest/|!ARGS:voice|!ARGS:/tripadvisor/|!ARGS:/iTunes/|!ARGS:lang_default_value|!ARGS:weather|!ARGS:/metakey/|!ARGS:/target/|!ARGS:/password/|!ARGS:/note/|!ARGS:form_profile|!ARGS:/theme/|!ARGS:ip|!ARGS:/afbeelding/|!ARGS:/screenshot/|!ARGS:embed_code|!ARGS:/^input_/|!ARGS:/^flb/|!ARGS:gwefan|!ARGS:/xthreads/|!ARGS:flv|!ARGS:dest|!ARGS:languageChange|!ARGS:/^perch_/|!ARGS:music|!ARGS:/^p_posts/|!ARGS:input_50|!ARGS:/resolv/|!ARGS:/^install_package/|!ARGS:/address/|!ARGS:wlp|!ARGS:hp|!ARGS:refsrc|!ARGS:/censor/|!ARGS:UpdateNote|!ARGS:regx_root|!ARGS:textfetch|!ARGS:input_3|!ARGS:file|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:value_string_9|!ARGS:/^cf/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:/return/|!ARGS:fromp|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:/home/|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/^obj_/|!ARGS:/photo/|!ARGS:/media/|!ARGS:/icon/|!ARGS:back|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/linkedin/|!ARGS:/twitter/|!ARGS:/flickr/|!ARGS:/youtube/|!ARGS:parent_name|!ARGS:/blog/|!ARGS:/vid/|!ARGS:_update_failure|!ARGS:_update_success|!ARGS:hdwok|!ARGS:hdwnook|!ARGS:OpenID|!ARGS:/^hilit/|!ARGS:/reciprocal/|!ARGS:importremote|!ARGS:/callback/|!ARGS:/sponsors/|!ARGS:/^akID/|!ARGS:service|!ARGS:want2Read|!ARGS:search_string|!ARGS:/thumb/|!ARGS:/preview/|!ARGS:subject|!ARGS:direct|!ARGS:fflv|!ARGS:direct|!ARGS:source_location/|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:/openid/|!ARGS:/adres/|!ARGS:/logo/|!ARGS:go|!ARGS:resolution|!ARGS:catalogue_search_code|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:path[alias]|!ARGS:/message/|!ARGS:/^utm/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:clickTag1|!ARGS:rf|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:lec_rm|!ARGS:n-state|!ARGS:Stream|!ARGS:CP_email|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:/^clickTagFrame/|!ARGS:/^attr/|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:/^V_feed/|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:/^GARS_existing/|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:loc|!ARGS:/body/|!ARGS:/^product_long/|!ARGS:/server/|!ARGS:/content/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:address|!ARGS:board_msg|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/desc/|!ARGS:/footer/|!ARGS:FAQTitle|!ARGS:host|!ARGS:/text/|!ARGS:whereto|!ARGS:pathToPiwik|!ARGS:email_sig|!ARGS:feed|!ARGS:/^artsee_banner_/|!ARGS:fetch|!ARGS:pingback_service|!ARGS:/hostname/|!ARGS:/http/|!ARGS:email_forward|!ARGS:bannercode|!ARGS:RTServerName|!ARGS:mesg|!ARGS:forward|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:advBannerMessage|!ARGS:thumb|!ARGS:u|!ARGS:header|!ARGS:action|!ARGS:cptpl_dir|!ARGS:Stream|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:stretch|!ARGS:cat_sponsor|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:contactMessage|!ARGS:var_value[usps_labels_help_2]|!ARGS:short_story|!ARGS:vinculo|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:headers-28|!ARGS:soundname|!ARGS:bbcode_tpl|!ARGS:faqText|!ARGS:/google/|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:from_href|!ARGS:Comentario|!ARGS:/^dynadata/|!ARGS:paypal_ipn|!ARGS:title|!ARGS:right_frame|!ARGS:l1_bdy|!ARGS:theMessage|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:/^ViewState/|!ARGS:postvars|!ARGS:vars[DBhostname]|!ARGS:base1|!ARGS:cart_header|!ARGS:layout|!ARGS:GMAP_KEY|!ARGS:full_story|!ARGS:source|!ARGS:Infos|!ARGS:rev_you_tube|!ARGS:ret_address|!ARGS:GMAP_KEY|!ARGS:newsBody|!ARGS:user_sig|!ARGS:cur|!ARGS:yahoo|!ARGS:sig|!ARGS:KT_Update1|!ARGS:flds[Message]|!ARGS:EditorHTML|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:sm_b_style|!ARGS:success|!ARGS:short_story|!ARGS:/^css/|!ARGS:vthumb|!ARGS:introduction|!ARGS:register_at|!ARGS:statusaddress|!ARGS:revnews_ad_120|!ARGS:/sponsor_banner/|!ARGS:newText|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:f_header|!ARGS:option[78]|!ARGS:agendWebPage|!ARGS:/ftp/|!ARGS:gen_header|!ARGS:button_dir|!ARGS:x_organizational|!ARGS:href|!ARGS:form_element3|!ARGS:answer|!ARGS:intro|!ARGS:c_msg|!ARGS:note|!ARGS:domain|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:clickTAG|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:thm|!ARGS:_RW_|!ARGS:/rss/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:helpbox|!ARGS:basehref|!ARGS:redir|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:inc|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:Post|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:oldmsg|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:bbcode_replace|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:goto|!ARGS:from|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:fb_ref|!ARGS:notes|!ARGS:pn_domain|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^rsargs/|!ARGS:op|!ARGS:ret|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:area|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:st_widget|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:Store_OUI_GlobalFooter|!ARGS:map|!ARGS:dynafield[_SIGNATURE]|!ARGS:payment_extrainfo|!ARGS:wysiwyg|!ARGS:banner|!ARGS:env_ping_list|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:code|!ARGS:/^k2extra/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" "t:none,t:urlDecodeUni,t:lowercase" +SecRule ARGS|!ARGS:/jform/|!ARGS:/code/|!ARGS:/^element/|!ARGS:/script/|!ARGS:data[mail][preload]|!ARGS:/text/|!ARGS:custom_script "(?:chr|f(?:write|open)|system|echr|passthru|serialize|php_uname|include|popen|shell_exec|mysql_query|exec|eval|create_function|proc_\w+|pfsockopen|leak|apache_child_terminate|posix_\w+|phpinfo|preg_\w+) ?\( ?'?" "deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,capture,chain,id:387123,phase:2,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: Generic php body attack attempt',logdata:'%{TX.0}'" +SecRule ARGS|!ARGS:content|!ARGS:/jform/|!ARGS:/text/|!ARGS:/script/ "(?:(?:cd|mkdir)[[:space:]]+(?:/|[a-z|0-9]|\.)|perl |killall |python |rpm |yum |apt-get |emerge |lynx |links |mkdir |elinks |cmd|pwd|(?:w|ftp)get |lwp-(?:download|request|mirror|rget) |uname |cvs |svn |(?:s|r)(?:cp|sh) |net(?:stat|cat)|rexec |smbclient |t?ftp |ncftp |chmod |curl |telnet |gcc |cc |g\+\+ |whoami|\./|killall |rm \-[a-z])" + +SecRule REQUEST_URI|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|ARGS|XML:/*|!ARGS:/script/|!ARGS:/custom_template/|!ARGS:/^elements/|!ARGS:default|!ARGS:/php/|!ARGS:piece3code|!ARGS:/^jform/|!ARGS:/query/|!ARGS:/comment/|!ARGS:keywords|!ARGS:/description/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/desc/|!ARGS:movie_brief|!ARGS:/text/|!ARGS:/message/|!ARGS:ncontent|!ARGS:/body/|!ARGS:/content/|!ARGS:searchword|!ARGS:add_keywords|!ARGS:/description/|!ARGS:/products_description/|!ARGS:contactMessage|!ARGS:cts|!ARGS:meta_descr|!ARGS:edited|!ARGS:content|!ARGS:description|!ARGS:Post|!ARGS:body|!ARGS:ll_content_message|!ARGS:page-content|!ARGS:reply|!ARGS:xml|!ARGS:content_en|!ARGS:filecontent|!ARGS:message|!ARGS:content_en|!ARGS:general[description]|!ARGS:response[14]|!ARGS:/article/ "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[a-z|0-9|\*|\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[a-z|0-9|\*| |\,]|\bunion\b.{1,100}?\bselect\b.*[a-z0-9].*from|select (?:load_file|char\()|(?:insert|remark)test;)" "deny,log,auditlog,status:403,phase:2,capture,t:none,t:urlDecodeUni,t:lowercase,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,id:350096,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection',logdata:'%{TX.0}',chain" +SecRule REQUEST_URI "!(^/administrator/index\.php\?option=com_rsform)" + +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|ARGS|!ARGS:ncontent|!ARGS:/php/|!ARGS:/script/|!ARGS:/custom_template/|!ARGS:/^elements/|!ARGS:/body/|!ARGS:/content/|!ARGS:/query/|!ARGS:/^jform/|!ARGS:searchword|!ARGS:add_keywords|!ARGS:comment|!ARGS:comments|!ARGS:text|!ARGS:/description/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:contactMessage|!ARGS:cts|!ARGS:meta_descr|!ARGS:text|!ARGS:edited|!ARGS:content|!ARGS:introtext|!ARGS:Post|!ARGS:itembigtext|!ARGS:/article/|!ARGS:body|!ARGS:mytextarea|!ARGS:ll_content_message|!ARGS:page-content|!ARGS:reply|!ARGS:xml|!ARGS:content_en|!ARGS:filecontent|!ARGS:message|!ARGS:content_en|!ARGS:general[description]|!ARGS:response[14]|!ARGS:article|!ARGS:wptextbox1 "(?:insert into values|select from [a-z|0-9]!( and)|bulk insert |union select|union all select|convert \(.*from|select (?:load_file|char\()|(?:insert|remark)test;)" "deny,log,auditlog,status:403,phase:2,capture,t:none,t:replaceComments,t:compressWhiteSpace,id:350097,rev:47,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection in ARGS',logdata:'%{TX.0}'" + +# Rule 340095: generic sig for more bad PHP functions +SecRule ARGS|!ARGS:/keywords/|!ARGS:/script/|!ARGS:/content/|!ARGS:product_desc|!ARGS:editor_body|!ARGS:/mail/|!ARGS:/^jform/|!ARGS:/longdesc/|!ARGS:/^layout/|!ARGS:/quote/|!ARGS:/^element/|!ARGS:message|!ARGS:/description/|!ARGS:/text/|!ARGS:/txt/|!ARGS:email "(?:\(chr ?\([0-9]{1,3}\)|= ?f(?:open|write) ?\(|\b(?:passthru|php_uname|phpinfo|preg_\w+|shell_exec|exec|system) ?(?:\( ?(?:'|\")|@|\: ?')\b)" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,deny,log,auditlog,status:403,phase:2,capture,id:350095,rev:12,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - PHP attack in Argument',logdata:'%{TX.0}'" +# Rule 340149: XSS injection +SecRule REQUEST_URI "!(/administrator/index\.php\?option=com_(?:rsform|modules|sobipro|nbill|plugins|employment|aclassif|redshop|cckjseblod|templates))" "chain,deny,log,auditlog,status:403,phase:2,t:none,t:removeNulls,t:lowercase,t:compressWhitespace,capture,id:310716,rev:34,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule ARGS|!ARGS:/script/|!ARGS:/^lang\[/|!ARGS:/premiere/|!ARGS:metakey|!ARGS:tcode|!ARGS:/accolade/|!ARGS:/product_/|!ARGS:/insertstring/|!ARGS:thecode|!ARGS:/^vertex/|!ARGS:tz_media_code|!ARGS:slider|!ARGS:/dialogue/|!ARGS:answer|!ARGS:location|!ARGS:fieldstyle|!ARGS:/confirmation/|!ARGS:/limitpage/|!ARGS:/button/|!ARGS:thirdparty|!ARGS:/synopsis/|!ARGS:/question/|!ARGS:/custom/|!ARGS:/profile/|!ARGS:addr|!ARGS:fulladdress|!ARGS:msc.restrict|!ARGS:/instrumentation/|!ARGS:/disallow/|!ARGS:php_out|!ARGS:rs_specs|!ARGS:dloadexp|!ARGS:passwd|!ARGS:/leftcol/|!ARGS:/rightcol/|!ARGS:/projects/|!ARGS:/discography/|!ARGS:/^button/|!ARGS:/remark/|!ARGS:order_sign|!ARGS:/^breves/|!ARGS:/^zcck/|!ARGS:/specification/|!ARGS:/^tpl_/|!ARGS:/biog/|!ARGS:/^attr/|!ARGS:/custfoot/|!ARGS:/custhead/|!ARGS:/display/|!ARGS:/sml_/|!ARGS:/^ctl_next/|!ARGS:/print/|!ARGS:/quote/|!ARGS:/instructions/|!ARGS:/priceFormat/|!ARGS:overview|!ARGS:js|!ARGS:/^arg/|!ARGS:/^rsmailConfig/|!ARGS:deal_coupon|!ARGS:/review/|!ARGS:/^cb_/|!ARGS:/^extraf/|!ARGS:/send/|!ARGS:/enquire/|!ARGS:/accesoires/|!ARGS:tip|!ARGS:/^dms/|!ARGS:/^cf/|!ARGS:/testimonial/|!ARGS:/server/|!ARGS:/sherpa/|!ARGS:/feature/|!ARGS:/^tips/|!ARGS:/thank/|!ARGS:/term/|!ARGS:/script/|!ARGS:/filter/|!ARGS:/^jform/|!ARGS:/booking/|!ARGS:ad_code|!ARGS:output|!ARGS:ll|!ARGS:/chronofield/|!ARGS:/config/|!ARGS:/^option_value/|!ARGS:parent_path|!ARGS:/popup/|!ARGS:/footer/|!ARGS:Right_photo_1|!ARGS:code|!ARGS:/^K2ExtraField/|!ARGS:/submitcode/|!ARGS:misc|!ARGS:/layout/|!ARGS:/^form/|!ARGS:payment_extrainfo|!ARGS:/^xjxargs/|!ARGS:/param/|!ARGS:oid|!ARGS:value|!ARGS:/video/|!ARGS:embedVideo|!ARGS:/vendor_/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:mes|!ARGS:signature|!ARGS:quote-form|!ARGS:paepdc|!ARGS:/VB_announce/|!ARGS:/^autoDS/|!ARGS:newyddionc|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/intro/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:/field_unit/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|!ARGS:/theme/|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS_NAMES:/^jform/|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:user[usertitle]|!ARGS:/^section/|!ARGS:/msg/|!ARGS:/notice/|!ARGS:/email/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:/desc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/|!ARGS:/pagecode/|!ARGS:parent_path|!ARGS:/header/|!ARGS:/footer/|!ARGS:awards|!ARGS:/canceledpage/|!ARGS:/email/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|(?:\.add|\@)import|asfunction\:|background-image\:|\be(?:cma|xec)script\b|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|(?:java|live|j|vb)script!s|lowsrc|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|event|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|shell\:|window\.location|asfunction:_root\.launch|\%env)" "t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace" + +# Rule 340148: XSS injection with multimatch checks +SecRule REQUEST_URI "!(/administrator/index\.php\?(?:option=com_(?:rsform|sobipro|modules|nbill|employment|aclassif|redshop|cckjseblod|templates)|format=html))" "chain,deny,log,auditlog,status:403,phase:2,t:none,t:removeNulls,t:lowercase,capture,id:310717,rev:215,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule ARGS|!ARGS:/script/|!ARGS:piece2code|ARGS_NAMES|!ARGS:/^lang\[/|!ARGS:/^trucs/|!ARGS:/accolade/|!ARGS:/adwords/|!ARGS:/product_/|!ARGS:metakey|!ARGS:/insertstring/|!ARGS:tcode|!ARGS:thecode|!ARGS:/^vertex/|!ARGS:tz_media_code|!ARGS:/dialogue/|!ARGS:slider|!ARGS:location|!ARGS:/format/|!ARGS:answer|!ARGS:/confirmation/|!ARGS:fieldstyle|!ARGS:/premiere/|!ARGS:/performances/|!ARGS:values|!ARGS:media|!ARGS:/synopsis/|!ARGS:/button/|!ARGS:thirdparty|!ARGS:/question/|!ARGS:/limitpage/|!ARGS:/disallow/|!ARGS:addr|!ARGS:fulladdress|!ARGS:/instrumentation/|!ARGS:msc.restrict|!ARGS:/profile/|!ARGS:passwd|!ARGS:rs_specs|!ARGS:dloadexp|!ARGS:/suffix/|!ARGS:/leftcol/|!ARGS:/rightcol/|!ARGS:title|!ARGS:php_out|!ARGS:/projects/|!ARGS:/discography/|!ARGS:order_sign|!ARGS:/remark/|!ARGS:/^button/|!ARGS:/^breves/|!ARGS:/^zcck/|!ARGS:/custom/|!ARGS:/sml_/|!ARGS:/^tpl_/|!ARGS:/biog/|!ARGS:/^attr/|!ARGS:/custhead/|!ARGS:/custfoot/|!ARGS:/display/|!ARGS:/userlist/|!ARGS:/print/|!ARGS:/^ctl_next/|!ARGS:/quote/|!ARGS:/instructions/|!ARGS:/specification/|!ARGS:overview|!ARGS:/^arg/|!ARGS:js|!ARGS:deal_coupon|!ARGS:/^rsmailConfig/|!ARGS:/review/|!ARGS:/^extraf/|!ARGS:/^cb_/|!ARGS:/enquire/|!ARGS:/send/|!ARGS:/^dms/|!ARGS:/accesoires/|!ARGS:tip|!ARGS:/^cf/|!ARGS:/testimonial/|!ARGS:/navigation/|!ARGS:/server/|!ARGS:/feature/|!ARGS:/sherpa/|!ARGS:id|!ARGS:/term/|!ARGS:/thank/|!ARGS:/script/|!ARGS:/booking/|!ARGS:/^jform/|!ARGS:ad_code|!ARGS:/msg/|!ARGS:/notice/|!ARGS:/email/|!ARGS:/priceFormat/|!ARGS:/caption/|!ARGS:/^tips/|!ARGS:/chronofield/|!ARGS:/config/|!ARGS:output|!ARGS:parent_path|!ARGS:/popup/|!ARGS:ll|!ARGS:/^option_value/|!ARGS:sidebar|!ARGS:code|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:/info/|!ARGS:misc|!ARGS:thanksemail|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^form/|!ARGS:/layout/|!ARGS:/^xjxargs/|!ARGS:payment_extrainfo|!ARGS:/param/|!ARGS:/^language_strings/|!ARGS:misc|!ARGS:oid|!ARGS:layout|!ARGS:prefix|!ARGS:value|!ARGS:default_value|!ARGS:/video/|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/embedVideo/|!ARGS:/intro/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:/tekst/|!ARGS:/field_unit/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:/duties/|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:parent_path|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/pagecode/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:awards|!ARGS:/ajax/ "(?:< ?script|(?:<|< ?/)(?:(?:java|vb)script|about|applet|activex|chrome)|\%env|< ?i?frame ?src ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|(?:\.add|\@)import |asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:/|<) ?(?:java|live|j|vb)script!s|lowsrc ?=|mocha\:|\bon(?:abort|blur|change|click|submit|select|dragdrop|event|focus|key(?:down|press|up)|mouse(?:down|move|out|over|up))\b ?=|shell\:|window\.location|asfunction:_root\.launch)" "t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase,multimatch" +# Rule 340147: Generic XSS filter +SecRule REQUEST_URI "!(/administrator/index\.php\?option=com_(?:rsform|sobipro|nbill|modules|employment|aclassif|redshop|cckjseblod|templates))" "chain,deny,log,auditlog,status:403,phase:2,t:none,t:lowercase,capture,id:310718,rev:41,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter',logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/script/|!ARGS:piece2code|!ARGS:/^trucs/|!ARGS:/^lang\[/|!ARGS:/adwords/|!ARGS:metakey|!ARGS:tcode|!ARGS:thecode|!ARGS:/accolade/|!ARGS:/^vertex/|!ARGS:location|!ARGS:tz_media_code|!ARGS:slider|!ARGS:/format/|!ARGS:/confirmation/|!ARGS:answer|!ARGS:fieldstyle|!ARGS:/dialogue/|!ARGS:/performances/|!ARGS:values|!ARGS:media|!ARGS:/synopsis/|!ARGS:/button/|!ARGS:thirdparty|!ARGS:/question/|!ARGS:/premiere/|!ARGS:/disallow/|!ARGS:addr|!ARGS:/instrumentation/|!ARGS:fulladdress|!ARGS:msc.restrict|!ARGS:/profile/|!ARGS:/leftcol/|!ARGS:rs_specs|!ARGS:dloadexp|!ARGS:passwd|!ARGS:/rightcol/|!ARGS:title|!ARGS:/suffix/|!ARGS:php_out|!ARGS:/projects/|!ARGS:order_sign|!ARGS:/^button/|!ARGS:/remark/|!ARGS:/discography/|!ARGS:/^breves/|!ARGS:/custom/|!ARGS:/^zcck/|!ARGS:/limitpage/|!ARGS:/^tpl_/|!ARGS:/biog/|!ARGS:/^attr/|!ARGS:/custhead/|!ARGS:/custfoot/|!ARGS:/display/|!ARGS:/^arg/|!ARGS:/^ctl_next/|!ARGS:/print/|!ARGS:/quote/|!ARGS:/instructions/|!ARGS:deal_coupon|!ARGS:output|!ARGS:/^one/|!ARGS:ll|!ARGS:js|!ARGS:/^rsmailConfig/|!ARGS:/^extraf/|!ARGS:/send/|!ARGS:/^cb_/|!ARGS:/enquire/|!ARGS:/^dms/|!ARGS:/testimonial/|!ARGS:/accesoires/|!ARGS:tip|!ARGS:/feature/|!ARGS:/^cf/|!ARGS:/sherpa/|!ARGS:/review/|!ARGS:/server/|!ARGS:id|!ARGS:/term/|!ARGS:/thank/|!ARGS:/booking/|!ARGS:/msg/|!ARGS:/notice/|!ARGS:/email/|!ARGS:/caption/|!ARGS:ad_code|!ARGS:/pagecode/|!ARGS:/priceFormat/|!ARGS:/filter/|!ARGS:/^items/|!ARGS:/navigation/|!ARGS:/chronofield/|!ARGS:/script/|!ARGS:/specification/|!ARGS:/^code_/|!ARGS:/config/|!ARGS:/popup/|!ARGS:terms|!ARGS:parent_path|!ARGS:/^tips/|!ARGS:tag|!ARGS:/^form/|!ARGS:/^params/|!ARGS:/intro/|!ARGS:/info/|!ARGS:sidebar|!ARGS:code|!ARGS:/^option_value/|!ARGS:pay_inst_1|!ARGS:contact_info|!ARGS:thankyou|!ARGS:Right_photo_1|!ARGS:sml_prt_1|!ARGS:/layout/|!ARGS:thanksemail|!ARGS:/^jform/|!ARGS:/param/|!ARGS:/^xjxargs/|!ARGS:/^language_strings/|!ARGS:misc|!ARGS:layout|!ARGS:oid|!ARGS:prefix|!ARGS:/embedVideo/|!ARGS:value|!ARGS:default_value|!ARGS:/vendor_/|!ARGS:/^K2ExtraField/|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/field_unit/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/duties/|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:/duties/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:parent_path|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:awards|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?script|(?:<|< ?/)(?:(?:java|vb)script|about|applet|activex|chrome)|\%env|< ?i?frame ?src ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|(?:\.add|\@)import |asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:/|<) ?(?:java|live|j|vb)script!s|lowsrc ?=|mocha\:|\bon(?:abort|blur|change|click|submit|select|dragdrop|event|focus|key(?:down|press|up)|mouse(?:down|move|out|over|up))\b ?=|shell\:|window\.location|asfunction:_root\.launch)" "t:none,t:urlDecodeUni,t:replaceComments,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace" + +SecMarker END_RULES_91347 + +SecRule REQUEST_FILENAME "/administrator/index2\.php" "phase:2,id:91348,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340014,ctl:ruleRemovebyID=340193,ctl:ruleRemovebyID=390620,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380011,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=380012,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340151,ctl:ruleRemovebyID=340007" +SecAction "phase:2,id:91349,t:none,pass,nolog,skipAfter:END_RULES_91349" + +SecRule REQUEST_URI|ARGS|!ARGS:/onsubmitcode/|!ARGS:html|!ARGS:file|!ARGS:/^p_process_chat/|!ARGS:/template/|!ARGS:snippet|!ARGS:phpcode|!ARGS:intro|!ARGS:/title/|!ARGS:/^data_parent/|!ARGS:code|!ARGS:lajmi|!ARGS:newcontent|!ARGS:content|!ARGS:/desc/|!ARGS:/hilit/|!ARGS:/hilight/|!ARGS:/highlight/|!ARGS:/body/|!ARGS:/post/|!ARGS:/txt|!ARGS:/content/|!ARGS:/keyword/|!ARGS:/summary/|!ARGS:/note/|!ARGS:/solution/|!ARGS:/msg/|!ARGS:/highlight/|!ARGS:/text/|!ARGS:/subject/|!ARGS:/message/|!ARGS:/post/|!ARGS:/resolution/|!ARGS:/problem/ "; ?(?:cat|ls|perl|uname|pwd|cp|kill|echo|tclsh8?|cpp|python|chown|rm|kill|ping|rsync|rdiff-backup|scp|(?:w|ftp)get|curl|links|g\+\+|ch(?:grp|own)|passwd|bash|telnet) " "phase:2,deny,log,auditlog,status:403,capture,id:343329,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhitespace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - command in REQUEST_URI or Argument',logdata:'%{TX.0}'" +# Rule 340147: Generic XSS filter +SecRule ARGS|ARGS_NAMES|!ARGS:/^cf/|!ARGS:/^OSDCS/|!ARGS:/^ARGS:booking_/|!ARGS:/^option_value/|!ARGS:/^one/|!ARGS:Right_photo_1|!ARGS:/term/|!ARGS:/^field/|!ARGS:/xargs/|!ARGS:/customcode/|!ARGS:/biography/|!ARGS:/review/|!ARGS:autogenerated|!ARGS:/^book/|!ARGS:/email/|!ARGS:/editor/|!ARGS:/listid/|!ARGS:/^_qf/|!ARGS:/select/|!ARGS:/filter/|!ARGS:/^tips/|!ARGS:/^items/|!ARGS:/navigation/|!ARGS:/chronofield/|!ARGS:/params/|!ARGS:tag|!ARGS:/^code_/|!ARGS:terms|!ARGS:/^form/|!ARGS:parent_path|!ARGS:/config/|!ARGS:/intro/|!ARGS:/info/|!ARGS:/^K2ExtraField/|!ARGS:/OSDCS/|!ARGS:info|!ARGS:server_validation|!ARGS:sidebar|!ARGS:pay_inst_1|!ARGS:/submitcode/|!ARGS:misc|!ARGS:/layout/|!ARGS:oid|!ARGS:layout|!ARGS:prefix|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:java|vb)?script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame|\%env)" "deny,log,auditlog,status:403,phase:2,t:none,t:removeNulls,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,capture,id:310618,rev:92,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter',logdata:'%{TX.0}'" + +SecRule ARGS|!ARGS:task|!ARGS:q|!ARGS:submit2|!ARGS:/query/|!ARGS:/sql/ "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table)|delete[[:space:]]*update.+set.+=)" "deny,log,auditlog,status:403,phase:2,id:341544,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection (/administrator/index2.php)'" +SecRule ARGS|!ARGS:task|!ARGS:submit2|!ARGS:/query/|!ARGS:/sql/ "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table)|delete[[:space:]]*update.+set.+=)" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,deny,log,auditlog,status:403,phase:2,id:341545,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection (/administrator/index2.php)'" +SecRule REQUEST_URI|ARGS|!ARGS:fcontent|!ARGS:videoplayer|!ARGS:/css/|!ARGS:/^wpm/|!ARGS:/message/|!ARGS:body|!ARGS:wysiwyg_input|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:message "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" "deny,log,auditlog,status:403,phase:2,t:none,t:lowercase,id:340789,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied'" +SecRule ARGS|!ARGS:/text/|!ARGS:fck_tw_body|!ARGS:/query/|!ARGS:/sql/|!ARGS:prefix|!ARGS:sub|!ARGS:msg_body|!ARGS:saved_data|!ARGS:fck_body|!ARGS:text|!ARGS:form[pagina_text]|!ARGS:description|!ARGS:message|!ARGS:content "(?:(\w+)and(\w+)char\([0-9]+\)|(?:execute|convert)\(|(?:\;delete.*;(?:insert|declare|varchar)|(?:and .* \(select |(?:drop|create)(\w+)table|declare .* varchar\())|convert\(varchar|null,(?:null,(?:null|accesslevel|user_name),|concat\()|union select |union all select |\b\W*?cast\b\W*?\(.* as |xecresultset|';declare\b\W*?|;set @)" "deny,log,auditlog,status:403,phase:2,multiMatch,id:341808,t:none,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:lowercase,t:replaceComments,t:compressWhiteSpace,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection (MM)'" +SecRule REQUEST_URI "!(/products/index\.php\?gallery=)" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:lowercase,id:340794,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied'" +SecRule REQUEST_URI|ARGS|!ARGS:/message/|!ARGS:body|!ARGS:/css/|!ARGS:/^wpm/|!ARGS:wysiwyg_input|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:message|!ARGS:videoplayer "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" + +SecRule REQUEST_URI|ARGS|!ARGS:fcontent|!ARGS:/message/|!ARGS:/css/|!ARGS:/^wpm/|!ARGS:body|!ARGS:wysiwyg_input|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:message|!ARGS:videoplayer "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" "deny,log,auditlog,status:403,phase:2,t:none,t:lowercase,id:340796,rev:14,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied'" + + + +SecMarker END_RULES_91349 + +SecRule REQUEST_FILENAME "/req\.php" "phase:2,id:91350,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340026" +SecAction "phase:2,id:91351,t:none,pass,nolog,skipAfter:END_RULES_91351" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:str2 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340744,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:str2 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340750,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91351 + +SecRule REQUEST_FILENAME "/cgi-bin/news/news\.cgi" "phase:2,id:91352,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340026" +SecAction "phase:2,id:91353,t:none,pass,nolog,skipAfter:END_RULES_91353" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:c "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:341746,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:c "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340752,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91353 + +SecRule REQUEST_FILENAME "/wp-admin/themes\.php" "phase:2,id:91354,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91355,t:none,pass,nolog,skipAfter:END_RULES_91355" + +#SecRule ARGS|!ARGS:tz_feedburner_email|!ARGS:tz_feedburner|!ARGS:tz_selectedtab|!ARGS:/icon/|!ARGS:/logo/|!ARGS:/linkedin/|!ARGS:/youtube/|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/twitter/|!ARGS:/link/|!ARGS:/theme/|!ARGS:/logo/|!ARGS:flickr|!ARGS:/banner/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/banner/|!ARGS:/image/|!ARGS:revchurch_video|!ARGS:/^YBN_/|!ARGS:bfa_ata_logo "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" # "id:340753,chain,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:11,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +#SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +#SecRule ARGS|!ARGS:tz_feedburner_email|!ARGS:tz_feedburner=|!ARGS:tz_selectedtab|!ARGS:/icon/|!ARGS:/logo/|!ARGS:/linkedin/|!ARGS:/youtube/|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/twitter/|!ARGS:/link/|!ARGS:/theme/|!ARGS:/logo/|!ARGS:flickr|!ARGS:/banner/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/banner/|!ARGS:/image/|!ARGS:revchurch_video|!ARGS:/^YBN_/|!ARGS:bfa_ata_logo "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" # "chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340754,rev:11,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +#SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91355 + +SecRule REQUEST_FILENAME "/edit-item\.php" "phase:2,id:91356,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/removed\.php" "phase:2,id:91357,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340084" + +SecRule REQUEST_FILENAME "/ezgctrlpanel\.php" "phase:2,id:91358,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91359,t:none,pass,nolog,skipAfter:END_RULES_91359" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:defaultprodpg|!ARGS:/redirect/|!ARGS:/link/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/pthanks/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:350746,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:defaultprodpg|!ARGS:/redirect/|!ARGS:/link/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/pthanks/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "chain,phase:2,deny,status:403,log,auditlog,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:350756,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "deny,log,auditlog,status:403,phase:2,!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91359 + +SecRule REQUEST_FILENAME "/magazine/index\.php" "phase:2,id:91360,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91361,t:none,pass,nolog,skipAfter:END_RULES_91361" + +SecRule ARGS|!ARGS:/path/|!ARGS:/site/|!ARGS:return|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:q|!ARGS:/referer/|!ARGS:/refer/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:343745,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/path/|!ARGS:/site/|!ARGS:return|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:q|!ARGS:/referer/|!ARGS:/refer/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340758,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91361 + +SecRule REQUEST_FILENAME "/fckeditor/editor/filemanager/browser/default/browser\.html" "phase:2,id:91362,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/track\.php" "phase:2,id:91363,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91364,t:none,pass,nolog,skipAfter:END_RULES_91364" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/ref/|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/referrer/|!ARGS:/^S/|!ARGS:ref|!ARGS:/referer/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340745,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/ref/|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/referrer/|!ARGS:/^S/|!ARGS:ref|!ARGS:/referer/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340760,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91364 + +SecRule REQUEST_FILENAME "/flashgallery\.php" "phase:2,id:91365,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/req\.php" "phase:2,id:91366,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91367,t:none,pass,nolog,skipAfter:END_RULES_91367" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^S/|!ARGS:str2 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340761,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^S/|!ARGS:str2 "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340762,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91367 + +SecRule REQUEST_FILENAME "/admin/patch\.php" "phase:2,id:91368,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371" + +SecRule REQUEST_FILENAME "/etc/reality-info\.css" "phase:2,id:91369,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/alt_doc\.php" "phase:2,id:91370,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380011,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/product_modify\.php" "phase:2,id:91371,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91372,t:none,pass,nolog,skipAfter:END_RULES_91372" + +SecRule ARGS|!ARGS:distribution|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^efields/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,id:340763,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:distribution|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^efields/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340764,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + + +SecMarker END_RULES_91372 + +SecRule REQUEST_FILENAME "/fix\.swf" "phase:2,id:91373,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91374,t:none,pass,nolog,skipAfter:END_RULES_91374" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:x "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340765,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:x "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340766,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91374 + +SecRule REQUEST_FILENAME "/typo3/alt_mod_frameset\.php" "phase:2,id:91375,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/cnf_config\.php" "phase:2,id:91376,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91377,t:none,pass,nolog,skipAfter:END_RULES_91377" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^val_/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340767,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^val_/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340768,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91377 + +SecRule REQUEST_FILENAME "/classes/crop_image\.php" "phase:2,id:91378,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/members/create_listing\.php" "phase:2,id:91379,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/livesupport/install/dbperform\.php" "phase:2,id:91380,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/st/out\.php" "phase:2,id:91381,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91382,t:none,pass,nolog,skipAfter:END_RULES_91382" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:u "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340769,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:u "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340770,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91382 + +SecRule REQUEST_FILENAME "/db_sql\.php" "phase:2,id:91383,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/catch\.php" "phase:2,id:91384,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91385,t:none,pass,nolog,skipAfter:END_RULES_91385" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:ru "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340771,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:ru "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340772,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91385 + +SecRule REQUEST_FILENAME "/admin/languages\.php" "phase:2,id:91386,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91387,t:none,pass,nolog,skipAfter:END_RULES_91387" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^var_value/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:340775,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^var_value/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340776,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91387 + +SecRule REQUEST_FILENAME "/slideshow/admin/p\.php" "phase:2,id:91388,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340151,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91389,t:none,pass,nolog,skipAfter:END_RULES_91389" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:a "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,id:341776,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:a "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "deny,log,auditlog,status:403,phase:2,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:341778,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91389 + +SecRule REQUEST_FILENAME "/wp-admin/theme-editor\.php" "phase:2,id:91390,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340855,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340011,ctl:ruleRemovebyID=380006,ctl:ruleRemovebyID=340213,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=341045,ctl:ruleRemovebyID=390715,ctl:ruleRemovebyID=340006" +SecAction "phase:2,id:91391,t:none,pass,nolog,skipAfter:END_RULES_91391" + +SecRule REQUEST_URI "!(alt_mod_frameset.php|checkout_shipping.php|^/components/com_zoom/etc/|/admin\.swf\?nick=|/editor/filemanager/browser/default/browser\.html\?(Type=Image&)?Connector=\.\./\.\./connectors)" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,deny,status:403,phase:2,chain,log,auditlog,t:normalisePath,id:340671,rev:19,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied in URI/ARGS', chain" +SecRule REQUEST_URI|ARGS|!ARGS:webpage[content]|!ARGS:article[content]|!ARGS:filecontent|!ARGS:/text/|!ARGS:/message/|!ARGS:/^fck_/|!ARGS:htmlSource|!ARGS:path_to_lzx|!ARGS:content|!ARGS:newcontent "(?:\.\./\.\./|\.\|\./\.\|\./\.\.)" + +#PHP injection +SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|!ARGS:/content/|!ARGS:/descripcion/|!ARGS:/text/|!ARGS:/description/|!ARGS:/resolution/|!ARGS:/message/|!ARGS:/msg/ "\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|(?:g|b)z(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:(?:g|b)z)?file|dir)|gzinflate|base64_decode|str_rot13|move_uploaded_file|(?:proc_|bz)open|call_user_func|$_(?:(?:pos|ge)t|session))\b" "phase:2,deny,log,status:403,rev:4,capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,auditlog,msg:'Atomicorp.com WAF Rules: PHP Injection Attack',id:'390725',logdata:'%{TX.0}',severity:'2'" + +SecRule ARGS|!ARGS:newcontent|!ARGS:khxc_incphp--filename|!ARGS:file_contents|!ARGS:filecontent|!ARGS:message|!ARGS:defaultParamList|!ARGS:body|!ARGS:gbu0_proddetdisp--incdisp "(?:or.+1[[:space:]]*=[[:space:]][0-9]|(?:or 1=[0-9]|'.+)--'|null is null)" "t:urlDecodeUni,t:urlDecodeUni,t:compressWhitespace,t:lowercase,phase:2,deny,status:403,id:340777,log,auditlog,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection'" +SecRule ARGS "(?:(?:eval|passthru) ?\( ?(?:base64_decode|gz(?:inflate|decode|encode)) ?\(|str_rot13 ?\()" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:345729,rev:1,log,auditlog,severity:2,msg:'Atomicorp.com WAF Rules: Potentially malicious code injection via WP theme-editor',deny,status:403,phase:2" +SecRule ARGS "(?:(?:eval|passthru) ?\( ?(?:base64_decode|gz(?:inflate|decode|encode)) ?\(|str_rot13 ?\()" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,id:345730,rev:1,severity:2,log,auditlog,msg:'Atomicorp.com WAF Rules: Potentially malicious code injection via WP theme-editor',deny,status:403,phase:2" +SecRule ARGS "(?:(?:eval|passthru) ?\( ?(?:base64_decode|gz(?:inflate|decode|encode)) ?\(|str_rot13 ?\()" "t:none,t:compressWhitespace,t:lowercase,id:345731,rev:1,severity:2,log,auditlog,msg:'Atomicorp.com WAF Rules: Potentially malicious code injection via WP theme-editor',deny,status:403,phase:2" + +SecMarker END_RULES_91391 + +SecRule REQUEST_FILENAME "/components/com_oziogallery/preview\.swf" "phase:2,id:91392,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91393,t:none,pass,nolog,skipAfter:END_RULES_91393" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:xmlPath "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340779,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:xmlPath "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340780,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91393 + +SecRule REQUEST_FILENAME "/fla_music\.swf" "phase:2,id:91394,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/mickadmincp/user\.php" "phase:2,id:91395,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91396,t:none,pass,nolog,skipAfter:END_RULES_91396" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfield/|!ARGS:user[homepage] "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340781,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfield/|!ARGS:user[homepage] "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340782,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91396 + +SecRule REQUEST_FILENAME "/wp-admin/tools\.php" "phase:2,id:91397,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380006,ctl:ruleRemovebyID=390707,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/includes/c0ntaktu3\.php" "phase:2,id:91398,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91399,t:none,pass,nolog,skipAfter:END_RULES_91399" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:bad_template "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340785,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:bad_template "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340786,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91399 + +SecRule REQUEST_FILENAME "/formmail\.php" "phase:2,id:91400,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91401,t:none,pass,nolog,skipAfter:END_RULES_91401" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/form/|!ARGS:/template/|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:this_form "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340787,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/form/|!ARGS:/template/|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:this_form "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340788,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91401 + +SecRule REQUEST_FILENAME "/free\.cgi" "phase:2,id:91402,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340018" + +SecRule REQUEST_FILENAME "/plugins/wp-postratings/postratings-admin-ajax\.php" "phase:2,id:91403,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/search\.php" "phase:2,id:91404,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340026" +SecAction "phase:2,id:91405,t:none,pass,nolog,skipAfter:END_RULES_91405" + +SecRule ARGS|!ARGS:/search/|!ARGS:value|!ARGS:/query/|!ARGS:q|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:file "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340790,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/search/|!ARGS:value|!ARGS:/query/|!ARGS:q|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:file "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340791,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91405 + +SecRule REQUEST_FILENAME "/online/index\.php" "phase:2,id:91406,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91407,t:none,pass,nolog,skipAfter:END_RULES_91407" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340792,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340793,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91407 + +SecRule REQUEST_FILENAME "/contenido/main\.php" "phase:2,id:91408,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=390715,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340213" +SecAction "phase:2,id:91409,t:none,pass,nolog,skipAfter:END_RULES_91409" + +SecRule ARGS|!ARGS:display_query|!ARGS:Db_submit|!ARGS:prev_sql_query|!ARGS:sql_query|!ARGS:Post|!ARGS:text|!ARGS:action|!ARGS:op|!ARGS:setup_db|!ARGS:wptextbox1|!ARGS:message|!ARGS:/^SQL/|!ARGS:query_string|!ARGS:query|!ARGS:description|!ARGS:output "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table)|delete[[:space:]]*update.+set.+=)" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,phase:2,deny,log,auditlog,status:403,id:340795,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection 2'" + +SecMarker END_RULES_91409 + +SecRule REQUEST_FILENAME "/imageresize\.php" "phase:2,id:91410,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/taguchitest\.php" "phase:2,id:91411,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340022,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91412,t:none,pass,nolog,skipAfter:END_RULES_91412" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:r "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340797,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:r "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340798,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91412 + +SecRule REQUEST_FILENAME "/forums/modcp/moderate\.php" "phase:2,id:91413,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340144" +SecAction "phase:2,id:91414,t:none,pass,nolog,skipAfter:END_RULES_91414" + +SecRule ARGS|!ARGS:/text/|!ARGS:display_query|!ARGS:Db_submit|!ARGS:prev_sql_query|!ARGS:sql_query|!ARGS:Post|!ARGS:text|!ARGS:action|!ARGS:op|!ARGS:setup_db|!ARGS:wptextbox1|!ARGS:message|!ARGS:/^SQL/|!ARGS:query_string|!ARGS:query|!ARGS:description "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table)|delete[[:space:]]*update.+set.+=)" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,phase:2,deny,log,auditlog,status:403,id:340799,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection 2'" + +SecMarker END_RULES_91414 + +SecRule REQUEST_FILENAME "/odp/index\.php" "phase:2,id:91415,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=380007" +SecAction "phase:2,id:91416,t:none,pass,nolog,skipAfter:END_RULES_91416" + +SecRule REQUEST_URI|ARGS|REQUEST_BODY|!ARGS:c "/\w*(\x27|\’)(\x6F|o|\x4F)(\x72|r|\x52)" "t:none,t:compressWhitespace,t:lowercase,phase:2,deny,log,auditlog,status:403,id:340800,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: SQL Inject Generic signature'" + +SecMarker END_RULES_91416 + +SecRule REQUEST_FILENAME "/yanner\.php" "phase:2,id:91417,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/pluskernel/settings\.php" "phase:2,id:91418,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91419,t:none,pass,nolog,skipAfter:END_RULES_91419" + +SecRule ARGS|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:r "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340801,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:r "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340802,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91419 + +SecRule REQUEST_FILENAME "/sql_error\.php" "phase:2,id:91420,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/login-register\.php" "phase:2,id:91421,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91422,t:none,pass,nolog,skipAfter:END_RULES_91422" + +SecRule ARGS|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:passwordlogin "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340803,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:passwordlogin "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340804,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91422 + +SecRule REQUEST_FILENAME "/lecture\.php" "phase:2,id:91423,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91424,t:none,pass,nolog,skipAfter:END_RULES_91424" + +SecRule ARGS|!ARGS:lec_rm|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:lec_doc "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340805,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:lec_rm|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:lec_doc "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340806,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91424 + +SecRule REQUEST_FILENAME "/response\.php" "phase:2,id:91425,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91426,t:none,pass,nolog,skipAfter:END_RULES_91426" + +SecRule ARGS|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:aardvark_page "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340807,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:aardvark_page "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340808,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91426 + +SecRule REQUEST_FILENAME "/edit_css\.ph" "phase:2,id:91427,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/modules/mod_oneononechat/phpfunctions\.php" "phase:2,id:91428,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/sql/fileman2\.php" "phase:2,id:91429,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340007" +SecAction "phase:2,id:91430,t:none,pass,nolog,skipAfter:END_RULES_91430" + +SecRule REQUEST_URI|ARGS|!ARGS:dir|!ARGS:/txt/|!ARGS:css_data|!ARGS:/text/|!ARGS:/message/|!ARGS:body|!ARGS:wysiwyg_input|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:/content/ "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" "phase:2,deny,log,auditlog,status:403,t:none,t:lowercase,id:340810,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied'" + +SecMarker END_RULES_91430 + +SecRule REQUEST_FILENAME "/wp-content/plugins/simple-popup-images/popup\.php" "phase:2,id:91431,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340026" + +SecRule REQUEST_FILENAME "/design/swapimages_onmousemove\.js" "phase:2,id:91432,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/edit_image" "phase:2,id:91433,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91434,t:none,pass,nolog,skipAfter:END_RULES_91434" + +SecRule ARGS|!ARGS:DirName|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/desc/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:aardvark_page "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340811,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:DirName|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/desc/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:aardvark_page "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340812,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91434 + +SecRule REQUEST_FILENAME "/server\.php" "phase:2,id:91435,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91436,t:none,pass,nolog,skipAfter:END_RULES_91436" + +SecRule ARGS|!ARGS:u|!ARGS:/^p_/|!ARGS:rf|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:aardvark_page "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340813,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:u|!ARGS:/^p_/|!ARGS:rf|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:aardvark_page "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340814,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{TX.0},%{matched_var_name}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91436 + +SecRule REQUEST_FILENAME "/php/compress\.php" "phase:2,id:91437,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/tbl_replace\.php" "phase:2,id:91438,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + + +SecRule REQUEST_FILENAME "wp-content/themes/bobv2/dax\.swf" "phase:2,id:91439,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/wp-admin/plugin-install\.php" "phase:2,id:91440,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91441,t:none,pass,nolog,skipAfter:END_RULES_91441" + +SecRule ARGS|!ARGS:s|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:/web/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340815,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:s|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:/web/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340816,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91441 + +SecRule REQUEST_FILENAME "/sitemap/index\.php" "phase:2,id:91442,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91443,t:none,pass,nolog,skipAfter:END_RULES_91443" + +SecRule ARGS|!ARGS:errmsg "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|< ?iframe ?|\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|\bon(?:abort|blur|change|click|dragdrop|event|focus|keydown|keypress|keyup|mouse(?:down|move|out|over|up))\b|script |shell\:|window\.location)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340817,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" + +SecMarker END_RULES_91443 + +SecRule REQUEST_FILENAME "/tbl_row_action\.php" "phase:2,id:91444,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/www/delivery/lg\.php" "phase:2,id:91445,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/tiny_mce/themes/advanced/source_editor\.htm" "phase:2,id:91446,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admincp/automediaembed_admin\.php" "phase:2,id:91447,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/wp-comments-post\.php" "phase:2,id:91448,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/compose\.php" "phase:2,id:91449,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=390711,ctl:ruleRemovebyID=390620,ctl:ruleRemovebyID=390613,ctl:ruleRemovebyID=390614" + +SecRule REQUEST_FILENAME "/cgi-bin/database/admin\.pl" "phase:2,id:91450,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91451,t:none,pass,nolog,skipAfter:END_RULES_91451" + + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:process_login|!ARGS:message|!ARGS:oldmsg|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/note/|!ARGS:/summary/|!ARGS:section|!ARGS:/xml/|!ARGS:/^descr/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:comment|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:removeNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:340818,rev:12,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" +SecRule ARGS "!(^(submit\+>>|>>)$)" + + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:process_login|!ARGS:message|!ARGS:oldmsg|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:section|!ARGS:/note/|!ARGS:/summary/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:/^descr/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:comment|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?((img|i?frame) ?src|a ?href) ?= ?(ogg|tls|ssl|gopher|zlib|(ht|f)tps?):/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,chain,multiMatch,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340819,rev:22,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" +SecRule ARGS "!(^(submit\+>>|>>)$)" "t:none,t:lowercase" + +# XSS injection +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:process_login|!ARGS:message|!ARGS:oldmsg|!ARGS:t_cont|!ARGS:footnote|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:/^descr/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:Submit|!ARGS:comment|!ARGS:/message/|!ARGS:formSubmit|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|iframe |\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|script |shell\:|window\.location)" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:removeNulls,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:340820,rev:18,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" +SecRule ARGS "!(^(submit\+>>|>>)$)" + + +SecMarker END_RULES_91451 + +SecRule REQUEST_FILENAME "/cynghrair/change\.php" "phase:2,id:91452,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/adm_noticies\.php" "phase:2,id:91453,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/plugins/ctrt/index\.php" "phase:2,id:91454,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91455,t:none,pass,nolog,skipAfter:END_RULES_91455" + + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:log|!ARGS:process_login|!ARGS:message|!ARGS:oldmsg|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:/^descr/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:comment|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:340821,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:log|!ARGS:process_login|!ARGS:message|!ARGS:oldmsg|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:/^descr/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:comment|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?((img|i?frame) ?src|a ?href) ?= ?(ogg|tls|ssl|gopher|zlib|(ht|f)tps?):/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,multiMatch,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340822,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" + +# XSS injection +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:log|!ARGS:process_login|!ARGS:message|!ARGS:oldmsg|!ARGS:t_cont|!ARGS:footnote|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:/^descr/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:Submit|!ARGS:comment|!ARGS:/message/|!ARGS:formSubmit|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|iframe |\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|script |shell\:|window\.location)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:340823,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" + +SecMarker END_RULES_91455 + +SecRule REQUEST_FILENAME "/install\.php" "phase:2,id:91456,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/install1\.php" "phase:2,id:91457,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/wp-admin/themes\.php" "phase:2,id:91458,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admincp/" "phase:2,id:91459,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=390707,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854" + +SecRule REQUEST_FILENAME "/admincp/css\.php" "phase:2,id:91460,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/modules/upl/wc/csxml\.php" "phase:2,id:91461,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/onmouseover\.js" "phase:2,id:91462,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admincp/vbacmps_install\.php" "phase:2,id:91463,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/manage/bios/edit/" "phase:2,id:91464,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/manage/index\.php" "phase:2,id:91465,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91466,t:none,pass,nolog,skipAfter:END_RULES_91466" + + +# Rule 340147: Generic XSS filter +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/description/|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:cache|!ARGS:_module|!ARGS:_op|!ARGS:title|!ARGS:desc|!ARGS:news|!ARGS:expiry|!ARGS:domain|!ARGS:email_id|!ARGS:obj_itop|!ARGS:route|!ARGS:token|!ARGS:/^mymodule/|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:phpcode|!ARGS:intro|!ARGS:Snippet|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:input[Desarrollo]|!ARGS:move2|!ARGS:hoperation|!ARGS:login_form|!ARGS:/product_benefits/|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:bbcode_tpl|!ARGS:Right_photo_1|!ARGS:embedVideo|!ARGS:/^K2ExtraField/|!ARGS:mentorhelp|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:/quote/|!ARGS:/print/|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:java|vb)?script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:htmlEntityDecode,t:lowercase,capture,id:360678,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter',chain,logdata:'%{TX.0}'" +SecRule ARGS "!(^(submit\+>>|>>)$)" + +# Rule 340148: XSS injection with multimatch checks +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/description/|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:cache|!ARGS:_module|!ARGS:_op|!ARGS:title|!ARGS:desc|!ARGS:news|!ARGS:expiry|!ARGS:domain|!ARGS:pay_inst_1|!ARGS:route|!ARGS:token|!ARGS:/^mymodule/|!ARGS:/^jform/|!ARGS:eip_value|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:move2|!ARGS:input[Desarrollo]|!ARGS:hoperation|!ARGS:arg2|!ARGS:login_form|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:/submitcode/|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:/quote/|!ARGS:/print/|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(ht|f)tps?)\:/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame|\%env)" "phase:2,deny,status:403,log,auditlog,chain,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,capture,id:360679,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}',multiMatch" +SecRule ARGS "!(^(submit\+>>|>>)$)" "t:none,t:lowercase" +# Rule 340149: XSS injection +SecRule REQUEST_URI|ARGS|!ARGS:cache|!ARGS:_module|!ARGS:_op|!ARGS:title|!ARGS:desc|!ARGS:news|!ARGS:expiry|!ARGS:domain|!ARGS:/description/|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:pay_inst_1|!ARGS:sml_prt_1|!ARGS:/^jform/|!ARGS:route|!ARGS:token|!ARGS:/^mymodule/|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:input[Desarrollo]|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:login_form|!ARGS:create_tables|!ARGS:insertfile|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:move2|!ARGS:hoperation|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:mes|!ARGS:signature|!ARGS:/quote/|!ARGS:paepdc|!ARGS:/quote/|!ARGS:/print/|!ARGS:/VB_announce/|!ARGS:/^autoDS/|!ARGS:newyddionc|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|!ARGS:search_theme_form_keys|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|shell\:|window\.location|asfunction:_root\.launch|\%env)" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:removeNulls,t:urlDecodeUni,t:replaceComments,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,capture,id:341149,rev:112,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule ARGS "!(^(submit(\+| )>>|>>)$)" "t:none,t:lowercase" + +SecMarker END_RULES_91466 + +SecRule REQUEST_FILENAME "/cgi-bin/cp-admin\.cgi" "phase:2,id:91467,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/_admin/" "phase:2,id:91468,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/siteadmin/" "phase:2,id:91469,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cmsadmin/" "phase:2,id:91470,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/forumadmin/" "phase:2,id:91471,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/management/" "phase:2,id:91472,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/manager/" "phase:2,id:91473,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/edit_product" "phase:2,id:91474,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/rssadmin/" "phase:2,id:91475,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/order/input\.php" "phase:2,id:91476,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91477,t:none,pass,nolog,skipAfter:END_RULES_91477" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/page/|!ARGS:order|!ARGS:youtube|!ARGS:reply|!ARGS:/^B/|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/product_desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:/descr/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,id:341823,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/^B/|!ARGS:order|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/product_desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:/descr/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?((img|i?frame) ?src|a ?href) ?= ?(ogg|tls|ssl|gopher|zlib|(ht|f)tps?):/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,multiMatch,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340824,rev:33,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" + +SecMarker END_RULES_91477 + +SecRule REQUEST_FILENAME "/ftp/index\.php" "phase:2,id:91478,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340144" +SecAction "phase:2,id:91479,t:none,pass,nolog,skipAfter:END_RULES_91479" + +SecRule ARGS|!ARGS:state|!ARGS:postpagetext|!ARGS:display_query|!ARGS:Db_submit|!ARGS:prev_sql_query|!ARGS:sql_query|!ARGS:Post|!ARGS:text|!ARGS:action|!ARGS:op|!ARGS:setup_db|!ARGS:wptextbox1|!ARGS:message|!ARGS:/^SQL/|!ARGS:query_string|!ARGS:query|!ARGS:description "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table)|delete[[:space:]]*update.+set.+=)" "t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,phase:2,deny,log,auditlog,status:403,id:340825,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection 2'" + +SecMarker END_RULES_91479 + +SecRule REQUEST_FILENAME "/editfield\.php" "phase:2,id:91480,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin1/" "phase:2,id:91481,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/edit/index\.php" "phase:2,id:91482,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/ticketreply\.php" "phase:2,id:91483,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340144" +SecAction "phase:2,id:91484,t:none,pass,nolog,skipAfter:END_RULES_91484" + +SecRule ARGS|!ARGS:reply|!ARGS:postpagetext|!ARGS:display_query|!ARGS:Db_submit|!ARGS:prev_sql_query|!ARGS:sql_query|!ARGS:Post|!ARGS:text|!ARGS:action|!ARGS:op|!ARGS:setup_db|!ARGS:wptextbox1|!ARGS:message|!ARGS:/^SQL/|!ARGS:query_string|!ARGS:query|!ARGS:description "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table)|delete[[:space:]]*update.+set.+=|union all select |union select [a-z][0-9]+ )" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:340852,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection 2'" + +SecMarker END_RULES_91484 + +SecRule REQUEST_FILENAME "/tiny_mce/plugins/advlink/link\.htm" "phase:2,id:91485,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/webadmin/" "phase:2,id:91486,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/front_content\.php" "phase:2,id:91487,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/main/" "phase:2,id:91488,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340017" + +SecRule REQUEST_FILENAME "/install/" "phase:2,id:91489,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/formmail\.conf" "phase:2,id:91490,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340017" +SecAction "phase:2,id:91491,t:none,pass,nolog,skipAfter:END_RULES_91491" + +SecRule ARGS|!ARGS:CompanyType|!ARGS:ncontent|!ARGS:/body/|!ARGS:/content/|!ARGS:searchword|!ARGS:add_keywords|!ARGS:comments|!ARGS:text|!ARGS:/description/|!ARGS:/^sql/|!ARGS:/products_description/|!ARGS:contactMessage|!ARGS:cts|!ARGS:meta_descr|!ARGS:text|!ARGS:edited|!ARGS:content|!ARGS:description|!ARGS:introtext|!ARGS:Post|!ARGS:sql_query|!ARGS:itembigtext|!ARGS:article_content|!ARGS:body|!ARGS:mytextarea|!ARGS:ll_content_message|!ARGS:page-content|!ARGS:reply|!ARGS:xml|!ARGS:content_en|!ARGS:filecontent|!ARGS:message|!ARGS:content_en|!ARGS:general[description]|!ARGS:response[14]|!ARGS:article|!ARGS:wptextbox1 "(?:insert into values|select from [a-z|0-9]|bulk insert |union select |union all select|convert \(.*from)" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,phase:2,deny,log,auditlog,status:403,id:340826,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection in ARGS'" + +SecMarker END_RULES_91491 + +SecRule REQUEST_FILENAME "/wizard/pages" "phase:2,id:91492,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/email\.php" "phase:2,id:91493,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/dict\.php" "phase:2,id:91494,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91495,t:none,pass,nolog,skipAfter:END_RULES_91495" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:request|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:340827,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:request|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:340828,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" + +SecMarker END_RULES_91495 + +SecRule REQUEST_FILENAME "/webadmin\.php" "phase:2,id:91496,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/ntunnel_mysql\.ph" "phase:2,id:91497,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019" + + +SecRule REQUEST_FILENAME "/planner\.php" "phase:2,id:91498,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:91499,t:none,pass,nolog,skipAfter:END_RULES_91499" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:title|!ARGS:request|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,t:none,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340829,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:title|!ARGS:request|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame)" "phase:2,deny,log,auditlog,status:403,t:none,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340830,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" + +SecMarker END_RULES_91499 + +SecRule REQUEST_FILENAME "/facebook/" "phase:2,id:91500,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/install2\.php" "phase:2,id:91501,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854" + +SecRule REQUEST_FILENAME "/install\.php" "phase:2,id:91502,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854" + +SecRule REQUEST_FILENAME "/stream/index\.php" "phase:2,id:91503,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340018" + +SecRule REQUEST_FILENAME "/secure\.php" "phase:2,id:91504,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=390709" + +SecRule REQUEST_FILENAME "/uplay/" "phase:2,id:91505,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/mapas_admin_edit\.php" "phase:2,id:91506,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:91507,t:none,pass,nolog,skipAfter:END_RULES_91507" + +SecRule ARGS|!ARGS:/titulo/|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:passwordlogin "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340831,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/titulo/|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:passwordlogin "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340832,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91507 + +SecRule REQUEST_FILENAME "/projectpier/" "phase:2,id:91508,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/supportkb\.php" "phase:2,id:91509,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/systemadmin/supportkb\.php" "phase:2,id:91510,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/manage\.php" "phase:2,id:91511,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin_panel/" "phase:2,id:91512,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/inc/php/img\.php" "phase:2,id:91513,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/media/" "phase:2,id:91514,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340164" + +SecRule REQUEST_FILENAME "/wizard_forms\.php" "phase:2,id:91515,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/content/types/import" "phase:2,id:91516,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371" + +SecRule REQUEST_FILENAME "/wp-admin/post\.php" "phase:2,id:91517,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340014,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=390707,ctl:ruleRemovebyID=341146,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340213,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380006,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340195" +SecAction "phase:2,id:91518,t:none,pass,nolog,skipAfter:END_RULES_91518" + +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|ARGS|!ARGS:content|!ARGS:fileContent|!ARGS:message|!ARGS:message_html|!ARGS:SAMLResponse|!ARGS:areas|!ARGS:/template/|!ARGS:site_first|!ARGS:sendDescription|!ARGS:templatecode|!ARGS:areas|!ARGS:wpSummary|!ARGS:/keyword/ "(?: ?(?:\bcurl\b|(?:w|ftp)get) (?:http|(?:s|t)?ftp|\- |dict|smb|file|gopher|imap|ldap|pop|rt|scp|smtp|telnet)| ?(?:cmd|command) ?= ?(?:chdir|mkdir|rm) |cd /(?:tmp|/var/tmp|/etc/|/proc|\.\.) |\|id ?\; ?echo.{1,200}\||\b(?:(?:n(?:map|et|c)|w(?:guest|sh)|telnet|r?cmd|ftp)\.exe\b|c(?:md|ommand)(?:(?:32)?\.exe\b|\b /[ck])))" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:cmdline,t:normalizePath,t:replaceNulls,chain,id:347714,rev:18,severity:2,msg:'Atomicorp.com WAF Rules: CMD injection',logdata:'%{TX.0}',tag:'Command Injection'" +SecRule REQUEST_URI "!(?:/count\.cgi|^/magento/index\.php/admin/dashboard/|^/images/stories/|^/content/pdf/media/print)" "t:none,t:lowercase" +SecRule ARGS|!ARGS:templatecode|!ARGS:areas|!ARGS:/news/|!ARGS:rsargs|!ARGS:/note/|!ARGS:announcement|!ARGS:/^meta/|!ARGS:SAMLResponse|!ARGS:/content/|!ARGS:/wysiwyg/|!ARGS:/prefix/|!ARGS:/suffix/|!ARGS:/comment/|!ARGS:problem|!ARGS:resolution|!ARGS:subject|!ARGS:/body/|!ARGS:/^widget-section/|!ARGS:/template/|!ARGS:/^eip_/|!ARGS:/sql/|!ARGS:prefix|!ARGS:/keyword/|!ARGS:/msg/|!ARGS:metadata|!ARGS:post_content|!ARGS:parent_name|!ARGS:topic|!ARGS:file_content|!ARGS:/^serendipity/|!ARGS:comment|!ARGS:summary|!ARGS:configoptionname|!ARGS:Definition|!ARGS:/php/|!ARGS:/Metatags/|!ARGS:/footerfile/|!ARGS:/layout/|!ARGS:/message/|!ARGS:email|!ARGS:/desc/|!ARGS:body|!ARGS:content "(?:\(chr ?\( ?[0-9]{1,3} ?\)| ?= ?f(?:open|write) ?\(|\b(?:passthru|serialize|php_uname|phpinfo|shell_exec|preg_\w+|mysql_query|exec|eval|create_function|system|base64_decode|decode_base64|base64_url_decode|str_rot13)\b ?(?:\(|\:))" "phase:2,deny,log,auditlog,status:403,t:none,t:replaceNulls,t:compressWhiteSpace,t:lowercase,capture,id:345195,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - Base64 Encoded PHP function in Argument - this may be an attack.',logdata:'%{TX.0}'" + +SecMarker END_RULES_91518 + +SecRule REQUEST_FILENAME "/wp-admin/" "phase:2,id:91519,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=390620,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854" + + +SecRule REQUEST_FILENAME "/tstemplate/ts/index\.php" "phase:2,id:91520,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340017" + +SecRule REQUEST_FILENAME "/alta\.php" "phase:2,id:91521,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/setup/" "phase:2,id:91522,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/install/" "phase:2,id:91523,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/settings\.php" "phase:2,id:91524,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/projects/csb/ticket/" "phase:2,id:91525,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340144" + +SecRule REQUEST_FILENAME "/contenido/main\.php" "phase:2,id:91526,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/orderform/processor\.php" "phase:2,id:91527,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/cgi-bin/soupermail\.pl" "phase:2,id:91528,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/read_dump\.php" "phase:2,id:91529,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin_center/" "phase:2,id:91530,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admincenter/" "phase:2,id:91531,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/homedeveloper\.php" "phase:2,id:91532,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/bevestiging\.php" "phase:2,id:91533,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/imagemanager/stream/index\.php" "phase:2,id:91534,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390614,ctl:ruleRemovebyID=390615,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/export\.php" "phase:2,id:91535,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/privado/" "phase:2,id:91536,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/webform/configure" "phase:2,id:91537,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/portalcp/vbpoptions\.php" "phase:2,id:91538,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/thubservice\.php" "phase:2,id:91539,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/user\.php" "phase:2,id:91540,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91541,t:none,pass,nolog,skipAfter:END_RULES_91541" + +SecRule ARGS|!ARGS:homepage|!ARGS:return|!ARGS:/user/|!ARGS:/pass/|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:www|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:passwordlogin "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340833,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:homepage|!ARGS:return|!ARGS:/user/|!ARGS:/pass/|!ARGS:/icon/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:www|!ARGS:/text/|!ARGS:/redir/|!ARGS:/image/|!ARGS:/^userfile/|!ARGS:page|!ARGS:passwordlogin "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340834,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91541 + +SecRule REQUEST_FILENAME "/survey/index\.php" "phase:2,id:91542,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91543,t:none,pass,nolog,skipAfter:END_RULES_91543" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/move/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:welcome|!ARGS:changes|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340835,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/move/|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:changes|!ARGS:welcome|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?((img|i?frame) ?src|a ?href) ?= ?(ogg|tls|ssl|gopher|zlib|(ht|f)tps?):/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,multiMatch,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340836,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" +SecRule REQUEST_URI|ARGS|!ARGS:/move/|!ARGS:embeddump|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:changes|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|!ARGS:search_theme_form_keys|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:user[usertitle]|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:/desc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|iframe |\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|script |shell\:|window\.location|asfunction:_root\.launch|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340837,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" + +SecMarker END_RULES_91543 + +SecRule REQUEST_FILENAME "/forum/post\.php" "phase:2,id:91544,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/crop_auto\.php" "phase:2,id:91545,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340008" + +SecRule REQUEST_FILENAME "/admin/main\.php" "phase:2,id:91546,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/thumb\.php" "phase:2,id:91547,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/com_virtuemart/fetchscript\.php" "phase:2,id:91548,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340026" + +SecRule REQUEST_FILENAME "/uploader\.php" "phase:2,id:91549,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/survey/preview\.php" "phase:2,id:91550,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91551,t:none,pass,nolog,skipAfter:END_RULES_91551" + +SecRule REQUEST_URI|ARGS|!ARGS:/survey/|ARGS_NAMES|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340840,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" + +# Rule 340148: XSS injection +SecRule REQUEST_URI|ARGS|!ARGS:/survey/|ARGS_NAMES|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?((img|i?frame) ?src|a ?href) ?= ?(ogg|tls|ssl|gopher|zlib|(ht|f)tps?):/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,multiMatch,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340841,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" + +# Rule 340149: XSS injection +SecRule REQUEST_URI|ARGS|!ARGS:/survey/|!ARGS:embeddump|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|!ARGS:search_theme_form_keys|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:user[usertitle]|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:/desc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|iframe |\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|script |shell\:|window\.location|asfunction:_root\.launch|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340842,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" + +SecMarker END_RULES_91551 + +SecRule REQUEST_FILENAME "/linkmachine\.php" "phase:2,id:91552,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/productadd\.php" "phase:2,id:91553,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340144" +SecAction "phase:2,id:91554,t:none,pass,nolog,skipAfter:END_RULES_91554" + +SecRule ARGS|!ARGS:create|!ARGS:postpagetext|!ARGS:display_query|!ARGS:Db_submit|!ARGS:prev_sql_query|!ARGS:sql_query|!ARGS:Post|!ARGS:text|!ARGS:action|!ARGS:op|!ARGS:setup_db|!ARGS:wptextbox1|!ARGS:message|!ARGS:/^SQL/|!ARGS:query_string|!ARGS:query|!ARGS:description "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table)|delete[[:space:]]*update.+set.+=)" "t:none,t:urlDecodeUni,t:compressWhitespace,t:lowercase,phase:2,deny,log,auditlog,status:403,id:340843,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection 2'" + +SecMarker END_RULES_91554 + +SecRule REQUEST_FILENAME "/admint/" "phase:2,id:91555,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/setupctcform\.php" "phase:2,id:91556,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/db\.php" "phase:2,id:91557,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019" + + +SecRule REQUEST_FILENAME "/admin-translate/" "phase:2,id:91558,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/mailtemplate_outpay1_result\.php" "phase:2,id:91559,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/" "phase:2,id:91560,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/supportannouncements\.php" "phase:2,id:91561,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/socialware/popups/add_friend\.php" "phase:2,id:91562,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/open\.php" "phase:2,id:91563,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:91564,t:none,pass,nolog,skipAfter:END_RULES_91564" + +SecRule ARGS|!ARGS:/site/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:q "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:340844,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/site/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:q "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:340845,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91564 + +SecRule REQUEST_FILENAME "/order/totals\.php" "phase:2,id:91565,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91566,t:none,pass,nolog,skipAfter:END_RULES_91566" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/token/|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340846,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter'" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:token/|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?((img|i?frame) ?src|a ?href) ?= ?(ogg|tls|ssl|gopher|zlib|(ht|f)tps?):/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,multiMatch,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340847,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" + +# Rule 340149: XSS injection +SecRule REQUEST_URI|ARGS|!ARGS:/token/|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|!ARGS:search_theme_form_keys|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:user[usertitle]|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:/desc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|iframe |\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|shell\:|window\.location|asfunction:_root\.launch|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340848,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack'" + +SecMarker END_RULES_91566 + +SecRule REQUEST_FILENAME "/admin/write\.php" "phase:2,id:91567,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91568,t:none,pass,nolog,skipAfter:END_RULES_91568" + +SecRule REQUEST_URI|ARGS|!ARGS:/text/|!ARGS:/movie/|!ARGS:/message/|!ARGS:ncontent|!ARGS:/body/|!ARGS:/content/|!ARGS:searchword|!ARGS:add_keywords|!ARGS:comments|!ARGS:text|!ARGS:/descr/|!ARGS:/^sql/|!ARGS:contactMessage|!ARGS:cts|!ARGS:text|!ARGS:edited|!ARGS:content|!ARGS:introtext|!ARGS:Post|!ARGS:sql_query|!ARGS:itembigtext|!ARGS:article_content|!ARGS:body|!ARGS:mytextarea|!ARGS:ll_content_message|!ARGS:page-content|!ARGS:reply|!ARGS:xml|!ARGS:content_en|!ARGS:filecontent|!ARGS:message|!ARGS:content_en|!ARGS:response[14]|!ARGS:/article/ "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[a-z|0-9|\*|\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[a-z|0-9|\*| |\,]|\bunion\b.{1,100}?\bselect\b.*[a-z0-9].*from)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:340849,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection'" + +SecMarker END_RULES_91568 + +SecRule REQUEST_FILENAME "/admin/addvideo\.php" "phase:2,id:91569,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/installation/install3\.php" "phase:2,id:91570,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854" + +SecRule REQUEST_FILENAME "/installation/install\.php" "phase:2,id:91571,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854" + +SecRule REQUEST_FILENAME "/install/" "phase:2,id:91572,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340852,ctl:ruleRemovebyID=340853,ctl:ruleRemovebyID=340854" + +SecRule REQUEST_FILENAME "/categorie\.php" "phase:2,id:91573,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91574,t:none,pass,nolog,skipAfter:END_RULES_91574" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/iframe/|!ARGS:/page/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:340850,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/iframe/|!ARGS:/page/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:340851,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91574 + +SecRule REQUEST_FILENAME "/install\.php" "phase:2,id:91575,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=390709" + +SecRule REQUEST_FILENAME "/quick_reply\.php" "phase:2,id:91576,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/adm-misc\.php" "phase:2,id:91577,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=390709" + +SecRule REQUEST_FILENAME "/install/" "phase:2,id:91578,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=390709" + +SecRule REQUEST_FILENAME "/glossary\.pl" "phase:2,id:91579,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin-create-edit-page\.php" "phase:2,id:91580,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/question/question\.php" "phase:2,id:91581,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/" "phase:2,id:91582,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=390709,ctl:ruleRemovebyID=390707,ctl:ruleRemovebyID=390711,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/administrator/" "phase:2,id:91583,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/adm/" "phase:2,id:91584,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/typo3/" "phase:2,id:91585,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/typo3/ajax\.php" "phase:2,id:91586,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/setup/" "phase:2,id:91587,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/portal/index\.php" "phase:2,id:91588,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340009" +SecAction "phase:2,id:91589,t:none,pass,nolog,skipAfter:END_RULES_91589" + +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:X-PageView|!REQUEST_HEADERS:Cookie|!REQUEST_HEADERS:REFERER|ARGS|!ARGS:/highlight/|!ARGS:name|!ARGS:/search/|!ARGS:/msg/|!ARGS:/comment/|!ARGS:/hilit/|!ARGS:/uri/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/description/|!ARGS:product[media_gallery][images]|!ARGS:/subject/|!ARGS:/comment/|!ARGS:/content/|!ARGS:/data/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/post/|!ARGS:LiveURLSegment|!ARGS:keywords|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:/description/|!ARGS:note_title|!ARGS:/^xjxargs/|!ARGS:backPath|!ARGS:webpage[content]|!ARGS:article[content]|!ARGS:filecontent|!ARGS:/message/|!ARGS:/^fck_/|!ARGS:htmlSource|!ARGS:path_to_lzx|!ARGS:content|!ARGS:/body/ "(?:/(?:etc|proc|var/tmp|usr|opt|s?bin|dev|tmp|kern|[br]oot|sys|windows|winnt)/|(?:\/|\\\\)+inetpub|localstart\.asp|boot\.ini)" "phase:2,deny,log,auditlog,status:403,t:none,t:normalisePath,t:lowercase,capture,id:340860,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Protected Path Access denied in URI/ARGS',logdata:'%{TX.0}'" + +SecMarker END_RULES_91589 + +SecRule REQUEST_FILENAME "/components/com_zoom/etc/" "phase:2,id:91590,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390709" + +SecRule REQUEST_FILENAME "/admin_orders\.php" "phase:2,id:91591,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/setup\.jspa" "phase:2,id:91592,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/pages\.php" "phase:2,id:91593,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/sql\.php3" "phase:2,id:91594,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/sql\.php" "phase:2,id:91595,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/ipn_main_handler\.php" "phase:2,id:91596,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91597,t:none,pass,nolog,skipAfter:END_RULES_91597" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/^item_name/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340870,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter',logdata:'%{TX.0}'" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/^item_name/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?((img|i?frame) ?src|a ?href) ?= ?(ogg|tls|ssl|gopher|zlib|(ht|f)tps?):/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,capture,multiMatch,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340871,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}'" + +SecRule REQUEST_URI|ARGS|!ARGS:/^item_name/|!ARGS:newyddionc|!ARGS:omschrijving|!ARGS:resolution|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|!ARGS:search_theme_form_keys|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:user[usertitle]|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:/desc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|shell\:|window\.location|asfunction:_root\.launch|\%env)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:340872,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}'" + + +SecMarker END_RULES_91597 + +SecRule REQUEST_FILENAME "/xcloner\.php" "phase:2,id:91598,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/cms/content\.php" "phase:2,id:91599,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91600,t:none,pass,nolog,skipAfter:END_RULES_91600" + +SecRule ARGS|!ARGS:short|!ARGS:keywords|!ARGS:/code/|!ARGS:plaatje|!ARGS:ranking_info|!ARGS:/callback/|!ARGS:subject|!ARGS:pic|!ARGS:/sponsors/|!ARGS:want2Read|!ARGS:/webcam/|!ARGS:search_string|!ARGS:direct|!ARGS:yt_thumb|!ARGS:fflv|!ARGS:direct|!ARGS:/site/|!ARGS:source_location|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:user_mail_register_no_approval_required_body|!ARGS:/openid/|!ARGS:/adres/|!ARGS:/logo/|!ARGS:/webseite/|!ARGS:/^utm/|!ARGS:resolution|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:/message/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:/youtube/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:pic1|!ARGS:/click/|!ARGS:rf|!ARGS:/web/|!ARGS:/home/|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:/^win/|!ARGS:lec_rm|!ARGS:n-state|!ARGS:/img/|!ARGS:Stream|!ARGS:CP_email|!ARGS:flvsite|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:attribute29|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:/server/|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:V_feed_email|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:loc|!ARGS:/^description/|!ARGS:notification_body|!ARGS:sitead|!ARGS:/^product_long_/|!ARGS:/^topic_content_/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:address|!ARGS:board_msg|!ARGS:logo_path|!ARGS:prehtml_root|!ARGS:revpro_video|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/html_content/|!ARGS:desc|!ARGS:descripcion|!ARGS:body_html|!ARGS:/^field_id_/|!ARGS:wpUploadDescription|!ARGS:customer_footer|!ARGS:FAQTitle|!ARGS:host|!ARGS:/text/|!ARGS:whereto|!ARGS:/description/|!ARGS:item[content]|!ARGS:pathToPiwik|!ARGS:admin_footer|!ARGS:email_sig|!ARGS:minicms_content|!ARGS:feed|!ARGS:/^artsee_banner_/|!ARGS:pingback_service|!ARGS:showStr|!ARGS:hostname|!ARGS:htmlSource|!ARGS:/virtual_http_path/|!ARGS:/virtual_https_path/|!ARGS:f_content|!ARGS:bannercode|!ARGS:email_forward|!ARGS:fetch|!ARGS:/txt/|!ARGS:blog|!ARGS:RTServerName|!ARGS:mesg|!ARGS:forward|!ARGS:atc_content|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/^commontemplate/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:footer_scripts|!ARGS:advBannerMessage|!ARGS:thumb|!ARGS:question_content|!ARGS:u|!ARGS:header|!ARGS:action|!ARGS:cptpl_dir|!ARGS:forum_desc|!ARGS:file_contents|!ARGS:newDesc|!ARGS:return_to|!ARGS:Stream|!ARGS:contents|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:cat_sponsor|!ARGS:stretch|!ARGS:/^fields_prev/|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:contactMessage|!ARGS:var_value[usps_labels_help_2]|!ARGS:short_story|!ARGS:intro_content|!ARGS:vinculo|!ARGS:openid_return_to|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:headers-28|!ARGS:fulldescr|!ARGS:soundname|!ARGS:bbcode_tpl|!ARGS:/link/|!ARGS:faqText|!ARGS:request_uri|!ARGS:google|!ARGS:definition|!ARGS:openid.return_to|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:from_href|!ARGS:Comentario|!ARGS:dynadata[_SIGNATURE]|!ARGS:ppicture|!ARGS:paypal_ipn|!ARGS:defaultImage|!ARGS:title|!ARGS:html|!ARGS:dbody|!ARGS:right_frame|!ARGS:l1_bdy|!ARGS:theMessage|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:commontemplate[header]|!ARGS:uri|!ARGS:/^blockbody/|!ARGS:field11|!ARGS:field_id_7|!ARGS:/^ViewState/|!ARGS:vars[DBhostname]|!ARGS:postvars|!ARGS:base1|!ARGS:cart_header|!ARGS:setting[description]|!ARGS:video_google|!ARGS:layout|!ARGS:GMAP_KEY|!ARGS:full_story|!ARGS:source|!ARGS:set_static_uri_to|!ARGS:livesite|!ARGS:Infos|!ARGS:rev_you_tube|!ARGS:ret_address|!ARGS:GMAP_KEY|!ARGS:newsBody|!ARGS:html_code|!ARGS:/http_script_dir/|!ARGS:cfgfilecontent|!ARGS:user_sig|!ARGS:cur|!ARGS:yahoo|!ARGS:/Website/|!ARGS:sig|!ARGS:template_data|!ARGS:template|!ARGS:option[ping_sites]|!ARGS:KT_Update1|!ARGS:flds[Message]|!ARGS:EditorHTML|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:vars[siteName]|!ARGS:replycontents|!ARGS:sitedisclaimer|!ARGS:sm_b_style|!ARGS:success|!ARGS:/^css/|!ARGS:short_story|!ARGS:ecards_more_pic_target|!ARGS:vthumb|!ARGS:introduction|!ARGS:register_at|!ARGS:/^products_description/|!ARGS:terms_content|!ARGS:statusaddress|!ARGS:revnews_ad_120|!ARGS:revnews_video|!ARGS:/sponsor_banner/|!ARGS:videoPath|!ARGS:newText|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:f_header|!ARGS:option[78]|!ARGS:savecontent|!ARGS:agendWebPage|!ARGS:params[helpsite]|!ARGS:iconnew|!ARGS:wpau-ftphost|!ARGS:gen_header|!ARGS:button_dir|!ARGS:news_desc|!ARGS:x_organizational|!ARGS:href|!ARGS:form_element3|!ARGS:wptextbox1|!ARGS:edit[site_mission]|!ARGS:answer|!ARGS:intro|!ARGS:note|!ARGS:c_msg|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/^sql_/|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:thm|!ARGS:_RW_|!ARGS:/^rss/|!ARGS:/rss$/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:team[logo]|!ARGS:helpbox|!ARGS:return|!ARGS:basehref|!ARGS:/^redirect/|!ARGS:redir|!ARGS:ret|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:portal_body|!ARGS:filecontent|!ARGS:inc|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:body|!ARGS:Post|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:notes|!ARGS:missing_fields_redirect|!ARGS:templatePath|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:oldmsg|!ARGS:/redirect/|!ARGS:src|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:site_desc|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:bbcode_replace|!ARGS:jumpTo|!ARGS:site|!ARGS:memo|!ARGS:live_site|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:g2_return|!ARGS:goto|!ARGS:site_first|!ARGS:from|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:fb_ref|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:pp_bio_content|!ARGS:xajaxargs[]|!ARGS:backto|!ARGS:/^http/|!ARGS:/^rsargs/|!ARGS:op|!ARGS:BLK_block_content|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:hamechalets_desc|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:description|!ARGS:ret|!ARGS:newDescription|!ARGS:area|!ARGS:content|!ARGS:/^data\[tt_content\]/|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:newcontent|!ARGS:st_widget|!ARGS:video|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:Store_OUI_GlobalFooter|!ARGS:in[http]|!ARGS:dynafield[_SIGNATURE]|!ARGS:payment_extrainfo|!ARGS:virtual_http_path|!ARGS:cta_content|!ARGS:wysiwyg|!ARGS:banner|!ARGS:env_ping_list|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:/^virtual_http/|!ARGS:cta_content|!ARGS:map_description_1|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:field5|!ARGS:p_content|!ARGS:f_site|!ARGS:CANCEL_RETURN "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)\:/" "phase:2,deny,log,auditlog,status:403,capture,id:340873,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:keywords|!ARGS:short|!ARGS:plaatje|!ARGS:ranking_info|!ARGS:/code/|!ARGS:/callback/|!ARGS:pic|!ARGS:/sponsors/|!ARGS:want2Read|!ARGS:/webcam/|!ARGS:search_string|!ARGS:yt_thumb|!ARGS:subject|!ARGS:direct|!ARGS:user_mail_register_no_approval_required_body|!ARGS:fflv|!ARGS:direct|!ARGS:/site/|!ARGS:source_location/|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:/openid_identifier|!ARGS:/adres/|!ARGS:/logo/|!ARGS:/webseite/|!ARGS:resolution|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:/message/|!ARGS:/^utm/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:/youtube/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:pic1|!ARGS:clickTag1|!ARGS:rf|!ARGS:web|!ARGS:/home/|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:lec_rm|!ARGS:n-state|!ARGS:/img/|!ARGS:Stream|!ARGS:CP_email|!ARGS:flvsite|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:/^clickTagFrame/|!ARGS:attribute29|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:/^GARS_existing/|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:loc|!ARGS:notification_body|!ARGS:sitead|!ARGS:/^product_long/|!ARGS:/server/|!ARGS:/^topic_content/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:address|!ARGS:board_msg|!ARGS:logo_path|!ARGS:prehtml_root|!ARGS:revpro_video|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/html_content/|!ARGS:desc|!ARGS:body_html|!ARGS:/^field_id_/|!ARGS:wpUploadDescription|!ARGS:/footer/|!ARGS:FAQTitle|!ARGS:host|!ARGS:webpath|!ARGS:/text/|!ARGS:whereto|!ARGS:/description/|!ARGS:item[content]|!ARGS:pathToPiwik|!ARGS:email_sig|!ARGS:minicms_content|!ARGS:feed|!ARGS:/^artsee_banner_/|!ARGS:fetch|!ARGS:pingback_service|!ARGS:hostname|!ARGS:htmlSource|!ARGS:/virtual_http_path/|!ARGS:/virtual_https_path/|!ARGS:f_content|!ARGS:email_forward|!ARGS:blog|!ARGS:RTServerName|!ARGS:mesg|!ARGS:forward|!ARGS:atc_content|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/^commontemplate/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:advBannerMessage|!ARGS:thumb|!ARGS:question_content|!ARGS:u|!ARGS:header|!ARGS:action|!ARGS:cptpl_dir|!ARGS:newDesc|!ARGS:forum_desc|!ARGS:file_contents|!ARGS:return_to|!ARGS:Stream|!ARGS:contents|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:newwebpath|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:stretch|!ARGS:cat_sponsor|!ARGS:/^fields_prev/|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:contactMessage|!ARGS:var_value[usps_labels_help_2]|!ARGS:short_story|!ARGS:intro_content|!ARGS:vinculo|!ARGS:openid_return_to|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:headers-28|!ARGS:fulldescr|!ARGS:soundname|!ARGS:Direccionsitioweb|!ARGS:/link/|!ARGS:faqText|!ARGS:request_uri|!ARGS:google|!ARGS:ud_web|!ARGS:openid.return_to|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:from_href|!ARGS:Comentario|!ARGS:/^dynadata/|!ARGS:ppicture|!ARGS:paypal_ipn|!ARGS:defaultImage|!ARGS:title|!ARGS:html|!ARGS:dbody|!ARGS:right_frame|!ARGS:l1_bdy|!ARGS:theMessage|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:uri|!ARGS:commontemplate[header]|!ARGS:/^blockbody/|!ARGS:field11|!ARGS:field_id_7|!ARGS:/^ViewState/|!ARGS:postvars|!ARGS:vars[DBhostname]|!ARGS:base1|!ARGS:cart_header|!ARGS:setting[description]|!ARGS:webcam|!ARGS:video_google|!ARGS:layout|!ARGS:GMAP_KEY|!ARGS:full_story|!ARGS:source|!ARGS:set_static_uri_to|!ARGS:livesite|!ARGS:Infos|!ARGS:rev_you_tube|!ARGS:ret_address|!ARGS:GMAP_KEY|!ARGS:newsBody|!ARGS:/webaddress/|!ARGS:/http_script_dir/|!ARGS:cfgfilecontent|!ARGS:user_sig|!ARGS:cur|!ARGS:yahoo|!ARGS:/Website/|!ARGS:sig|!ARGS:template_data|!ARGS:template|!ARGS:option[ping_sites]|!ARGS:KT_Update1|!ARGS:flds[Message]|!ARGS:EditorHTML|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:vars[siteName]|!ARGS:replycontents|!ARGS:sitedisclaimer|!ARGS:sm_b_style|!ARGS:success|!ARGS:short_story|!ARGS:/^css/|!ARGS:ecards_more_pic_target|!ARGS:vthumb|!ARGS:introduction|!ARGS:register_at|!ARGS:/^products_description/|!ARGS:terms_content|!ARGS:statusaddress|!ARGS:revnews_ad_120|!ARGS:revnews_video|!ARGS:/sponsor_banner/|!ARGS:videoPath|!ARGS:web_site|!ARGS:newText|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:f_header|!ARGS:option[78]|!ARGS:savecontent|!ARGS:params[helpsite]|!ARGS:iconnew|!ARGS:agendWebPage|!ARGS:wpau-ftphost|!ARGS:gen_header|!ARGS:button_dir|!ARGS:news_desc|!ARGS:x_organizational|!ARGS:href|!ARGS:form_element3|!ARGS:wptextbox1|!ARGS:edit[site_mission]|!ARGS:answer|!ARGS:intro|!ARGS:c_msg|!ARGS:note|!ARGS:domain|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/^sql_/|!ARGS:clickTAG|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:thm|!ARGS:_RW_|!ARGS:/^rss/|!ARGS:/rss$/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:team[logo]|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:basehref|!ARGS:/redirect/|!ARGS:redir|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:portal_body|!ARGS:filecontent|!ARGS:inc|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:body|!ARGS:Post|!ARGS:data[Label][website]|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:webeditor1|!ARGS:oldmsg|!ARGS:src|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:site_desc|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:jumpTo|!ARGS:site|!ARGS:memo|!ARGS:live_site|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:user_website|!ARGS:g2_return|!ARGS:goto|!ARGS:site_first|!ARGS:from|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:userDetails[web_address]|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:web_address|!ARGS:msgpreview|!ARGS:fb_ref|!ARGS:notes|!ARGS:pn_domain|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:value_190|!ARGS:pp_bio_content|!ARGS:xajaxargs[]|!ARGS:backto|!ARGS:/^http/|!ARGS:/^rsargs/|!ARGS:op|!ARGS:BLK_block_content|!ARGS:ret|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:hamechalets_desc|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:description|!ARGS:newDescription|!ARGS:area|!ARGS:content|!ARGS:/^data\[tt_content\]/|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:newcontent|!ARGS:st_widget|!ARGS:video|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:Store_OUI_GlobalFooter|!ARGS:in[http]|!ARGS:map|!ARGS:dynafield[_SIGNATURE]|!ARGS:payment_extrainfo|!ARGS:virtual_http_path|!ARGS:cta_content|!ARGS:x_website|!ARGS:wysiwyg|!ARGS:banner|!ARGS:env_ping_list|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:/^virtual_http/|!ARGS:cta_content|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:code|!ARGS:field5|!ARGS:p_content|!ARGS:f_site|!ARGS:CANCEL_RETURN "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)\:/" "phase:2,deny,log,auditlog,status:403,id:340874,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,capture,chain,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91600 + +SecRule REQUEST_FILENAME "/mailordermanager5\.mvc" "phase:2,id:91601,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/content_pop\.php" "phase:2,id:91602,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/backend/noticias_abm\.php" "phase:2,id:91603,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/pncrtl/options\.php" "phase:2,id:91604,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin\.cgi" "phase:2,id:91605,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340855,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=340131,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/fim_thumb\.php" "phase:2,id:91606,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/intaketemp\.php" "phase:2,id:91607,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/sqltoexcel/sql2excel\.php" "phase:2,id:91608,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/moodle/mod/glossary/edit\.php" "phase:2,id:91609,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/miespacio/adpaepdc\.php" "phase:2,id:91610,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "ext/ics_awstats/mod1/index\.php" "phase:2,id:91611,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340026,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340151" +SecAction "phase:2,id:91612,t:none,pass,nolog,skipAfter:END_RULES_91612" + +SecRule ARGS|!ARGS:config "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)\:/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:320463,rev:9,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (modules.php)'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:config "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)\:/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:320462,rev:9,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (modules.php)'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91612 + +SecRule REQUEST_FILENAME "/wizard/edit/modules/eshop/product/insert" "phase:2,id:91613,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340009" +SecAction "phase:2,id:91614,t:none,pass,nolog,skipAfter:END_RULES_91614" + +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:X-PageView|!REQUEST_HEADERS:Cookie|!REQUEST_HEADERS:REFERER|ARGS|!ARGS:redirect_to|!ARGS:field_id_29|!ARGS:/highlight/|!ARGS:/search/|!ARGS:/msg/|!ARGS:/comment/|!ARGS:/hilit/|!ARGS:/uri/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/description/|!ARGS:product[media_gallery][images]|!ARGS:/subject/|!ARGS:/comment/|!ARGS:/content/|!ARGS:/data/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/post/|!ARGS:LiveURLSegment|!ARGS:keywords|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:/description/|!ARGS:note_title|!ARGS:/^xjxargs/|!ARGS:backPath|!ARGS:webpage[content]|!ARGS:article[content]|!ARGS:filecontent|!ARGS:/message/|!ARGS:/^fck_/|!ARGS:htmlSource|!ARGS:path_to_lzx|!ARGS:content|!ARGS:/body/ "(?:/(?:etc|proc|var/tmp|usr|opt|s?bin|dev|kern|[br]oot|sys|windows|winnt)/|(?:\/|\\\\)+inetpub|localstart\.asp|boot\.ini)" "phase:2,deny,log,auditlog,status:403,t:none,t:normalisePath,t:lowercase,capture,id:321463,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Protected Path Access denied in URI/ARGS',logdata:'%{TX.0}'" + +SecMarker END_RULES_91614 + +SecRule REQUEST_FILENAME "/ucp\.php" "phase:2,id:91615,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340007" +SecAction "phase:2,id:91616,t:none,pass,nolog,skipAfter:END_RULES_91616" + +SecRule REQUEST_URI|ARGS|!ARGS:redirect|!ARGS:/resolution/|!ARGS:/description/|!ARGS:/comment/|!ARGS:/obrazek/|!ARGS:/txt/|!ARGS:/keywords/|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:css_data|!ARGS:/text/|!ARGS:/message/|!ARGS:/body/|!ARGS:/content/|!ARGS:/html/|!ARGS:filename "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" "phase:2,deny,log,auditlog,status:403,t:none,t:lowercase,capture,id:321464,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied',logdata:'%{TX.0}'" + +SecMarker END_RULES_91616 + +SecRule REQUEST_FILENAME "/response_3d\.php" "phase:2,id:91617,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340151" +SecAction "phase:2,id:91618,t:none,pass,nolog,skipAfter:END_RULES_91618" + +SecRule ARGS|!ARGS:config|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/domain/|!ARGS:ResponsePath "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)\:/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:320468,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (modules.php)'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:config|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/domain/|!ARGS:ResponsePath "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)\:/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:320469,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (modules.php)'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91618 + +SecRule REQUEST_FILENAME "/getclientpolicies\.aspx" "phase:2,id:91619,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91620,t:none,pass,nolog,skipAfter:END_RULES_91620" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:xml|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:java|vb)?script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:320470,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter',logdata:'%{TX.0}'" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:xml|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(ht|f)tps?)\:/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:320472,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}',multimatch" + +# Rule 340149: XSS injection +SecRule REQUEST_URI|ARGS|!ARGS:paepdc|!ARGS:/VB_announce/|!ARGS:xml|!ARGS:/^autoDS/|!ARGS:newyddionc|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|!ARGS:search_theme_form_keys|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:user[usertitle]|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:/desc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|shell\:|window\.location|asfunction:_root\.launch|\%env)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceNulls,t:compressWhitespace,id:320471,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}'" + +SecMarker END_RULES_91620 + +SecRule REQUEST_FILENAME "/add_product\.php" "phase:2,id:91621,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91622,t:none,pass,nolog,skipAfter:END_RULES_91622" + +SecRule REQUEST_URI|ARGS|!ARGS:picture|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:320572,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:179,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:picture|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:320473,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,capture,chain,rev:179,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91622 + +SecRule REQUEST_FILENAME "/wp-admin/page\.php" "phase:2,id:91623,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/affiliate/scripts/server\.ph" "phase:2,id:91624,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340144" + +SecRule REQUEST_FILENAME "/modules/resize\.php$" "phase:2,id:91625,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340009" +SecAction "phase:2,id:91626,t:none,pass,nolog,skipAfter:END_RULES_91626" + +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:X-PageView|!REQUEST_HEADERS:Cookie|!REQUEST_HEADERS:REFERER|ARGS|!ARGS:g2_prefix|!ARGS:g2_form[path]|!ARGS:/keyword/|!ARGS:field_id_29|!ARGS:/highlight/|!ARGS:/search/|!ARGS:/msg/|!ARGS:/comment/|!ARGS:/hilit/|!ARGS:/uri/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/description/|!ARGS:product[media_gallery][images]|!ARGS:/subject/|!ARGS:/comment/|!ARGS:/content/|!ARGS:/data/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/post/|!ARGS:LiveURLSegment|!ARGS:keywords|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:/description/|!ARGS:note_title|!ARGS:/^xjxargs/|!ARGS:backPath|!ARGS:webpage[content]|!ARGS:article[content]|!ARGS:filecontent|!ARGS:/message/|!ARGS:/^fck_/|!ARGS:htmlSource|!ARGS:path_to_lzx|!ARGS:content|!ARGS:/body/|!ARGS:imagefile "(?:/(?:etc|proc|var/tmp|usr|opt|s?bin|dev|kern|[br]oot|sys|windows|winnt)/|(?:\/|\\\\)+inetpub|localstart\.asp|boot\.ini)" "phase:2,deny,log,auditlog,status:403,t:none,t:normalisePath,t:lowercase,capture,id:321486,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Protected Path Access denied in URI/ARGS', logdata:'%{TX.0}'" + + +SecMarker END_RULES_91626 + +SecRule REQUEST_FILENAME "/nota_abm\.php$" "phase:2,id:91627,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/admin/service/producttocategory\.php" "phase:2,id:91628,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340157" + +SecRule REQUEST_FILENAME "/admin/moduleinterface\.php" "phase:2,id:91629,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/ajax_file_upload\.php" "phase:2,id:91630,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=347008" +SecAction "phase:2,id:91631,t:none,pass,nolog,skipAfter:END_RULES_91631" + +SecRule ARGS|!ARGS:folder|!ARGS:/description/|!ARGS:/comment/|!ARGS:obrazek|!ARGS:/txt/|!ARGS:keywords|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:css_data|!ARGS:/text/|!ARGS:/message/|!ARGS:body|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:/content/ "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" "phase:2,deny,log,auditlog,status:403,t:none,t:lowercase,capture,id:320486,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied',logdata:'%{TX.0}'" +SecRule ARGS "\.\./\.\./\.\./\.\./\.\./\.\./\.\./" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:normalisePath,id:359008,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Suspicious deep path recursion denied'" + +SecMarker END_RULES_91631 + +SecRule REQUEST_FILENAME "/ajax_create_folder\.php" "phase:2,id:91632,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=347008" +SecAction "phase:2,id:91633,t:none,pass,nolog,skipAfter:END_RULES_91633" + +SecRule ARGS|!ARGS:/folder/|!ARGS:/description/|!ARGS:/comment/|!ARGS:obrazek|!ARGS:/txt/|!ARGS:keywords|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:css_data|!ARGS:/text/|!ARGS:/message/|!ARGS:body|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:/content/ "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" "phase:2,deny,log,auditlog,status:403,t:none,t:lowercase,capture,id:320487,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied',logdata:'%{TX.0}'" +SecRule ARGS "\.\./\.\./\.\./\.\./\.\./\.\./\.\./" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:normalisePath,id:359208,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Suspicious deep path recursion denied'" + +SecMarker END_RULES_91633 + +SecRule REQUEST_FILENAME "/test_templates\.php" "phase:2,id:91634,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/phpminiadmin\.php" "phase:2,id:91635,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/webacula/restorejob/" "phase:2,id:91636,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/calendar/functions/popup\.php" "phase:2,id:91637,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390715" + + +#PHP injection +SecRule REQUEST_FILENAME|ARGS|XML:/*|!ARGS:/descripcion/|!ARGS:/text/|!ARGS:/description/|!ARGS:/resolution/|!ARGS:/message/|!ARGS:/msg/ "\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|(?:g|b)z(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:(?:g|b)z)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func|$_(?:(?:pos|ge)t|session))\b" "phase:2,deny,log,status:403,rev:4,capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,auditlog,msg:'Atomicorp.com WAF Rules: PHP Injection Attack',id:'390726',logdata:'%{TX.0}',severity:'2'" +SecRule REQUEST_FILENAME "/cms/" "phase:2,id:91638,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" +SecAction "phase:2,id:91639,t:none,pass,nolog,skipAfter:END_RULES_91639" + +SecRule QUERY_STRING|ARGS|!ARGS:content|!ARGS:wrap|!ARGS:txtContent|!ARGS:/template/|!ARGS:text "(?i:(((url|src|href|lowsrc)[\s]*=)|(url[\s]*[\(]))[\s]*['\x22]*[\x09\x0a\x0b\x0c\x0d]*j[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:])" "phase:2,deny,status:403,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:normalisePathWin,capture,id:390727,log,auditlog,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting stealth attempt to inject javascript ',logdata:'%{TX.0}'" + +SecMarker END_RULES_91639 + +SecRule REQUEST_FILENAME "/tbl_export\.php" "phase:2,id:91640,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + + +SecRule REQUEST_FILENAME "/import\.php" "phase:2,id:91641,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=340009" +SecAction "phase:2,id:91642,t:none,pass,nolog,skipAfter:END_RULES_91642" + +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:X-PageView|!REQUEST_HEADERS:Cookie|!REQUEST_HEADERS:REFERER|ARGS|!ARGS:/sql/|!ARGS:prefix|!ARGS:/txt/|!ARGS:/summary/|!ARGS:/text/|!ARGS:/^config/|!ARGS:/^dPcfg/|!ARGS:g2_prefix|!ARGS:g2_form[path]|!ARGS:/keyword/|!ARGS:field_id_29|!ARGS:/highlight/|!ARGS:/search/|!ARGS:/msg/|!ARGS:/comment/|!ARGS:/hilit/|!ARGS:/uri/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/description/|!ARGS:product[media_gallery][images]|!ARGS:/subject/|!ARGS:/comment/|!ARGS:/content/|!ARGS:/data/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/post/|!ARGS:LiveURLSegment|!ARGS:keywords|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:/description/|!ARGS:note_title|!ARGS:/^xjxargs/|!ARGS:backPath|!ARGS:webpage[content]|!ARGS:article[content]|!ARGS:filecontent|!ARGS:/message/|!ARGS:/^fck_/|!ARGS:htmlSource|!ARGS:path_to_lzx|!ARGS:content|!ARGS:/body/ "(?:/(?:etc|proc|var/tmp|usr|opt|s?bin|dev|tmp|kern|[br]oot|sys|windows|winnt)/|(?:\/|\\\\)+inetpub|localstart\.asp|boot\.ini)" "phase:2,deny,status:403,t:none,log,auditlog,t:normalisePath,capture,id:390728,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Protected Path Access denied in URI/ARGS', logdata:'%{TX.0}'" + +SecMarker END_RULES_91642 + +SecRule REQUEST_FILENAME "/civicrm/admin/" "phase:2,id:91643,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/civicrm/report/contact/summary" "phase:2,id:91644,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/instellingen\.php" "phase:2,id:91645,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91646,t:none,pass,nolog,skipAfter:END_RULES_91646" + +SecRule REQUEST_URI|ARGS|!ARGS:IDEAL_EMAIL "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:390729,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:IDEAL_EMAIL "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:390730,t:none,t:urlDecodeUni,t:htmlEntityDecode,multimatch,capture,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91646 + +SecRule REQUEST_FILENAME "/admin/listing_editresult\.php" "phase:2,id:91647,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/items_price_result\.php" "phase:2,id:91648,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/configure_homepage\.php" "phase:2,id:91649,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/newreply\.php" "phase:2,id:91650,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390621" + +SecRule REQUEST_FILENAME "/editpost\.php" "phase:2,id:91651,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390621,ctl:ruleRemovebyID=380020" + +SecRule REQUEST_FILENAME "/admin/file_manager\.php" "phase:2,id:91652,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340855" + +SecRule REQUEST_FILENAME "/includes/conteudosactions\.php" "phase:2,id:91653,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/webim/button\.php" "phase:2,id:91654,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/includes/multimediaactions\.php" "phase:2,id:91655,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/includes/lojaactions\.php" "phase:2,id:91656,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703" + +SecRule REQUEST_FILENAME "/config/index\.php" "phase:2,id:91657,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340007" +SecAction "phase:2,id:91658,t:none,pass,nolog,skipAfter:END_RULES_91658" + +SecRule REQUEST_URI|ARGS|!ARGS:/CACHE_PATH/|!ARGS:SQLiteDataDir|!ARGS:/description/|!ARGS:/comment/|!ARGS:obrazek|!ARGS:/txt/|!ARGS:keywords|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:css_data|!ARGS:/text/|!ARGS:/message/|!ARGS:body|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:/content/ "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" "phase:2,deny,log,auditlog,status:403,t:none,t:lowercase,capture,id:390731,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied',logdata:'%{TX.0}'" + +SecMarker END_RULES_91658 + +SecRule REQUEST_FILENAME "/modedit\.php" "phase:2,id:91659,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/categories\.php" "phase:2,id:91660,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/addclass\.php" "phase:2,id:91661,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/medialibrary\.php" "phase:2,id:91662,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390700" + +SecRule REQUEST_FILENAME "/meta_admin\.php" "phase:2,id:91663,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/admin/question_edit\.php" "phase:2,id:91664,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/processors/directory_addedit\.php" "phase:2,id:91665,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/wp-admin/widgets\.php" "phase:2,id:91666,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/admin/aprod\.php" "phase:2,id:91667,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/admin/ritem\.php" "phase:2,id:91668,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/affiliate/scripts/server\.php" "phase:2,id:91669,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/sifr\.swf" "phase:2,id:91670,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/smalladmin/index\.php" "phase:2,id:91671,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/content_manager\.php" "phase:2,id:91672,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/account/loginpost/" "phase:2,id:91673,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91674,t:none,pass,nolog,skipAfter:END_RULES_91674" + +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:video_credits|!ARGS:move2|!ARGS:hoperation|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:send|!ARGS:resumoDetalhe|!ARGS:bbcode_tpl|!ARGS:Right_photo_1|!ARGS:embedVideo|!ARGS:/^K2ExtraField/|!ARGS:mentorhelp|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:java|vb)?script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?(>|<)|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,capture,id:370147,rev:87,severity:2,msg:'Atomicorp.com WAF Rules: Generic XSS filter',logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:video_credits|!ARGS:move2|!ARGS:hoperation|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:send|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:/submitcode/|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(ht|f)tps?)\:/|alert ?\(||\" ?> ?<|\" ?[a-z]+ ?<.*>|> ?\"? ?>|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,multimatch,capture,id:370148,rev:95,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}'" + +SecMarker END_RULES_91674 + +SecRule REQUEST_FILENAME "/admin/package_edit\.php" "phase:2,id:91675,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cgi-bin/setup\.cgi" "phase:2,id:91676,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/pncrtl/template\.php" "phase:2,id:91677,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/novedades_abm\.php" "phase:2,id:91678,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cgi-bin/pmanage/pmanage\.cgi" "phase:2,id:91679,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/sage/download\.php" "phase:2,id:91680,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/versioncheck\.php" "phase:2,id:91681,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=330700" + +SecRule REQUEST_FILENAME "/kameleon\.php" "phase:2,id:91682,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340026" +SecAction "phase:2,id:91683,t:none,pass,nolog,skipAfter:END_RULES_91683" + + +#SecRule ARGS "!@pmFromFile trusted-domains.txt" chain +SecRule REQUEST_URI|ARGS|!ARGS:static|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:370149,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:static|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:370150,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,capture,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91683 + +SecRule REQUEST_FILENAME "/click\.php" "phase:2,id:91684,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340026" +SecAction "phase:2,id:91685,t:none,pass,nolog,skipAfter:END_RULES_91685" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:to|!ARGS:from|!ARGS:lnk|!ARGS:to|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:c "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:370151,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:to|!ARGS:from|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:c "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:370152,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,capture,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91685 + +SecRule REQUEST_FILENAME "/admin/cruise_co_process\.php" "phase:2,id:91686,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340152" + +SecRule REQUEST_FILENAME "/supportcenter/" "phase:2,id:91687,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340152" + +SecRule REQUEST_FILENAME "/sendmail\.php" "phase:2,id:91688,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/files_code\.php" "phase:2,id:91689,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91690,t:none,pass,nolog,skipAfter:END_RULES_91690" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/hidden/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:370153,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/hidden/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:370154,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,capture,chain,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91690 + +SecRule REQUEST_FILENAME "/modify\.php" "phase:2,id:91691,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91692,t:none,pass,nolog,skipAfter:END_RULES_91692" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/direct/|!ARGS:/thumb/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:370155,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/direct/|!ARGS:/thumb/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:370156,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,capture,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91692 + +SecRule REQUEST_FILENAME "/admin/layout/edit/" "phase:2,id:91693,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020" +SecAction "phase:2,id:91694,t:none,pass,nolog,skipAfter:END_RULES_91694" + +SecRule ARGS|REQUEST_URI_RAW|XML:/*|!ARGS:filecontent|!ARGS:/template/|!ARGS:/header/|!ARGS:/^layout/ "(?:define|fgets|move_uploaded_file|readfile|ftp_put|ftp_fget|gzd?en?code|gzinflate|ftp_nb_put|bzopen|readdir|gzread|fopen|ftp_nb_f(put|get)|ftp_get|scandir|fscanf|readgzfile|fread|proc_open|fgetc|fgetss|ftp_fput|ftp_nb_get|session_start|fwrite|gzwrite|gzopen|gzcompress|curl_multi_exec|curl_exec|eval|create_function|base64_decode|decode_base64|str_rot13|php_uname|file_get_contents|include|require|require_once|parse_ini_file|shell_exec|popen|ini_(?:get|restore)|safe_mode|phpinfo|system|exec|passthru|serialize|include|php_uname|preg_\w+|execute)\s*[\"\(@]" "phase:2,deny,log,status:403,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,t:lowercase,capture,auditlog,msg:'Atomicorp.com WAF Rules: Potentially malicious PHP code injection attempt',id:370157,rev:1,logdata:'%{TX.0}',severity:'2'" + +SecMarker END_RULES_91694 + +SecRule REQUEST_FILENAME "/edit_behaviour\.php" "phase:2,id:91695,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=390711,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126" + +SecRule REQUEST_FILENAME "/otrs/index\.pl" "phase:2,id:91696,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390715,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=390709,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340008,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=340027,ctl:ruleRemovebyID=340011,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=340131,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020" + +SecRule REQUEST_FILENAME "/content/edit/" "phase:2,id:91697,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/ises/config\.php" "phase:2,id:91698,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91699,t:none,pass,nolog,skipAfter:END_RULES_91699" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^func_key/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:360663,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/^func_key/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:360664,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91699 + +SecRule REQUEST_FILENAME "/cacti/data_input\.php" "phase:2,id:91700,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cgi-bin/bmailercp\.cgi" "phase:2,id:91701,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/wp-admin/admin\.php" "phase:2,id:91702,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340195,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028" + +SecRule REQUEST_FILENAME "/control_panel\.php" "phase:2,id:91703,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/apsona_svc\.php" "phase:2,id:91704,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340159" +SecAction "phase:2,id:91705,t:none,pass,nolog,skipAfter:END_RULES_91705" + +SecRule ARGS|XML:/*|!ARGS:data|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/descr/|!ARGS:/body/|!ARGS:/text/|!ARGS:fck_tw_body|!ARGS:sub|!ARGS:msg_body|!ARGS:saved_data|!ARGS:fck_body|!ARGS:text|!ARGS:form[pagina_text]|!ARGS:description|!ARGS:message|!ARGS:content "(?:(\w+)(?:user|and)(\w+)char\([0-9]+\)|(?:execute|convert)\(|; ?delete.*;(?:insert|declare|varchar)|and .* \( ?select |(?:drop|create)(\w+)table|(?:declare|convert) .* varchar\(|null ?, ?(?:null ?, ?(?:accesslevel|user_name)) ?,|concat\(|union select |union all select|\b\W*?cast\b\W*?\(.* as |xecresultset|' ?; ?declare\b\W*?|; ?set @|select (?:load_file|char\()|(?:insert|remark)test;)" "phase:2,deny,log,auditlog,status:403,capture,id:360665,t:none,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,t:replaceComments,t:compressWhiteSpace,rev:28,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection (MM)',logdata:'%{TX.0}',multiMatch" + +SecMarker END_RULES_91705 + +SecRule REQUEST_FILENAME "/css/gallery-css\.php" "phase:2,id:91706,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/rcv_paypal\.php" "phase:2,id:91707,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340095" +SecAction "phase:2,id:91708,t:none,pass,nolog,skipAfter:END_RULES_91708" + +SecRule ARGS|!ARGS:/item_name/|!ARGS:/Metatags/|!ARGS:/footerfile/|!ARGS:/layout/|!ARGS:message|!ARGS:email|!ARGS:/description/|!ARGS:body|!ARGS:/text/|!ARGS:/txt/|!ARGS:content "(?:\(chr ?\( ?[0-9]{1,3} ?\)| ?= ?f(?:open|write) ?\(|(?:passthru|serialize|php_uname|phpinfo|preg_\w+|shell_exec|exec|eval|create_function|system) ?\()" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,capture,id:360666,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: PHP attack in Argument',logdata:'%{TX.0}'" + +SecMarker END_RULES_91708 + +SecRule REQUEST_FILENAME "/upload_crop\.php" "phase:2,id:91709,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/admin/generic_edit\.php" "phase:2,id:91710,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/edit_workshops\.php" "phase:2,id:91711,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126" +SecAction "phase:2,id:91712,t:none,pass,nolog,skipAfter:END_RULES_91712" + +SecRule ARGS|!ARGS:/Metatags/|!ARGS:/footerfile/|!ARGS:/layout/|!ARGS:message|!ARGS:email|!ARGS:/description/|!ARGS:body|!ARGS:/text/|!ARGS:/txt/|!ARGS:content "(?:\(chr ?\( ?[0-9]{1,3} ?\)| ?= ?f(?:open|write) ?\(|(?:passthru|php_uname|phpinfo|preg_\w+|shell_exec|exec|system) ?\()" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,capture,id:360667,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: PHP attack in Argument',logdata:'%{TX.0}'" + +SecMarker END_RULES_91712 + +SecRule REQUEST_FILENAME "/collect_db\.php" "phase:2,id:91713,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390614" + +SecRule REQUEST_FILENAME "/a__iiconcreatelive\.php" "phase:2,id:91714,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91715,t:none,pass,nolog,skipAfter:END_RULES_91715" + +SecRule ARGS|!ARGS:contentfrom "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,id:360668,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:contentfrom "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:360669,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91715 + +SecRule REQUEST_FILENAME "/etc/get_testimonial\.php" "phase:2,id:91716,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390709" + +SecRule REQUEST_FILENAME "/_vti_bin/_vti_aut/author\.exe" "phase:2,id:91717,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=390709" +SecAction "phase:2,id:91718,t:none,pass,nolog,skipAfter:END_RULES_91718" + + +#Protected file upload protection +SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/* "@pm .www_acl .htpasswd .htaccess boot.ini httpd.conf /etc/ .htgroup .wwwacl .history .bash_history" "id:333851,phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334397,t:none,pass,nolog,noauditlog,skipAfter:END_FILE_PROTECTION_SPEC_1" + +SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|!ARGS:/hilit/|!ARGS:/hilight/|!ARGS:/highlight/|!ARGS:/body/|!ARGS:/post/|!ARGS:/txt|!ARGS:tiny_vals|!ARGS:/description/|!ARGS:content|!ARGS:/keyword/|!ARGS:/desc/|!ARGS:/summary/|!ARGS:/note/|!ARGS:/solution/|!ARGS:/msg/|!ARGS:/highlight/|!ARGS:/text/|!ARGS:/search/|!ARGS:/subject/|!ARGS:/message/|!ARGS:/post/|!ARGS:/resolution/|!ARGS:/problem/|!ARGS:/data/ "(?:\b(?:\.(?:ht(?:access|passwd|group)|www_?acl)|httpd\.conf|boot\.ini)\b|\/etc\/|/\.(?:history|bash_history|sh_history)$)" "phase:2,deny,status:403,capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'Atomicorp.com WAF Rules: Attempt to Access protect file Remotely',id:'360670',rev:14,logdata:'%{TX.0}',severity:'2'" + +SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie "(?:\b(?:\.(?:ht(?:access|passwd|group)|www_?acl)|httpd\.conf|boot\.ini)\b|\/etc\/|/\.(?:history|bash_history|sh_history)$)" "phase:2,deny,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'Atomicorp.com WAF Rules: Attempt to Access protect file Remotely',id:'360671',rev:6,logdata:'%{TX.0}',severity:'2'" + +# +SecMarker END_FILE_PROTECTION_SPEC_1 + +SecMarker END_RULES_91718 + +SecRule REQUEST_FILENAME "/admin/reclame\.php" "phase:2,id:91719,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/install/itron\.php" "phase:2,id:91720,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340855,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371" + +SecRule REQUEST_FILENAME "/editcode\.php" "phase:2,id:91721,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/query_highlighted_block\.php" "phase:2,id:91722,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91723,t:none,pass,nolog,skipAfter:END_RULES_91723" + +SecRule REQUEST_URI|ARGS|!ARGS:theme|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:360672,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:theme|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,id:360673,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91723 + +SecRule REQUEST_FILENAME "/query_block_highlight\.php" "phase:2,id:91724,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91725,t:none,pass,nolog,skipAfter:END_RULES_91725" + +SecRule REQUEST_URI|ARGS|!ARGS:theme|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:360674,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:theme|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,id:360675,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91725 + +SecRule REQUEST_FILENAME "/query_block\.php" "phase:2,id:91726,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91727,t:none,pass,nolog,skipAfter:END_RULES_91727" + +SecRule REQUEST_URI|ARGS|!ARGS:theme|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:360676,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:theme|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,id:360677,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91727 + +SecRule REQUEST_FILENAME "/shopadmin/index\.php" "phase:2,id:91728,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cms/rss\.php" "phase:2,id:91729,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/cms-edit\.php" "phase:2,id:91730,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/manufacturers\.php" "phase:2,id:91731,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/eventaddaction\.php" "phase:2,id:91732,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/settings/customerror" "phase:2,id:91733,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/edit_design\.php" "phase:2,id:91734,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/api\.php" "phase:2,id:91735,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/editresult_listing\.php" "phase:2,id:91736,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/products_product_process\.php" "phase:2,id:91737,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin_prod\.php" "phase:2,id:91738,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/editproperty_process\.php" "phase:2,id:91739,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/sections_process\.php" "phase:2,id:91740,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/sg_saveentry\.php" "phase:2,id:91741,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/admin_content_config\.php" "phase:2,id:91742,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/credit_log2\.php" "phase:2,id:91743,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/folio-edit\.php" "phase:2,id:91744,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/admin/prodedit\.php" "phase:2,id:91745,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/livezilla/server\.php" "phase:2,id:91746,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340814,ctl:ruleRemovebyID=340813,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=390614" + +SecRule REQUEST_FILENAME "/livezilla/server\.php" "phase:2,id:91747,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/flvprovider\.php" "phase:2,id:91748,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/subscribe_user2group\.php" "phase:2,id:91749,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/editcontent_process\.php" "phase:2,id:91750,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/select_category\.php" "phase:2,id:91751,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/acp/options\.php" "phase:2,id:91752,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/editroster\.php" "phase:2,id:91753,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/process\.php" "phase:2,id:91754,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91755,t:none,pass,nolog,skipAfter:END_RULES_91755" + +SecRule REQUEST_URI|ARGS|!ARGS:fu|!ARGS:/text/|!ARGS:input_3|!ARGS:file|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:value_string_9|!ARGS:/^cforms/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:theme|!ARGS:returnBond|!ARGS:fromp|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:/home/|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/photo/|!ARGS:media|!ARGS:parent_name|!ARGS:back|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/twitter/|!ARGS:/flickr/|!ARGS:/youtube/|!ARGS:/blog/|!ARGS:/video/|!ARGS:/^field1/|!ARGS:_update_failure|!ARGS:_update_success|!ARGS:importremote|!ARGS:/callback/|!ARGS:hdwok|!ARGS:hdwnook|!ARGS:OpenID|!ARGS:akID[46][value]|!ARGS:setmedia|!ARGS:/^hilit/|!ARGS:/reciprocal/|!ARGS:/callback/|!ARGS:subject|!ARGS:pic|!ARGS:/sponsors/|!ARGS:want2Read|!ARGS:search_string|!ARGS:direct|!ARGS:yt_thumb|!ARGS:fflv|!ARGS:direct|!ARGS:source_location|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:user_mail_register_no_approval_required_body|!ARGS:/openid/|!ARGS:/adres/|!ARGS:/logo/|!ARGS:/^utm/|!ARGS:resolution|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:/message/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:/youtube/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:pic1|!ARGS:/click/|!ARGS:rf|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:/^win/|!ARGS:lec_rm|!ARGS:n-state|!ARGS:Stream|!ARGS:CP_email|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:attribute29|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:/server/|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:loc|!ARGS:notification_body|!ARGS:/^product_long_/|!ARGS:/^topic_content_/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:address|!ARGS:board_msg|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:desc|!ARGS:descripcion|!ARGS:/^field_id_/|!ARGS:wpUploadDescription|!ARGS:customer_footer|!ARGS:FAQTitle|!ARGS:host|!ARGS:/txt/|!ARGS:whereto|!ARGS:/description/|!ARGS:item[content]|!ARGS:pathToPiwik|!ARGS:admin_footer|!ARGS:email_sig|!ARGS:minicms_content|!ARGS:/^artsee_banner_/|!ARGS:pingback_service|!ARGS:showStr|!ARGS:hostname|!ARGS:/virtual_http_path/|!ARGS:/virtual_https_path/|!ARGS:f_content|!ARGS:bannercode|!ARGS:email_forward|!ARGS:fetch|!ARGS:/txt/|!ARGS:RTServerName|!ARGS:mesg|!ARGS:forward|!ARGS:atc_content|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:footer_scripts|!ARGS:advBannerMessage|!ARGS:thumb|!ARGS:question_content|!ARGS:u|!ARGS:header|!ARGS:action|!ARGS:cptpl_dir|!ARGS:forum_desc|!ARGS:file_contents|!ARGS:newDesc|!ARGS:/return/|!ARGS:Stream|!ARGS:contents|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:cat_sponsor|!ARGS:stretch|!ARGS:/^fields_prev/|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:contactMessage|!ARGS:/help/|!ARGS:short_story|!ARGS:intro_content|!ARGS:vinculo|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:headers-28|!ARGS:fulldescr|!ARGS:soundname|!ARGS:bbcode_tpl|!ARGS:/link/|!ARGS:request_uri|!ARGS:google|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:from_href|!ARGS:Comentario|!ARGS:dynadata[_SIGNATURE]|!ARGS:ppicture|!ARGS:paypal_ipn|!ARGS:defaultImage|!ARGS:title|!ARGS:dbody|!ARGS:right_frame|!ARGS:l1_bdy|!ARGS:theMessage|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:uri|!ARGS:/^blockbody/|!ARGS:field11|!ARGS:field_id_7|!ARGS:/^ViewState/|!ARGS:vars[DBhostname]|!ARGS:postvars|!ARGS:base1|!ARGS:cart_header|!ARGS:layout|!ARGS:GMAP_KEY|!ARGS:full_story|!ARGS:source|!ARGS:set_static_uri_to|!ARGS:Infos|!ARGS:rev_you_tube|!ARGS:ret_address|!ARGS:GMAP_KEY|!ARGS:newsBody|!ARGS:/http_script_dir/|!ARGS:cfgfilecontent|!ARGS:user_sig|!ARGS:cur|!ARGS:yahoo|!ARGS:sig|!ARGS:KT_Update1|!ARGS:flds[Message]|!ARGS:EditorHTML|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:replycontents|!ARGS:sm_b_style|!ARGS:success|!ARGS:/^css/|!ARGS:short_story|!ARGS:ecards_more_pic_target|!ARGS:vthumb|!ARGS:introduction|!ARGS:register_at|!ARGS:terms_content|!ARGS:statusaddress|!ARGS:revnews_ad_120|!ARGS:/sponsor_banner/|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:f_header|!ARGS:option[78]|!ARGS:savecontent|!ARGS:agendWebPage|!ARGS:/icon/|!ARGS:wpau-ftphost|!ARGS:gen_header|!ARGS:button_dir|!ARGS:news_desc|!ARGS:x_organizational|!ARGS:href|!ARGS:form_element3|!ARGS:answer|!ARGS:intro|!ARGS:note|!ARGS:c_msg|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:thm|!ARGS:_RW_|!ARGS:/^rss/|!ARGS:/rss$/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:team[logo]|!ARGS:return|!ARGS:ureferrer|!ARGS:basehref|!ARGS:/^redirect/|!ARGS:redir|!ARGS:refertoyouby|!ARGS:ret|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:portal_body|!ARGS:filecontent|!ARGS:inc|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:body|!ARGS:Post|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:notes|!ARGS:missing_fields_redirect|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:/referer/|!ARGS:/refer/|!ARGS:/redirect/|!ARGS:src|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:bbcode_replace|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:g2_return|!ARGS:goto|!ARGS:from|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:fb_ref|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:pp_bio_content|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^http/|!ARGS:/^rsargs/|!ARGS:op|!ARGS:BLK_block_content|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:hamechalets_desc|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:description|!ARGS:ret|!ARGS:newDescription|!ARGS:area|!ARGS:content|!ARGS:/^data\[tt_content\]/|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:newcontent|!ARGS:st_widget|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:home_top|!ARGS:Store_OUI_GlobalFooter|!ARGS:in[http]|!ARGS:dynafield[_SIGNATURE]|!ARGS:virtual_http_path|!ARGS:cta_content|!ARGS:wysiwyg|!ARGS:banner|!ARGS:env_ping_list|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:/^virtual_http/|!ARGS:cta_content|!ARGS:map_description_1|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:field5|!ARGS:p_content|!ARGS:CANCEL_RETURN|!ARGS:/^k2extra/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:330162,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:fu|!ARGS:/text/|!ARGS:input_3|!ARGS:file|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:value_string_9|!ARGS:/^cforms/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:theme|!ARGS:returnBond|!ARGS:fromp|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:/home/|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/photo/|!ARGS:media|!ARGS:parent_name|!ARGS:back|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/twitter/|!ARGS:/flickr/|!ARGS:/youtube/|!ARGS:/blog/|!ARGS:/video/|!ARGS:/^field1/|!ARGS:_update_failure|!ARGS:_update_success|!ARGS:importremote|!ARGS:/callback/|!ARGS:hdwok|!ARGS:hdwnook|!ARGS:OpenID|!ARGS:akID[46][value]|!ARGS:setmedia|!ARGS:/^hilit/|!ARGS:/reciprocal/|!ARGS:/callback/|!ARGS:subject|!ARGS:pic|!ARGS:/sponsors/|!ARGS:want2Read|!ARGS:search_string|!ARGS:direct|!ARGS:yt_thumb|!ARGS:fflv|!ARGS:direct|!ARGS:source_location|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:user_mail_register_no_approval_required_body|!ARGS:/openid/|!ARGS:/adres/|!ARGS:/logo/|!ARGS:/^utm/|!ARGS:resolution|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:/message/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:/youtube/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:pic1|!ARGS:/click/|!ARGS:rf|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:/^win/|!ARGS:lec_rm|!ARGS:n-state|!ARGS:Stream|!ARGS:CP_email|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:attribute29|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:/server/|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:loc|!ARGS:notification_body|!ARGS:/^product_long_/|!ARGS:/^topic_content_/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:address|!ARGS:board_msg|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:desc|!ARGS:descripcion|!ARGS:/^field_id_/|!ARGS:wpUploadDescription|!ARGS:customer_footer|!ARGS:FAQTitle|!ARGS:host|!ARGS:/txt/|!ARGS:whereto|!ARGS:/description/|!ARGS:item[content]|!ARGS:pathToPiwik|!ARGS:admin_footer|!ARGS:email_sig|!ARGS:minicms_content|!ARGS:/^artsee_banner_/|!ARGS:pingback_service|!ARGS:showStr|!ARGS:hostname|!ARGS:/virtual_http_path/|!ARGS:/virtual_https_path/|!ARGS:f_content|!ARGS:bannercode|!ARGS:email_forward|!ARGS:fetch|!ARGS:/txt/|!ARGS:RTServerName|!ARGS:mesg|!ARGS:forward|!ARGS:atc_content|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:footer_scripts|!ARGS:advBannerMessage|!ARGS:thumb|!ARGS:question_content|!ARGS:u|!ARGS:header|!ARGS:action|!ARGS:cptpl_dir|!ARGS:forum_desc|!ARGS:file_contents|!ARGS:newDesc|!ARGS:/return/|!ARGS:Stream|!ARGS:contents|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:cat_sponsor|!ARGS:stretch|!ARGS:/^fields_prev/|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:contactMessage|!ARGS:/help/|!ARGS:short_story|!ARGS:intro_content|!ARGS:vinculo|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:headers-28|!ARGS:fulldescr|!ARGS:soundname|!ARGS:bbcode_tpl|!ARGS:/link/|!ARGS:request_uri|!ARGS:google|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:from_href|!ARGS:Comentario|!ARGS:dynadata[_SIGNATURE]|!ARGS:ppicture|!ARGS:paypal_ipn|!ARGS:defaultImage|!ARGS:title|!ARGS:dbody|!ARGS:right_frame|!ARGS:l1_bdy|!ARGS:theMessage|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:uri|!ARGS:/^blockbody/|!ARGS:field11|!ARGS:field_id_7|!ARGS:/^ViewState/|!ARGS:vars[DBhostname]|!ARGS:postvars|!ARGS:base1|!ARGS:cart_header|!ARGS:layout|!ARGS:GMAP_KEY|!ARGS:full_story|!ARGS:source|!ARGS:set_static_uri_to|!ARGS:Infos|!ARGS:rev_you_tube|!ARGS:ret_address|!ARGS:GMAP_KEY|!ARGS:newsBody|!ARGS:/http_script_dir/|!ARGS:cfgfilecontent|!ARGS:user_sig|!ARGS:cur|!ARGS:yahoo|!ARGS:sig|!ARGS:KT_Update1|!ARGS:flds[Message]|!ARGS:EditorHTML|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:replycontents|!ARGS:sm_b_style|!ARGS:success|!ARGS:/^css/|!ARGS:short_story|!ARGS:ecards_more_pic_target|!ARGS:vthumb|!ARGS:introduction|!ARGS:register_at|!ARGS:terms_content|!ARGS:statusaddress|!ARGS:revnews_ad_120|!ARGS:/sponsor_banner/|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:f_header|!ARGS:option[78]|!ARGS:savecontent|!ARGS:agendWebPage|!ARGS:/icon/|!ARGS:wpau-ftphost|!ARGS:gen_header|!ARGS:button_dir|!ARGS:news_desc|!ARGS:x_organizational|!ARGS:href|!ARGS:form_element3|!ARGS:answer|!ARGS:intro|!ARGS:note|!ARGS:c_msg|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:thm|!ARGS:_RW_|!ARGS:/^rss/|!ARGS:/rss$/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:team[logo]|!ARGS:return|!ARGS:ureferrer|!ARGS:basehref|!ARGS:/^redirect/|!ARGS:redir|!ARGS:refertoyouby|!ARGS:ret|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:portal_body|!ARGS:filecontent|!ARGS:inc|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:body|!ARGS:Post|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:notes|!ARGS:missing_fields_redirect|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:/referer/|!ARGS:/refer/|!ARGS:/redirect/|!ARGS:src|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:bbcode_replace|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:g2_return|!ARGS:goto|!ARGS:from|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:fb_ref|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:pp_bio_content|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^http/|!ARGS:/^rsargs/|!ARGS:op|!ARGS:BLK_block_content|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:hamechalets_desc|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:description|!ARGS:ret|!ARGS:newDescription|!ARGS:area|!ARGS:content|!ARGS:/^data\[tt_content\]/|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:newcontent|!ARGS:st_widget|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:Store_OUI_GlobalFooter|!ARGS:in[http]|!ARGS:dynafield[_SIGNATURE]|!ARGS:virtual_http_path|!ARGS:cta_content|!ARGS:wysiwyg|!ARGS:banner|!ARGS:env_ping_list|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:/^virtual_http/|!ARGS:cta_content|!ARGS:map_description_1|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:field5|!ARGS:p_content|!ARGS:CANCEL_RETURN|!ARGS:/^k2extra/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,id:330163,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91755 + +SecRule REQUEST_FILENAME "/properties\.php" "phase:2,id:91756,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/db_update\.php" "phase:2,id:91757,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/prodadd\.php" "phase:2,id:91758,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/mt\.fcgi" "phase:2,id:91759,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91760,t:none,pass,nolog,skipAfter:END_RULES_91760" + +SecRule ARGS|!ARGS:text|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:350474,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (mt.cgi)'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:text|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:350475,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (mt.cgi)'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS "!(^(submit\+>>|>>)$)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,capture,id:350247,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',chain,logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/text/|!ARGS:livezillacode|!ARGS:/embed/|!ARGS:fdesc|!ARGS:ldesc|!ARGS:/script/|!ARGS:xdescription|!ARGS:desc|!ARGS:design_description|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/cms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:descr|!ARGS:/products_description/|!ARGS:match_report|!ARGS:/product_desc/|!ARGS:description_short_1|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:phpcode|!ARGS:intro|!ARGS:Snippet|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:input[Desarrollo]|!ARGS:move2|!ARGS:hoperation|!ARGS:login_form|!ARGS:/product_benefits/|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:bbcode_tpl|!ARGS:Right_photo_1|!ARGS:embedVideo|!ARGS:/^K2ExtraField/|!ARGS:mentorhelp|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/footer/|!ARGS:/link/|!ARGS:text|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:java|vb)?script|about|applet|activex|chrome) ?>|< ?/?i?frame|\%env)" "t:none,t:urlDecodeUni,t:replaceComments,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace" + +SecRule ARGS "!(^(submit\+>>|>>)$)" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:lowercase,t:compressWhitespace,capture,id:350248,rev:129,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|!ARGS:/text/|!ARGS:livezillacode|!ARGS:ldesc|!ARGS:fdesc|!ARGS:/footer/|!ARGS:xdescription|!ARGS:/embed/|!ARGS:/script/|!ARGS:desc|!ARGS:design_description|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/wyscms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:descr|!ARGS:/products_description/|!ARGS:match_report|!ARGS:/product_desc/|!ARGS:description_short_1|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:pay_inst_1|!ARGS:sml_prt_1|!ARGS:/form/|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:input[Desarrollo]|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:move2|!ARGS:hoperation|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:mes|!ARGS:signature|!ARGS:paepdc|!ARGS:/VB_announce/|!ARGS:/^autoDS/|!ARGS:newyddionc|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/header/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:text|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:i?frame ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|shell\:|window\.location|asfunction:_root\.launch|\%env)" "t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase" + + +SecMarker END_RULES_91760 + +SecRule REQUEST_FILENAME "/mt\.cgi" "phase:2,id:91761,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91762,t:none,pass,nolog,skipAfter:END_RULES_91762" + + + +SecRule ARGS "!(^(submit\+>>|>>)$)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,capture,id:361248,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',chain,logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/text/|!ARGS:livezillacode|!ARGS:/embed/|!ARGS:fdesc|!ARGS:ldesc|!ARGS:/script/|!ARGS:xdescription|!ARGS:desc|!ARGS:design_description|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/cms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:descr|!ARGS:/products_description/|!ARGS:match_report|!ARGS:/product_desc/|!ARGS:description_short_1|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:phpcode|!ARGS:intro|!ARGS:Snippet|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:input[Desarrollo]|!ARGS:move2|!ARGS:hoperation|!ARGS:login_form|!ARGS:/product_benefits/|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:bbcode_tpl|!ARGS:Right_photo_1|!ARGS:embedVideo|!ARGS:/^K2ExtraField/|!ARGS:mentorhelp|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/footer/|!ARGS:/link/|!ARGS:text|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:java|vb)?script|about|applet|activex|chrome) ?>|< ?/?i?frame|\%env)" "t:none,t:urlDecodeUni,t:replaceComments,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace" + +SecRule ARGS "!(^(submit\+>>|>>)$)" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:lowercase,t:compressWhitespace,capture,id:350249,rev:129,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|!ARGS:/text/|!ARGS:livezillacode|!ARGS:ldesc|!ARGS:fdesc|!ARGS:/footer/|!ARGS:xdescription|!ARGS:/embed/|!ARGS:/script/|!ARGS:desc|!ARGS:design_description|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/wyscms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:descr|!ARGS:/products_description/|!ARGS:match_report|!ARGS:/product_desc/|!ARGS:description_short_1|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:pay_inst_1|!ARGS:sml_prt_1|!ARGS:/form/|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:input[Desarrollo]|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:move2|!ARGS:hoperation|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:mes|!ARGS:signature|!ARGS:paepdc|!ARGS:/VB_announce/|!ARGS:/^autoDS/|!ARGS:newyddionc|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/header/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:text|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:i?frame ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc|mocha\:|!(i|t)on(?:abort|blur|change|click!s|dragdrop|focus|keydown|keypress|keyup)|onmouse(?:down|move|out|over|up)|shell\:|window\.location|asfunction:_root\.launch|\%env)" "t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase" + + +SecMarker END_RULES_91762 + +SecRule REQUEST_FILENAME "/systeembeheer/" "phase:2,id:91763,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390709" + +SecRule REQUEST_FILENAME "/admin/add_sighting\.php" "phase:2,id:91764,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/ticket_detail\.php" "phase:2,id:91765,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/createsite\.php" "phase:2,id:91766,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/cleanedit\.php" "phase:2,id:91767,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/zabbix/setup\.php" "phase:2,id:91768,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/upldgallery\.php" "phase:2,id:91769,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/tooltip_result\.php" "phase:2,id:91770,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/edit_orders\.php" "phase:2,id:91771,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/tableedit\.php" "phase:2,id:91772,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390621" + +SecRule REQUEST_FILENAME "/admin_previewjobs\.php" "phase:2,id:91773,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/businessadd2\.php" "phase:2,id:91774,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/packages-rest\.php" "phase:2,id:91775,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/connectors/resource/index\.php" "phase:2,id:91776,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/editmessagesexec\.php" "phase:2,id:91777,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/backend\.php" "phase:2,id:91778,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/imp/redirect\.php" "phase:2,id:91779,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/edetailing_nsclc\.html" "phase:2,id:91780,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390615" + +SecRule REQUEST_FILENAME "/wibstats\.php" "phase:2,id:91781,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390615" + +SecRule REQUEST_FILENAME "/admincp/plugin\.php" "phase:2,id:91782,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=380023" + +SecRule REQUEST_FILENAME "/maakpromotieorderb\.php" "phase:2,id:91783,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/admin/listcontent\.php" "phase:2,id:91784,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/showtable/update\.php" "phase:2,id:91785,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91786,t:none,pass,nolog,skipAfter:END_RULES_91786" + +SecRule ARGS|!ARGS:q|!ARGS:guid|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:330475,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (mt.cgi)'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:q|!ARGS:guid|!ARGS:text|!ARGS:base_url|!ARGS:outbound|!ARGS:out|!ARGS:referer|!ARGS:serverurl|!ARGS:referrer|!ARGS:url|!ARGS:team[url]|!ARGS:helpurl|!ARGS:helpbox|!ARGS:website|!ARGS:return|!ARGS:url2send|!ARGS:attach-url|!ARGS:ureferrer|!ARGS:comment|!ARGS:basehref|!ARGS:redirect|!ARGS:refertoyouby|!ARGS:ajaxurl|!ARGS:product[media_gallery][images]|!ARGS:oaparams|!ARGS:loc|!ARGS:backurl|!ARGS:bg_image|!ARGS:imageFile|!ARGS:siteurl|!ARGS:install_url|!ARGS:comments_commentFind|!ARGS:resource|!ARGS:thelink|!ARGS:x_receipt_link_url|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:clickurl|!ARGS:filecontent|!ARGS:inc|!ARGS:link|!ARGS:fck_body|!ARGS:fck_brief|!ARGS:introtext|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:userpicpersonal|!ARGS:blog_url|!ARGS:body|!ARGS:linkdescr|!ARGS:Post|!ARGS:last_msg|!ARGS:params[link]|!ARGS:texty|!ARGS:params[request_url]|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:templatePath|!ARGS:fulltext|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:config_helpurl|!ARGS:website_link|!ARGS:view|!ARGS:redirect_to|!ARGS:return_link_url|!ARGS:products_image|!ARGS:_wp_original_http_referer|!ARGS:refer|!ARGS:oldmsg|!ARGS:lk_url "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:330476,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (mt.cgi)'" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + +SecMarker END_RULES_91786 + +SecRule REQUEST_FILENAME "/admin/locations/editphoto\.php" "phase:2,id:91787,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/translation_tool\.php" "phase:2,id:91788,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/edituserplugin\.php" "phase:2,id:91789,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/imp/mailbox\.php" "phase:2,id:91790,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390613,ctl:ruleRemovebyID=390614,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/services/prefs\.php" "phase:2,id:91791,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390613,ctl:ruleRemovebyID=390614" + +SecRule REQUEST_FILENAME "/admin/update-page\.php" "phase:2,id:91792,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/uploadify/uploadify\.php" "phase:2,id:91793,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/admin/savestory\.php" "phase:2,id:91794,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/chat/server\.php" "phase:2,id:91795,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=390715,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/cha-insertproduct\.php" "phase:2,id:91796,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/ezedit/server\.php" "phase:2,id:91797,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/cometchat_receive\.php" "phase:2,id:91798,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390616" + +SecRule REQUEST_FILENAME "/admin/news_editresult\.php" "phase:2,id:91799,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/admin/news\.php" "phase:2,id:91800,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/items_attribute_result\.php" "phase:2,id:91801,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/bcadmn/index\.php" "phase:2,id:91802,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/thub\.php" "phase:2,id:91803,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/sidenavsave\.php" "phase:2,id:91804,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/imp/message\.php" "phase:2,id:91805,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390613,ctl:ruleRemovebyID=390614" + +SecRule REQUEST_FILENAME "/cgi-bin/editor/wsd" "phase:2,id:91806,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/sitesettings\.php" "phase:2,id:91807,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/workadmin\.php" "phase:2,id:91808,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/addons/imagelibrary/select_image\.php" "phase:2,id:91809,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/news_edit\.php" "phase:2,id:91810,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/wp-faq-css\.php" "phase:2,id:91811,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/cfk-action\.php" "phase:2,id:91812,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/htmle\.php" "phase:2,id:91813,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/product_edit\.php" "phase:2,id:91814,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/cgi-bin/backuppc_admin" "phase:2,id:91815,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390709" + +SecRule REQUEST_FILENAME "/delivery/spc\.php" "phase:2,id:91816,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/includes/share\.php" "phase:2,id:91817,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/kronolith/" "phase:2,id:91818,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/delivery/ajs\.php" "phase:2,id:91819,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/browse\.php" "phase:2,id:91820,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/watermark\.php" "phase:2,id:91821,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91822,t:none,pass,nolog,skipAfter:END_RULES_91822" + +SecRule REQUEST_URI|ARGS|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:330477,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,id:330478,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http://%{SERVER_NAME}/" + + +SecMarker END_RULES_91822 + +SecRule REQUEST_FILENAME "/addcontent\.php" "phase:2,id:91823,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340161" + +SecRule REQUEST_FILENAME "/showmail\.php" "phase:2,id:91824,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703" + +SecRule REQUEST_FILENAME "/aprogram\.php" "phase:2,id:91825,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/admin/edit-event\.php" "phase:2,id:91826,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/extrainfo\.php" "phase:2,id:91827,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/extrainfo\.php" "phase:2,id:91828,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/company/modify\.php" "phase:2,id:91829,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/dimcp/setting\.php" "phase:2,id:91830,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/jg_radiof\.php" "phase:2,id:91831,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/tiki-editpage\.php" "phase:2,id:91832,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=380025" + +SecRule REQUEST_FILENAME "/power_news_add\.php" "phase:2,id:91833,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/jg_teksta\.php" "phase:2,id:91834,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/static_content_editresult\.php" "phase:2,id:91835,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/shopadmin/login\.php" "phase:2,id:91836,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/sgal_thumb\.php" "phase:2,id:91837,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/livehelp/image\.php" "phase:2,id:91838,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/ajax\.php" "phase:2,id:91839,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340027,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340027,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/saveconfig\.php" "phase:2,id:91840,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/products\.php" "phase:2,id:91841,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/edit-process\.php" "phase:2,id:91842,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/phpminiadmin\.php" "phase:2,id:91843,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/freepost\.php" "phase:2,id:91844,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/advertpro/admin/admin\.pl" "phase:2,id:91845,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/inc/flash_to_db_insert\.php" "phase:2,id:91846,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/blocks/form/services\.php" "phase:2,id:91847,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/admin/settings/" "phase:2,id:91848,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/manager/ispmgr" "phase:2,id:91849,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340027,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/editimage\.html" "phase:2,id:91850,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/siteprefs\.php" "phase:2,id:91851,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/admin/include/update\.php" "phase:2,id:91852,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/directory\.php" "phase:2,id:91853,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/video_add\.php" "phase:2,id:91854,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147" + +SecRule REQUEST_FILENAME "/admin/products/entry/index\.php" "phase:2,id:91855,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/editconfirm\.php" "phase:2,id:91856,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/connectors/element/snippet\.php" "phase:2,id:91857,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=340016" +SecAction "phase:2,id:91858,t:none,pass,nolog,skipAfter:END_RULES_91858" + + +SecRule REQUEST_URI|ARGS "< ?\?" "t:none,t:urlDecodeUni,t:lowercase,phase:2,deny,log,auditlog,status:403,capture,chain,id:361128,rev:14,severity:2,msg:'Atomicorp.com WAF Rules: Remote PHP command exection',logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|!ARGS:view|!ARGS:payment_extrainfo|!ARGS:solution|!ARGS:snippet|!ARGS:resolution|!ARGS:message|!ARGS:/template/|!ARGS:msg|!ARGS:/php/|!ARGS:gen_header|!ARGS:/layout/|!ARGS:post|!ARGS:/description/|!ARGS:/text/|!ARGS:/txt/|!ARGS:footerfile|!ARGS:/descr/|!ARGS:titleMetatags|!ARGS:/content/|!ARGS:/^eip_/ "(?:(?:chr|fwrite|fopen|system|echr|passthru|serialize|php_uname|popen|proc_open|shell_exec|mysql_query|eval|create_function|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo|preg_\w+) ?\(|system\( ?getenv ?\( ?http_php ?\) ?\))" + + +SecMarker END_RULES_91858 + +SecRule REQUEST_FILENAME "/plugins/podpress/podpress_backend\.ph" "phase:2,id:91859,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/productos_edit\.php" "phase:2,id:91860,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/produto_script\.php" "phase:2,id:91861,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/db_structure\.php" "phase:2,id:91862,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/mail\.cgi" "phase:2,id:91863,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/hades_framework/option_panel/ajax\.php" "phase:2,id:91864,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:91865,t:none,pass,nolog,skipAfter:END_RULES_91865" + + +SecRule REQUEST_URI|ARGS|!ARGS:/values/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:361129,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/values/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,id:361130,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_91865 + +SecRule REQUEST_FILENAME "/apsona_svc\.php" "phase:2,id:91866,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340095" +SecAction "phase:2,id:91867,t:none,pass,nolog,skipAfter:END_RULES_91867" + +SecRule ARGS "(?:\(chr ?\( ?[0-9]{1,3} ?\)| ?= ?f(?:open|write) ?\(|(?:passthru|serialize|php_uname|phpinfo|preg_\w+|shell_exec|mysql_query|exec|eval|create_function|base64_decode|decode_base64) ?\()" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,capture,id:361131,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - PHP function in Argument - this may be an attack.',logdata:'%{TX.0}'" + +SecMarker END_RULES_91867 + +SecRule REQUEST_FILENAME "/s_listing\.php" "phase:2,id:91868,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/module-inventory/" "phase:2,id:91869,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/items_name_result\.php" "phase:2,id:91870,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/webmail/src/addressbook\.php" "phase:2,id:91871,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/cms-setup/" "phase:2,id:91872,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390727,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159" + +SecRule REQUEST_FILENAME "/s_search\.php" "phase:2,id:91873,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/cpage\.php" "phase:2,id:91874,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=341047,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/display_property\.aspx" "phase:2,id:91875,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/admin-stats\.php" "phase:2,id:91876,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/quickscan/8a\.php" "phase:2,id:91877,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/creatematchstats\.php" "phase:2,id:91878,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/add-process\.php" "phase:2,id:91879,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147" + +SecRule REQUEST_FILENAME "/admin/pages/updates\.php" "phase:2,id:91880,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/login_status\.php" "phase:2,id:91881,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91882,t:none,pass,nolog,skipAfter:END_RULES_91882" + + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:next|!ARGS:origin|!ARGS:no_session|!ARGS:no_user|!ARGS:ok_session "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:362129,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:next|!ARGS:origin|!ARGS:no_session|!ARGS:no_user|!ARGS:ok_session "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:362130,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_91882 + +SecRule REQUEST_FILENAME "/db_search\.php" "phase:2,id:91883,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/gravityforms/preview\.php" "phase:2,id:91884,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91885,t:none,pass,nolog,skipAfter:END_RULES_91885" + + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/input/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:362131,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/input/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:362132,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_91885 + +SecRule REQUEST_FILENAME "/admin/contmin\.php" "phase:2,id:91886,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/add_static_cgi\.php" "phase:2,id:91887,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/ash/default\.php" "phase:2,id:91888,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ratesadmin\.php" "phase:2,id:91889,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/testamin\.php" "phase:2,id:91890,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/dartiframe\.html" "phase:2,id:91891,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/jomsocial/profile/edit" "phase:2,id:91892,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/administratie/pro/servers\.php" "phase:2,id:91893,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/payment\.php" "phase:2,id:91894,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/cms/save\.php" "phase:2,id:91895,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=341047,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/pages/update\.php" "phase:2,id:91896,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=341047,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/administrator/options\.php" "phase:2,id:91897,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/modules/catalogs/save_element\.php" "phase:2,id:91898,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=341047,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin_modal/save/" "phase:2,id:91899,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=341047,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/favicon\.php" "phase:2,id:91900,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/components\.php" "phase:2,id:91901,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=341047,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/postbagdo\.php" "phase:2,id:91902,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=341047,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/wp-admin/media\.php" "phase:2,id:91903,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/administrator/index3\.php" "phase:2,id:91904,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/portaladmin/edit_annonce1\.php" "phase:2,id:91905,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=347008" + +SecRule REQUEST_FILENAME "/portaladmin/add_annonce1\.php" "phase:2,id:91906,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=347008" + +SecRule REQUEST_FILENAME "/cms_centralparking\.php" "phase:2,id:91907,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=341047,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/save_lesson\.php" "phase:2,id:91908,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/e_brochure_edit\.php" "phase:2,id:91909,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/aboutus-pages_exe\.php" "phase:2,id:91910,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/tbl_alter\.php" "phase:2,id:91911,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/newspro\.cgi" "phase:2,id:91912,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/video_edit\.php" "phase:2,id:91913,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/email/test\.php" "phase:2,id:91914,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/groupedit\.php" "phase:2,id:91915,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/retail_oordenkings\.edit\.php" "phase:2,id:91916,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/lesson_edit\.php" "phase:2,id:91917,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/mailtemplate_dhltrack_result\.php" "phase:2,id:91918,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/browse_links\.php" "phase:2,id:91919,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/quote_rads\.php" "phase:2,id:91920,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/tweet-blender/ws\.php" "phase:2,id:91921,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/video_edit\.php" "phase:2,id:91922,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/save\.json" "phase:2,id:91923,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/admin/test\.html" "phase:2,id:91924,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/edit\.php" "phase:2,id:91925,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-admin/nav-menus\.php" "phase:2,id:91926,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390614,ctl:ruleRemovebyID=390707,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/wp-admin/admin-post\.php" "phase:2,id:91927,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390614,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/portfolio/edit\.php" "phase:2,id:91928,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-content/plugins/pods/ajax/showform\.php" "phase:2,id:91929,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/manage/team/create\.php" "phase:2,id:91930,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/sage_download\.php" "phase:2,id:91931,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/template_content_editresult\.php" "phase:2,id:91932,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/adm/index\.php" "phase:2,id:91933,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/e_brochure_email\.php" "phase:2,id:91934,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/addlinks\.php" "phase:2,id:91935,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/adminsettings\.php" "phase:2,id:91936,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/modules/news/nav\.php" "phase:2,id:91937,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/addnews\.php" "phase:2,id:91938,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/administrator/postarticles\.php" "phase:2,id:91939,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/administrator/contactus\.php" "phase:2,id:91940,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/administrator/homepagecontent\.php" "phase:2,id:91941,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/filebrowser/umifilebrowser\.html" "phase:2,id:91942,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=347008" + +SecRule REQUEST_FILENAME "/coupons_exclusions\.php" "phase:2,id:91943,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/wp-content/plugins/voltrank" "phase:2,id:91944,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin_configvalues\.php" "phase:2,id:91945,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/processaddeditproduct\.php" "phase:2,id:91946,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/eecms\.php" "phase:2,id:91947,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/builder/postsitedata\.php" "phase:2,id:91948,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/settingsgeneralaction\.php" "phase:2,id:91949,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/wp-comments-post\.php" "phase:2,id:91950,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/include/load_page\.php" "phase:2,id:91951,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/profile/shopsettings\.jsf" "phase:2,id:91952,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/multimediasave\.do" "phase:2,id:91953,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/business_profile_engine\.php" "phase:2,id:91954,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/jupgrade/administrator/index\.php" "phase:2,id:91955,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/v2_configvars_engine\.php" "phase:2,id:91956,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/bookingcalendar/php/save\.php" "phase:2,id:91957,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wizard/start\.php" "phase:2,id:91958,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/mailtemplateeditaction\.php" "phase:2,id:91959,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/settingscontact\.php" "phase:2,id:91960,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/property-edit\.php" "phase:2,id:91961,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/server/webissues/handler\.php" "phase:2,id:91962,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390904" + +SecRule REQUEST_FILENAME "/admin/db_edit\.php" "phase:2,id:91963,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/index\.php/datafeedmanager/adminhtml_datafeedmanager/save" "phase:2,id:91964,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/venue-edit\.php" "phase:2,id:91965,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/cms-setup/" "phase:2,id:91966,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/wp-admin/theme-install\.php" "phase:2,id:91967,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/products_add\.php" "phase:2,id:91968,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/admin/story_uploader\.php" "phase:2,id:91969,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145" +SecAction "phase:2,id:91970,t:none,pass,nolog,skipAfter:END_RULES_91970" + +SecRule ARGS|!ARGS:/comment/|!ARGS:problem|!ARGS:resolution|!ARGS:subject|!ARGS:/body/|!ARGS:/^widget-section/|!ARGS:/template/|!ARGS:/^eip_/|!ARGS:/sql/|!ARGS:prefix|!ARGS:/keyword/|!ARGS:/msg/|!ARGS:metadata|!ARGS:post_content|!ARGS:parent_name|!ARGS:topic|!ARGS:file_content|!ARGS:/^serendipity/|!ARGS:comment|!ARGS:summary|!ARGS:configoptionname|!ARGS:Definition|!ARGS:/php/|!ARGS:/Metatags/|!ARGS:/footerfile/|!ARGS:/layout/|!ARGS:/message/|!ARGS:email|!ARGS:/desc/|!ARGS:body|!ARGS:/text/|!ARGS:/txt/|!ARGS:content "(?:\(chr ?\( ?[0-9]{1,3} ?\)| ?= ?f(?:open|write) ?\(|(?:passthru|php_uname|phpinfo|shell_exec|preg_\w+|mysql_query|exec|eval|create_function|base64_decode|decode_base64) ?\()" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,capture,id:344195,rev:33,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - PHP function in Argument - this may be an attack.',logdata:'%{TX.0}'" + +SecMarker END_RULES_91970 + +SecRule REQUEST_FILENAME "/include/ajax_price\.php" "phase:2,id:91971,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/page_editor/save_page\.php" "phase:2,id:91972,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/story_prosess\.php" "phase:2,id:91973,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145" +SecAction "phase:2,id:91974,t:none,pass,nolog,skipAfter:END_RULES_91974" + +SecRule ARGS|!ARGS:/comment/|!ARGS:problem|!ARGS:resolution|!ARGS:subject|!ARGS:/body/|!ARGS:/^widget-section/|!ARGS:/template/|!ARGS:/^eip_/|!ARGS:/sql/|!ARGS:prefix|!ARGS:/keyword/|!ARGS:/msg/|!ARGS:metadata|!ARGS:post_content|!ARGS:parent_name|!ARGS:topic|!ARGS:file_content|!ARGS:/^serendipity/|!ARGS:comment|!ARGS:summary|!ARGS:configoptionname|!ARGS:Definition|!ARGS:/php/|!ARGS:/Metatags/|!ARGS:/footerfile/|!ARGS:/layout/|!ARGS:/message/|!ARGS:email|!ARGS:/desc/|!ARGS:body|!ARGS:/text/|!ARGS:/txt/|!ARGS:content "(?:\(chr ?\( ?[0-9]{1,3} ?\)| ?= ?f(?:open|write) ?\(|(?:passthru|php_uname|phpinfo|shell_exec|preg_\w+|mysql_query|exec|eval|create_function|base64_decode|decode_base64) ?\()" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,capture,id:344196,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - PHP function in Argument - this may be an attack.',logdata:'%{TX.0}'" + +SecMarker END_RULES_91974 + +SecRule REQUEST_FILENAME "/admin/story_process\.php" "phase:2,id:91975,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145" +SecAction "phase:2,id:91976,t:none,pass,nolog,skipAfter:END_RULES_91976" + +SecRule ARGS|!ARGS:/comment/|!ARGS:problem|!ARGS:resolution|!ARGS:subject|!ARGS:/body/|!ARGS:/^widget-section/|!ARGS:/template/|!ARGS:/^eip_/|!ARGS:/sql/|!ARGS:prefix|!ARGS:/keyword/|!ARGS:/msg/|!ARGS:metadata|!ARGS:post_content|!ARGS:parent_name|!ARGS:topic|!ARGS:file_content|!ARGS:/^serendipity/|!ARGS:comment|!ARGS:summary|!ARGS:configoptionname|!ARGS:Definition|!ARGS:/php/|!ARGS:/Metatags/|!ARGS:/footerfile/|!ARGS:/layout/|!ARGS:/message/|!ARGS:email|!ARGS:/desc/|!ARGS:body|!ARGS:/text/|!ARGS:/txt/|!ARGS:content "(?:\(chr ?\( ?[0-9]{1,3} ?\)| ?= ?f(?:open|write) ?\(|(?:passthru|php_uname|phpinfo|shell_exec|preg_\w+|mysql_query|exec|eval|create_function|base64_decode|decode_base64) ?\()" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,capture,id:344296,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - PHP function in Argument - this may be an attack.',logdata:'%{TX.0}'" + +SecMarker END_RULES_91976 + +SecRule REQUEST_FILENAME "/seopanel/login\.php" "phase:2,id:91977,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/doku\.php" "phase:2,id:91978,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/shopperpress/ppt/ajax/actions\.php" "phase:2,id:91979,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/wp-content/plugins/spostarbust/images/index\.php" "phase:2,id:91980,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/emailxmlasattachment\.ph" "phase:2,id:91981,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/console/manage_products\.php" "phase:2,id:91982,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/agents/uploader/doupload\.php" "phase:2,id:91983,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380006,ctl:ruleRemovebyID=380007" + +SecRule REQUEST_FILENAME "/wp-load\.php" "phase:2,id:91984,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340094,ctl:ruleRemovebyID=390715" + +SecRule REQUEST_FILENAME "/textpattern/index\.php" "phase:2,id:91985,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/filemanager/filemanager\.php" "phase:2,id:91986,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/imagecrop\.php" "phase:2,id:91987,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:91988,t:none,pass,nolog,skipAfter:END_RULES_91988" + + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/file/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:336633,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/file/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:336634,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_91988 + +SecRule REQUEST_FILENAME "/dashboard\.php" "phase:2,id:91989,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/ie-style\.php" "phase:2,id:91990,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340021" + +SecRule REQUEST_FILENAME "/plugins/likebox\.php" "phase:2,id:91991,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/bb_gate\.php" "phase:2,id:91992,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/imgprod\.php" "phase:2,id:91993,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/phpmyvisites\.php" "phase:2,id:91994,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/editpage\.php" "phase:2,id:91995,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/modules/mod_ajax_contact/ajax\.php" "phase:2,id:91996,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390703" + +SecRule REQUEST_FILENAME "/admin/artwork/index/upload_file" "phase:2,id:91997,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/admin/media/upload\.php" "phase:2,id:91998,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/php-stats\.php" "phase:2,id:91999,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/a_config_dt\.php" "phase:2,id:92000,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/aom/item/index\.php" "phase:2,id:92001,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/orders/ordersave\.php" "phase:2,id:92002,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/nucleus/index\.php" "phase:2,id:92003,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/save_post\.php" "phase:2,id:92004,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/provider/offers\.php" "phase:2,id:92005,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/plugins/wp-slimstat/wp-slimstat-js\.php" "phase:2,id:92006,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/editor/sitemanger/index\.php" "phase:2,id:92007,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/addclientvideo\.php" "phase:2,id:92008,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/single_upload\.php" "phase:2,id:92009,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/betrieb\.php" "phase:2,id:92010,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/wiki/lib/exe/fetch\.php" "phase:2,id:92011,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/wp-admin/press-this\.php" "phase:2,id:92012,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/pagine\.php" "phase:2,id:92013,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/order-categories\.php" "phase:2,id:92014,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/livehelp/" "phase:2,id:92015,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/livehelp/" "phase:2,id:92016,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/livehelpnew/" "phase:2,id:92017,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/livehelpnew/" "phase:2,id:92018,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/raidlogimport/admin/dkp\.php" "phase:2,id:92019,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/p\.php" "phase:2,id:92020,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:92021,t:none,pass,nolog,skipAfter:END_RULES_92021" + + +SecRule REQUEST_URI|ARGS|!ARGS:t|!ARGS:/url/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:378451,phase:2,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{MATCHED_VAR}',chain" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + + +SecMarker END_RULES_92021 + +SecRule REQUEST_FILENAME "/admincp/verticalresponse\.php" "phase:2,id:92022,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/admin/editart\.php" "phase:2,id:92023,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/panel/content/itinerary\.php" "phase:2,id:92024,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/adminmailing\.php" "phase:2,id:92025,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/homepageedit\.php" "phase:2,id:92026,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/jobedit\.php" "phase:2,id:92027,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/media-upload\.php" "phase:2,id:92028,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/ndxz-studio" "phase:2,id:92029,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/ndxzstudio" "phase:2,id:92030,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/json\.php" "phase:2,id:92031,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/_salvaxml\.php" "phase:2,id:92032,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/imp/imple\.php" "phase:2,id:92033,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/cms/settings\.php" "phase:2,id:92034,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/destination-edit\.php" "phase:2,id:92035,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/posthtml\.php" "phase:2,id:92036,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/template_edit\.asp" "phase:2,id:92037,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390727" + +SecRule REQUEST_FILENAME "/question/edit\.php" "phase:2,id:92038,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/cgi-bin/menu\.pl" "phase:2,id:92039,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/add_article\.php" "phase:2,id:92040,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/update\.php" "phase:2,id:92041,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-content/plugins/contactme/xd_receiver\.php" "phase:2,id:92042,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/edit_home\.php" "phase:2,id:92043,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/update-news\.php" "phase:2,id:92044,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/mod/quiz/attempt\.php" "phase:2,id:92045,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/linnworks_xml\.php" "phase:2,id:92046,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=380018" + +SecRule REQUEST_FILENAME "/order/saveeshop" "phase:2,id:92047,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/comments\.php" "phase:2,id:92048,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" +SecAction "phase:2,id:92049,t:none,pass,nolog,skipAfter:END_RULES_92049" + +SecRule ARGS|!ARGS:/^resp/|!ARGS:rpath|!ARGS:data|!ARGS:/body/|!ARGS:editor1|!ARGS:/sidebar/|!ARGS:/template/|!ARGS:/desc/|!ARGS:resolution|!ARGS:/problem/|!ARGS:/solution/|!ARGS:/^style_options/|!ARGS:/CACHE_PATH/|!ARGS:connector|!ARGS:/comment/|!ARGS:obrazek|!ARGS:/txt/|!ARGS:keywords|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:css_data|!ARGS:/text/|!ARGS:/message/|!ARGS:body|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:/content/ "(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))(?:%(?:u2024|2e)|\.){2}(?:\x5c|(?:%(?:c(?:0%(?:9v|af)|1%1c)|2(?:5(?:2f|5c)|f)|u221[56]|1u|5c)|\/))" "deny,log,auditlog,status:403,t:none,t:lowercase,capture,id:343307,phase:2,rev:39,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied',logdata:'%{TX.0}'" + +SecMarker END_RULES_92049 + +SecRule REQUEST_FILENAME "/viewraid\.php" "phase:2,id:92050,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/twitter/tweets-grab\.php" "phase:2,id:92051,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/set_label\.php" "phase:2,id:92052,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/index\.php/profile/register/registerprofile" "phase:2,id:92053,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/code_editor\.php" "phase:2,id:92054,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=380018-380021,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=390715,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=340006-340007,ctl:ruleRemovebyID=340011,ctl:ruleRemovebyID=340014,ctl:ruleRemovebyID=340193,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340021,ctl:ruleRemovebyID=340027,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340118,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=340131,ctl:ruleRemovebyID=340133,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=380006,ctl:ruleRemovebyID=390709,ctl:ruleRemovebyID=390715,ctl:ruleRemovebyID=390801,ctl:ruleRemovebyID=390810,ctl:ruleRemovebyID=393449" + +SecRule REQUEST_FILENAME "/popeditmarker\.php" "phase:2,id:92055,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/connectors/security/access/policy/template\.php" "phase:2,id:92056,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/modiwats\.php" "phase:2,id:92057,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380016,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/php-stats\.php" "phase:2,id:92058,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/banner-edit\.php" "phase:2,id:92059,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/content-edit\.php" "phase:2,id:92060,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/paymentrecall\.php" "phase:2,id:92061,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/hostmeinadmin/clientshosting\.php" "phase:2,id:92062,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/processwire/page/edit" "phase:2,id:92063,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/general_settings\.php" "phase:2,id:92064,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/adclick\.php" "phase:2,id:92065,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin_edit_cat\.php" "phase:2,id:92066,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/listings/client\.php" "phase:2,id:92067,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:92068,t:none,pass,nolog,skipAfter:END_RULES_92068" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/file/|!ARGS:info "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:336133,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/file/|!ARGS:info "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:336134,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_92068 + +SecRule REQUEST_FILENAME "/kontaktformular_web-plaaning\.php" "phase:2,id:92069,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/web-planning\.php" "phase:2,id:92070,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/shop/remote\.php" "phase:2,id:92071,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390703" +SecAction "phase:2,id:92072,t:none,pass,nolog,skipAfter:END_RULES_92072" + +SecRule ARGS|XML:/*|!ARGS:/^products/ "(?:or.+1[[:space:]]*=[[:space:]]1|or 1=[0-9]|admin'(?: --| #)| or '1'='1--|having 1 ?= ?1 --|or\+1=[0-9]|null is null ?--|\b(\d+) ?(?:=|<>|<=>|!=) ?[1-3]\b)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,t:replaceNulls,t:compressWhitespace,capture,id:380572,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - SQL injection probe',logdata:'%{TX.0}'" + +SecMarker END_RULES_92072 + +SecRule REQUEST_FILENAME "/beta_add_record\.php" "phase:2,id:92073,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/echeck_receipt\.php" "phase:2,id:92074,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/livehelp/send\.php" "phase:2,id:92075,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/tweets-grab-ldn\.php" "phase:2,id:92076,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:92077,t:none,pass,nolog,skipAfter:END_RULES_92077" + + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:api "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:336135,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:api "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:336136,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_92077 + +SecRule REQUEST_FILENAME "/receipt\.php" "phase:2,id:92078,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:92079,t:none,pass,nolog,skipAfter:END_RULES_92079" + + +SecRule REQUEST_URI|ARGS|!ARGS:/^list/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/img/|!ARGS:api|!ARGS:/uri/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:336137,t:none,t:normalisePath,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/^list/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/img/|!ARGS:api|!ARGS:/uri/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:336138,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_92079 + +SecRule REQUEST_FILENAME "/admin/contenu/modif/" "phase:2,id:92080,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/processproperty\.php" "phase:2,id:92081,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/newsletter/envoi\.php" "phase:2,id:92082,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/extplorer/index\.php" "phase:2,id:92083,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/administrator/functions/update_article\.ph" "phase:2,id:92084,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/functions/client\.php" "phase:2,id:92085,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" +SecAction "phase:2,id:92086,t:none,pass,nolog,skipAfter:END_RULES_92086" + + +SecRule REQUEST_URI|ARGS|!ARGS:info "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:336139,t:none,t:urlDecodeUni,t:normalisePath,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:info "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:336140,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_92086 + +SecRule REQUEST_FILENAME "/op\.php" "phase:2,id:92087,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340195" + +SecRule REQUEST_FILENAME "/mod_raxo_allmode/tools/tb\.php" "phase:2,id:92088,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" +SecAction "phase:2,id:92089,t:none,pass,nolog,skipAfter:END_RULES_92089" + + +SecRule REQUEST_URI|ARGS|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:336240,t:none,t:urlDecodeUni,t:normalisePath,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:336241,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_92089 + +SecRule REQUEST_FILENAME "/edit_offer\.php" "phase:2,id:92090,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/foto-graveren\.php" "phase:2,id:92091,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" +SecAction "phase:2,id:92092,t:none,pass,nolog,skipAfter:END_RULES_92092" + + +SecRule REQUEST_URI|ARGS|!ARGS:/afbeelding/|!ARGS:/foto/|!ARGS:/Photo/|!ARGS:/image/|!ARGS:/img/|!ARGS:src|!ARGS:/^MA/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:336242,t:none,t:urlDecodeUni,t:normalisePath,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/afbeelding/|!ARGS:/foto/|!ARGS:/Photo/|!ARGS:/image/|!ARGS:/img/|!ARGS:src|!ARGS:/^MA/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:336243,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_92092 + +SecRule REQUEST_FILENAME "/beta_new_update\.php" "phase:2,id:92093,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/webdav\.php" "phase:2,id:92094,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=392301" + +SecRule REQUEST_FILENAME "/sassistant/monitoring\.php" "phase:2,id:92095,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=390709" +SecAction "phase:2,id:92096,t:none,pass,nolog,skipAfter:END_RULES_92096" + + +SecRule REQUEST_URI|ARGS|!ARGS:/monitor/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:336244,t:none,t:urlDecodeUni,t:normalisePath,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + +SecRule REQUEST_URI|ARGS|!ARGS:/monitor/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:336245,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{TX.0}',chain" +SecRule MATCHED_VAR "!@beginsWith http:/%{SERVER_NAME}/" + + +SecMarker END_RULES_92096 + +SecRule REQUEST_FILENAME "/admin/printdeexpediat\.php" "phase:2,id:92097,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/shop/presta_admin/index\.php" "phase:2,id:92098,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/adduserplugin\.php" "phase:2,id:92099,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/edithtmlblob\.php" "phase:2,id:92100,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390727" + +SecRule REQUEST_FILENAME "/video_admin/editvideo/" "phase:2,id:92101,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/administrator/functions/update_article\.php" "phase:2,id:92102,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390727,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/catalog/admbre/categories\.php" "phase:2,id:92103,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/send_weeklyadlist\.php" "phase:2,id:92104,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390727" + +SecRule REQUEST_FILENAME "/admin-edit\.php" "phase:2,id:92105,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/admin/producto\.php" "phase:2,id:92106,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390614" + +SecRule REQUEST_FILENAME "/service/psnabe/clientsservices\.php" "phase:2,id:92107,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/wp-admin/options-permalink\.php" "phase:2,id:92108,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/ga\.php" "phase:2,id:92109,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/server_databases\.php" "phase:2,id:92110,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/amember/admin/email\.php" "phase:2,id:92111,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/send_weeklyadlist\.php" "phase:2,id:92112,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/support/agent/index\.php" "phase:2,id:92113,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/web-services/emailme\.php" "phase:2,id:92114,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/we_cmd\.php" "phase:2,id:92115,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/manage_news\.php" "phase:2,id:92116,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/admin/addersivu\.php" "phase:2,id:92117,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/vqgen/" "phase:2,id:92118,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/hallinta/kirjailija\.php" "phase:2,id:92119,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/json-api/cpanel" "phase:2,id:92120,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/mod/quiz/attempt\.php" "phase:2,id:92121,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "extplorer/index\.php" "phase:2,id:92122,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/wp-content/themes/oakland/theme/functions/upload\.php" "phase:2,id:92123,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/acp/vbshout\.php" "phase:2,id:92124,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/property\.php" "phase:2,id:92125,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:92126,t:none,pass,nolog,skipAfter:END_RULES_92126" + + +SecRule ARGS|!ARGS:id|!ARGS:kotisivu|!ARGS:mb|!ARGS:jibber|!ARGS:pattern_select|!ARGS:wordpress_extra|!ARGS:origin|!ARGS:fail|!ARGS:success|!ARGS:move_to|!ARGS:/^listingfields/|!ARGS:svc_id|!ARGS:/^constant_contact/|!ARGS:hq|!ARGS:/flsrv/|!ARGS:svc_id|!ARGS:junkWords|!ARGS:/foto/|!ARGS:/^attr_/|!ARGS:name_ip|!ARGS:/stream/|!ARGS:canonical|!ARGS:/addy/|!ARGS:rel_path|!ARGS:aim|!ARGS:api|!ARGS:details|!ARGS:/^field/|!ARGS:profile_id|!ARGS:/^complete_action/|!ARGS:/^option_value/|!ARGS:/buzz/|!ARGS:cc_list_id|!ARGS:/jform/|!ARGS:/liveUpdate/|!ARGS:/service/|!ARGS:marqueur|!ARGS:/vertex/|!ARGS:metavalue|!ARGS:binary|!ARGS:snippet|!ARGS:/^ZA_ARTICLE/|!ARGS:obr|!ARGS:^/xcpr_/|!ARGS:back|!ARGS:/pic/|!ARGS:/plaatje/|!ARGS:profile|!ARGS:repository|!ARGS:catalogue_search_code|!ARGS:os|!ARGS:ticketmaster|!ARGS:/destination/|!ARGS:r|!ARGS:/speedtest/|!ARGS:voice|!ARGS:/tripadvisor/|!ARGS:/iTunes/|!ARGS:service|!ARGS:lang_default_value|!ARGS:weather|!ARGS:/metakey/|!ARGS:/target/|!ARGS:/password/|!ARGS:/note/|!ARGS:form_profile|!ARGS:/theme/|!ARGS:ip|!ARGS:/afbeelding/|!ARGS:/screenshot/|!ARGS:/^input_/|!ARGS:embed_code|!ARGS:/^flb/|!ARGS:gwefan|!ARGS:/xthreads/|!ARGS:flv|!ARGS:dest|!ARGS:languageChange|!ARGS:/^perch_/|!ARGS:music|!ARGS:/^p_posts/|!ARGS:input_50|!ARGS:/resolv/|!ARGS:/^install_package/|!ARGS:/address/|!ARGS:refsrc|!ARGS:hp|!ARGS:/censor/|!ARGS:UpdateNote|!ARGS:regx_root|!ARGS:input_3|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:value_string_9|!ARGS:/^cf/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:/return/|!ARGS:fromp|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:sfhome|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:loc|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/photo/|!ARGS:/logo/|!ARGS:go|!ARGS:/^utm/|!ARGS:resolution|!ARGS:/export/|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:path[alias]|!ARGS:/message/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:/click/|!ARGS:rf|!ARGS:payment_home|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:/^win/|!ARGS:lec_rm|!ARGS:n-state|!ARGS:CP_email|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:attribute29|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:/server/|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:/body/|!ARGS:/^product_long_/|!ARGS:/content/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:board_msg|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/desc/|!ARGS:customer_footer|!ARGS:FAQTitle|!ARGS:host|!ARGS:/text/|!ARGS:whereto|!ARGS:pathToPiwik|!ARGS:admin_footer|!ARGS:email_sig|!ARGS:/^artsee_banner_/|!ARGS:pingback_service|!ARGS:showStr|!ARGS:/hostname/|!ARGS:/http/|!ARGS:bannercode|!ARGS:email_forward|!ARGS:fetch|!ARGS:/txt/|!ARGS:mesg|!ARGS:forward|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:footer_scripts|!ARGS:advBannerMessage|!ARGS:u|!ARGS:/header/|!ARGS:action|!ARGS:cptpl_dir|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:cat_sponsor|!ARGS:stretch|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:contactMessage|!ARGS:var_value[usps_labels_help_2]|!ARGS:short_story|!ARGS:vinculo|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:soundname|!ARGS:bbcode_tpl|!ARGS:/link/|!ARGS:faqText|!ARGS:request_uri|!ARGS:/google/|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:Comentario|!ARGS:dynadata[_SIGNATURE]|!ARGS:paypal_ipn|!ARGS:title|!ARGS:/frame/|!ARGS:l1_bdy|!ARGS:theMessage|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:uri|!ARGS:wp_home|!ARGS:/^ViewState/|!ARGS:postvars|!ARGS:base1|!ARGS:layout|!ARGS:EditorHTML|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:option[home]|!ARGS:sm_b_style|!ARGS:success|!ARGS:/^css/|!ARGS:short_story|!ARGS:vthumb|!ARGS:introduction|!ARGS:register_at|!ARGS:statusaddress|!ARGS:revnews_ad_120|!ARGS:/sponsor_banner/|!ARGS:newText|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:option[78]|!ARGS:agendWebPage|!ARGS:/icon/|!ARGS:/ftp/|!ARGS:button_dir|!ARGS:x_organizational|!ARGS:form_element3|!ARGS:answer|!ARGS:intro|!ARGS:note|!ARGS:c_msg|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:home|!ARGS:thm|!ARGS:_RW_|!ARGS:/rss/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:helpbox|!ARGS:ureferrer|!ARGS:redir|!ARGS:refertoyouby|!ARGS:ret|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:inc|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:Post|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:notes|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:refer|!ARGS:oldmsg|!ARGS:/referer/|!ARGS:/refer/|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:bbcode_replace|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:from|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:fb_ref|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^rsargs/|!ARGS:op|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:ret|!ARGS:area|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:st_widget|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:home_top|!ARGS:Store_OUI_GlobalFooter|!ARGS:dynafield[_SIGNATURE]|!ARGS:payment_extrainfo|!ARGS:wysiwyg|!ARGS:banner|!ARGS:env_ping_list|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:/^k2extra/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:320162,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,chain,rev:287,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" "t:none,t:urlDecodeUni,t:lowercase" + +SecRule REQUEST_URI|ARGS|!ARGS:id|!ARGS:kotisivu|!ARGS:mb|!ARGS:jibber|!ARGS:wordpress_extra|!ARGS:origin|!ARGS:pattern_select|!ARGS:fail|!ARGS:success|!ARGS:move_to|!ARGS:/^listingfields/|!ARGS:svc_id|!ARGS:/^constant_contact/|!ARGS:hq|!ARGS:/flsrv/|!ARGS:svc_id|!ARGS:/foto/|!ARGS:junkWords|!ARGS:name_ip|!ARGS:/stream/|!ARGS:canonical|!ARGS:/addy/|!ARGS:rel_path|!ARGS:aim|!ARGS:/^field/|!ARGS:details|!ARGS:/^complete_action/|!ARGS:profile_id|!ARGS:api|!ARGS:/^option_value/|!ARGS:button_src|!ARGS:cc_list_id|!ARGS:/buzz/|!ARGS:/jform/|!ARGS:/liveUpdate/|!ARGS:/service/|!ARGS:marqueur|!ARGS:/vertex/|!ARGS:metavalue|!ARGS:binary|!ARGS:snippet|!ARGS:/^ZA_ARTICLE/|!ARGS:obr|!ARGS:back|!ARGS:^/xcpr_/|!ARGS:/pic/|!ARGS:/plaatje/|!ARGS:profile|!ARGS:repository|!ARGS:/export/|!ARGS:os|!ARGS:ticketmaster|!ARGS:/destination/|!ARGS:r|!ARGS:/speedtest/|!ARGS:voice|!ARGS:/tripadvisor/|!ARGS:/iTunes/|!ARGS:lang_default_value|!ARGS:weather|!ARGS:/metakey/|!ARGS:/target/|!ARGS:/password/|!ARGS:/note/|!ARGS:form_profile|!ARGS:/theme/|!ARGS:ip|!ARGS:/afbeelding/|!ARGS:/screenshot/|!ARGS:embed_code|!ARGS:/^input_/|!ARGS:/^flb/|!ARGS:gwefan|!ARGS:/xthreads/|!ARGS:flv|!ARGS:dest|!ARGS:languageChange|!ARGS:/^perch_/|!ARGS:music|!ARGS:/^p_posts/|!ARGS:input_50|!ARGS:/resolv/|!ARGS:/^install_package/|!ARGS:/address/|!ARGS:wlp|!ARGS:hp|!ARGS:refsrc|!ARGS:/censor/|!ARGS:UpdateNote|!ARGS:regx_root|!ARGS:input_3|!ARGS:file|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:value_string_9|!ARGS:/^cf/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:/return/|!ARGS:fromp|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:sfhome|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/^obj_/|!ARGS:direct|!ARGS:fflv|!ARGS:direct|!ARGS:source_location/|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:/openid/|!ARGS:/adres/|!ARGS:/logo/|!ARGS:go|!ARGS:resolution|!ARGS:catalogue_search_code|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:path[alias]|!ARGS:/message/|!ARGS:/^utm/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:clickTag1|!ARGS:rf|!ARGS:payment_home|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:lec_rm|!ARGS:n-state|!ARGS:CP_email|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:/^clickTagFrame/|!ARGS:/^attr/|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:/^V_feed/|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:/^GARS_existing/|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:loc|!ARGS:/body/|!ARGS:/^product_long/|!ARGS:/server/|!ARGS:/content/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:board_msg|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/desc/|!ARGS:/footer/|!ARGS:FAQTitle|!ARGS:host|!ARGS:/text/|!ARGS:whereto|!ARGS:item[content]|!ARGS:pathToPiwik|!ARGS:email_sig|!ARGS:minicms_content|!ARGS:feed|!ARGS:/^artsee_banner_/|!ARGS:fetch|!ARGS:pingback_service|!ARGS:/hostname/|!ARGS:/http/|!ARGS:f_content|!ARGS:email_forward|!ARGS:bannercode|!ARGS:mesg|!ARGS:forward|!ARGS:atc_content|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:question_content|!ARGS:u|!ARGS:header|!ARGS:action|!ARGS:cptpl_dir|!ARGS:file_contents|!ARGS:contents|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:stretch|!ARGS:cat_sponsor|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:relocate|!ARGS:add_fd3|!ARGS:headers-28|!ARGS:soundname|!ARGS:bbcode_tpl|!ARGS:faqText|!ARGS:/google/|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:Comentario|!ARGS:/^dynadata/|!ARGS:paypal_ipn|!ARGS:title|!ARGS:right_frame|!ARGS:l1_bdy|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:wp_home|!ARGS:/^ViewState/|!ARGS:postvars|!ARGS:vars[DBhostname]|!ARGS:base1|!ARGS:cart_header|!ARGS:layout|!ARGS:short_story|!ARGS:/sponsor_banner/|!ARGS:newText|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:f_header|!ARGS:option[78]|!ARGS:savecontent|!ARGS:agendWebPage|!ARGS:/ftp/|!ARGS:gen_header|!ARGS:button_dir|!ARGS:x_organizational|!ARGS:form_element3|!ARGS:answer|!ARGS:intro|!ARGS:c_msg|!ARGS:note|!ARGS:domain|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:clickTAG|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:home|!ARGS:thm|!ARGS:_RW_|!ARGS:/rss/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:helpbox|!ARGS:redir|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:filecontent|!ARGS:inc|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:Post|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:oldmsg|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:bbcode_replace|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:goto|!ARGS:from|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:msgpreview|!ARGS:fb_ref|!ARGS:notes|!ARGS:pn_domain|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:pp_bio_content|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^rsargs/|!ARGS:op|!ARGS:BLK_block_content|!ARGS:ret|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:area|!ARGS:content|!ARGS:/^data\[tt_content\]/|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:newcontent|!ARGS:st_widget|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:home_top|!ARGS:Store_OUI_GlobalFooter|!ARGS:map|!ARGS:dynafield[_SIGNATURE]|!ARGS:payment_extrainfo|!ARGS:cta_content|!ARGS:wysiwyg|!ARGS:banner|!ARGS:env_ping_list|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:cta_content|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:code|!ARGS:p_content|!ARGS:/^k2extra/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:lowercase,multimatch,id:320163,rev:287,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{MATCHED_VAR}',chain" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + + +SecMarker END_RULES_92126 + +SecRule REQUEST_FILENAME "/theme/functions/upload\.php" "phase:2,id:92127,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/showimage\.php\.jpg" "phase:2,id:92128,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340035" + +SecRule REQUEST_FILENAME "/forums/admin/index\.php" "phase:2,id:92129,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" +SecAction "phase:2,id:92130,t:none,pass,nolog,skipAfter:END_RULES_92130" + +SecRule ARGS|!ARGS:/field_/|!ARGS:id|!ARGS:/addy/|!ARGS:rel_path|!ARGS:aim|!ARGS:api|!ARGS:details|!ARGS:/^field/|!ARGS:profile_id|!ARGS:/^complete_action/|!ARGS:/^option_value/|!ARGS:/buzz/|!ARGS:cc_list_id|!ARGS:/jform/|!ARGS:/liveUpdate/|!ARGS:/service/|!ARGS:marqueur|!ARGS:/vertex/|!ARGS:metavalue|!ARGS:binary|!ARGS:snippet|!ARGS:/^ZA_ARTICLE/|!ARGS:obr|!ARGS:^/xcpr_/|!ARGS:back|!ARGS:/pic/|!ARGS:/plaatje/|!ARGS:profile|!ARGS:repository|!ARGS:catalogue_search_code|!ARGS:os|!ARGS:ticketmaster|!ARGS:/destination/|!ARGS:r|!ARGS:/speedtest/|!ARGS:voice|!ARGS:/tripadvisor/|!ARGS:/iTunes/|!ARGS:service|!ARGS:lang_default_value|!ARGS:weather|!ARGS:/metakey/|!ARGS:/target/|!ARGS:/password/|!ARGS:/note/|!ARGS:form_profile|!ARGS:/theme/|!ARGS:ip|!ARGS:/afbeelding/|!ARGS:/screenshot/|!ARGS:/^input_/|!ARGS:embed_code|!ARGS:/^flb/|!ARGS:gwefan|!ARGS:/xthreads/|!ARGS:flv|!ARGS:dest|!ARGS:languageChange|!ARGS:/^perch_/|!ARGS:music|!ARGS:/^p_posts/|!ARGS:input_50|!ARGS:/resolv/|!ARGS:/^install_package/|!ARGS:/address/|!ARGS:refsrc|!ARGS:hp|!ARGS:/censor/|!ARGS:UpdateNote|!ARGS:regx_root|!ARGS:input_3|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:value_string_9|!ARGS:/^cf/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:/return/|!ARGS:fromp|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:sfhome|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:loc|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/photo/|!ARGS:/logo/|!ARGS:go|!ARGS:/^utm/|!ARGS:resolution|!ARGS:/export/|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:path[alias]|!ARGS:/message/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:/click/|!ARGS:rf|!ARGS:payment_home|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:/^win/|!ARGS:lec_rm|!ARGS:n-state|!ARGS:CP_email|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:attribute29|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:/server/|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:/body/|!ARGS:/^product_long_/|!ARGS:/content/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:board_msg|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/desc/|!ARGS:customer_footer|!ARGS:FAQTitle|!ARGS:host|!ARGS:/text/|!ARGS:whereto|!ARGS:pathToPiwik|!ARGS:admin_footer|!ARGS:email_sig|!ARGS:/^artsee_banner_/|!ARGS:pingback_service|!ARGS:showStr|!ARGS:/hostname/|!ARGS:/http/|!ARGS:bannercode|!ARGS:email_forward|!ARGS:fetch|!ARGS:/txt/|!ARGS:mesg|!ARGS:forward|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:footer_scripts|!ARGS:advBannerMessage|!ARGS:u|!ARGS:/header/|!ARGS:action|!ARGS:cptpl_dir|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:cat_sponsor|!ARGS:stretch|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:contactMessage|!ARGS:var_value[usps_labels_help_2]|!ARGS:short_story|!ARGS:vinculo|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:soundname|!ARGS:bbcode_tpl|!ARGS:/link/|!ARGS:faqText|!ARGS:request_uri|!ARGS:/google/|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:Comentario|!ARGS:dynadata[_SIGNATURE]|!ARGS:paypal_ipn|!ARGS:title|!ARGS:/frame/|!ARGS:l1_bdy|!ARGS:theMessage|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:uri|!ARGS:wp_home|!ARGS:/^ViewState/|!ARGS:postvars|!ARGS:base1|!ARGS:layout|!ARGS:EditorHTML|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:option[home]|!ARGS:sm_b_style|!ARGS:success|!ARGS:/^css/|!ARGS:short_story|!ARGS:vthumb|!ARGS:introduction|!ARGS:register_at|!ARGS:statusaddress|!ARGS:revnews_ad_120|!ARGS:/sponsor_banner/|!ARGS:newText|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:option[78]|!ARGS:agendWebPage|!ARGS:/icon/|!ARGS:/ftp/|!ARGS:button_dir|!ARGS:x_organizational|!ARGS:form_element3|!ARGS:answer|!ARGS:intro|!ARGS:note|!ARGS:c_msg|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:home|!ARGS:thm|!ARGS:_RW_|!ARGS:/rss/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:helpbox|!ARGS:ureferrer|!ARGS:redir|!ARGS:refertoyouby|!ARGS:ret|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:referredby|!ARGS:inc|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:Post|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:notes|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:refer|!ARGS:oldmsg|!ARGS:/referer/|!ARGS:/refer/|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:bbcode_replace|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:from|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:fb_ref|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^rsargs/|!ARGS:op|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:ret|!ARGS:area|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:st_widget|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:home_top|!ARGS:Store_OUI_GlobalFooter|!ARGS:dynafield[_SIGNATURE]|!ARGS:payment_extrainfo|!ARGS:wysiwyg|!ARGS:banner|!ARGS:env_ping_list|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:/^k2extra/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:320164,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,chain,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (AE)',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" "t:none,t:urlDecodeUni,t:lowercase" + +SecRule REQUEST_URI|ARGS|!ARGS:/field_/|!ARGS:aim|!ARGS:/^field/|!ARGS:details|!ARGS:/^complete_action/|!ARGS:profile_id|!ARGS:api|!ARGS:/^option_value/|!ARGS:button_src|!ARGS:cc_list_id|!ARGS:/buzz/|!ARGS:/jform/|!ARGS:/liveUpdate/|!ARGS:/service/|!ARGS:marqueur|!ARGS:/vertex/|!ARGS:metavalue|!ARGS:binary|!ARGS:snippet|!ARGS:/^ZA_ARTICLE/|!ARGS:obr|!ARGS:back|!ARGS:^/xcpr_/|!ARGS:/pic/|!ARGS:/plaatje/|!ARGS:profile|!ARGS:repository|!ARGS:/export/|!ARGS:os|!ARGS:ticketmaster|!ARGS:/destination/|!ARGS:r|!ARGS:/speedtest/|!ARGS:voice|!ARGS:/tripadvisor/|!ARGS:/iTunes/|!ARGS:lang_default_value|!ARGS:weather|!ARGS:/metakey/|!ARGS:/target/|!ARGS:/password/|!ARGS:/note/|!ARGS:form_profile|!ARGS:/theme/|!ARGS:ip|!ARGS:/afbeelding/|!ARGS:/screenshot/|!ARGS:embed_code|!ARGS:/^input_/|!ARGS:/^flb/|!ARGS:gwefan|!ARGS:/xthreads/|!ARGS:flv|!ARGS:dest|!ARGS:languageChange|!ARGS:/^perch_/|!ARGS:music|!ARGS:/^p_posts/|!ARGS:input_50|!ARGS:/resolv/|!ARGS:/^install_package/|!ARGS:/address/|!ARGS:wlp|!ARGS:hp|!ARGS:refsrc|!ARGS:/censor/|!ARGS:UpdateNote|!ARGS:regx_root|!ARGS:input_3|!ARGS:file|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:value_string_9|!ARGS:/^cf/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:/return/|!ARGS:fromp|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:sfhome|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/^obj_/|!ARGS:direct|!ARGS:fflv|!ARGS:direct|!ARGS:source_location/|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:/openid/|!ARGS:/adres/|!ARGS:/logo/|!ARGS:go|!ARGS:resolution|!ARGS:catalogue_search_code|!ARGS:/link/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:path[alias]|!ARGS:/message/|!ARGS:/^utm/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:camefrom|!ARGS:ucapi|!ARGS:clickTag1|!ARGS:rf|!ARGS:payment_home|!ARGS:sourcetitle|!ARGS:form_pathscript|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:dcsref|!ARGS:lec_rm|!ARGS:n-state|!ARGS:CP_email|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:/^clickTagFrame/|!ARGS:/^attr/|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:request|!ARGS:confirm|!ARGS:/^groups/|!ARGS:came_from|!ARGS:prodLogo|!ARGS:prodDownload|!ARGS:/^V_feed/|!ARGS:itemIntro|!ARGS:photo|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:typePageCode|!ARGS:/^GARS_existing/|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:loc|!ARGS:/body/|!ARGS:/^product_long/|!ARGS:/server/|!ARGS:/content/|!ARGS:banner_top|!ARGS:banners_list|!ARGS:heading|!ARGS:packageComments|!ARGS:cl_post|!ARGS:board_msg|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:msg|!ARGS:configuration_key|!ARGS:search|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/desc/|!ARGS:/footer/|!ARGS:FAQTitle|!ARGS:host|!ARGS:/text/|!ARGS:whereto|!ARGS:item[content]|!ARGS:pathToPiwik|!ARGS:email_sig|!ARGS:minicms_content|!ARGS:feed|!ARGS:/^artsee_banner_/|!ARGS:fetch|!ARGS:pingback_service|!ARGS:/hostname/|!ARGS:/http/|!ARGS:f_content|!ARGS:email_forward|!ARGS:bannercode|!ARGS:mesg|!ARGS:forward|!ARGS:atc_content|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:question_content|!ARGS:u|!ARGS:header|!ARGS:action|!ARGS:cptpl_dir|!ARGS:file_contents|!ARGS:contents|!ARGS:arg6|!ARGS:dbhost|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:stretch|!ARGS:cat_sponsor|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:relocate|!ARGS:add_fd3|!ARGS:headers-28|!ARGS:soundname|!ARGS:bbcode_tpl|!ARGS:faqText|!ARGS:/google/|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:searchstring|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:Comentario|!ARGS:/^dynadata/|!ARGS:paypal_ipn|!ARGS:title|!ARGS:right_frame|!ARGS:l1_bdy|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:wp_home|!ARGS:/^ViewState/|!ARGS:postvars|!ARGS:vars[DBhostname]|!ARGS:base1|!ARGS:cart_header|!ARGS:layout|!ARGS:short_story|!ARGS:/sponsor_banner/|!ARGS:newText|!ARGS:PageCopy|!ARGS:amp;loc|!ARGS:f_header|!ARGS:option[78]|!ARGS:savecontent|!ARGS:agendWebPage|!ARGS:/ftp/|!ARGS:gen_header|!ARGS:button_dir|!ARGS:x_organizational|!ARGS:form_element3|!ARGS:answer|!ARGS:intro|!ARGS:c_msg|!ARGS:note|!ARGS:domain|!ARGS:how_did_you_hear_about_us|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:clickTAG|!ARGS:problem|!ARGS:default_banner|!ARGS:archive_chrono|!ARGS:home|!ARGS:thm|!ARGS:_RW_|!ARGS:/rss/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:helpbox|!ARGS:redir|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:filecontent|!ARGS:inc|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:Post|!ARGS:reply|!ARGS:last_msg|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:FULL_URL|!ARGS:HOMEPAGE_URL|!ARGS:ATTACHMENTS_URL|!ARGS:stories_cat|!ARGS:sUrl|!ARGS:view|!ARGS:howhear|!ARGS:oldmsg|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:signature|!ARGS:disc|!ARGS:utmr|!ARGS:user[signature]|!ARGS:Query|!ARGS:steps|!ARGS:bbcode_replace|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:goto|!ARGS:from|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:configParams[api][configParamValue]|!ARGS:/^wimpy/|!ARGS:msgpreview|!ARGS:fb_ref|!ARGS:notes|!ARGS:pn_domain|!ARGS:newidentities[0][signature]|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:pp_bio_content|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^rsargs/|!ARGS:op|!ARGS:BLK_block_content|!ARGS:ret|!ARGS:Store_CustomerEmail_Header|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:area|!ARGS:content|!ARGS:/^data\[tt_content\]/|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:newcontent|!ARGS:st_widget|!ARGS:ban_reason|!ARGS:def|!ARGS:data[Email][comment]|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:home_top|!ARGS:Store_OUI_GlobalFooter|!ARGS:map|!ARGS:dynafield[_SIGNATURE]|!ARGS:payment_extrainfo|!ARGS:cta_content|!ARGS:wysiwyg|!ARGS:banner|!ARGS:env_ping_list|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:cta_content|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:code|!ARGS:p_content|!ARGS:/^k2extra/ "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:lowercase,multimatch,id:320165,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS (MM)',logdata:'%{MATCHED_VAR}',chain" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + + +SecMarker END_RULES_92130 + +SecRule REQUEST_FILENAME "/link_list\.js\.php" "phase:2,id:92131,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340003,ctl:ruleRemovebyID=340020,ctl:ruleRemovebyID=340158" + +SecRule REQUEST_FILENAME "/ajax_get_file_listing\.php" "phase:2,id:92132,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/cgi-bin/send\.pl" "phase:2,id:92133,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340158,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=341049,ctl:ruleRemovebyID=340157" + +SecRule REQUEST_FILENAME "/send_mail_with_attachment\.php" "phase:2,id:92134,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/ts_manage\.php" "phase:2,id:92135,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/plugins/eqdkp_uploader/dialog\.php" "phase:2,id:92136,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/plugins/eqdkp_lightbox/dialog\.php" "phase:2,id:92137,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/addeditproperties\.php" "phase:2,id:92138,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/muokkaa_suomi\.php" "phase:2,id:92139,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/cms/setpage\.php" "phase:2,id:92140,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/quick_updates\.php" "phase:2,id:92141,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/custom404css\.php" "phase:2,id:92142,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/extra_info_pages\.php" "phase:2,id:92143,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/wp-admin/edit-tags\.php" "phase:2,id:92144,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/qrcode/img\.php" "phase:2,id:92145,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/randomimage\.php" "phase:2,id:92146,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/acp/user\.php" "phase:2,id:92147,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/save_page_settings\.php" "phase:2,id:92148,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/changedata\.php" "phase:2,id:92149,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/cadmin/index\.php" "phase:2,id:92150,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/magento/index\.php/banner" "phase:2,id:92151,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/factor_edit\.php" "phase:2,id:92152,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/admin/options/editpl\.php" "phase:2,id:92153,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/upload/scripts/ajax\.sfsyncphotos\.php" "phase:2,id:92154,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/adminepharmac\.php" "phase:2,id:92155,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/siteadmin/leafs/addinline" "phase:2,id:92156,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/dmxeditor/dialogs/upload\.php" "phase:2,id:92157,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/plugins/system/phpimageeditor/index\.php" "phase:2,id:92158,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/galeria/thumbs\.php" "phase:2,id:92159,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/prize_posting\.php" "phase:2,id:92160,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/clientservices\.php" "phase:2,id:92161,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/ajax_save_name\.php" "phase:2,id:92162,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/ckeditor/xss" "phase:2,id:92163,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/muuta\.php" "phase:2,id:92164,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin-osb\.php" "phase:2,id:92165,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/envoi-code\.html" "phase:2,id:92166,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711,ctl:ruleRemovebyID=380018" + +SecRule REQUEST_FILENAME "/tiki-edit_css\.php" "phase:2,id:92167,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/admin/index\.cfm" "phase:2,id:92168,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/e107_plugins/sgallery/showpic\.php" "phase:2,id:92169,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/modules/mod_rar_radio/tmpl/player/player\.php" "phase:2,id:92170,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/editpackage\.php" "phase:2,id:92171,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/systeembeheer/mysql" "phase:2,id:92172,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/view_system_style_source\.php" "phase:2,id:92173,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/admin/autorisierung\.php" "phase:2,id:92174,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/updatetemp\.html" "phase:2,id:92175,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/admin_zoej\.php" "phase:2,id:92176,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/content/item/edit/" "phase:2,id:92177,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/cgi-bin/helpdesk/ajax\.cgi" "phase:2,id:92178,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/ajax_image_thumbnail\.php" "phase:2,id:92179,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/ajax_delete_file\.php" "phase:2,id:92180,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/tools/reacties\.php" "phase:2,id:92181,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/administration/basic_settings\.php" "phase:2,id:92182,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/fdlhq/admin/config\.php" "phase:2,id:92183,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin-osb\.php" "phase:2,id:92184,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/sysext/tstemplate/" "phase:2,id:92185,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/dbadmin/" "phase:2,id:92186,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/tbl_structure\.php" "phase:2,id:92187,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344374,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/imagens\.php" "phase:2,id:92188,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/app_dev\.php" "phase:2,id:92189,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/generator/index\.php" "phase:2,id:92190,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390712" + +SecRule REQUEST_FILENAME "/admin/item_processor\.php" "phase:2,id:92191,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/editcode/" "phase:2,id:92192,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/admin/pages/thememail\.php" "phase:2,id:92193,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/admin/pages/themechooser\.php" "phase:2,id:92194,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/thumbopen\.php" "phase:2,id:92195,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:92196,t:none,pass,nolog,skipAfter:END_RULES_92196" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,id:341726,chain,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/redir/|!ARGS:src "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:341727,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + + +SecMarker END_RULES_92196 + +SecRule REQUEST_FILENAME "/sendmessage\.php" "phase:2,id:92197,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/admin-themes-editor\.php" "phase:2,id:92198,t:none,t:lowercase,pass,nolog,noauditlog" + +SecRule REQUEST_FILENAME "/kangooadmin/index\.php" "phase:2,id:92199,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/business_profile_engine\.php" "phase:2,id:92200,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/backmin/index\.php" "phase:2,id:92201,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211" + +SecRule REQUEST_FILENAME "/livechat/ajax/footprints\.php" "phase:2,id:92202,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/typo3conf/" "phase:2,id:92203,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/ntunnel_mysql\.php" "phase:2,id:92204,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/magmi_saveprofile\.php" "phase:2,id:92205,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/magmi_saveconfig\.php" "phase:2,id:92206,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/details\.php" "phase:2,id:92207,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390614" + +SecRule REQUEST_FILENAME "/detail_ispravak\.php" "phase:2,id:92208,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/page/addedit\.php" "phase:2,id:92209,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/booking_apartman_podaci\.php" "phase:2,id:92210,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/sfpadmin\.php" "phase:2,id:92211,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/iwp/ajax\.php" "phase:2,id:92212,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/setup/config\.php" "phase:2,id:92213,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/ziegenproblem\.php" "phase:2,id:92214,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/image\.php" "phase:2,id:92215,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:92216,t:none,pass,nolog,skipAfter:END_RULES_92216" + +SecRule ARGS|!ARGS:pagex|!ARGS:/refer/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:f "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,id:341737,chain,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:pagex|!ARGS:/refer/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:f "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:341738,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + + +SecMarker END_RULES_92216 + +SecRule REQUEST_FILENAME "/unesi\.komentar\.inc\.php" "phase:2,id:92217,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/tiki-auto_save\.php" "phase:2,id:92218,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/querywindow\.php" "phase:2,id:92219,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/static_content_editresult_mobile\.php" "phase:2,id:92220,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/form/configuration\.php" "phase:2,id:92221,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/site_checker\.php" "phase:2,id:92222,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390712" + +SecRule REQUEST_FILENAME "/ins_upd_data\.php" "phase:2,id:92223,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ajaxfilemanager\.php" "phase:2,id:92224,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=347008" + +SecRule REQUEST_FILENAME "/ajax_get_file_listing\.php" "phase:2,id:92225,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=347008" + +SecRule REQUEST_FILENAME "/admin/assets/inc/bin/general\.services\.php" "phase:2,id:92226,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/ajax_image_editor\.php" "phase:2,id:92227,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=347008" + +SecRule REQUEST_FILENAME "/beheer/toolboxx\.php" "phase:2,id:92228,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/aktualnolight_elementi\.php" "phase:2,id:92229,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/wp-content/plugins/counterize/counterize\.php" "phase:2,id:92230,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/modules/v6_pages_engine\.php" "phase:2,id:92231,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/modules/v7_pages_engine\.php" "phase:2,id:92232,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/wwwsqldesigner/" "phase:2,id:92233,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/bottom\.php" "phase:2,id:92234,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:92235,t:none,pass,nolog,skipAfter:END_RULES_92235" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:module "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,id:341739,chain,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecRule ARGS|!ARGS:/url/|!ARGS:lnk|!ARGS:module "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/" "capture,phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,multimatch,id:341740,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS',logdata:'%{MATCHED_VAR}'" +SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + + +SecMarker END_RULES_92235 + +SecRule REQUEST_FILENAME "/clients/admin/addonmodules\.php" "phase:2,id:92236,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/graps-cms\.php" "phase:2,id:92237,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/sadrzajdrag_elementi\.php" "phase:2,id:92238,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/listaproperty\.php" "phase:2,id:92239,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/plazadmin\.php" "phase:2,id:92240,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/filtteri" "phase:2,id:92241,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/cgi-bin/jrscgi/update\.cgi" "phase:2,id:92242,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/imagemanager/stream/index\.php" "phase:2,id:92243,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390704" + +SecRule REQUEST_FILENAME "/wp-admin/user-edit\.php" "phase:2,id:92244,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/options-website\.php" "phase:2,id:92245,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/savefile\.html" "phase:2,id:92246,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380016" + +SecRule REQUEST_FILENAME "/database/cashtrack\.php" "phase:2,id:92247,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/wp-content/plugins/winkelmodule/naardab\.php" "phase:2,id:92248,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/write-post\.php" "phase:2,id:92249,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/website/beheer/edit\.php" "phase:2,id:92250,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/potenzen_1_formmailer\.php" "phase:2,id:92251,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/admin/catalogusbijwerken\.php" "phase:2,id:92252,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/livechat/server\.php" "phase:2,id:92253,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin_updatemedia\.php" "phase:2,id:92254,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/afg_img_rsz\.php" "phase:2,id:92255,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/cms/pagina_edit\.php" "phase:2,id:92256,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/connectors/resource/index\.php" "phase:2,id:92257,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/connectors/index\.php" "phase:2,id:92258,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=340095,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=341211,ctl:ruleRemovebyID=380018" + +SecRule REQUEST_FILENAME "/getxml\.php" "phase:2,id:92259,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ajax-tab\.php" "phase:2,id:92260,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390614,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=380006,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/mod/quiz/attempt\.php" "phase:2,id:92261,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/livechat/mobile/chat\.php" "phase:2,id:92262,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340574,ctl:ruleRemovebyID=340573" + +SecRule REQUEST_FILENAME "/soap\.hsp" "phase:2,id:92263,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390712,ctl:ruleRemovebyID=340121,ctl:ruleRemovebyID=340122" + +SecRule REQUEST_FILENAME "/mailman/admindb/*" "phase:2,id:92264,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147" + +SecRule REQUEST_FILENAME "/cms/save\.php" "phase:2,id:92265,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/sort_edit\.php" "phase:2,id:92266,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/geweest\.php" "phase:2,id:92267,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/project/project_item\.php" "phase:2,id:92268,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-content/plugins/pdfjs-viewer-shortcode/web/viewer\.php" "phase:2,id:92269,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/process_submission\.php" "phase:2,id:92270,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ajax-upgradetab\.php" "phase:2,id:92271,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=341155" + +SecRule REQUEST_FILENAME "/updatemail\.php" "phase:2,id:92272,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/toevoegen_gemee\.php" "phase:2,id:92273,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/cms_gemeentetiel/" "phase:2,id:92274,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/deleteblogui\.php" "phase:2,id:92275,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/check_mandatory_fields\.php" "phase:2,id:92276,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/assets/components/migx/connector\.php" "phase:2,id:92277,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/administration/modifier/formulaire\.php" "phase:2,id:92278,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/imagemanager/stream/index\.php" "phase:2,id:92279,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/admin/edit_config\.php" "phase:2,id:92280,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admineditevent\.php" "phase:2,id:92281,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/article_edit\.php" "phase:2,id:92282,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/serendipity_admin\.php" "phase:2,id:92283,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/upload_resize\.php" "phase:2,id:92284,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/main/php/editor\.php" "phase:2,id:92285,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340128" + +SecRule REQUEST_FILENAME "/scp/canned\.php" "phase:2,id:92286,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/scp/tickets\.php" "phase:2,id:92287,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/scp/settings\.php" "phase:2,id:92288,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/didwegetthiswrong\.php" "phase:2,id:92289,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/acp/config_payments_form\.php" "phase:2,id:92290,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/v2/edit\.php" "phase:2,id:92291,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/b/ss/appleusstartpage/" "phase:2,id:92292,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/script-youtube-bg\.php" "phase:2,id:92293,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/adm_vsz/servert_up\.php" "phase:2,id:92294,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/smb/web/web-server-settings/" "phase:2,id:92295,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/smb/web/edit/" "phase:2,id:92296,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/ajaxupload\.php" "phase:2,id:92297,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/ajaxupload2\.php" "phase:2,id:92298,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/searchreplacedb2\.php" "phase:2,id:92299,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/static/ajax\.php" "phase:2,id:92300,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/js/tiny_mce/plugins/filemanager/upload\.php" "phase:2,id:92301,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=347008" +SecAction "phase:2,id:92302,t:none,pass,nolog,skipAfter:END_RULES_92302" + + +# Rule 340006: generic recursion signatures +SecRule ARGS "\.\./\.\./" "chain,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:cmdline,capture,id:344596,phase:2,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied in URI/ARGS',logdata:'%{TX.0},%{matched_var_name}'" +SecRule ARGS:path|ARGS:path_thumb "!(^\.\./\.\./\.\./\.\./\.\./media-upload/)" + + +SecMarker END_RULES_92302 + +SecRule REQUEST_FILENAME "/tools/payment_methods\.php" "phase:2,id:92303,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/sitesetup\.php" "phase:2,id:92304,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/addmodifybloguim\.php" "phase:2,id:92305,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/addeditartikel\.php" "phase:2,id:92306,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/load1pdf\.php" "phase:2,id:92307,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/_cmsms/admin/moduleinterface\.php" "phase:2,id:92308,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/manage/ci_car_f\.php" "phase:2,id:92309,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/saveedititem\.php" "phase:2,id:92310,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/moduleinterface\.php" "phase:2,id:92311,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/livesupport/server\.php" "phase:2,id:92312,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/scripts/process_submission\.php" "phase:2,id:92313,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/admin/package_add_result\.php" "phase:2,id:92314,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ee-admin\.php" "phase:2,id:92315,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/fulladmin/configproducts\.php" "phase:2,id:92316,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/product_options\.json\.php" "phase:2,id:92317,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/supportannouncements\.php" "phase:2,id:92318,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/fixtures_update\.php" "phase:2,id:92319,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/forums/private\.php" "phase:2,id:92320,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/vba_gallery_admin\.php" "phase:2,id:92321,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/multitv\.connector\.php" "phase:2,id:92322,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/e_editwrite\.php" "phase:2,id:92323,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/e_date\.php" "phase:2,id:92324,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/dnsmanagement\.php" "phase:2,id:92325,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/clientarea\.php" "phase:2,id:92326,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/thumbnails\.php" "phase:2,id:92327,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/stats\.php" "phase:2,id:92328,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/agreement_edit\.php" "phase:2,id:92329,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/process/processdb\.php" "phase:2,id:92330,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/mdeploy\.php" "phase:2,id:92331,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/themify/img\.php" "phase:2,id:92332,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/worldpay\.php" "phase:2,id:92333,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/parsechecker\.php" "phase:2,id:92334,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/db_edit\.php" "phase:2,id:92335,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/admin/content\.php" "phase:2,id:92336,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/xoops/configproducts\.php" "phase:2,id:92337,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/engine/index\.php" "phase:2,id:92338,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/derefer\.php" "phase:2,id:92339,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/change_it\.php" "phase:2,id:92340,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/secure/moveissue\.jspa" "phase:2,id:92341,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/configaddonmods\.php" "phase:2,id:92342,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/edit_menu\.php" "phase:2,id:92343,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/s/process\.php" "phase:2,id:92344,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/flash/gate\.php" "phase:2,id:92345,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=392301" + +SecRule REQUEST_FILENAME "/multimediasave\.do" "phase:2,id:92346,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/restaurant\.php" "phase:2,id:92347,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-admin/plugins\.php" "phase:2,id:92348,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/item\.php" "phase:2,id:92349,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/components/com_avchat3/chat/wget\.php" "phase:2,id:92350,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/securimage_play\.swf" "phase:2,id:92351,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/frontpageupdate\.php" "phase:2,id:92352,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/parsechecker\.php" "phase:2,id:92353,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/document_general\.php" "phase:2,id:92354,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/lib/exe/ajax\.php" "phase:2,id:92355,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/quickview\.aspx" "phase:2,id:92356,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390613,ctl:ruleRemovebyID=390614" + +SecRule REQUEST_FILENAME "/tce_file\.php" "phase:2,id:92357,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/admin/updatepage\.php" "phase:2,id:92358,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/modules/widget_engine\.php" "phase:2,id:92359,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/v2_news_engine\.php" "phase:2,id:92360,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/db_routines\.php" "phase:2,id:92361,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/cmd/pagina\.php" "phase:2,id:92362,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/advcp/" "phase:2,id:92363,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/0101_change_text\.php" "phase:2,id:92364,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/0104_dupicate\.php" "phase:2,id:92365,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/0101_change_text\.php" "phase:2,id:92366,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/0104_duplicate\.php" "phase:2,id:92367,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/0101_change\.php" "phase:2,id:92368,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/0101_change_news\.php" "phase:2,id:92369,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/reviews/uploadproduct\.php" "phase:2,id:92370,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/redaxo/index\.php" "phase:2,id:92371,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/adm-misc\.php" "phase:2,id:92372,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/property-details\.php" "phase:2,id:92373,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/artikel/" "phase:2,id:92374,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/editieren_grunddaten\.php" "phase:2,id:92375,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/contao/main\.php" "phase:2,id:92376,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/seo-report\.php" "phase:2,id:92377,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/site_links\.php" "phase:2,id:92378,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/wp-admin/network/themes\.php" "phase:2,id:92379,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/previewtemplate\.php" "phase:2,id:92380,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/distributors/edit\.php" "phase:2,id:92381,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/deref\.php" "phase:2,id:92382,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162" + +SecRule REQUEST_FILENAME "/gr_radiostatus_panel/" "phase:2,id:92383,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/typo3/mod\.php" "phase:2,id:92384,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/addmodifyeventui\.php" "phase:2,id:92385,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/addmodifyeventuim\.php" "phase:2,id:92386,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/deleteeventui\.php" "phase:2,id:92387,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/deleteeventuim\.php" "phase:2,id:92388,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/addmodifyblogui\.php" "phase:2,id:92389,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/addmodifybloguim\.php" "phase:2,id:92390,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/bug_update\.php" "phase:2,id:92391,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/func/get-members\.php" "phase:2,id:92392,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340003" + +SecRule REQUEST_FILENAME "/update_page\.php" "phase:2,id:92393,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/abf-db\.php" "phase:2,id:92394,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/checkout_yourinfo\.php" "phase:2,id:92395,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/adminhandler\.php" "phase:2,id:92396,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/sadmin/" "phase:2,id:92397,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/cms/editcentre\.php" "phase:2,id:92398,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/admin/content/widget" "phase:2,id:92399,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/wp-change_domain\.php" "phase:2,id:92400,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/pagetext/edit\.php" "phase:2,id:92401,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/cms/actueel\.php" "phase:2,id:92402,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/wp-content/plugins/cws-pb/" "phase:2,id:92403,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/public_file_edit\.php" "phase:2,id:92404,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/editgall\.php" "phase:2,id:92405,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/mod/quiz/" "phase:2,id:92406,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/integration/service\.php" "phase:2,id:92407,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/create_question\.php" "phase:2,id:92408,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/wpfb-ajax\.php" "phase:2,id:92409,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/branding\.php" "phase:2,id:92410,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/jackbox_social\.php" "phase:2,id:92411,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/wp-admin/customize\.php" "phase:2,id:92412,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/blog/import" "phase:2,id:92413,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/system/ajax" "phase:2,id:92414,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/admin/prodedit\.php" "phase:2,id:92415,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cometchat/admin/" "phase:2,id:92416,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cgi-bin/dada/plugins/bridge\.cgi" "phase:2,id:92417,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cms/addcentre\.php" "phase:2,id:92418,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/edit_orders_tax\.php" "phase:2,id:92419,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/whmadmcp/addonmodules\.php" "phase:2,id:92420,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "property-edit-handler\.php" "phase:2,id:92421,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016" + +SecRule REQUEST_FILENAME "/admin/admin_settings_save\.php" "phase:2,id:92422,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/send\.email\.do\.php" "phase:2,id:92423,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/homepage\.php" "phase:2,id:92424,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-content/plugins/backwpup/job/job_run\.php" "phase:2,id:92425,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/project/install/handle_ajax" "phase:2,id:92426,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/cometchat_send\.php" "phase:2,id:92427,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/social_slider_panel/admin\.php" "phase:2,id:92428,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340464,ctl:ruleRemovebyID=340465" + +SecRule REQUEST_FILENAME "/ga_node_subserver\.php" "phase:2,id:92429,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/bitrix/admin/fileman_file_edit\.php" "phase:2,id:92430,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340128,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/bitrix/tools/autosave\.php" "phase:2,id:92431,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/wp-admin/plugin-editor\.php" "phase:2,id:92432,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340213" + +SecRule REQUEST_FILENAME "/admin/picaimport\.php" "phase:2,id:92433,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/backend/event_insert" "phase:2,id:92434,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/build_email" "phase:2,id:92435,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/sadmin/responsivefilemanager" "phase:2,id:92436,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340006,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/fixddbb\.php" "phase:2,id:92437,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/ajax_upload/" "phase:2,id:92438,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/supportkb\.php" "phase:2,id:92439,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/template_update\.php" "phase:2,id:92440,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/editevents\.php" "phase:2,id:92441,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/edit_workshops\.php" "phase:2,id:92442,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/useredit\.php" "phase:2,id:92443,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admincp/staff/staff_edit\.php" "phase:2,id:92444,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/configproducts\.php" "phase:2,id:92445,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/wp-admin/post\.php" "phase:2,id:92446,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=380026" + +SecRule REQUEST_FILENAME "/ajax/api/" "phase:2,id:92447,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ajax\.adm_server\.php" "phase:2,id:92448,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ftlocal\.html" "phase:2,id:92449,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/articles/editarticle\.php" "phase:2,id:92450,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/autosave-ajax\.php" "phase:2,id:92451,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cmsmodules/ecommerce/pages/tools" "phase:2,id:92452,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/products_frameset\.aspx" "phase:2,id:92453,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/contenu/contenu\.php" "phase:2,id:92454,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin_sklep/index\.php" "phase:2,id:92455,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/course/edit\.php" "phase:2,id:92456,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-admin/admin\.php" "phase:2,id:92457,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/funcs\.php" "phase:2,id:92458,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ibd-admin/add_article\.php" "phase:2,id:92459,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/articles/editpicarticle\.php" "phase:2,id:92460,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/news/create" "phase:2,id:92461,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/products/add\.php" "phase:2,id:92462,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/products/edit\.php" "phase:2,id:92463,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/_editor/index\.php" "phase:2,id:92464,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380016" + +SecRule REQUEST_FILENAME "/stk/index\.php" "phase:2,id:92465,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/services/bmwidget\.json" "phase:2,id:92466,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/services/bmcontent\.json" "phase:2,id:92467,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/store_edit\.php" "phase:2,id:92468,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ajax\.process\.php" "phase:2,id:92469,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/sienna\.php" "phase:2,id:92470,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/sadmin/index\.php" "phase:2,id:92471,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/ajax_calls/updateletter\.php" "phase:2,id:92472,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cgi-bin/editfile\.cgi" "phase:2,id:92473,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=341048,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/sendmail\.php" "phase:2,id:92474,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ajaxemail" "phase:2,id:92475,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin-db-create-table-census-load\.php" "phase:2,id:92476,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340157" + +SecRule REQUEST_FILENAME "/updateorder\.php" "phase:2,id:92477,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/awesome-gallery/resize\.php" "phase:2,id:92478,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/report\.php" "phase:2,id:92479,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/addvesti\.php" "phase:2,id:92480,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "email-templates\.php" "phase:2,id:92481,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cornerstone-endpoint" "phase:2,id:92482,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/fileman_file_edit\.php" "phase:2,id:92483,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/inc/e_product\.php" "phase:2,id:92484,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/configurator\.do" "phase:2,id:92485,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/supporttickets\.php" "phase:2,id:92486,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" +SecAction "phase:2,id:92487,t:none,pass,nolog,skipAfter:END_RULES_92487" + +SecRule ARGS|ARGS_NAMES|!ARGS:/adsense/|!ARGS:rtel|!ARGS:/TextArea/|!ARGS:insp_code|!ARGS:/marketing_code/|!ARGS:addthis|!ARGS:/go_code/|!ARGS:/shortcode/|!ARGS:/analitics/|!ARGS:/area_id/|!ARGS:message|!ARGS:/theme/|!ARGS:/ga_code/|!ARGS:/analytic/|!ARGS:/_js_/|!ARGS:/schema/|!ARGS:/^ifeature/|!ARGS:/^redux/|!ARGS:/analyticscode/|!ARGS:/suffix/|!ARGS:/sadrzaj/|!ARGS:js_includes|!ARGS:/m1_source/|!ARGS:/geodir/|!ARGS:/banner_block/|!ARGS:/introcopy/|!ARGS:eingabe|!ARGS:ausgabe|!ARGS:/previewdata/|!ARGS:/tracking_extra/|!ARGS:/^groups/|!ARGS:video|!ARGS:/google_map/|!ARGS:/field_map/|!ARGS:/gacode/|!ARGS:code1|!ARGS:ga_code|!ARGS:customized|!ARGS:code_analytics|!ARGS:uvod|!ARGS:/^field_video/|!ARGS:q|!ARGS:/^textarea-video/|!ARGS:leirro|!ARGS:lomake|!ARGS:vastaus|!ARGS:/^texte$/|!ARGS:vraag|!ARGS:qti_data|!ARGS:tracklist|!ARGS:i_google|!ARGS:code_area_text|!ARGS:/log_code/|!ARGS:/^ADVERT_/|!ARGS:UserData|!ARGS:areas|!ARGS:templatecode|!ARGS:/prevObject/|!ARGS:/replaceAll/|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:/prependTo/|!ARGS:/appendTo/|!ARGS:/mapcode/|!ARGS:googleCode|!ARGS:/sidebar/|!ARGS:/ad_code/|!ARGS:/^recipient/|!ARGS:optional_head|!ARGS:/^form/|!ARGS:/^var_value/|!ARGS:variable_data|!ARGS:/^instance/|!ARGS:/customfield/|!ARGS:notice|!ARGS:/formcode/|!ARGS:/ajax/|!ARGS:all|!ARGS:allowedTags|!ARGS:/google_analytics/|!ARGS:/widget/|!ARGS:ad_code|!ARGS:/keycaptcha_code/|!ARGS:/jscode/|!ARGS:postcontents|!ARGS:video1|!ARGS:/updateAds/|!ARGS:map|!ARGS:gmapcode|!ARGS:/^Sidebar/|!ARGS:/^wpTextbox/|!ARGS:paragrafo|!ARGS:/question/|!ARGS:/style/|!ARGS:tracking_code|!ARGS:whats-new|!ARGS:analyticscode|!ARGS:top_news|!ARGS:data[config]|!ARGS:fulltext|!ARGS:introtext|!ARGS:offertext|!ARGS:block|!ARGS:livezillacode|!ARGS:/embed/|!ARGS:/desc/|!ARGS:/script/|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/cms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:match_report|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:phpcode|!ARGS:intro|!ARGS:Snippet|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:input[Desarrollo]|!ARGS:move2|!ARGS:hoperation|!ARGS:login_form|!ARGS:/product_benefits/|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:bbcode_tpl|!ARGS:Right_photo_1|!ARGS:embedVideo|!ARGS:/^K2ExtraField/|!ARGS:mentorhelp|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/footer/|!ARGS:/link/|!ARGS:text|!ARGS:txt|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?script|(?:<|< ?/)(?:(?:java|vb)script|about|applet|activex|chrome)|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:replaceComments,t:compressWhitespace,t:lowercase,capture,id:390147,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule ARGS|REQUEST_HEADERS:X_FORWARDED_FOR|ARGS_NAMES|!ARGS:message|!ARGS:/adsense/|!ARGS:rtel|!ARGS:/TextArea/|!ARGS:/^dbem/!ARGS:insp_code|!ARGS:/marketing_code/|!ARGS:addthis|!ARGS:/option_tree/|!ARGS:/go_code/|!ARGS:/custom/|!ARGS:/shortcode/|!ARGS:/analitics/|!ARGS:/area_id/|!ARGS:/_head_/|!ARGS:/theme/|!ARGS:/ga_code/|!ARGS:/analytic/|!ARGS:/_js_/|!ARGS:/schema/|!ARGS:/^ifeature/|!ARGS:/^redux/|!ARGS:/analyticscode/|!ARGS:/suffix/|!ARGS:/sadrzaj/|!ARGS:js_includes|!ARGS:/m1_source/|!ARGS:/geodir/|!ARGS:/suffix/|!ARGS:/banner_block/|!ARGS:/introcopy/|!ARGS:ausgabe|!ARGS:eingabe|!ARGS:/previewdata/|!ARGS:/tracking_extra/|!ARGS:SAMLResponse|!ARGS:/^groups/|!ARGS:video|!ARGS:/google_map/|!ARGS:/gacode/|!ARGS:code1|!ARGS:sotenson|!ARGS:ga_code|!ARGS:customized|!ARGS:code_analytics|!ARGS:uvod|!ARGS:/^field_video/|!ARGS:q|!ARGS:/^textarea-video/|!ARGS:leirro|!ARGS:lomake|!ARGS:vastaus|!ARGS:vraag|!ARGS:qti_data|!ARGS:tracklist|!ARGS:i_google|!ARGS:code_area_text|!ARGS:/log_code/|!ARGS:/^ADVERT_/|!ARGS:UserData|!ARGS:areas|!ARGS:templatecode|!ARGS:/prevObject/|!ARGS:/replaceAll/|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:/prependTo/|!ARGS:/appendTo/|!ARGS:/mapcode/|!ARGS:googleCode|!ARGS:/^recipient/|!ARGS:optional_head|!ARGS:/^form/|!ARGS:/^var_value/|!ARGS:variable_data|!ARGS:/customfield/|!ARGS:val333|!ARGS:notice|!ARGS:/formcode/|!ARGS:/ajax/|!ARGS:all|!ARGS:allowedTags|!ARGS:/tracking/|!ARGS:/google_analytics/|!ARGS:/widget/|!ARGS:ad_code|!ARGS:/jscode/|!ARGS:postcontents|!ARGS:/keycaptcha_code/|!ARGS:video1|!ARGS:/updateAds/|!ARGS:map|!ARGS:gmapcode|!ARGS:/^Sidebar/|!ARGS:/^wpTextbox/|!ARGS:paragrafo|!ARGS:/question/|!ARGS:/style/|!ARGS:sidebar|!ARGS:analyticscode|!ARGS:top_news|!ARGS:tracking_code|!ARGS:data[config]|!ARGS:fulltext|!ARGS:introtext|!ARGS:offertext|!ARGS:block|!ARGS:livezillacode|!ARGS:whats-new|!ARGS:/embed/|!ARGS:/desc/|!ARGS:/sidebar/|!ARGS:/ad_code/|!ARGS:/footer/|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/wyscms/|!ARGS:/script/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:/^field_/|!ARGS:match_report|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:/^instance/|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:eip_value|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:move2|!ARGS:input[Desarrollo]|!ARGS:hoperation|!ARGS:arg2|!ARGS:login_form|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:/submitcode/|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?script|< ?(?:i?frame ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(ht|f)tps?)\:/|document\.write ?\(|(?:<|< ?/) ?(?:(?:java|vb)script|applet|activex|chrome)|< ?/?i?frame|\% ?env)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:removeNulls,t:utf8tounicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhiteSpace,t:lowercase,multiMatch,id:390148,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" + +SecMarker END_RULES_92487 + +SecRule REQUEST_FILENAME "/api/podapi/" "phase:2,id:92488,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390709" + +SecRule REQUEST_FILENAME "/templatesavechanges" "phase:2,id:92489,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340835,ctl:ruleRemovebyID=340836,ctl:ruleRemovebyID=340837" + +SecRule REQUEST_FILENAME "accordioncheckout\.do" "phase:2,id:92490,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "accordion\.do" "phase:2,id:92491,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/formbuilder/index/submit" "phase:2,id:92492,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin-exec\.php" "phase:2,id:92493,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/press-this\.php" "phase:2,id:92494,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/includes/apps/ajax_func\.php" "phase:2,id:92495,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/pw/page/edit/" "phase:2,id:92496,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/bitrix/tools/autosave\.php" "phase:2,id:92497,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/bitrix/tools/public_file_edit_src\.php" "phase:2,id:92498,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/bitrix/admin/fileman_file_edit\.php" "phase:2,id:92499,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/manage/faq/edit/" "phase:2,id:92500,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/engine/update\.php" "phase:2,id:92501,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380006" + +SecRule REQUEST_FILENAME "/manager/ispmgr" "phase:2,id:92502,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/amember/aff/click-js/" "phase:2,id:92503,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/manage/seo/" "phase:2,id:92504,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=390572" + +SecRule REQUEST_FILENAME "/admin/admin-data\.php" "phase:2,id:92505,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/edit_interface\.php" "phase:2,id:92506,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/portal/policies-exec\.php" "phase:2,id:92507,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/php/successjunction\.php" "phase:2,id:92508,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/test/addquestion/" "phase:2,id:92509,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350149" + +SecRule REQUEST_FILENAME "/clientsdomainreg\.php" "phase:2,id:92510,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/profiles\.php" "phase:2,id:92511,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/configdomains\.php" "phase:2,id:92512,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/plugins/moxiemanager/api\.php" "phase:2,id:92513,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=340006" + +SecRule REQUEST_FILENAME "/orders/order_userorderform\.php" "phase:2,id:92514,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/shibboleth\.sso/slo/redirect" "phase:2,id:92515,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/moodle/mod/questionnaire/complete\.php" "phase:2,id:92516,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/structure/types/import" "phase:2,id:92517,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/wp-admin/async-upload\.php" "phase:2,id:92518,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340145" + +SecRule REQUEST_FILENAME "/admin/products/edit\.php" "phase:2,id:92519,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/linkit/autocomplete/" "phase:2,id:92520,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/sys_sbc/" "phase:2,id:92521,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/auroadmin/update-cms\.php" "phase:2,id:92522,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/manage/article/" "phase:2,id:92523,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/processing\.php" "phase:2,id:92524,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018" + +SecRule REQUEST_FILENAME "/server-side\.php" "phase:2,id:92525,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/members/access/admin-setup/" "phase:2,id:92526,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018" + +SecRule REQUEST_FILENAME "/panelediting\.php" "phase:2,id:92527,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/sliderdesign\.php" "phase:2,id:92528,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/smb/file-manager/code-editor" "phase:2,id:92529,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/cf-api/" "phase:2,id:92530,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/projects/savedraftproject/" "phase:2,id:92531,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340113" + +SecRule REQUEST_FILENAME "/scriptediting\.php" "phase:2,id:92532,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=340113,ctl:ruleRemovebyID=340157" + +SecRule REQUEST_FILENAME "/administration/" "phase:2,id:92533,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/update_row/" "phase:2,id:92534,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=30147,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/luxeadmin/index\.php" "phase:2,id:92535,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/wp-cron\.php" "phase:2,id:92536,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390616" + +SecRule REQUEST_FILENAME "/mip-send\.php" "phase:2,id:92537,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=350163" + +SecRule REQUEST_FILENAME "/mobilecart\.php" "phase:2,id:92538,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/cart" "phase:2,id:92539,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/cart\.php" "phase:2,id:92540,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390707" + +SecRule REQUEST_FILENAME "/wp-json/yoast/v1/prominent_words/" "phase:2,id:92541,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/create-project/article/" "phase:2,id:92542,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admincontrolpanel/user\.php" "phase:2,id:92543,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/entity_reference_autocomplete/" "phase:2,id:92544,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/assets" "phase:2,id:92545,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/pages/admintravels\.php" "phase:2,id:92546,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/pages/admintravels\.php" "phase:2,id:92547,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/index\.php/jtlconnector/" "phase:2,id:92548,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/v1/json/obmstore\.image\.delete/" "phase:2,id:92549,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/v1/json/obmstore" "phase:2,id:92550,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=380018" + +SecRule REQUEST_FILENAME "/v1/json/obmstore\.template\.convert" "phase:2,id:92551,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=380018" + +SecRule REQUEST_FILENAME "/obm/resources/javascript/emaileditor/index\.html" "phase:2,id:92552,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=380018" + +SecRule REQUEST_FILENAME "/amember/admin-users/autocomplete" "phase:2,id:92553,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/cgi-bin/ms000001\.pl" "phase:2,id:92554,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380019" + +SecRule REQUEST_FILENAME "/data/feed/rss\.php" "phase:2,id:92555,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/wp-content/uploads/galleries/" "phase:2,id:92556,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/img/homepage/" "phase:2,id:92557,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/services/bmreport\.json" "phase:2,id:92558,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/members/access/default/admin-payments/" "phase:2,id:92559,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/mailscript/emailc\.php" "phase:2,id:92560,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/blog_edit\.php" "phase:2,id:92561,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=340159" +SecAction "phase:2,id:92562,t:none,pass,nolog,skipAfter:END_RULES_92562" + +SecRule ARGS|XML:/*|!ARGS:/article/|!ARGS:/replaceAll/|!ARGS:areas|!ARGS:/^wpt_/|!ARGS:field_value_mapping|!ARGS:/post_code/|!ARGS:tHtml|!ARGS:/_dnn/|!ARGS:actionFilter|!ARGS:Error|!ARGS:code|!ARGS:thecode|!ARGS:param[DEFAULTVALUE]|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:templatecode|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:data|!ARGS:resolution|!ARGS:/prependTo/|!ARGS:/appendTo/|!ARGS:/prevObject/|!ARGS:/^Cms_Page/|!ARGS:json|!ARGS:/php/|!ARGS:wpSummary|!ARGS:/teaser/|!ARGS:fdata|!ARGS:file_content|!ARGS:/narrative/|!ARGS:data|!ARGS:/database/|!ARGS:/sql/|!ARGS:prefix|!ARGS:contenido|!ARGS:query|!ARGS:/descr/|!ARGS:/body/|!ARGS:/text/|!ARGS:/txt/|!ARGS:fck_tw_body|!ARGS:sub|!ARGS:msg_body|!ARGS:saved_data|!ARGS:fck_body|!ARGS:description|!ARGS:/message/|!ARGS:/content/|!ARGS:comment|!ARGS:p_action|!ARGS:/report/|!ARGS:/narrative/|!ARGS:/FCKeditor/ "(?:\w ?(?:user|and) {1,100}. char\([0-9]| \b(?:execute|convert)\(|; ?\bdelete\b.{1,100}?;(?:insert|declare ?\@|varchar) ?|and .{1,100} \( ?select .{1,100} from |\bdrop\b {1,100}. table |(?:declare|convert) .{1,100} varchar\(|null ?, ?(?:null ?, ?(?:null|accesslevel|user_name)) ?,|\bconcat\(|union select |union all select|\bcast\b .{1,50}\( as |xecresultset|' ?; ?declare\b @|; ?set @|select (?:load_file|char\()|(?:insert|remark)test ?;|\bcreate\b table [a-z0-9]+ \()" "phase:2,deny,log,auditlog,status:403,capture,id:344159,t:none,t:urlDecodeUni,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection (MM)',logdata:'%{TX.0}',multiMatch,tag:'SQLi'" + +SecMarker END_RULES_92562 + +SecRule REQUEST_FILENAME "/wp-admin/codisto/ebaytab/" "phase:2,id:92563,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/data" "phase:2,id:92564,t:none,t:lowercase,pass,nolog,noauditlog,skip:1,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" +SecAction "phase:2,id:92565,t:none,pass,nolog,skipAfter:END_RULES_92565" + +SecRule ARGS|ARGS_NAMES|!ARGS:/li_field/|!ARGS:/media/|!ARGS:/adsense/|!ARGS:rtel|!ARGS:/TextArea/|!ARGS:insp_code|!ARGS:/marketing_code/|!ARGS:addthis|!ARGS:/go_code/|!ARGS:/shortcode/|!ARGS:/analitics/|!ARGS:/area_id/|!ARGS:message|!ARGS:/theme/|!ARGS:/ga_code/|!ARGS:/analytic/|!ARGS:/_js_/|!ARGS:/schema/|!ARGS:/^ifeature/|!ARGS:/^redux/|!ARGS:/analyticscode/|!ARGS:/suffix/|!ARGS:/sadrzaj/|!ARGS:js_includes|!ARGS:/m1_source/|!ARGS:/geodir/|!ARGS:/banner_block/|!ARGS:/introcopy/|!ARGS:eingabe|!ARGS:ausgabe|!ARGS:/preview/|!ARGS:/tracking_extra/|!ARGS:/^groups/|!ARGS:video|!ARGS:/google_map/|!ARGS:/field_map/|!ARGS:/gacode/|!ARGS:code1|!ARGS:ga_code|!ARGS:customized|!ARGS:code_analytics|!ARGS:uvod|!ARGS:/^field_video/|!ARGS:q|!ARGS:/^textarea-video/|!ARGS:leirro|!ARGS:lomake|!ARGS:vastaus|!ARGS:/^texte$/|!ARGS:vraag|!ARGS:qti_data|!ARGS:tracklist|!ARGS:i_google|!ARGS:code_area_text|!ARGS:/log_code/|!ARGS:/^ADVERT_/|!ARGS:UserData|!ARGS:areas|!ARGS:templatecode|!ARGS:/prevObject/|!ARGS:/replaceAll/|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:/prependTo/|!ARGS:/appendTo/|!ARGS:/mapcode/|!ARGS:googleCode|!ARGS:/sidebar/|!ARGS:/ad_code/|!ARGS:/^recipient/|!ARGS:optional_head|!ARGS:/^form/|!ARGS:/^var_value/|!ARGS:variable_data|!ARGS:/^instance/|!ARGS:/customfield/|!ARGS:notice|!ARGS:/formcode/|!ARGS:/ajax/|!ARGS:all|!ARGS:allowedTags|!ARGS:/google_analytics/|!ARGS:/widget/|!ARGS:ad_code|!ARGS:/keycaptcha_code/|!ARGS:/jscode/|!ARGS:video1|!ARGS:/updateAds/|!ARGS:map|!ARGS:gmapcode|!ARGS:/^Sidebar/|!ARGS:/^wpTextbox/|!ARGS:paragrafo|!ARGS:/question/|!ARGS:/style/|!ARGS:tracking_code|!ARGS:whats-new|!ARGS:analyticscode|!ARGS:top_news|!ARGS:data[config]|!ARGS:fulltext|!ARGS:introtext|!ARGS:offertext|!ARGS:block|!ARGS:livezillacode|!ARGS:/embed/|!ARGS:/desc/|!ARGS:/script/|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/cms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:match_report|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:phpcode|!ARGS:intro|!ARGS:Snippet|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:input[Desarrollo]|!ARGS:move2|!ARGS:hoperation|!ARGS:login_form|!ARGS:/product_benefits/|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:bbcode_tpl|!ARGS:Right_photo_1|!ARGS:embedVideo|!ARGS:/^K2ExtraField/|!ARGS:mentorhelp|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/html/|!ARGS:/content/|!ARGS:/header/|!ARGS:/footer/|!ARGS:/link/|!ARGS:text|!ARGS:txt|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?script|(?:<|< ?/)(?:(?:java|vb)script|about|applet|activex|chrome)|< ?/?i?frame|\%env)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:replaceComments,t:compressWhitespace,t:lowercase,capture,id:391147,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule ARGS|REQUEST_HEADERS:X_FORWARDED_FOR|ARGS_NAMES|!ARGS:/li_field/|!ARGS:message|!ARGS:/media/|!ARGS:/adsense/|!ARGS:rtel|!ARGS:/TextArea/|!ARGS:/^dbem/!ARGS:insp_code|!ARGS:/marketing_code/|!ARGS:addthis|!ARGS:/option_tree/|!ARGS:/go_code/|!ARGS:/custom/|!ARGS:/shortcode/|!ARGS:/analitics/|!ARGS:/area_id/|!ARGS:/_head_/|!ARGS:/theme/|!ARGS:/ga_code/|!ARGS:/analytic/|!ARGS:/_js_/|!ARGS:/schema/|!ARGS:/^ifeature/|!ARGS:/^redux/|!ARGS:/analyticscode/|!ARGS:/suffix/|!ARGS:/sadrzaj/|!ARGS:js_includes|!ARGS:/m1_source/|!ARGS:/geodir/|!ARGS:/suffix/|!ARGS:/banner_block/|!ARGS:/introcopy/|!ARGS:ausgabe|!ARGS:eingabe|!ARGS:/preview/|!ARGS:/tracking_extra/|!ARGS:SAMLResponse|!ARGS:/^groups/|!ARGS:video|!ARGS:/google_map/|!ARGS:/gacode/|!ARGS:code1|!ARGS:sotenson|!ARGS:ga_code|!ARGS:customized|!ARGS:code_analytics|!ARGS:uvod|!ARGS:/^field_video/|!ARGS:q|!ARGS:/^textarea-video/|!ARGS:leirro|!ARGS:lomake|!ARGS:vastaus|!ARGS:vraag|!ARGS:qti_data|!ARGS:tracklist|!ARGS:i_google|!ARGS:code_area_text|!ARGS:/log_code/|!ARGS:/^ADVERT_/|!ARGS:UserData|!ARGS:areas|!ARGS:templatecode|!ARGS:/prevObject/|!ARGS:/replaceAll/|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:/prependTo/|!ARGS:/appendTo/|!ARGS:/mapcode/|!ARGS:googleCode|!ARGS:/^recipient/|!ARGS:optional_head|!ARGS:/^form/|!ARGS:/^var_value/|!ARGS:variable_data|!ARGS:/customfield/|!ARGS:val333|!ARGS:notice|!ARGS:/formcode/|!ARGS:/ajax/|!ARGS:all|!ARGS:allowedTags|!ARGS:/tracking/|!ARGS:/google_analytics/|!ARGS:/widget/|!ARGS:ad_code|!ARGS:/jscode/|!ARGS:/keycaptcha_code/|!ARGS:video1|!ARGS:/updateAds/|!ARGS:map|!ARGS:gmapcode|!ARGS:/^Sidebar/|!ARGS:/^wpTextbox/|!ARGS:paragrafo|!ARGS:/question/|!ARGS:/style/|!ARGS:sidebar|!ARGS:analyticscode|!ARGS:top_news|!ARGS:tracking_code|!ARGS:data[config]|!ARGS:fulltext|!ARGS:introtext|!ARGS:offertext|!ARGS:block|!ARGS:livezillacode|!ARGS:whats-new|!ARGS:/embed/|!ARGS:/desc/|!ARGS:/sidebar/|!ARGS:/ad_code/|!ARGS:/footer/|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/wyscms/|!ARGS:/script/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:/^field_/|!ARGS:match_report|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:/^instance/|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:eip_value|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:move2|!ARGS:input[Desarrollo]|!ARGS:hoperation|!ARGS:arg2|!ARGS:login_form|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:/submitcode/|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?script|< ?(?:i?frame ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(ht|f)tps?)\:/|document\.write ?\(|(?:<|< ?/) ?(?:(?:java|vb)script|applet|activex|chrome)|< ?/?i?frame|\% ?env)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:removeNulls,t:utf8tounicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhiteSpace,t:lowercase,multiMatch,id:391148,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" + +SecMarker END_RULES_92565 + +SecRule REQUEST_FILENAME "/storefiles" "phase:2,id:92566,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/amember/default/admin-payments/p/invoices" "phase:2,id:92567,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/v1a/json/obmstore\.image\.delete" "phase:2,id:92568,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/modules/gateways/callback/paypalpaymentsproref\.php" "phase:2,id:92569,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/eafservice/jsp/v1/term" "phase:2,id:92570,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/s/ajax\.php" "phase:2,id:92571,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/ladm" "phase:2,id:92572,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/cgi-bin/jrental/scripts/command\.cgi" "phase:2,id:92573,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/v1b/json/obmstore\.template\.save/" "phase:2,id:92574,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=390614" + +SecRule REQUEST_FILENAME "/admin/lang_edit\.php" "phase:2,id:92575,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/amember/admin-setup" "phase:2,id:92576,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/1823/natives" "phase:2,id:92577,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/lists/admin" "phase:2,id:92578,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/memberadmin/prefs_email\.php" "phase:2,id:92579,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-admin/edit\.php" "phase:2,id:92580,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147" + +SecRule REQUEST_FILENAME "/services/bmcontent\.json" "phase:2,id:92581,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/remote\.php/dav/" "phase:2,id:92582,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=392301" + +SecRule REQUEST_FILENAME "/s/projects/save" "phase:2,id:92583,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/entries/about/98-about" "phase:2,id:92584,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/s/projects/save/2" "phase:2,id:92585,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/static_text/6" "phase:2,id:92586,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin/entries/studies" "phase:2,id:92587,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/wp-json/baa/v2/register-broken-link" "phase:2,id:92588,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/cms/wp-admin/admin-ajax\.php" "phase:2,id:92589,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340748" + +SecRule REQUEST_FILENAME "/cms/wp-admin/post\.php" "phase:2,id:92590,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007" + +SecRule REQUEST_FILENAME "/wp-json/op3" "phase:2,id:92591,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/pages/edit/editform" "phase:2,id:92592,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/amember/admin-users" "phase:2,id:92593,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/amember/admin-trans-global" "phase:2,id:92594,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/v1b/json/fr\.image\.delete/" "phase:2,id:92595,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/wp-admin/edit-tags\.php" "phase:2,id:92596,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/json/fr\.device\.preview/" "phase:2,id:92597,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/lms/test/addquestion" "phase:2,id:92598,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/lms/test/editquestion" "phase:2,id:92599,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/lms/test/edittest" "phase:2,id:92600,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/lms/test/create" "phase:2,id:92601,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/lms/test/addtest" "phase:2,id:92602,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/s/news/save" "phase:2,id:92603,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=341256" + +SecRule REQUEST_FILENAME "/en/employer_signup\.php" "phase:2,id:92604,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/entity_reference_autocomplete/node/" "phase:2,id:92605,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/autobrite-magifoam" "phase:2,id:92606,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/wp-json/redirection/v1/redirect/post" "phase:2,id:92607,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/autodiscover/autodiscover\.xml" "phase:2,id:92608,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340007,ctl:ruleRemovebyID=390616" + +SecRule REQUEST_FILENAME "/admin/index\.php" "phase:2,id:92609,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/admin/food-menus/" "phase:2,id:92610,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/entries/events/" "phase:2,id:92611,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/_fragment" "phase:2,id:92612,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/secutran" "phase:2,id:92613,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340095" + +SecRule REQUEST_FILENAME "/quickbooks/mirror\.php" "phase:2,id:92614,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340017,ctl:ruleRemovebyID=340144,ctl:ruleRemovebyID=340145,ctl:ruleRemovebyID=331025,ctl:ruleRemovebyID=331026,ctl:ruleRemovebyID=331027,ctl:ruleRemovebyID=331028,ctl:ruleRemovebyID=340146,ctl:ruleRemovebyID=340155,ctl:ruleRemovebyID=344367,ctl:ruleRemovebyID=340156,ctl:ruleRemovebyID=340157,ctl:ruleRemovebyID=340159,ctl:ruleRemovebyID=340160,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340164,ctl:ruleRemovebyID=340165,ctl:ruleRemovebyID=380019,ctl:ruleRemovebyID=380020,ctl:ruleRemovebyID=380022,ctl:ruleRemovebyID=380121,ctl:ruleRemovebyID=380122,ctl:ruleRemovebyID=380023,ctl:ruleRemovebyID=380024,ctl:ruleRemovebyID=380025,ctl:ruleRemovebyID=381025,ctl:ruleRemovebyID=380126,ctl:ruleRemovebyID=390572,ctl:ruleRemovebyID=390711" + +SecRule REQUEST_FILENAME "/v1c/json/" "phase:2,id:92615,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/json/fr\.template\.save" "phase:2,id:92616,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/json/en\.template\.save" "phase:2,id:92617,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/json/fr\.template\.convert" "phase:2,id:92618,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/json/en\.template\.convert" "phase:2,id:92619,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/json/fr\.image\.delete/" "phase:2,id:92620,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/json/fr\.image\.save/" "phase:2,id:92621,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/json/en\.image\.delete/" "phase:2,id:92622,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/json/en\.image\.save/" "phase:2,id:92623,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/vip/bonus\.php" "phase:2,id:92624,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/cvs3/" "phase:2,id:92625,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390616" + +SecRule REQUEST_FILENAME "/php/upd\.php" "phase:2,id:92626,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/core/admin/auth\.php" "phase:2,id:92627,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/backoffice/index\.php" "phase:2,id:92628,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/vd/async/detailpost\.php" "phase:2,id:92629,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/processing_contact_fr\.php" "phase:2,id:92630,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/processing_contact_en\.php" "phase:2,id:92631,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/cbc_portal_api_dev/services/" "phase:2,id:92632,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/computer\.form\.php" "phase:2,id:92633,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/admin_cf/modif_news\.php" "phase:2,id:92634,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/ecrire/" "phase:2,id:92635,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/dolibarr/compta/" "phase:2,id:92636,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/admin_lecon_eds\.php" "phase:2,id:92637,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/cshop/add_cart_confirm" "phase:2,id:92638,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/maintenance/modules-site/menus-pages/mod-content-page\.php" "phase:2,id:92639,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/project\.form\.php" "phase:2,id:92640,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/api/statiqueweb/" "phase:2,id:92641,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/news/admin/modifier-actualite\.html" "phase:2,id:92642,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/admin/contenu/modif_contenu3\.asp" "phase:2,id:92643,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/fr/admin/contenu/modif_contenu3\.asp" "phase:2,id:92644,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/en/admin/contenu/modif_contenu3\.asp" "phase:2,id:92645,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/data/docdata\.php" "phase:2,id:92646,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/compta/facture/card\.php" "phase:2,id:92647,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/admin/contenu/modif_contenu3\.asp" "phase:2,id:92648,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/promotion/actualites/actualites-ajouter/" "phase:2,id:92649,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/utils/operations\.php" "phase:2,id:92650,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/rest/merchant/storefront/" "phase:2,id:92651,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390616" + +SecRule REQUEST_FILENAME "/cbc_portal_api_dev/services/returnmanagement/datafile/" "phase:2,id:92652,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/goggle-ads-auth/auth\.php" "phase:2,id:92653,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/front/softwarelicense\.form\.php" "phase:2,id:92654,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/front/user\.form\.php" "phase:2,id:92655,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/front/monitor\.form\.php" "phase:2,id:92656,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/ecrire/" "phase:2,id:92657,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/newsentry/newsitemcreate" "phase:2,id:92658,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/secure_access/catalog/product/validate/" "phase:2,id:92659,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162" + +SecRule REQUEST_FILENAME "/wp-json/script-manager/v1/scripts" "phase:2,id:92660,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/kel4dm1n/edit_orders_ajax\.php" "phase:2,id:92661,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/ajax-call" "phase:2,id:92662,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-json/wp/v2/media" "phase:2,id:92663,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/module/personnalisation/product" "phase:2,id:92664,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/theme/design_config/save/back/edit" "phase:2,id:92665,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/applicationerror\.aspx" "phase:2,id:92666,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340009" + +SecRule REQUEST_FILENAME "/admin/app/customer/" "phase:2,id:92667,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340130,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=340149" + +SecRule REQUEST_FILENAME "/admin/content/instituts/" "phase:2,id:92668,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/auth/module\.php" "phase:2,id:92669,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/auth/module\.php/saml/sp/saml2-logout\.php/default-sp" "phase:2,id:92670,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/auth/module\.php/saml/sp/saml2-logout\.php" "phase:2,id:92671,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/magic/kel4dm1n/categories\.php" "phase:2,id:92672,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340156" + +SecRule REQUEST_FILENAME "/portal_api/services/returnmanagement/datafile/amenddatafile" "phase:2,id:92673,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/v2b/json/" "phase:2,id:92674,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/cbc_portal_api_dev/services/returnmanagement/datafile/amenddatafile" "phase:2,id:92675,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/scp/plugins\.php" "phase:2,id:92676,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/scp/ajax\.php" "phase:2,id:92677,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/wp-json/wp-statistics/v2" "phase:2,id:92678,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/cbc_portal_api_dev/" "phase:2,id:92679,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wc-api/wc_bookings_google_calendar_wooconnect/" "phase:2,id:92680,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/signinresult\.php" "phase:2,id:92681,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340148,ctl:ruleRemovebyID=333140,ctl:ruleRemovebyID=340147" + +SecRule REQUEST_FILENAME "/wp-load\.php" "phase:2,id:92682,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390715" + +SecRule REQUEST_FILENAME "/wp-load\.php" "phase:2,id:92683,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390715" + +SecRule REQUEST_FILENAME "/executehtml\.php" "phase:2,id:92684,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/admin/listings\.php" "phase:2,id:92685,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340163" + +SecRule REQUEST_FILENAME "/ajax/send_email_or_sms\.php" "phase:2,id:92686,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=342259" + +SecRule REQUEST_FILENAME "/wp-json/wp/v2/" "phase:2,id:92687,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/admin/orders\.php" "phase:2,id:92688,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=333141,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/content/postsave" "phase:2,id:92689,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=333141" + +SecRule REQUEST_FILENAME "/wp-json/wp/v2/posts/" "phase:2,id:92690,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333141" + +SecRule REQUEST_FILENAME "/admin/rsvp_edit\.php" "phase:2,id:92691,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/wp-json/contact-form-7/" "phase:2,id:92692,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340163,ctl:ruleRemovebyID=340162" + +SecRule REQUEST_FILENAME "/v2b/json/fr\.html\.text/" "phase:2,id:92693,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340149,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/block/add/code_block" "phase:2,id:92694,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655" + +SecRule REQUEST_FILENAME "/v2c/json/fr\.device\.preview/" "phase:2,id:92695,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655" + +SecRule REQUEST_FILENAME "/pests/edit/" "phase:2,id:92696,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/admin/app/customer/32/edit?uniqid=s64ef8923c69f3" "phase:2,id:92697,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655" + +SecRule REQUEST_FILENAME "/wp-admin/options\.php" "phase:2,id:92698,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/v2a/json/" "phase:2,id:92699,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371" + +SecRule REQUEST_FILENAME "/v2a/json/" "phase:2,id:92700,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371" + +SecRule REQUEST_FILENAME "/wp-json/" "phase:2,id:92701,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=340130" + +SecRule REQUEST_FILENAME "/admin/app/customer/" "phase:2,id:92702,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371" + +SecRule REQUEST_FILENAME "/admin/ebook/" "phase:2,id:92703,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371" + +SecRule REQUEST_FILENAME "/api/redbox/" "phase:2,id:92704,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371" + +SecRule REQUEST_FILENAME "/ajax/update-form" "phase:2,id:92705,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344371,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/contao/picker" "phase:2,id:92706,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340130" + +SecRule REQUEST_FILENAME "/amember/admin-products" "phase:2,id:92707,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333141" + +SecRule REQUEST_FILENAME "/doku\.php" "phase:2,id:92708,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340130" + +SecRule REQUEST_FILENAME "/editor/filter_xss/" "phase:2,id:92709,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=340147,ctl:ruleRemovebyID=340148" + +SecRule REQUEST_FILENAME "/admin/app/media/" "phase:2,id:92710,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/modules/accordion/save_question\.php" "phase:2,id:92711,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655" + +SecRule REQUEST_FILENAME "/adm_program/modules/announcements/announcements_function\.php" "phase:2,id:92712,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655" + +SecRule REQUEST_FILENAME "/configgeneral\.php" "phase:2,id:92713,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=342259" + +SecRule REQUEST_FILENAME "/apps/weditorwd8/index\.php" "phase:2,id:92714,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333141" + +SecRule REQUEST_FILENAME "/editcontent" "phase:2,id:92715,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340147" + +SecRule REQUEST_FILENAME "/form/save" "phase:2,id:92716,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/westerbus" "phase:2,id:92717,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655" + +SecRule REQUEST_FILENAME "/client/applications" "phase:2,id:92718,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/moodle/mod/quiz/autosave\.ajax\.php" "phase:2,id:92719,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/backend/livingtech/water/readings/update/1567" "phase:2,id:92720,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655" + +SecRule REQUEST_FILENAME "/wp-json/contact-form-7/v1/contact-forms/947" "phase:2,id:92721,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=342259" + +SecRule REQUEST_FILENAME "/wp-admin/edit\.php" "phase:2,id:92722,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340130" + +SecRule REQUEST_FILENAME "/backend/" "phase:2,id:92723,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655" + +SecRule REQUEST_FILENAME "/backend/" "phase:2,id:92724,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=393655" + +SecRule REQUEST_FILENAME "/kontakt/" "phase:2,id:92725,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=342259" + +SecRule REQUEST_FILENAME "/plugins/servlet/gadgets" "phase:2,id:92726,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "/panel/x3_settings\.php" "phase:2,id:92727,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=342259,ctl:ruleRemovebyID=340130" + +SecRule REQUEST_FILENAME "/portal_api/services/returnmanagement/datafile" "phase:2,id:92728,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=344367" + +SecRule REQUEST_FILENAME "/toolbox_nb/" "phase:2,id:92729,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340121,ctl:ruleRemovebyID=340152,ctl:ruleRemovebyID=380018,ctl:ruleRemovebyID=380026,ctl:ruleRemovebyID=393655,ctl:ruleRemovebyID=333141" + +SecRule REQUEST_FILENAME "/g/collect" "phase:2,id:92730,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340162,ctl:ruleRemovebyID=340165" + +SecRule REQUEST_FILENAME "/inside/" "phase:2,id:92731,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147" + +SecRule REQUEST_FILENAME "/toolbox_nb/" "phase:2,id:92732,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340121,ctl:ruleRemovebyID=333141" + +SecRule REQUEST_FILENAME "/tml_downloader/" "phase:2,id:92733,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=333141" + +SecRule REQUEST_FILENAME "list_bulk\.aspx" "phase:2,id:92734,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340029" + +SecRule REQUEST_FILENAME "open\.php" "phase:2,id:92735,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=350147,ctl:ruleRemovebyID=350148" + +SecRule REQUEST_FILENAME "/toolbox_nb/" "phase:2,id:92736,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=390704,ctl:ruleRemovebyID=340016,ctl:ruleRemovebyID=340122,ctl:ruleRemovebyID=342259" + +SecRule REQUEST_FILENAME "^/contao" "phase:2,id:92737,t:none,t:lowercase,pass,nolog,noauditlog,ctl:ruleRemovebyID=340130" + +# http://www.atomicorp.com/ +# Atomicorp (Gotroot.com) ModSecurity rules +# Application Security Rules for modsec 2.x +# +# Copyright 2005-2023 by Atomicorp, Inc. all rights reserved. +# Redistribution is strictly prohibited in any form, including whole or in part. +# +# Distribution of this work or derivative of this work in any form is +# prohibited unless prior written permission is obtained from the +# copyright holder. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF +# THE POSSIBILITY OF SUCH DAMAGE. +# +#---ASL-CONFIG-FILE--- +# + +# Do not edit this file! +# This file is generated and changes will be overwritten. +# +# If you need to make changes to the rules, please follow the procedure here: +# http://www.atomicorp.com/wiki/index.php/Mod_security +#SecAction "phase:1,t:none,pass,nolog,noauditlog,initcol:global=global,initcol:ip=%{remote_addr}" +# + + + + +#Block compressed encoding +SecRule REQUEST_HEADERS:Content-Encoding "^Identity$" "capture,log,auditlog,phase:1,t:none,deny,status:501,msg:'Atomicorp.com WAF Rules: ModSecurity does not support content encodings and can not detect attacks using it, therefore it must be blocked.',id:'340362',rev:3,severity:'3',logdata:'%{TX.0}'" + +# Indicators list +SecRemoteRulesFailAction Warn +SecRemoteRules cH3qcelhFi https://updates.atomicorp.com/channels/rules/installers/indicators.conf + +#check methods +SecRule REQUEST_METHOD "@pm TRACE TRACK CONNECT" "phase:1,id:'333793',t:none,pass,nolog,noauditlog,skip:1" +SecAction "phase:1,id:334358,t:none,pass,nolog,noauditlog,skipAfter:END_METHOD_CHECKS" + +# Rule 340002: deny TRACE method +SecRule REQUEST_METHOD "@pm TRACE TRACK" "phase:1,deny,log,auditlog,status:403,t:none,id:340002,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: TRACE/TRACK method denied'" + +# Rule 340361: deny CONNECT method +SecRule REQUEST_METHOD "CONNECT" "deny,status:403,log,auditlog,t:none,capture,phase:1,id:340361,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: CONNECT method denied',logdata:'%{TX.0}'" + +SecMarker END_METHOD_CHECKS + +#protocol violation +SecRule REQUEST_METHOD "POST" "deny,status:403,log,auditlog,t:none,chain,rev:4,id:'390616',phase:2,msg:'Atomicorp.com WAF Rules: POST request must have a Content-Length header',severity:'4'" +SecRule &REQUEST_HEADERS:Content-Length "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:Transfer-Encoding "@eq 0" "t:none" + +# Check for the expect header w/ HTTP/1.1 protocol +# +SecRule REQUEST_HEADERS:Expect "100-continue" "deny,status:403,t:none,chain,phase:2,log,auditlog,msg:'Atomicorp.com WAF Rules: Expect Header Not Allowed for HTTP 1.0. This is an HTTP 1.1 feature.',severity:'5',id:'390706',rev:1" +SecRule REQUEST_PROTOCOL "@streq HTTP/1.0" + +# Rule 340012: +#Proxy Protection with our added MATCHED_VAR enhancement +SecRule REQUEST_URI_RAW "^\w+:/" "chain,phase:2,t:none,t:lowercase,capture,deny,log,auditlog,msg:'Atomicorp.com WAF Rules: Unauthorized Proxy access attempt',severity:'2',id:'340012',rev:3,logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!@rx ://%{SERVER_NAME}/" + +#Apache Range DOS attack protection rules +SecRule REQUEST_HEADERS:Range "(\d+)\-(\d+)\," "chain,capture,phase:2,rev:2,log,auditlog,t:none,deny,status:403,msg:'Atomicorp.com WAF Rules: Range: Invalid Last Byte Value. This may be a DOS attack',logdata:'%{matched_var}',severity:'5',id:'353012'" + SecRule TX:2 "!@ge %{tx.1}" + +SecRule REQUEST_FILENAME "\.pdf$" "phase:2,id:334359,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_RANGE_DOS" +SecRule REQUEST_HEADERS:Range "^bytes=(\d+)?\-(\d+)?\,(\d+)?\-(\d+)?\,(\d+)?\-(\d+)?\,(\d+)?\-(\d+)?\,(\d+)?\-(\d+)?\,(\d+)?\-(\d+)?\,(\d+)?\-(\d+)?\,(\d+)?\-(\d+)?\," "phase:2,log,auditlog,capture,rev:2,t:none,t:lowercase,deny,msg:'Atomicorp.com WAF Rules: Range: Too many fields, this may be a DOS attack',logdata:'%{matched_var}',severity:'5',id:'353013'" +SecMarker END_RANGE_DOS + + +#Webdav doesnt always include Content-Length +SecRule REQUEST_METHOD "^(?:CHECKOUT|PUT)" "phase:1,id:364359,pass,t:none,nolog,noauditlog,skipAfter:END_TYPE_CHECK_1" + +SecRule REMOTE_ADDR "@ipMatch 127.0.0.1,::1" "phase:1,id:364459,pass,t:none,nolog,noauditlog,skipAfter:END_TYPE_CHECK_1" + +#Request Body must define Content-Type per RFC, so application knows how to parse +#Prevents impedence mismatch attacks +SecRule &REQUEST_HEADERS:Content-Type "@eq 0" "log,auditlog,chain,phase:2,rev:8,t:none,deny,log,status:403,msg:'Atomicorp.com WAF Rules: Request Containing Content, but Missing Content-Type header',id:'392301',severity:'5',tag:'no_ar'" + SecRule REQUEST_HEADERS:Content-Length "!^0$" "t:none" + +SecMarker END_TYPE_CHECK_1 + +# This one has limited utility as a fixed rule, this probably needs to be generated by the customer +# Restrict the maximum number of arguments in a request +SecRule &ARGS "@gt 4096" "chain,phase:2,t:none,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: Too many arguments in request (max set to 4096, increase as necessary for your system)',id:'390707',severity:'4',rev:'9'" +SecRule REQUEST_URI "!((?:^/(?:imaclean|massdelete)/)|^/cgi-bin/dada/mail\.cgi$|^/index\.php/mageworx/customoptions_options|^/za/|^/back-?office/|^/moderate\.php|^/backend/configdomains\.php|\.do$|^/admin[a-z0-9]+?/index\.php\?controller=adminmodules)" "t:none,t:lowercase" + +SecRule &REQUEST_COOKIES_NAMES "@gt 1000" "phase:2,t:none,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: Too many cookies in request (max set to 1000, increase as necessary for your system)',id:'330707',severity:'4',rev:2" + +SecRule REQUEST_URI "set-cookie" "phase:2,t:none,t:urlDecodeUni,t:lowercase,log,auditlog,deny,status:403,msg:'Atomicorp.com WAF Rules: Possible CSRF attack',id:'330708',severity:'4',rev:2" + +# +#Blocks certain types of obfuscation attacks on WAF +SecRule ARGS_NAMES "@validateByteRange 1-255" "deny,log,auditlog,status:403,phase:2,msg:'Atomicorp.com WAF Rules: Null Byte Attack Blocked (Null byte character in Argument Name)',rev:23,id:'390626',severity:'1'" + +Secrule REQUEST_FILENAME "(?:/ajax-tab\.php|^/eprocservice/supplierinboundservice)" "phase:2,id:344358,t:none,t:lowercase,pass,nolog,noauditlog,skipAfter:END_CHAR_CHECK" + +SecRule ARGS|ARGS_NAMES|!ARGS:/msg/|!ARGS:message|!ARGS:templatecode|!ARGS:/bps_customcode/|!ARGS:areas|!ARGS:/illegalusernames/|!ARGS:/pw/|!ARGS:/^jform/|!ARGS:/image/|!ARGS:resolution|!ARGS:post|!ARGS:depth|!ARGS:email|!ARGS:/comment/|!ARGS:mailbox|!ARGS:/description/|!ARGS:/txt/|!ARGS:/text/|!ARGS:body|!ARGS:/message/|!ARGS:/content/|!ARGS:/password/|!ARGS:FoxyData|!ARGS:sent_mail_folder "@validateByteRange 1-255" "pass,nolog,noauditlog,phase:2,rev:24,id:390617,t:none,t:urlDecodeUni,setvar:tx.invalidarg=1,setvar:tx.invalidarg2=%{matched_var_name}'" + +#Is this a known spammer? +SecRule TX:INVALIDARG "@eq 1" "chain,t:none,log,auditlog,deny,status:403,phase:2,msg:'Atomicorp.com WAF Rules: Spammer attempting to defeat recapatcha',rev:1,id:'395614',severity:'2'" +SecRule TX:INVALIDARG2 "ARGS:recaptcha_response_field" + +SecRule TX:INVALIDARG "@eq 1" "chain,deny,log,auditlog,status:403,phase:2,msg:'Atomicorp.com WAF Rules: Null Byte Attack Blocked (Invalid character in ARGS)',rev:23,id:'390614',severity:'2'" +SecRule TX:INVALIDARG2 "!@rx recaptcha_response_field" + +SecMarker END_CHAR_CHECK + +#block nulls and invalid characters +SecRule REQUEST_URI|REQUEST_HEADERS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|!ARGS:templateCode|!ARGS:areas|!ARGS:/password/|!ARGS:FoxyData|!ARGS:sent_mail_folder "@validateByteRange 1-255" "deny,log,auditlog,status:403,phase:2,msg:'Atomicorp.com WAF Rules: Null Byte Attack Blocked (Invalid character in request or headers)',rev:10,id:'390613',severity:'2',t:none,t:urlDecodeUni" + +#Check for digits in content length header +SecRule REQUEST_HEADERS:Content-Length "!^\d+$" "deny,log,auditlog,status:403,capture,phase:2,t:none,msg:'Atomicorp.com WAF Rules: Content-Length HTTP header is not numeric', severity:'2',rev:1,id:'390618',logdata:'%{TX.0}'" + + +#Response splitting attacks +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|REQUEST_URI "(?:\bhttp\/(?:0\.9|1\.[01])|< ?(?:html|meta)\b)" "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:400,msg:'Atomicorp.com WAF Rules: Attack Blocked - HTTP Response Splitting Attack',id:'390712',logdata:'%{TX.0}',severity:'1',rev:5" + +#SecMarker END_SPLIT_CHECKS + +###############FILE PROTECTION RULES#################### +# +Secrule REQUEST_URI "^/eprocservice/supplierinboundservice" "phase:2,id:344359,t:none,t:lowercase,pass,nolog,noauditlog,skipAfter:END_FILE_PROTECTION_2" + +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|!ARGS:templatecode|!ARGS:area|!ARGS:php|!ARGS:/form_data/|!ARGS:/post/|!ARGS:/comment/|!ARGS:/desc/|!ARGS:/htaccess/|!ARGS:/subject/|!ARGS:/keywords/|!ARGS:/note/|!ARGS:/title/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/body/|!ARGS:/message/|!ARGS:data|!ARGS:/content/|!ARGS:/resolution/|!ARGS:/wp_autosave/ "@pmFromFile os_files.txt" "id:344360,rev:5,severity:2,phase:2,deny,status:403,capture,t:none,t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase,msg:'Atomicorp.com WAF Rules: Unauthorized Operating System File Access Attempt',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',tag:'attack-lfi',log,auditlog" + +SecRule REQUEST_URI_RAW|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|REQUEST_FILENAME|!ARGS:templatecode|!ARGS:area|!ARGS:php|!ARGS:/form_data/ "@pm ../ ... ..\ /etc /proc /var/tmp /usr /opt /sbin /bin /dev /tmp /kern /root /boot /sys /windows /winnt inetpub localstart.asp boot.ini ~root ~ftp ~bin ~nobody ~named ~guest ~logs ~sshd ~admin ~mysql ~postgres ~oracle //////// env win.ini" "id:334399,rev:2,phase:2,t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,t:cmdLine,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334361,t:none,pass,nolog,noauditlog,skipAfter:END_FILE_PROTECTION_1" + +#Legacy web servers or misconfigured webservers +SecRule REQUEST_URI "/etc/passwd" "phase:1,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:cmdline,id:347009,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Protected File access denied'" + +#Invalid recursion +#.../... +SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES|XML:/* "\.\.\.%2F\.\.\.%2F" "deny,log,auditlog,status:403,t:none,capture,id:347017,phase:2,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Invalid Generic Path Recursion denied in URI/ARGS',logdata:'%{TX.0},%{matched_var_name}'" + +SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES|XML:/* "\.\.\./\.\.\." "deny,log,auditlog,status:403,t:none,t:utf8toUnicode,t:urlDecodeUni,capture,id:347016,phase:2,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Invalid Generic Path Recursion denied in URI/ARGS',logdata:'%{TX.0},%{matched_var_name}'" + +#potentially malicious recursion +#../../../../.. +SecRule REQUEST_URI|REQUEST_FILENAME|ARGS|!ARGS:/text/|!ARGS:/txt/|!ARGS:/body/|!ARGS:/message/|!ARGS:data|!ARGS:/content/|!ARGS:/resolution/|!ARGS:/post/|!ARGS:/comment/|!ARGS:/desc/|!ARGS:/subject/|!ARGS:/content/|!ARGS:/keywords/|!ARGS:/note/|!ARGS:/title/ "/?\.?\./\.\./\.\./\.\./\.\." "phase:2,deny,log,auditlog,status:403,chain,t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,t:cmdline,id:347008,rev:16,severity:2,msg:'Atomicorp.com WAF Rules: Suspicious deep path recursion denied'" +SecRule REQUEST_URI "!(?:/site-builder/|/node/(?:[0-9]+/(?:edit|add)|add/))" "t:none,t:lowercase" + +SecRule REQUEST_URI_RAW|REQUEST_FILENAME|ARGS|!ARGS:/text/|!ARGS:/txt/|!ARGS:/body/|!ARGS:/message/|!ARGS:data|!ARGS:/content/|!ARGS:/resolution/|!ARGS:/post/|!ARGS:/comment/|!ARGS:/desc/|!ARGS:/subject/|!ARGS:/content/|!ARGS:/keywords/|!ARGS:/note/|!ARGS:/title/ "\.\.\\\.\.\\\.\." "phase:1,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,id:347019,rev:15,severity:2,msg:'Atomicorp.com WAF Rules: Suspicious path recursion denied'" + +#potentially malicious recursion +#../../../../.. +SecRule REQUEST_URI_RAW|REQUEST_FILENAME|ARGS|!ARGS:/text/|!ARGS:/txt/|!ARGS:/body/|!ARGS:/message/|!ARGS:data|!ARGS:/content/|!ARGS:/resolution/|!ARGS:/post/|!ARGS:/comment/|!ARGS:/desc/|!ARGS:/subject/|!ARGS:/content/|!ARGS:/keywords/|!ARGS:/note/|!ARGS:/title/ "/?\.?\./\.\./\.\./\.\./\.\." "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:cmdline,id:347028,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Suspicious deep path recursion denied (base64 encoded)'" +SecRule REQUEST_URI "!(?:/site-builder/|/node/(?:[0-9]+/(?:edit|add)|add/))" "t:none,t:lowercase" + + +SecRule REQUEST_URI "(^/node/(?:[0-9]+/(?:edit|add)|add)/)" "t:none,t:lowercase,phase:2,id:323714,pass,nolog,noauditlog,skipAfter:END_RULE_340008" +# Rule 340008: generic bogus path sigs +SecRule REQUEST_URI|REQUEST_FILENAME|REQUEST_HEADERS|ARGS|!ARGS:myDevEditControl_html|!ARGS:/^currentValue/|!ARGS:/message/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/summary/|!ARGS:resolution|!ARGS:prefix|!ARGS:/post/|!ARGS:/comment/|!ARGS:/description/|!ARGS:/subject/|!ARGS:/content/|!ARGS:/keywords/|!ARGS:/note/|!ARGS:/title/|!ARGS:/msg/|!ARGS:suffix "/\.{3,}/" "capture,phase:2,log,auditlog,deny,status:403,t:none,t:urlDecodeUni,t:removenulls,t:cmdline,multimatch,id:340008,rev:9,severity:2,msg:'Atomicorp.com WAF Rules: Bogus Path denied',logdata:'%{TX.0},%{matched_var_name}'" + +# Rule 340008: generic bogus path sigs +SecRule REQUEST_URI|REQUEST_FILENAME|REQUEST_HEADERS|ARGS|!ARGS:myDevEditControl_html|!ARGS:/^currentValue/|!ARGS:/message/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/summary/|!ARGS:resolution|!ARGS:prefix|!ARGS:/post/|!ARGS:/comment/|!ARGS:/description/|!ARGS:/subject/|!ARGS:/content/|!ARGS:/keywords/|!ARGS:/note/|!ARGS:/title/|!ARGS:/msg/|!ARGS:suffix "/\.{3,}/" "capture,phase:2,log,auditlog,deny,status:403,t:none,t:urlDecodeUni,t:removenulls,t:cmdline,id:340218,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Bogus Path denied (base64 encoded)',logdata:'%{TX.0},%{matched_var_name}'" + +SecMarker END_RULE_340008 + +# Rule 340142: Special account protection +SecRule REQUEST_URI "~(?:root|ftp|bin|admin|nobody|shutdown|named|guest|logs|sshd|mysql|postgres|oracle|tortix|atomic|httpd?)/" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:cmdLine,t:replaceNulls,t:normalisePath,id:340142,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Special account protection'" + +SecRule SERVER_PORT "^(?:30000|8443)$" "phase:2,id:323712,pass,t:none,nolog,noauditlog,skipAfter:END_ASL_3" + +SecRule REQUEST_URI "(?:|^/cpsess[0-9]+/scripts2?/|alt_mod_frameset.php|checkout_shipping.php|^/components/com_zoom/etc/|/admin\.swf\?nick=|/editor/filemanager/browser/default/browser\.html\?(type=image&)?Connector=\.\./\.\./connectors|/phpthumb\.php\?((?:w|h)=[0-9]+&)?((?:w|h)=[0-9]+&)?src=\.\./\.\./(?:uploads|images)|^/etc/[a-z0-9-_]+\.(css|html?|jpe?g|gif|png|te?xt)$|^/\?cx=|^/wizard/edit/html$|/mancgi/cronrun\?command|^/index\.php\?module=asl&event=|^/site/index\.php\?do=/admincp/setting/edit/|^/plesk/server/migration/|^/smb/web/)" "t:none,t:lowercase,phase:2,id:323716,pass,nolog,noauditlog,skipAfter:END_RULE_340009" +# Rule 340009: generic recursion signatures +SecRule REQUEST_URI|REQUEST_HEADERS|!REQUEST_HEADERS:X-PageView|!REQUEST_HEADERS:Cookie|!REQUEST_HEADERS:REFERER|ARGS|!ARGS:dictionaryPath|!ARGS:shell|!ARGS:/zip_path/|!ARGS:server_path|!ARGS:php|!ARGS:/^civicrm/|!ARGS:/imagemagick/|!ARGS:/^gvid_/|!ARGS:/app_path/|!ARGS:/script/|!ARGS:/bin_path/|!ARGS:/ffmpeg_path/|!ARGS:/exiftool_path/|!ARGS:/antiword/|!ARGS:/pdftotext/|!ARGS:/^SystemProperties/|!ARGS:/bin_path/|!ARGS:/IMConfig/|!ARGS:imagemagick_path|!ARGS:/referer/|!ARGS:/referrer/|!ARGS:response|!ARGS:data|!ARGS:cte_cmd|!ARGS:/setting/|!ARGS:MailPath|!ARGS:file_temporary_path|!ARGS:/workingDir/|!ARGS:containers.env.value|!ARGS:jpg_path|!ARGS:/^groups/|!ARGS:editor|!ARGS:article|!ARGS:/shell/|!ARGS:/content/|!ARGS:/tx_extensionmanager/|!ARGS:/aspell/|!ARGS:title|!ARGS:/sidebar/|!ARGS:/^p_process/|!ARGS:prefix|!ARGS:suffix|!ARGS:resolution|!ARGS:/^w2Pcfg/|!ARGS:returnto|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:name|!ARGS:/redirect/|!ARGS:/path_to_file_cmd/|!ARGS:timezone|!ARGS:ZM_EXTRA_DEBUG_LOG|!ARGS:/ZM_PATH/|!ARGS:/device/|!ARGS:/sendmail/|!ARGS:/txt/|!ARGS:/summary/|!ARGS:/text/|!ARGS:/^config/|!ARGS:/^dPcfg/|!ARGS:g2_prefix|!ARGS:g2_form[path]|!ARGS:/keyword/|!ARGS:field_id_29|!ARGS:/highlight/|!ARGS:/search/|!ARGS:/msg/|!ARGS:/comment/|!ARGS:/hilit/|!ARGS:/uri/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:product[media_gallery][images]|!ARGS:/subject/|!ARGS:/comment/|!ARGS:/data/|!ARGS:/txt/|!ARGS:csum|!ARGS:/post/|!ARGS:LiveURLSegment|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:/desc/|!ARGS:note_title|!ARGS:/^xjxargs/|!ARGS:backPath|!ARGS:/message/|!ARGS:/^fck_/|!ARGS:htmlSource|!ARGS:path_to_lzx|!ARGS:/body/ "(?:(\.\.|^| )/(?:etc|proc|var/tmp|usr|opt|s?bin|dev|tmp|kern|[br]oot|sys|windows|winnt)/|(?:\/|\\\\)+inetpub|localstart\.asp|(?:win|boot\.ini))" "phase:2,deny,status:403,t:none,t:urlDecodeUni,t:cmdLine,t:replaceNulls,capture,id:340009,rev:68,severity:2,msg:'Atomicorp.com WAF Rules: Protected Path Access denied in URI/ARGS',logdata:'%{TX.0},%{matched_var_name}',multimatch,log,auditlog" +SecMarker END_RULE_340009 + +SecMarker END_FILE_PROTECTION_1 + +SecRule REQUEST_URI "(?:/products/index\.php\?gallery=|connector=\.\./\.\./connectors|^/admin/(?:structure/views/|[a-z]+/(?:edit|add)|d/1/)|/phpthumb\.php\?((?:w|h)=[0-9]+&)?((?:w|h)=[0-9]+&)?src=\.\./.{0,32}(?:pics|uploads|images)|/site-(?:builder|content)/|/node/(?:[0-9]+/(?:edit|add)|add/)|^/typo3/sysext/rtehtmlarea/mod3/browse_links\.php\?@rtetsconfigparams|^/eprocservice/supplierinboundservice)" "t:none,t:lowercase,phase:2,id:323715,pass,nolog,noauditlog,skipAfter:END_RULE_340007" + + +#Rule 340007: generic recursion signatures +#ver 1 +#SecRule REQUEST_URI_RAW|ARGS|!ARGS:/background/|!ARGS:/osm_file_list_URa/L|!ARGS:editor|!ARGS:/^ultra_/|!ARGS:/form_data/|!ARGS:/srcFile/|!ARGS:/^curUrl/|!ARGS:elm1|!ARGS:/EditorZone/|!ARGS:file_private_path|!ARGS:code|!ARGS:/^resp/|!ARGS:rpath|!ARGS:backpath|!ARGS:data|!ARGS:/body/|!ARGS:editor1|!ARGS:/sidebar/|!ARGS:/template/|!ARGS:/desc/|!ARGS:resolution|!ARGS:/problem/|!ARGS:/solution/|!ARGS:/^style_options/|!ARGS:/CACHE_PATH/|!ARGS:connector|!ARGS:/comment/|!ARGS:obrazek|!ARGS:/txt/|!ARGS:keywords|!ARGS:/^fields/|!ARGS:tos|!ARGS:exito|!ARGS:/icon/|!ARGS:/logo/|!ARGS:Details|!ARGS:/fields_prev/|!ARGS:Lead|!ARGS:/editfile/|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:css_data|!ARGS:/text/|!ARGS:/message/|!ARGS:body|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:/content/ "(?i)(?:\x5c|(?:%(?:2(?:5(?:2f|5c)|%46|f)|c(?:0%(?:9v|af)|1%1c)|u(?:221[56]|002f)|%32(?:%46|F)|e0%80%af|1u|5c)|\/))(?:%(?:2(?:(?:52)?e|%45)|(?:e0%8|c)0%ae|u(?:002e|2024)|%32(?:%45|E))|\.){2}(?:\x5c|(?:%(?:2(?:5(?:2f|5c)|%46|f)|c(?:0%(?:9v|af)|1%1c)|u(?:221[56]|002f)|%32(?:%46|F)|e0%80%af|1u|5c)|\/))" "phase:2,deny,log,auditlog,status:403,t:none,capture,id:340007,rev:48,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied',logdata:'%{TX.0},%{matched_var_name}'" + +#probably too many FPs +#SecRule REQUEST_URI_RAW|ARGS|!ARGS:/background/|!ARGS:/osm_file_list_URa/L|!ARGS:editor|!ARGS:/^ultra_/|!ARGS:/form_data/|!ARGS:/srcFile/|!ARGS:/^curUrl/|!ARGS:elm1|!ARGS:/EditorZone/|!ARGS:file_private_path|!ARGS:code|!ARGS:/^resp/|!ARGS:rpath|!ARGS:backpath|!ARGS:data|!ARGS:/body/|!ARGS:editor1|!ARGS:/sidebar/|!ARGS:/template/|!ARGS:/desc/|!ARGS:resolution|!ARGS:/problem/|!ARGS:/solution/|!ARGS:/^style_options/|!ARGS:/CACHE_PATH/|!ARGS:connector|!ARGS:/comment/|!ARGS:obrazek|!ARGS:/txt/|!ARGS:keywords|!ARGS:/^fields/|!ARGS:tos|!ARGS:exito|!ARGS:/icon/|!ARGS:/logo/|!ARGS:Details|!ARGS:/fields_prev/|!ARGS:Lead|!ARGS:/editfile/|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:css_data|!ARGS:/text/|!ARGS:/message/|!ARGS:body|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:/content/ "(?i)(?:\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8|e)0%80%ae|2(?:(?:5(?:c0%25a|2))?e|%45)|u(?:(?:002|ff0)e|2024)|%32(?:%(?:%6|4)5|E)|c0(?:%[256aef]e|\.))|\.(?:%0[01]|\?)?|\?\.?|0x2e){2}(?:\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\/))" "phase:2,deny,log,auditlog,status:403,t:none,capture,id:340007,rev:48,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied',logdata:'%{TX.0},%{matched_var_name}'" +#ver 2 +SecRule ARGS|!ARGS:/background/|!ARGS:/osm_file_list_URa/L|!ARGS:editor|!ARGS:/^ultra_/|!ARGS:/form_data/|!ARGS:/srcFile/|!ARGS:/^curUrl/|!ARGS:elm1|!ARGS:/EditorZone/|!ARGS:file_private_path|!ARGS:code|!ARGS:/^resp/|!ARGS:rpath|!ARGS:backpath|!ARGS:data|!ARGS:/body/|!ARGS:editor1|!ARGS:/sidebar/|!ARGS:/template/|!ARGS:/desc/|!ARGS:resolution|!ARGS:/problem/|!ARGS:/solution/|!ARGS:/^style_options/|!ARGS:/CACHE_PATH/|!ARGS:connector|!ARGS:/comment/|!ARGS:obrazek|!ARGS:/txt/|!ARGS:keywords|!ARGS:/^fields/|!ARGS:tos|!ARGS:exito|!ARGS:/icon/|!ARGS:/logo/|!ARGS:Details|!ARGS:/fields_prev/|!ARGS:Lead|!ARGS:/editfile/|!ARGS:/wysiwyg/|!ARGS:/ajax/|!ARGS:css_data|!ARGS:/text/|!ARGS:/message/|!ARGS:body|!ARGS:pagecontent|!ARGS:/html/|!ARGS:filecontent|!ARGS:content|!ARGS:filename|!ARGS:fck_body|!ARGS:text|!ARGS:/content/ "(?i)(?:\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8|e)0%80%ae|2(?:(?:5(?:c0%25a|2))?e|%45)|u(?:(?:002|ff0)e|2024)|%32(?:%(?:%6|4)5|E)|c0(?:%[256aef]e|\.))|\.(?:%0[01]|\?)?|\?\.?|0x2e){2}(?:\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\/))" "phase:2,deny,log,auditlog,status:403,t:none,capture,id:340007,rev:48,severity:2,msg:'Atomicorp.com WAF Rules: Generic Path Recursion denied',logdata:'%{TX.0},%{matched_var_name}'" + +SecMarker END_RULE_340007 + +SecRule SERVER_PORT "@streq 30000" "phase:2,id:323710,pass,t:none,nolog,noauditlog,skipAfter:END_ASL_3" +#Protected file upload protection +SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!ARGS:templatecode|!ARGS:areas|!ARGS:title "@pm .www_acl .htpasswd web.config .htaccess boot.ini httpd.conf /etc/ .htgroup global.asa .wwwacl .history sh_history env" "phase:2,id:'333796',t:none,t:urlDecodeUni,t:htmlEntityDecode,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334362,t:none,pass,nolog,noauditlog,skipAfter:END_FILE_PROTECTION_2" + +SecRule REQUEST_URI "^(?:/cpsess[0-9]+/(?:scripts2?|json-api)/|^/file\?file=/etc/cccam\.cfg$|event=update_asl_config|^/etc/(?:js/|\?)|^/index\.php\?module=asl&event=|^/etc/img/)" "t:none,t:urlDecodeUni,t:lowercase,phase:2,id:323765,pass,nolog,noauditlog,skipAfter:END_RULE_390709" + +SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|!ARGS:/hilit/|!ARGS:/hilight/|!ARGS:/highlight/|!ARGS:/body/|!ARGS:/post/|!ARGS:/txt|!ARGS:resolution|!ARGS:tiny_vals|!ARGS:/description/|!ARGS:title|!ARGS:/content/|!ARGS:/title/|!ARGS:/systemfilter/|!ARGS:parent_name|!ARGS:/^config_setting/|!ARGS:name|!ARGS:v_zZ_ConfDir|!ARGS:/keyword/|!ARGS:/desc/|!ARGS:/summary/|!ARGS:csum|!ARGS:suffix|!ARGS:prefix|!ARGS:/note/|!ARGS:/solution/|!ARGS:/msg/|!ARGS:/highlight/|!ARGS:/text/|!ARGS:/search/|!ARGS:/subject/|!ARGS:/message/|!ARGS:/post/|!ARGS:/resolution/|!ARGS:/problem/|!ARGS:/data/ "(?:\b(?:\.(?:ht(?:access|passwd|group)|www_?acl)|global\.asa|httpd\.conf|boot\.ini|web.config)\b|( |^|\.\.)/etc/|/\.(?:history|bash_history|sh_history|env)$)" "phase:2,deny,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:cmdLine,ctl:auditLogParts=+E,deny,log,auditlog,msg:'Atomicorp.com WAF Rules: Attempt to access protected file remotely',id:'390709',rev:30,logdata:'%{TX.0}',severity:'2'" + +SecMarker END_RULE_390709 + +SecMarker END_ASL_3 + +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie "(?:\b(?:\.(?:ht(?:access|passwd|group)|www_?acl)|global\.asa|httpd\.conf|boot\.ini)\b|\/etc\/|/\.(?:history|bash_history|sh_history)$)" "phase:2,deny,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhitespace,t:cmdLine,ctl:auditLogParts=+E,deny,log,auditlog,msg:'Atomicorp.com WAF Rules: Attempt to access protected file remotely',id:'390719',rev:6,logdata:'%{TX.0}',severity:'2'" +# +SecMarker END_FILE_PROTECTION_2 + + +################ SQL injection rules ######################### +#Always SQL injection cases w/ antievasion +SecRule REQUEST_FILENAME "\.(?:(?:m|j)pe?g4?|flv|bmp|tiff?|p(?:(?:p|g|b)m|n(?:g|m)|df|s)|gif|css|ico|avi|w(?:m(?:v|a)|ebp)|mp(?:3|4)|cgm|svg|swf|og(?:m|v|x)|xls|doc|od(?:t|s)|ppt|wbk)$" "phase:2,pass,id:'333797',t:none,t:lowercase,nolog,noauditlog,setvar:tx.static=1,skipAfter:END_SQL_CHECKS" + +SecRule REQUEST_URI "(^/node/add/|/admin/content/|/todo\?action=edit$|^/eprocservice/supplierinboundservice|^/ntunnel_mysql|^/([a-z0-9]+/)index\.php\?controller=adminmodules\?configure=megaimporter)" "phase:2,pass,id:'333798',t:none,t:lowercase,nolog,noauditlog,skipAfter:END_SQL_CHECKS" + +SecRule ARGS:module "^modulebuilder$" "phase:2,pass,id:'353799',t:none,t:lowercase,nolog,noauditlog,skipAfter:END_SQL_CHECKS" + +SecRule REQUEST_URI "(?:^/adminer/adminer\.php\?server=|^/[a-z]+/index\.php\?/tickets/ajax/replylock)" "phase:2,pass,id:'375798',t:none,t:lowercase,nolog,noauditlog,skipAfter:END_SQL_CHECKS_PM1" + +SecRule REQUEST_URI "^/index\.php\?route=/table/replace$" "id:321112,rev:1,phase:2,t:urlDecodeUni,t:lowercase,pass,nolog,noauditlog,skipAfter:SKIP_AFTER_RULE_344367" + +#SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|!ARGS:availability|!ARGS:SAMLResponse|!ARGS:import|!ARGS:/_tbl/|!ARGS:/wp_autosave/|!ARGS:/searchclause/|!ARGS:ausgabe|!ARGS:/google/|!ARGS:/theme/|!ARGS:/form/|!ARGS:/content/|!ARGS:/^cms_partial/|!ARGS:/type/|!ARGS:/text/|!ARGS:storage_alter_type|!ARGS:/database/|!ARGS:prod_|!ARGS:/prod_/|!ARGS:/^field_type/|!ARGS:prefix|!ARGS:suffix|!ARGS:/table_select/|!ARGS:/^vpinfo/|!ARGS:website|!ARGS:suffix|!ARGS:Body|!ARGS:wikitext|!ARGS:type|!ARGS:content|!ARGS:/^Cms_Page/|!ARGS:areas|!ARGS:templatecode|!ARGS:website|!ARGS:/insertstring/|!ARGS:signature|!ARGS:/description/|!ARGS:Db_submit|!ARGS:text|!ARGS:code|!ARGS:comment|!ARGS:/^table/|!ARGS:/message/|!ARGS:query|!ARGS_NAMES:table_name|!ARGS:/jql/|!ARGS:/sql/|!ARGS:/^table/|!ARGS:resolution|!ARGS_NAMES:/conf_varchar/|!ARGS:input_25|!ARGS_NAMES:/^jform/|XML:/* "@rx (?i)\b(?:c(?:o(?:n(?:v(?:ert(?:_tz)?)?|cat(?:_ws)?|nection_id)|(?:mpres)?s|ercibility|(?:un)?t|llation|alesce)|ur(?:rent_(?:time(?:stamp)?|date|user)|(?:dat|tim)e)|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|ast|r32)|s(?:u(?:b(?:str(?:ing(?:_index)?)?|(?:dat|tim)e)|m)|t(?:d(?:dev_(?:sam|po)p)?|r(?:_to_date|cmp))|e(?:c(?:_to_time|ond)|ssion_user)|ys(?:tem_user|date)|ha[12]?|oundex|chema|ig?n|leep|pace|qrt)|i(?:s(?:_(?:ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|(?:free|used)_lock)|null)|n(?:et(?:6_(?:aton|ntoa)|_(?:aton|ntoa))|s(?:ert|tr)|terval)?|f(?:null)?)|d(?:a(?:t(?:e(?:_(?:format|add|sub)|diff)?|abase)|y(?:of(?:month|week|year)|name)?)|e(?:(?:s_(?:de|en)cryp|faul)t|grees|code)|count|ump)|l(?:o(?:ca(?:l(?:timestamp)?|te)|g(?:10|2)?|ad_file|wer)|ast(?:_(?:inser_id|day))?|e(?:(?:as|f)t|ngth)|case|trim|pad|n)|u(?:n(?:compress(?:ed_length)?|ix_timestamp|hex)|tc_(?:time(?:stamp)?|date)|p(?:datexml|per)|uid(?:_short)?|case|ser)|t(?:ime(?:_(?:format|to_sec)|stamp(?:diff|add)?|diff)?|o(?:(?:second|day)s|_base64|n?char)|r(?:uncate|im)|an)|m(?:a(?:ke(?:_set|date)|ster_pos_wait|x)|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:nth(?:name)?|d)|d5)|r(?:e(?:p(?:lace|eat)|lease_lock|verse)|a(?:wtohex|dians|nd)|o(?:w_count|und)|ight|trim|pad)|f(?:i(?:eld(?:_in_set)?|nd_in_set)|rom_(?:unixtime|base64|days)|o(?:und_rows|rmat)|loor)|p(?:o(?:w(?:er)?|sition)|eriod_(?:diff|add)|rocedure_analyse|assword|g_sleep|i)|a(?:s(?:cii(?:str)?|in)|es_(?:de|en)crypt|dd(?:dat|tim)e|(?:co|b)s|tan2?|vg)|b(?:i(?:t_(?:length|count|x?or|and)|n(?:_to_num)?)|enchmark)|e(?:x(?:tract(?:value)?|p(?:ort_set)?)|nc(?:rypt|ode)|lt)|g(?:r(?:oup_conca|eates)t|et_(?:format|lock))|v(?:a(?:r(?:_(?:sam|po)p|iance)|lues)|ersion)|o(?:(?:ld_passwo)?rd|ct(?:et_length)?)|we(?:ek(?:ofyear|day)?|ight_string)|n(?:o(?:t_in|w)|ame_const|ullif)|h(?:ex(?:toraw)?|our)|qu(?:arter|ote)|year(?:week)?|xmltype)\W*\(" "id:344367,rev:10,phase:2,deny,status:403,capture,t:none,t:urlDecodeUni,t:lowercase,msg:'Atomicorp.com WAF Rules: SQL Injection Attack',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',tag:'SQLi',ctl:auditLogParts=+E" + +SecMarker SKIP_AFTER_RULE_344367 + +#GraphQL +#query IntrospectionQuery { +#{__schema{queryType{ +SecRule REQUEST_BODY|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|!ARGS:_wp_http_referer|!ARGS:SAMLResponse|!ARGS:import|!ARGS:/_tbl/|!ARGS:/wp_autosave/|!ARGS:/searchclause/|!ARGS:/^cms_partial/|!ARGS:/type/|!ARGS:/text/|!ARGS:storage_alter_type|!ARGS:/database/|!ARGS:/^field_type/|!ARGS:prefix|!ARGS:suffix|!ARGS:/table_select/|!ARGS:/^vpinfo/|!ARGS:website|!ARGS:suffix|!ARGS:Body|!ARGS:wikitext|!ARGS:type|!ARGS:content|!ARGS:/^Cms_Page/|!ARGS:areas|!ARGS:templatecode|!ARGS:website|!ARGS:/insertstring/|!ARGS:signature|!ARGS:/description/|!ARGS:Db_submit|!ARGS:text|!ARGS:code|!ARGS:comment|!ARGS:/^table/|!ARGS:/message/|!ARGS:query|!ARGS:/sql/|!ARGS:/^table/|!ARGS:resolution|!ARGS_NAMES:/conf_varchar/|!ARGS_NAMES:/^jform/|!ARGS:attachment_hash_combined|XML:/* "@rx (?:query introspectionquery ?|__schema\ ?{ ?(?:querytype|types?)) ?\{" "id:344378,rev:2,phase:2,deny,status:403,capture,t:none,t:urlDecodeUni,t:removecomments,t:compressWhiteSpace,t:lowercase,msg:'Atomicorp.com WAF Rules: GraphQL Injection Attack attempt',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',tag:'SQLi',severity:'CRITICAL'" + +#SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES:home_branch|ARGS_NAMES|ARGS|!ARGS:data|!ARGS:_wp_http_referer|!ARGS:SAMLResponse|!ARGS:import|!ARGS:/_tbl/|!ARGS:/wp_autosave/|!ARGS:/searchclause/|!ARGS:/^cms_partial/|!ARGS:/type/|!ARGS:/text/|!ARGS:storage_alter_type|!ARGS:/database/|!ARGS:/^field_type/|!ARGS:prefix|!ARGS:suffix|!ARGS:/table_select/|!ARGS:/^vpinfo/|!ARGS:website|!ARGS:suffix|!ARGS:Body|!ARGS:wikitext|!ARGS:type|!ARGS:content|!ARGS:/^Cms_Page/|!ARGS:areas|!ARGS:templatecode|!ARGS:website|!ARGS:/insertstring/|!ARGS:signature|!ARGS:/description/|!ARGS:Db_submit|!ARGS:text|!ARGS:code|!ARGS:comment|!ARGS:/^table/|!ARGS:/message/|!ARGS:query|!ARGS_NAMES:table_name|!ARGS:/sql/|!ARGS:/^table/|!ARGS:resolution|!ARGS_NAMES:/conf_varchar/|!ARGS_NAMES:/^jform/|!ARGS:attachment_hash_combined|!ARGS:/content/|!ARGS:/html/|!ARGS:/email/|!ARGS:/signature/|XML:/* "@rx (?i:[\"'`]\s*?(?:(?:n(?:and|ot)|(?:x?x)?or|between|\|\||and|div|&&)\s+[\s\w]+=\s*?\w+\s*?having\s+|like(?:\s+[\s\w]+=\s*?\w+\s*?having\s+|\W*?[\"'`\d])|\*\s*?\w+\W+[\"'`])|(?:union\s*?(?:distinct|[(!@]*?|all)?\s*?[([]*?\s*?select|select\s+?[\[\]()\s\w\.,\"'`-]+from)\s+|\w\s+like\s+[\"'`]|find_in_set\s*?\(|like\s*?[\"'`]%)" "id:344371,rev:4,phase:2,deny,status:403,capture,t:none,t:urlDecodeUni,msg:'Atomicorp.com WAF Rules: SQL Injection Attack/SQL authentication bypass attempt',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',tag:'SQLi',severity:'CRITICAL'" + + + +#SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|!ARGS:_wp_http_referer|!ARGS:SAMLResponse|!ARGS:import|!ARGS:/_tbl/|!ARGS:/wp_autosave/|!ARGS:/searchclause/|!ARGS:/^cms_partial/|!ARGS:/type/|!ARGS:/text/|!ARGS:storage_alter_type|!ARGS:/database/|!ARGS:/^field_type/|!ARGS:prefix|!ARGS:suffix|!ARGS:/table_select/|!ARGS:/^vpinfo/|!ARGS:website|!ARGS:suffix|!ARGS:Body|!ARGS:wikitext|!ARGS:type|!ARGS:content|!ARGS:/^Cms_Page/|!ARGS:areas|!ARGS:templatecode|!ARGS:website|!ARGS:/insertstring/|!ARGS:signature|!ARGS:/description/|!ARGS:Db_submit|!ARGS:text|!ARGS:code|!ARGS:comment|!ARGS:/^table/|!ARGS:/message/|!ARGS:query|!ARGS_NAMES:table_name|!ARGS:/sql/|!ARGS:/^table/|!ARGS:resolution|!ARGS_NAMES:/conf_varchar/|!ARGS_NAMES:/^jform/|!ARGS:attachment_hash_combined|XML:/* "@rx (?i:[\"'`](?:\s*?(?:(?:\*.+(?:(?:an|i)d|between|like|x?or|div)\W*?[\"'`]|(?:between|like|x?or|and|div)\s[^\d]+[\w-]+.*?)\d|[^\w\s?]+\s*?[^\w\s]+\s*?[\"'`]|[^\w\s]+\s*?[\W\d].*?(?:--|#))|.*?\*\s*?\d)|[()\*<>%+-][\w-]+[^\w\s]+[\"'`][^,]|\^[\"'`])" "id:344374,rev:2,phase:2,deny,status:403,capture,t:none,t:urlDecodeUni,msg:'Atomicorp.com WAF Rules: SQL Injection Attack attempt',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',tag:'SQLi',severity:'CRITICAL'" + + + +SecRule ARGS|!ARGS:/^cms_partial/|!ARGS:/type/|!ARGS:/searchClause/|!ARGS:import|!ARGS:DR|!ARGS:SAMLResponse|!ARGS:/wizArray/|!ARGS:/^Cms_Page/|!ARGS:search|!ARGS:pagetext|!ARGS:/database/|!ARGS:/^vpinfo/|!ARGS:website|!ARGS:suffix|!ARGS:Body|!ARGS:wikitext|!ARGS:type|!ARGS:content|!ARGS:areas|!ARGS:templatecode|!ARGS:website|!ARGS:/insertstring/|!ARGS:signature|!ARGS:/description/|!ARGS:Db_submit|!ARGS:text|!ARGS:code|!ARGS:comment|!ARGS:/sql/|!ARGS:prefix|!ARGS:/message/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:resolution|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/ "@pmFromFile sql.txt" "phase:2,deny,log,auditlog,status:403,capture,id:340155,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,rev:25,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL Injection protection',logdata:'%{TX.0}',tag:'SQLi'" + +SecMarker END_SQL_CHECKS_PM1 + +#Always SQL injection cases w/ antievasion +#SecRule ARGS|!ARGS:/installcode/|!ARGS:/sql/|!ARGS:prefix|!ARGS:s_manifest|!ARGS:/database/|!ARGS:content|!ARGS:newcontent|!ARGS:query|!ARGS:/description/|!ARGS:/text/|!ARGS:Db_submit|!ARGS:/table/|!ARGS:EXPORTTABLE|!ARGS:/message/|!ARGS:previous_field|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:X-PageView|!ARGS_NAMES:/varchar/|!ARGS_NAMES:cfg_xsp_password|!ARGS:/body/|!ARGS:runQuery|!ARGS:field_type[]|!ARGS:/^field_type/|!ARGS:/^fieldtype_/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/subject/ "@pmFromFile sql.txt" "phase:2,deny,status:403,capture,id:340160,t:none,t:replaceComments,t:compressWhiteSpace,rev:30,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL Injection protection',logdata:'%{TX.0}',chain" +#SecRule ARGS:module "!(^modulebuilder$)" "t:none,t:lowercase" +#SecRule REQUEST_URI "/index\.php\?module=administration" + +#Always SQL injection cases w/ antievasion +SecRule ARGS|!ARGS:pagetext|!ARGS:/wizArray/|!ARGS:/database/|!ARGS:/installcode/|!ARGS:areas|!ARGS:templatecode|!ARGS:s_manifest|!ARGS:Db_submit|!ARGS:/database/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|ARGS_NAMES|!ARGS:/description/|!ARGS:/insertstring/|!ARGS_NAMES:/conf_varchar/|!ARGS_NAMES:table_name|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|!REQUEST_COOKIES_NAMES:/sql/ "@pmFromFile sql.txt" "phase:2,deny,log,auditlog,status:403,capture,id:380023,t:none,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,rev:8,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL Injection protection',logdata:'%{TX.0}',tag:'SQLi'" + +#Always SQL injection cases w/ antievasion +SecRule ARGS|!ARGS:pagetext|!ARGS:message|!ARGS:/wizArray/|!ARGS:/database/|!ARGS:Db_submit|!ARGS:areas|!ARGS:templatecode|!ARGS:/description/|!ARGS:/sql/|!ARGS:prefix|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:query|ARGS_NAMES|!ARGS_NAMES:table_name|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|!REQUEST_COOKIES:/utm/ "@pmFromFile sql.txt" "phase:2,deny,log,auditlog,status:403,capture,id:380024,t:none,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL Injection protection',logdata:'%{TX.0}',tag:'SQLi'" + + +SecMarker END_SQL_CHECKS + +SecRule REQUEST_URI "union ?\(?select ?\(" "phase:1,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:lowercase,t:replaceComments,t:compressWhiteSpace,msg:'Atomicorp.com WAF Rules: SQL injection',id:380123,rev:5,logdata:'%{TX.0}',severity:'2',tag:'SQLi'" + +#################################### +#First major set +Secrule REQUEST_URI "^/(?:eprocservice/supplierinboundservice|ntunnel_mysql)" "phase:2,id:344356,t:none,t:lowercase,pass,nolog,noauditlog,skipAfter:END_INJECTION_RULES_ALL" + +SecRule REQUEST_URI|REQUEST_COOKIES|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|REQUEST_HEADERS|ARGS|!ARGS:/^Cms_Page/|!ARGS:/database/|!ARGS:templatecode|!ARGS:/insertstring/|!ARGS:areas|XML:/* "@pm select having grant delete insert drop alter replace truncate update create rename describe table database dba index into from convert bulk column update set union or = ' -- procedure declare serialize passthru outfile null <> eval create_function system exec trucate sleep benchmark create_function reg_replace(" "phase:2,id:'333799',t:none,t:urlDecodeUni,t:removeComments,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334363,t:none,pass,nolog,noauditlog,skipAfter:END_SQL_INJECTION_RULE_1" + + +#allow for truevault +SecRule REQUEST_URI "^(?:/([a-z0-9]+/)?wp-load\.php\?vaultpress=true|/ntunnel_mysql|^/\?r=events/update)" "phase:2,id:336317,t:none,t:lowercase,pass,nolog,noauditlog,skipAfter:END_RULE_380122" + +#SQL stored procedure injection +SecRule REQUEST_URI|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|XML:/*|ARGS|!ARGS:/^Cms_Page/|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:/database/|!ARGS:comment|!ARGS:templatecode|!ARGS:areas|!ARGS:content|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/text/|!ARGS:/message/|!ARGS:/body/ "(?:procedure\s+analyse\s.{0,100}\(|create\s+(procedure|function)\s.{0,100}\w+\s.{0,100}\(\s.{0,200}\)\s.{0,100}declare[^\w]+[@#]\s.{0,100}\w+|exec\s.{0,100}\(\s.{0,200}@|\b(?:sleep|benchmark)\b ?\( ?[0-9])" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,msg:'Atomicorp.com WAF Rules: MySQL and PostgreSQL stored procedure/function injections',id:380122,rev:5,logdata:'%{TX.0}',severity:'2',tag:'SQLi'" + +SecMarker END_RULE_380122 + +#allow for truevault +SecRule REQUEST_URI "^/administrator/index\.php\?option=com_hikashop&ctrl=" "phase:2,id:346317,t:none,t:lowercase,pass,nolog,noauditlog,skipAfter:END_RULE_380025" + +#PHP shell code SQL injection +SecRule REQUEST_URI|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|ARGS|!ARGS:/database/|!ARGS:SAMLResponse|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:templatecode|!ARGS:areas|!ARGS:/database/|!ARGS:comment|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/prefix/|!ARGS:/suffix/|!ARGS:definition|XML:/* "(?:\bunion\b.{1,100}?\bselect\b.{1,100}?php.{1,100}?(?:passthru|serialize|system|eval|create_function|create_function|preg_\w+|exec|shell_exec ?(?:\(|\: ?'?))|select.{1,100}?(?:php|perl).{1,100}?into outfile|reg_replace ?\()" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,msg:'Atomicorp.com WAF Rules: SQL injection with PHP/PERL payload',id:380025,rev:8,logdata:'%{TX.0}',severity:'2',tag:'SQLi',tag:'RCE'" + + + +SecMarker END_RULE_380025 + +# Rule 340013: +#Prevent SQL injection in cookies +SecRule REQUEST_COOKIES|REQUEST_HEADERS:User-Agent|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|!REQUEST_COOKIES:/temp_widdit/|!REQUEST_COOKIES:/sql/ "(?:\b(?:select|grant|delete|insert|alter|replace|truncate|update|create|rename|describe)\b[[:space:]]+[a-z|0-9|\*| |\}|\{|\,\(\)]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[a-z|0-9|\*| |\,]|\bunion\b.{1,100}?\bselect\b.[a-z0-9]|select (?:load_file|char\()|(?:insert|remark)test;|\bdrop (?:all tables|table [a-z0-9]+|[a-z0-9]+) ?;)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:lowercase,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,id:340013,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection in cookie or UA',logdata:'%{TX.0}',tag:'SQLi'" + +# Rule 340015: +#Prevent SQL injection in UA +#SecRule REQUEST_HEADERS:User-Agent "(?:(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[a-z|0-9|\*| |\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+[a-z|0-9|\*| |\,]|union select [a-z0-9])" "t:replaceComments,t:compressWhiteSpace,id:340015,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection in User Agent header'" +# +SecRule REQUEST_URI "(?:(?:/wp-admin/post|privmsg|/ticket/admin|/misc|tiki-editpage|/post|/imp/compose|/posting)\.php|/modules\.php\?op=modload&name=(?:downloads|submit_news)|/admin\.php\?module=ns\-addStory\&op=|/index\.php\?name=pnphpbb2&file=posting&mode=reply|/phpmyadmin/|/pnphpbb2-posting\.html|/otrs/index\.pl|tiki-index\.php\?page=|/index\.php\?title=.*&action=edit|/node/[0-9]+/edit|/editcode/|^/ntunnel_mysql/^/([a-z0-9]+/)index\.php\?controller=adminmodules\?configure=megaimporter)" "phase:2,t:none,t:lowercase,pass,nolog,noauditlog,id:340015,skipAfter:END_RULE_340016" + +# Rule 340016: +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|!REQUEST_COOKIES:/sql/|!REQUEST_COOKIES:/temp_widdit/|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|ARGS|XML:/*|!ARGS:/opgaver/|!ARGS:/^Cms_Page/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:/brief/|!ARGS:templatecode|!ARGS:area|!ARGS:/changelog/|!ARGS:permissions|!ARGS:/^p_posts/|!ARGS:po|!ARGS:et_pb_unprocessed_data|!ARGS:data|!ARGS:contenido|!ARGS:content|!ARGS:/siteorigin/|!ARGS:panels_data|!ARGS:source|!ARGS:/calotropis/|!ARGS:/searchclause/|!ARGS:resolution|!ARGS:SAMLResponse|!ARGS:/^info/|!ARGS:/narrative/|!ARGS:/FCKeditor/|!ARGS:/txt/|!ARGS:inc|!ARGS:op|!ARGS:_signature|!ARGS:/^label_/|!ARGS:/teaser/|!ARGS:bio|!ARGS:/installcode/|!ARGS:UserData|!ARGS:code|!ARGS:/report/|!ARGS:/^gcaption/|!ARGS:/^p_process_chats/|!ARGS:/database/|!ARGS:/^para/|!ARGS:/comment/|!ARGS:/keywords/|!ARGS:cf85|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/desc/|!ARGS:movie_brief|!ARGS:/text/|!ARGS:/message/|!ARGS:ncontent|!ARGS:/body/|!ARGS:/content/|!ARGS:searchword|!ARGS:contactMessage|!ARGS:cts|!ARGS:meta_descr|!ARGS:edited|!ARGS:content|!ARGS:Post|!ARGS:body|!ARGS:ll_content_message|!ARGS:page-content|!ARGS:reply|!ARGS:xml|!ARGS:content_en|!ARGS:filecontent|!ARGS:message|!ARGS:content_en|!ARGS:response[14]|!ARGS:/article/|!ARGS:data[Application][cv] "(?:(?:truncate|truncate|rename)[[:space:]]+[a-z| |0-9|\*|\.|\,|\(|\)|_|\-]+[[:space:]]+(?:into|from|table|database|index|view)[[:space:]]+[a-z|0-9|\*| |\{|\.|\,|\(|\)|_|\-]|\bunion\b.{1,256}?select.{1,256}[a-z0-9\(\)].{1,256}(?:from|#|, ?[0-9a-z]|--)|\bselect\b.{1,256}?(?:load_file|char\()|(?:insert|remark)test ?;|insert [a-z|0-9|\*|\,]+ (?:from|into|table|database|index|view|\{|\'|\`)[[:space:]]+\(|update [a-z0-9]+set |insert into (?:\{|\'|\`)|\btruncate table|delete from [a-z0-9]+ where|\' or true --|create (?:database|table) [a-z0-9]+ ?;|\breplace ?\( \'|\bgrant [a-z]+ on |select[[:space:]]+(?:[a-z|0-9|\*|\.|\,|\(|\)|_|\-]|[a-z|0-9|\*|\.|\,|\(|\)|_|\-] ?, ?)+[[:space:]]+(?:into|from|table|index|view)[[:space:]]+[a-z|0-9|\*| |\{|\.|\,|\(|\)|_|\-]|\bdrop (?:all tables|table [a-z0-9]+|[a-z0-9]+) ?;|\balter\b [a-z0-9]+ [a-z0-9]+ ?\;)" "phase:2,deny,log,auditlog,status:403,capture,multimatch,t:none,t:urlDecodeUni,t:lowercase,t:replaceNulls,t:removecomments,t:compressWhiteSpace,id:340016,rev:48,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - SQL injection attempt detected',logdata:'%{TX.0}',tag:'SQLi'" + +SecMarker END_RULE_340016 + +#bypass for these, no args +SecRule TX:STATIC "@eq 1" "phase:2,id:'333800',pass,t:none,nolog,noauditlog,skipAfter:END_SQL_CHECKS_2" + +#SecRule REQUEST_FILENAME "\.(?:(?:m|j)pe?g4?|bmp|tiff?|p(?:(?:p|g|b)m|n(?:g|m)|df)|gif|css|ico|avi|flv|w(?:m(?:v|a)|ebp)|mp(?:3|4)|cgm|svg|swf|og(?:m|v|x)|doc|xls|od(?:t|s)|ppt|wbk)$" phase:2,id:'333800',pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_SQL_CHECKS_2 + +# Rule 340017: +SecRule REQUEST_URI|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES:/temp_widdit/|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|ARGS|!ARGS:SAMLResponse|!ARGS:/^Cms_Page/|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:ncontent|!ARGS:/body/|!ARGS:/installcode/|!ARGS:code|!ARGS:/content/|!ARGS:/database/|!ARGS:searchword|!ARGS:add_keywords|!ARGS:comment|!ARGS:comments|!ARGS:text|!ARGS:/description/|!ARGS:contenido|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:contactMessage|!ARGS:cts|!ARGS:meta_descr|!ARGS:text|!ARGS:edited|!ARGS:content|!ARGS:introtext|!ARGS:Post|!ARGS:itembigtext|!ARGS:/article/|!ARGS:body|!ARGS:mytextarea|!ARGS:ll_content_message|!ARGS:page-content|!ARGS:reply|!ARGS:xml|!ARGS:content_en|!ARGS:filecontent|!ARGS:/message/|!ARGS:content_en|!ARGS:response[14]|!ARGS:article|!ARGS:wptextbox1|!ARGS:/narrative/|!ARGS:/FCKeditor/|!ARGS:data "(?:insert into values|select from [a-z|0-9]+!( and)|bulk insert |union select|union all select|convert \(.{1,256}from|select (?:load_file|char\(|\* from)|(?:insert|remark)test;)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:lowercase,t:replaceComments,t:compressWhiteSpace,chain,id:340017,rev:49,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection in ARGS',logdata:'%{TX.0}',tag:'SQLi'" +SecRule REQUEST_URI "!(?:^/edit_page$|/node/[0-9]+/edit|^/forum/posting\.php|^/admins/wnedit\.php|modules\.php\?name=morums&file=posting&mode=|^/joomla/administrator/index2\.php|^/wiki/index\.php?.*action=submit|^/imp/compose\.php|^/horde/imp/compose\.php|/sql.php|/tbl_(?:change|s(?:ql|tructure))\.php|/admincp/template\.php\?do=(?:insert|update)template|admin/area/save-page\.php$|^/cgi-bin/cookmail\.exe$|^/catalog/secure_admin/categories\.php\?cpath=)" "t:none,t:lowercase" + +# Rule 340144: Generic SQL sigs +SecRule REQUEST_URI "!(?:(?:/wp-admin/post|privmsg|/ticket/admin|/misc|tiki-editpage|/post|/horde3?/imp/compose|/posting)\.php|/modules\.php\?op=modload&name=(?:Downloads|Submit_News)|/admin\.php\?module=NS\-AddStory\&op=|/index\.php\?name=pnphpbb2&file=posting&mode=reply|/phpmyadmin/|/pnphpbb2-posting\.html|/otrs/index\.pl|tiki-index\.php\?page=|/index\.php\?title=.*&action=edit|/node/[0-9]+/edit|/joomla/administrator/index2\.php|module=admin&act=dispLayoutAdminEdit&layout_srl=|upgrade.php?step=|^/ubbthreads/install/|^/projects/csb/milestone$|^/backoffice/index\.php\?controller=admintranslations|^/admin/applications/edit/)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:lowercase,id:340144,rev:38,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection 2',chain,logdata:'%{TX.0}',tag:'SQLi'" +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES:/temp_widdit/|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|ARGS|!ARGS:/body_/|!ARGS:shortcode|!ARGS:/description/|!ARGS:/sys_template/|!ARGS:/^Cms_Page/|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:templatecode|!ARGS:areas|!ARGS:body|!ARGS:/teaser/|!ARGS:/content/|!ARGS:wpSummary|!ARGS:ncontent|!ARGS:/installcode/|!ARGS:/database/|!ARGS:code|!ARGS:/report/|!ARGS:/database/|!ARGS:/text/|!ARGS:comment|!ARGS:/txt/|!ARGS:blogText|!ARGS:sendDescription|!ARGS:exec[text]|!ARGS:keywords|!ARGS:tiny_vals|!ARGS:postpagetext|!ARGS:display_query|!ARGS:Db_submit|!ARGS:Post|!ARGS:text|!ARGS:action|!ARGS:op|!ARGS:setup_db|!ARGS:wptextbox1|!ARGS:/message/|!ARGS:contenido|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:query_string|!ARGS:query|!ARGS:description|!ARGS:/^para/|!ARGS:/narrative/|!ARGS:/FCKeditor/|!ARGS:/^info/|!ARGS:content|!ARGS:data|!ARGS:/^p_posts/|!ARGS:questions_detail "(?:\b(?:alter|drop)\b [a-z0-9]+ \b(?:column|database|procedure|table)\b|delete[[:space:]] .{1,100}+ update [a-z0-9]+ set .{1,100}+=|union all select |\bunion\b.{1,100}?\bselect\b.{0,200}[a-z0-9]+ from |select (?:load_file|char ?\()|(?:insert|remark)test;)|\bcreate\b table [a-z0-9]+ \(" "t:none,t:urlDecodeUni,t:lowercase,t:replaceComments,t:compressWhiteSpace" + +SecMarker END_SQL_CHECKS_2 + +# Rule 340145: Generic SQL sigs +SecRule REQUEST_URI|ARGS|XML:/*|!ARGS:datafile|!ARGS:SAMLResponse|!ARGS:/cleandata/|!ARGS:FCKeditor|!ARGS:output|!ARGS:/^parabola_settings/|!ARGS:explanation|!ARGS:/^wp_meta_box/|!ARGS:/post/|!ARGS:product[name]|!ARGS:cookie|!ARGS:/^field\[6\]$/|!ARGS:UserData|!ARGS:serData|!ARGS:/^Cms_Page/|!ARGS:/^autoDS/|!ARGS:/^pages/|!ARGS:prefix|!ARGS:suffix|!ARGS:qa_answer|!ARGS:areas|!ARGS:templatecode|!ARGS:featured_ids|!ARGS:/teksti/|!ARGS:/^jform/|!ARGS:callforprice|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:condition|!ARGS:/^chronofield/|!ARGS:resolution|!ARGS:/desc/|!ARGS:/^cforms/|!ARGS:special|!ARGS:/email|!ARGS:/body/|!ARGS:/installcode/|!ARGS:contenido|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/comment/|!ARGS:/content/|!ARGS:newcontent|!ARGS:/text/|!ARGS:/txt/|!ARGS:khxc_incphp--filename|!ARGS:/file_content/|!ARGS:filecontent|!ARGS:/message/|!ARGS:defaultParamList|!ARGS:body|!ARGS:gbu0_proddetdisp--incdisp|!ARGS:gbu0_prodcatdisp--incdisp "(?:or [0-9] ?= ?[0-9]|admin'(?: --| #)|or (?:'|\")? ?(?:0|1|2|3|a|b) ?(?:'|\")? ?= ?(?:'|\")? ?(/:0|1|2|3|a|b) ?(?:'|\")?|having 1 ?= ?1 ?--|null is null ?--| \b(\d+) ?(?:=|<>|<=>|\!=) ?[0-3]\b)" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:replaceComments,t:replaceNulls,t:compressWhitespace,t:lowercase,capture,id:340145,rev:43,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - SQL injection probe',logdata:'%{TX.0}',tag:'SQLi'" +SecRule REQUEST_URI "!(?:/index\.php/admin/catalog_category/save|(?:/admin/stats|/css/gallery-css)\.php\?1=1|/admin\.php\?tile=mail$|/catalog_category/save/key/|/\?op=admin_settings|^/\?openpage=|^/admin/extra|^/node/[0-9]+/edit\?destination=admin/content|^/administrator/index\.php\?option=com_chronoforms)" "t:none,t:lowercase" + +# Rule 390572: Generic SQL sigs +SecRule ARGS|XML:/*|!ARGS:datafile|!ARGS:SAMLResponse|!ARGS:/cleandata/|!ARGS:serData|!ARGS:explanation|!ARGS:/post/|!ARGS:/^wp_meta_box/|!ARGS:cookie|!ARGS:/^field\[6\]$/|!ARGS:/^autoDS/|!ARGS:pagetext|!ARGS:featured_ids|!ARGS:/^pages/|!ARGS:/^Cms_Page/|!ARGS:qa_answer|!ARGS:/teksti/|!ARGS:areas|!ARGS:templatecode|!ARGS:/^jform/|!ARGS:callforprice|!ARGS:condition|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:prefix|!ARGS:pagetext|!ARGS:suffix|!ARGS:special|!ARGS:description|!ARGS:resolution|!ARGS:/^chronofield/|!ARGS:memo|!ARGS:/^cforms/|!ARGS:/email|!ARGS:/body/|!ARGS:contenido|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/comment/|!ARGS:content|!ARGS:/descr/|!ARGS:newcontent|!ARGS:/text/|!ARGS:/txt/|!ARGS:/installcode/|!ARGS:/database/|!ARGS:khxc_incphp--filename|!ARGS:/file_content/|!ARGS:filecontent|!ARGS:/message/|!ARGS:defaultParamList|!ARGS:body|!ARGS:/^gbu0/ "(?:or.{1,100}1[[:space:]].{,100}=[[:space:]]1|or 1=[0-9]|admin'(?: --| #)| or '1'='1--|having 1 ?= ?1 --|or\+1=[0-9]|null is null ?--|(?:and|or) ?(\d+) ?(?:=|<>|<=>|!=) ?[1-3]\b)" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:lowercase,t:replaceComments,t:compressWhitespace,capture,id:390572,rev:22,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - SQL injection probe',logdata:'%{TX.0}',tag:'SQLi'" +SecRule REQUEST_URI "!(?:/(?:catalog_category|featured)/save|(?:/admin/stats|/css/gallery-css)\.php\?1=1|/admin\.php\?tile=mail$|/\?op=admin_settings|^/\?openpage=|^/node/[0-9]+/(?:edit|webform/))" "t:none,t:lowercase" + +# Rule 340146: Meta character SQL injection +SecRule REQUEST_URI "(?:insert[[:space:]]+into.+values|select (\*|[a-z0-9]+) from.+[a-z|0-9|\{]|select.+from|bulk[[:space:]]+insert|union.+select|select (?:load_file|char\()|convert ?\(from|and.{1,256}char\(|(?:insert|remark)test ?;)" "phase:2,deny,log,auditlog,status:403,chain,capture,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:lowercase,id:340146,rev:8,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL metacharacter URI injection protection',logdata:'%{TX.0}',tag:'SQLi'" +SecRule ARGS:boattype "!(^select)" "t:none,t:lowercase" + + +SecMarker END_SQL_INJECTION_RULE_1 + +####################### Second Set +# + +SecRule TX:STATIC "@eq 1" "phase:2,id:'333801',pass,t:none,nolog,noauditlog,skipAfter:END_SQL_CHECKS_3" + +#SecRule REQUEST_FILENAME "\.(?:(?:m|j)pe?g4?|bmp|tiff?|p(?:(?:p|g|b)m|n(?:g|m)|df)|gif|css|ico|avi|flv|w(?:m(?:v|a)|ebp)|mp(?:3|4)|cgm|svg|swf|og(?:m|v|x)|doc|xls|od(?:t|s)|ppt|wbk)$" phase:2,id:333801,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_SQL_CHECKS_3 + + +SecRule REQUEST_URI|XML:/*|ARGS|!ARGS:SAMLResponse|!ARGS:contenido|!ARGS:/sql/|!ARGS:/^Cms_Page/|!ARGS:prefix|!ARGS:/database/|!ARGS:pagetext|!ARGS:query|REQUEST_HEADERS|!ARGS:/FCKeditor/|!ARGS:/narrative/|!ARGS:/insertstring/|!ARGS:templatecode|!ARGS:areas "@pm select outfile exec passthru serialize preg_ eval create_function create_function union concat file_put_contents" "phase:2,id:333802,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,multimatch,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:333701,t:none,pass,nolog,noauditlog,skipAfter:END_SQL_INJECTION_RULE_2" + +#shell code SQL injection +SecRule REQUEST_URI|XML:/*|ARGS|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:/sql/|!ARGS:prefix|!ARGS:contenido|!ARGS:query|!ARGS:/message/|!ARGS:templatecode|!ARGS:/^Cms_Page/|!ARGS:areas|!ARGS:pagetext|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|!ARGS:/narrative/|!ARGS:templatecode|!ARGS:areas "(?:(?:\bunion\b.{1,100}?\bselect\b.{1,100}?php.{1,100}?(?:system|create_function|create_function|eval ?\(|shell_exec|passthru|serialize|preg_\w+|exec).{1,100}?into)|select.{1,100}?(?:php|perl).{1,100}?into outfile|union select all|concat ?\(user_|insert into.{1,100}file_put_contents)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,multimatch,msg:'Atomicorp.com WAF Rules: SQL injection with payload - base64 encoded',id:381025,rev:4,logdata:'%{TX.0}',severity:'2',tag:'SQLi'" +SecMarker END_SQL_INJECTION_RULE_2 + +SecRule REQUEST_URI|XML:/*|ARGS|!ARGS:contenido|!ARGS:/sql/|!ARGS:/^Cms_Page/|!ARGS:prefix|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:query|!ARGS:/message/|!ARGS:/narrative/|!ARGS:areas|!ARGS:templatecode "@pm file_put_contents select outfile exec passthru serialize" "phase:2,id:333803,t:none,t:urlDecodeUni,t:removeComments,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334364,t:none,pass,nolog,noauditlog,skipAfter:END_SQL_INJECTION_RULE_3" + +#PHP shell code SQL injection +SecRule REQUEST_URI|XML:/*|ARGS|!ARGS:/insertstring/|!ARGS:contenido|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/narrative/|!ARGS:templatecode|!ARGS:/^Cms_Page/|!ARGS:pagetext|!ARGS:/database/|!ARGS:areas "(?:(?:\bunion\b.{1,100}?\bselect\b.{1,100}?php.{1,100}?(?:system|eval ?\(|shell_exec|preg_\w+|passthru|create_function|serialize|exec).{1,100}?into)|select.{1,100}?(?:php|perl).{1,100}?into outfile|insert into.{1,100}file_put_contents)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,msg:'Atomicorp.com WAF Rules: SQL injection with PHP/PERL payload - hex encoded',id:381026,rev:3,logdata:'%{TX.0}',severity:'2',tag:'SQLi'" +SecMarker END_SQL_INJECTION_RULE_3 + +#SQL inline command attack with more AE cases +SecRule ARGS|XML:/*|!ARGS:SAMLResponse|!ARGS:areas|!ARGS:templatecode|!ARGS:/^Cms_Page/|!ARGS:/txt/|!ARGS:/text/|!ARGS:/teaser/|!ARGS:wpSummary|!ARGS:/narrative/|!ARGS:templatecode|!ARGS:/insertstring/|!ARGS:areas|!ARGS:contenido|!ARGS:/sql/|!ARGS:prefix|!ARGS:content|!ARGS:file_content|!ARGS:query|!ARGS:/descr/|!ARGS:/body/|!ARGS:/text/|!ARGS:fck_tw_body|!ARGS:sub|!ARGS:msg_body|!ARGS:saved_data|!ARGS:fck_body|!ARGS:text|!ARGS:form[pagina_text]|!ARGS:description|!ARGS:/message/|!ARGS:content|!ARGS:/report/ "@pm char execute convert delete insert select drop create table declare null accesslevel user_name concat( union case xecresultset ;set @ cast" "phase:2,id:333804,t:none,t:replaceNulls,t:urlDecodeUni,t:compressWhiteSpace,t:replaceComments,t:compressWhiteSpace,multiMatch,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334365,t:none,pass,nolog,noauditlog,skipAfter:END_SQL_INJECTION_RULE_4" + +SecRule ARGS|XML:/*|!ARGS:/replaceAll/|!ARGS:areas|!ARGS:/^wpt_/|!ARGS:field_value_mapping|!ARGS:/post_code/|!ARGS:tHtml|!ARGS:/_dnn/|!ARGS:actionFilter|!ARGS:Error|!ARGS:code|!ARGS:thecode|!ARGS:param[DEFAULTVALUE]|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:templatecode|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:data|!ARGS:resolution|!ARGS:/prependTo/|!ARGS:/appendTo/|!ARGS:/prevObject/|!ARGS:/^Cms_Page/|!ARGS:json|!ARGS:/php/|!ARGS:wpSummary|!ARGS:/teaser/|!ARGS:fdata|!ARGS:file_content|!ARGS:/narrative/|!ARGS:data|!ARGS:/database/|!ARGS:/sql/|!ARGS:prefix|!ARGS:contenido|!ARGS:query|!ARGS:/descr/|!ARGS:/body/|!ARGS:/text/|!ARGS:/txt/|!ARGS:fck_tw_body|!ARGS:sub|!ARGS:msg_body|!ARGS:saved_data|!ARGS:fck_body|!ARGS:description|!ARGS:/message/|!ARGS:/content/|!ARGS:comment|!ARGS:p_action|!ARGS:/report/|!ARGS:/narrative/|!ARGS:/FCKeditor/ "(?:\w ?(?:user|and) {1,100}. char\([0-9]| \b(?:execute|convert)\(|; ?\bdelete\b.{1,100}?;(?:insert|declare ?\@|varchar) ?|and .{1,100} \( ?select .{1,100} from |\bdrop\b {1,100}. table |(?:declare|convert) .{1,100} varchar\(|null ?, ?(?:null ?, ?(?:null|accesslevel|user_name)) ?,|\bconcat\(|union select |union all select|\bcast\b .{1,50}\( as |xecresultset|' ?; ?declare\b @|; ?set @|select (?:load_file|char\()|(?:insert|remark)test ?;|\bcreate\b table [a-z0-9]+ \()" "chain,phase:2,deny,log,auditlog,status:403,capture,id:340159,t:none,t:urlDecodeUni,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,t:lowercase,rev:39,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection (MM)',logdata:'%{TX.0}',multiMatch,tag:'SQLi'" +SecRule REQUEST_URI "!(?:/install/index\.php|/admin/fetch_data_af\.php\?action=create_txt_file_from_af_table$|/admin/structure/feeds/edit|^/([a-z]+/)?wp-admin/(?:admin|options-general)\.php\?page=wpsc-settings|/horde/services/ajax\.php/kronolith|^/\?option=com_easyblog|^/administrator/index.php?option=com_droptables|^/dev/node/|^/node/[0-9]+)" "t:none,t:lowercase" + +SecMarker END_SQL_INJECTION_RULE_4 + +SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:SAMLResponse|!ARGS:/^Cms_Page/|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:areas|!ARGS:templatecode|!ARGS:/narrative/|!ARGS:wpSummary|!ARGS:/database/|!ARGS:/text/|!ARGS:pass|!ARGS:meta_descr|!ARGS:text|!ARGS:edited|!ARGS:content|!ARGS:description|!ARGS:introtext|!ARGS:Post|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:itembigtext|!ARGS:article_content|!ARGS:body|!ARGS:mytextarea|!ARGS:ll_content_message|!ARGS:page-content|!ARGS:reply|!ARGS:xml|!ARGS:content_en|!ARGS:filecontent|!ARGS:message|!ARGS:content_en|!ARGS:general[description]|!ARGS:response[14]|!ARGS:article|!ARGS:wptextbox1 "@pm cast xecresults declare" "phase:2,id:333805,t:none,t:replaceComments,t:compressWhiteSpace,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334366,t:none,pass,nolog,noauditlog,skipAfter:END_SQL_INJECTION_RULE_5" + +#SQL Injection cases +SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|!REQUEST_COOKIES_NAMES:/utm/|!REQUEST_COOKIES_NAMES:/_pk_ref/|REQUEST_URI|ARGS|ARGS_NAMES|!ARGS:/^Cms_Page/|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:code|!ARGS:wpSummary|!ARGS:areas|!ARGS:templatecode|!ARGS:comment|!ARGS:/database/|!ARGS:/text/|!ARGS:pass|!ARGS:meta_descr|!ARGS:text|!ARGS:edited|!ARGS:content|!ARGS:description|!ARGS:introtext|!ARGS:Post|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:itembigtext|!ARGS:article_content|!ARGS:body|!ARGS:mytextarea|!ARGS:ll_content_message|!ARGS:page-content|!ARGS:reply|!ARGS:xml|!ARGS:content_en|!ARGS:filecontent|!ARGS:/message/|!ARGS:content_en|!ARGS:general[description]|!ARGS:response[14]|!ARGS:article|!ARGS:wptextbox1 "(?:\bcast\b .{1.100} ?\(.{1,100} as |xecresultset|; ?declare\b ?\@)" "phase:2,deny,log,auditlog,status:403,capture,id:340164,t:none,t:replaceComments,t:compressWhiteSpace,t:lowercase,rev:11,severity:2,msg:'Atomicorp.com WAF Rules: SQL Injection Attack',logdata:'%{TX.0}',tag:'SQLi'" +SecMarker END_SQL_INJECTION_RULE_5 + +SecRule ARGS|REQUEST_URI|XML:/*|REQUEST_HEADERS|ARGS_NAMES|!ARGS:SAMLResponse|!ARGS:/^Cms_Page/|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:contenido|!ARGS:/report/|!ARGS:wpSummary|!ARGS:/teaser/|!ARGS:/txt/|!ARGS:/narrative/|!ARGS:/text/|!ARGS:areas|!ARGS:templatecode "@pm = char( varchar execute convert delete insert declare select drop create table convert( null accesslevel user_name concat( union cast xecresultset" "phase:2,id:333806,t:none,t:replaceComments,t:compressWhiteSpace,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334367,t:none,pass,nolog,noauditlog,skipAfter:END_SQL_INJECTION_RULE_6" +#Always bad SQL injection case w/ antievasion +#SecRule ARGS|!ARGS:/^fulltext/|!ARGS:message|ARGS_NAMES|REQUEST_FILENAME|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|!ARGS:topicseen|!ARGS_NAMES:posted_data[product_substring]|!REQUEST_HEADERS:X-PageView "\b(\d+) ?= ?\1\b|[\'\"](\w+)[\'\"] ?= ?[\'\"]\2\b" +SecRule ARGS|!ARGS:Db_submit|!ARGS:/installcode/|!ARGS:/^fulltext/|!ARGS:contenido|!ARGS:/sql/|!ARGS:prefix|!ARGS:wpSummary|!ARGS:query|!ARGS:message|ARGS_NAMES|!ARGS:/narrative/|REQUEST_HEADERS|!ARGS:/^Cms_Page/|!ARGS:areas|!ARGS:/database/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:templatecode|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|!ARGS:comment|!ARGS:topicseen|!ARGS_NAMES:posted_data[product_substring]|!REQUEST_HEADERS:X-PageView "\b(\d+) ?= ?\1\b|[\'\"](\w+)[\'\"] ?= ?[\'\"]\2\b" "phase:2,deny,log,auditlog,status:403,capture,id:340156,capture,t:none,t:htmlEntityDecode,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,rev:14,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL injection protection',logdata:'%{TX.0}',logdata:'%{TX.0}',tag:'SQLi'" + +SecRule REQUEST_URI "(?:/install/index\.php|/index\.php\?mode=install&sub=create_table$|^/admin/test/examples/txtsqladmin/index\.php|^/store/images/|^/([a-z]+/)?wp-admin/(?:admin|options-general)\.php\?page=wpsc-settings|/horde/services/ajax\.php/kronolith)" "phase:2,t:none,t:lowercase,id:344368,pass,nolog,noauditlog,skipAfter:END_RULE_340157" + +#SQL inline command attac +SecRule REQUEST_HEADERS|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|!REQUEST_COOKIES|XML:/*|ARGS|!ARGS:article|!ARGS:/post_code/|!ARGS:error|!ARGS:thecode|!ARGS:/template/|!ARGS:/replaceAll/|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:/prependTo/|!ARGS:/^Cms_Page/|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:/appendTo/|!ARGS:json|!ARGS:panels_data|!ARGS:field_value_mapping|!ARGS:data|!ARGS:areas|!ARGS:/^field_aut_content/|!ARGS:/^field_id/|!ARGS:actionFilter|!ARGS:post_excerpt|!ARGS:post_content|!ARGS:/^body/|!ARGS:response|!ARGS:/wp_autosave/|!ARGS:SAMLResponse|!ARGS:templatecode|!ARGS:contenido|!ARGS:/txt/|!ARGS:/text/|!ARGS:/teaser/|!ARGS:wpSummary|!ARGS:/narrative/|!ARGS:/installcode/|!ARGS:/php/|!ARGS:content|!ARGS:file_content|!ARGS:faqs_answer|!ARGS:/^para/|!ARGS:keywords|!ARGS:code|!ARGS:/sql/|!ARGS:prefix|!ARGS:data|!ARGS:/database/|!ARGS:/description/|!ARGS:alternate1|!ARGS:comment|!ARGS:body|!ARGS:fulldescr|!ARGS:article_content|!ARGS:query|!ARGS:/text/|!ARGS:txt|!ARGS:action|!ARGS:Db_submit|!ARGS:saved_data|!ARGS:form[pagina_text]|!ARGS:/message/|!ARGS:steps|!ARGS:fck_body|!ARGS:p_action|!ARGS:newcontent|!ARGS:/report/|!ARGS:/narrative/|!ARGS:/FCKeditor/ "(?:\w ?(?:user|and)(\w+)char ?\([0-9]| \b(?:execute|convert) ?\(|; ?\bdelete\b.{1,100}?; ?(?:insert|declare @|varchar) ?|\bdrop\b .{1,100} table |(?:declare|convert) .{1,100} varchar\(|null ?, ?null ?, ?(?:accesslevel|user_?name) ?,|\bconcat\(|union select |union all select|xecresultset|' ?; ?declare\b ?@|; ?set @|select (?:load_file|char ?\()|(?:insert|remark)test;|\bcreate\b table [a-z0-9]+ \()" "phase:2,deny,log,auditlog,status:403,capture,id:340157,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,rev:38,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection',logdata:'%{TX.0},%{matched_var_name}',tag:'SQLi'" +SecMarker END_RULE_340157 + +#additional SQL injection checks on cookies +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/utm/ "(?:(\w+)(?:user|and)(\w+)char\([0-9]+\)|\b(?:execute|convert)\(|; ?\bdelete\b.{1,100}?; ?(?:insert|declare @|varchar) ?|and .{1,100} \(select |\b(?:drop|create)\b(\w+)table\b|(?:declare|convert) .{1,100} varchar\(|null ?, ?null ?, ?(?:accesslevel|user_?name) ?,|concat\(|union select |union all select|\bcast\b ?\(.{1,100} as |xecresultset|' ?; ?declare\b ?@|; ?set @|select (?:load_file|char\()|(?:insert|remark)test;)" "phase:2,deny,log,auditlog,status:403,capture,id:340181,t:none,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Generic SQL inline command protection',logdata:'%{TX.0}',tag:'SQLi'" +SecMarker END_SQL_INJECTION_RULE_6 + +SecMarker END_SQL_CHECKS_3 + +SecMarker END_SQL_CHECKS_EVERYTHING + +############ COMMAND INJECTION RULES ######################### + +#Needs work, too greedy +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|!ARGS:shortcodes|!ARGS:/content/|!ARGS:/scripttag/|!ARGS:/description/|!ARGS:/wp_autosave/|!ARGS:/html/|!ARGS:/text/|!ARGS:/message/|!ARGS:answer|!ARGS:affiliatelinks|!ARGS:body|!ARGS:/body/|!ARGS:/comment/|!ARGS:/signature/ "@rx (?:\$(?:\((?:\(.*\)|.*)\)|\{.*\})|[<>]\(.*\))" "phase:2,status:403,deny,id:393655,rev:15,t:none,t:urlDecodeUni,t:cmdLine,capture, msg:'Atomicorp.com WAF Rules: Possible Remote Command Execution: Unix Shell Expression Found',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',tag:'attack-rce',ctl:auditLogParts=+E,log,auditlog" + +SecRule REQUEST_URI|REQUEST_COOKIES|!REQUEST_COOKIES:/utm/|!REQUEST_COOKIES:/_pk_ref/|ARGS|!ARGS:fileContent|!ARGS:title|!ARGS:templatecode|!ARGS:areas|!ARGS:/template/ "@pm exec cmd cd ls pwd perl echo uname curl kill sh cp python chown rm rsync rdiff-backup wget ftpget links g++ chgrp chown passwd bash telnet wguest csh tcsh wsh fetch dash rcmd ftp cmd32 nmap net nc \# \| \; \` ping sleep benchmark || powershell" "phase:2,id:333807,rev:2,t:none,t:urlDecodeUni,t:cmdline,t:normalizePath,multimatch,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334368,t:none,pass,nolog,noauditlog,skipAfter:END_CMD_INJECTION_RULE_1" + +# HTTP/1.1 +SecRule REQUEST_URI|REQUEST_HEADERS|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS|!ARGS:/message/|ARGS_NAMES|XML:/* "<(?:\!--\#includefile=|\?=\$_post\[0\])" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeComments,t:removewhitespace,t:lowercase,msg:'Atomicorp.com WAF Rules: Code injection',id:380027,rev:2,logdata:'%{TX.0}',severity:'2',tag:'RCE'" + +#python/object/new +SecRule REQUEST_URI|REQUEST_HEADERS|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS|!ARGS:/message/|ARGS_NAMES|XML:/* "(?:\!python/object/new|onerrorresumenext\:function)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeComments,t:removewhitespace,t:lowercase,msg:'Atomicorp.com WAF Rules: Code injection',id:380028,rev:1,logdata:'%{TX.0}',severity:'2',tag:'RCE'" + +#$IFS$ +SecRule REQUEST_URI|REQUEST_HEADERS|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS|!ARGS:/message/|ARGS_NAMES|XML:/* "\$IFS\$" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeComments,t:removewhitespace,t:lowercase,msg:'Atomicorp.com WAF Rules: Code injection',id:344377,rev:1,logdata:'%{TX.0}',severity:'2',tag:'RCE'" + +#(printf +#|/bin/id| +#; cat / +SecRule REQUEST_URI|REQUEST_HEADERS|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS|!ARGS:/message/|ARGS_NAMES|XML:/* "(?:\(printf|\| ?/bin/id ?\|; cat /)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeComments,t:compresswhitespace,t:lowercase,msg:'Atomicorp.com WAF Rules: Code injection',id:344376,rev:1,logdata:'%{TX.0}',severity:'2',tag:'RCE'" + +SecMarker END_CMD3_ALL + +#additional types +SecRule REQUEST_FILENAME "(?:\.(?:cgi|js(?:on|f|pa?)|pl|aspx?|cfml?|do)$|/cgi-?(?:bin|cdn)/|/[a-z]+-cgi/)" "phase:2,id:333810,pass,setvar:tx.nonphp=1,t:none,nolog,noauditlog,skipAfter:END_INJECTION_RULES_ALL" + +#Bad function rules +# Rule 340019: +#Generic PHP bad functions protection +#PHP copy() function: http://securitytracker.com/alerts/2006/Apr/1015882.html +SecRule ARGS "compress\.zlib ?:" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,id:340019,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Generic PHP bad functions protection'" + +#RFI/injection rules +SecRule ARGS|REQUEST_URI|!ARGS:templatecode|!ARGS:areas|!ARGS:/url/|!ARGS:SAMLResponse "@pm http:// https:// ftp:// ftps:// ogg:// tls:// data:// php:// zlib:// gopher:// compress.zlib connect phar:// rar:// expect:// zip:// ssh2:// dict:// ssh:// file:// ssl:// glob:// s3:// scp://" "phase:2,id:333812,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceNulls,t:compressWhiteSpace,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:334370,t:none,pass,nolog,noauditlog,skipAfter:END_INJECTION_RULES_ALL" + +#pdf, which may have an arg as part of an XSS attack but no other RFI methods +SecRule REQUEST_FILENAME "\.pdf$" "phase:2,id:333813,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_INJECTION_RULES" + +SecRule REQUEST_FILENAME "\.(?:xml|html?)$" "phase:2,id:333811,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_INJECTION_RULES_1" + +#Skip these rules if its not a POST or GET +SecRule REQUEST_METHOD "!(?:GET|POST)" "id:382191,phase:2,t:none,skipAfter:END_INJECTION_RULES_1,nolog,noauditlog,pass" + + +# Rule 340162: Generic PHP code injection protection in URI w/ anti-evasion +SecRule REQUEST_URI "(?:/(?:(?:wp-admin/(page|post|widgets|link|network/site-settings\.php|options|themes/basic/themify/img\.php\?src=|admin\.php?cf/cf\.php)|admin/(?:edittemplate|webpage_update|theme-options|add_edit_)|(?:signup|cpinquiry|profile))\.php|p(?:(?:hpbb\/install\/install\.ph|l\/download\?file=htt)p|roxy\/cb_proxy\.\?a=http:\/\/)|i(?:ndex\.php\/admin\/system_config\/save\/section\/payment\/|mp\/compose\.php)|tiki-(?:objectpermissions|editpage|view_cache)|jomsocial\/[a-z]+\/(?:edit|add))|^(?:\/(?:(?:[a-z0-9\-]+\/events\?(?:utm_|trk_)|node\/[0-9]+\/(?:edit|add)|[a-z]+\/unsubscribe)|(?:mysqldumper\/dump|xmlrpc)\.php$|go\.php\?u=affilorama&t=http:\/\/|\.services\/sitelogout)|/(?:b/ss/mxmacromedia|horde/services/go|node/add|cas/))|(?:(?:jw_allvideos_player|mod_mp3player)\?(?:file|playlist)=htt|ubbthreads\/admin\/dofeatures\.ph)p|ad-?server\/adjs|\?mode=addshout|^/administrator/index\.php\?option=com_rsform|^/index\.php/profile/register/registerprofile|^/[a-z]+/edit|^/(?:elements|admin/media)/(?:s(?:ave|ettings?)|appearance)/|^/panel\?comd=nlwebform|^/cocms/index\.php\?|^/ls_javascript_combine/|^/index\.php\?option=com_rsform|^/killboard/\?a=admin_idfeedsyndication|^/api/users|^/numo/module/form_handler/|^/admin/add_edit_document|^/\?br=|^/app\.php/dl_ext/\?view=upload|^/index\.php\?option=com_uniform|^/\?_task=mail|^/index\.php\?p=admin/actions/elements/|^/?amoptimizer_bundle_check|^/\?wc-ajax|^/index\.php\?get=film&doaction=resultat)" "phase:2,id:333814,rev:6,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_INJECTION_RULES_1" + +#SecRule ARGS "!@pmFromFile trusted-domains.txt" chain +SecRule ARGS|!ARGS:/^acf/|!ARGS:sld|!ARGS:carpeta|!ARGS:/wpforms/|!ARGS:imej|!ARGS:/saml/|!ARGS:/affwp/|!ARGS:/reason/|!ARGS:/container/|!ARGS:r|!ARGS:/^colissimo/|!ARGS:/refid/|!ARGS:/r3f5x9JS/|!ARGS:chl|!ARGS:/^tw247/|!ARGS:ujk|!ARGS:loc_db|!ARGS:/^woo/|!ARGS:pwd|!ARGS:/^objectTo/|!ARGS:1_1_8|!ARGS:/journal/|!ARGS:username|!ARGS:video|!ARGS:/website/|!ARGS:replace|!ARGS:/cdn/|!ARGS:/^xing/|!ARGS:ads|!ARGS:directories|!ARGS:/bookmark/|!ARGS:/case_name/|!ARGS:f_success|!ARGS:f_error|!ARGS:name|!ARGS:/userOption/|!ARGS:/brochure/|!ARGS:/target/|!ARGS:/^_d$/|!ARGS:klarna_order|!ARGS:/to$/|!ARGS:/schema/|!ARGS:protocol|!ARGS:str|!ARGS:/query/|!ARGS:/from/|!ARGS:/forward/|!ARGS:/^addon-/|!ARGS:/_script/|!ARGS:/graphic/|!ARGS:/virtuemart/|!ARGS:UF_VK|!ARGS:/powermail/|!ARGS:mp4|!ARGS:/confirmation/|!ARGS:/cloudflare/|!ARGS:/^ref_/|!ARGS:/hsw_ash/|!ARGS:/_online_/|!ARGS:/home/|!ARGS:installFull|!ARGS:b2w|!ARGS:/email/|!ARGS:term|!ARGS:/source_array/|!ARGS:/button/|!ARGS:/bestand/|!ARGS:/^request/|!ARGS:m_wb|!ARGS:/customfield/|!ARGS:/keyword/|!ARGS:embed|!ARGS:/cmsform/|!ARGS:/title/|!ARGS:social_network|!ARGS:scope|!ARGS:fb|!ARGS:/^vfb-/|!ARGS:to|!ARGS:pu|!ARGS:sima|!ARGS:/movie/|!ARGS:dns|!ARGS:contact_info|!ARGS:source_code|!ARGS:/_form/|!ARGS:listserv|!ARGS:p_zoho|!ARGS:sugarroot|!ARGS:cyswllt|!ARGS:/^attribute/|!ARGS:/^channel/|!ARGS:/^wdf_joodb/|!ARGS:/^replacer/|!ARGS:/^option/|!ARGS:/css_frame/|!ARGS:ad_code|!ARGS:tickets|!ARGS:war|!ARGS:slug|!ARGS:/whereto/|!ARGS:/search/|!ARGS:pack|!ARGS:origem|!ARGS:/extra_info/|!ARGS:str_sitio|!ARGS:post-id|!ARGS:xml|!ARGS:/metatags/|!ARGS:radio|!ARGS:shire|!ARGS:/^svc_id/|!ARGS:RelayState|!ARGS:ds_source|!ARGS:/^si_contact_/|!ARGS:next|!ARGS:clip|!ARGS:kotisivu|!ARGS:mb|!ARGS:jibber|!ARGS:pattern_select|!ARGS:wordpress_extra|!ARGS:origin|!ARGS:fail|!ARGS:success|!ARGS:move_to|!ARGS:/^es-field/|!ARGS:/^listingfields/|!ARGS:svc_id|!ARGS:/^constant_contact/|!ARGS:hq|!ARGS:/flsrv/|!ARGS:svc_id|!ARGS:junkWords|!ARGS:/foto/|!ARGS:/^attr_/|!ARGS:name_ip|!ARGS:/stream/|!ARGS:canonical|!ARGS:/addy/|!ARGS:rel_path|!ARGS:aim|!ARGS:api|!ARGS:details|!ARGS:/^field/|!ARGS:profile_id|!ARGS:/^complete_action/|!ARGS:/buzz/|!ARGS:cc_list_id|!ARGS:/jform/|!ARGS:/liveUpdate/|!ARGS:/service/|!ARGS:marqueur|!ARGS:/vertex/|!ARGS:metavalue|!ARGS:binary|!ARGS:snippet|!ARGS:/^ZA_ARTICLE/|!ARGS:obr|!ARGS:/xcpr_/|!ARGS:/pic/|!ARGS:/plaatje/|!ARGS:profile|!ARGS:repository|!ARGS:os|!ARGS:ticketmaster|!ARGS:/destination/|!ARGS:r|!ARGS:/speedtest/|!ARGS:voice|!ARGS:/live$/|!ARGS:/tripadvisor/|!ARGS:/itune/|!ARGS:lang_default_value|!ARGS:weather|!ARGS:/metakey/|!ARGS:/^pass/|!ARGS:/password/|!ARGS:/note/|!ARGS:/form_/|!ARGS:/theme/|!ARGS:ip|!ARGS:/afbeelding/|!ARGS:/screenshot/|!ARGS:/^input_/|!ARGS:embed_code|!ARGS:/^flb/|!ARGS:gwefan|!ARGS:/xthreads/|!ARGS:flv|!ARGS:dest|!ARGS:languageChange|!ARGS:/^perch_/|!ARGS:music|!ARGS:/^p_posts/|!ARGS:/resolv/|!ARGS:/^install_package/|!ARGS:/address/|!ARGS:application|!ARGS:refsrc|!ARGS:hp|!ARGS:/censor/|!ARGS:UpdateNote|!ARGS:regx_root|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:/^cf/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:/return/|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:loc|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/photo/|!ARGS:/media/|!ARGS:parent_name|!ARGS:back|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/twitter/|!ARGS:/flickr/|!ARGS:/youtube/|!ARGS:/blog/|!ARGS:/vid/|!ARGS:_update_failure|!ARGS:_update_success|!ARGS:importremote|!ARGS:hdwok|!ARGS:hdwnook|!ARGS:OpenID|!ARGS:/^akID/|!ARGS:/^hilit/|!ARGS:/reciprocal/|!ARGS:/callback/|!ARGS:subject|!ARGS:/sponsors/|!ARGS:want2Read|!ARGS:direct|!ARGS:/thumb/|!ARGS:fflv|!ARGS:direct|!ARGS:source_location|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:wlp|!ARGS:/openid/|!ARGS:/adres/|!ARGS:/logo/|!ARGS:go|!ARGS:/^utm/|!ARGS:resolution|!ARGS:/export/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:path[alias]|!ARGS:/message/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:ucapi|!ARGS:/click/|!ARGS:rf|!ARGS:sourcetitle|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:/^win/|!ARGS:lec_rm|!ARGS:n-state|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:/server/|!ARGS:confirm|!ARGS:/^groups/|!ARGS:prodDownload|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:/body/|!ARGS:/^product_long_/|!ARGS:/content/|!ARGS:/banner/|!ARGS:heading|!ARGS:cl_post|!ARGS:/msg/|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/desc/|!ARGS:customer_footer|!ARGS:FAQTitle|!ARGS:/host/|!ARGS:/text/|!ARGS:/Piwik/|!ARGS:admin_footer|!ARGS:showStr|!ARGS:/http/|!ARGS:fetch|!ARGS:/txt/|!ARGS:mesg|!ARGS:forward|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:footer_scripts|!ARGS:u|!ARGS:/header/|!ARGS:action|!ARGS:cptpl_dir|!ARGS:arg6|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:cat_sponsor|!ARGS:stretch|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:/usps_label/|!ARGS:/story/|!ARGS:vinculo|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:soundname|!ARGS:/^bbcode_/|!ARGS:/vimeo/|!ARGS:/link/|!ARGS:request_uri|!ARGS:/shopvk/|!ARGS:/google/|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:Comentario|!ARGS:/^dynadata/|!ARGS:paypal_ipn|!ARGS:title|!ARGS:/frame/|!ARGS:l1_bdy|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:uri|!ARGS:/^ViewState/|!ARGS:postvars|!ARGS:base1|!ARGS:layout|!ARGS:GMAP_KEY|!ARGS:source|!ARGS:set_static_uri_to|!ARGS:Infos|!ARGS:rev_you_tube|!ARGS:GMAP_KEY|!ARGS:newsBody|!ARGS:user_sig|!ARGS:cur|!ARGS:yahoo|!ARGS:sig|!ARGS:KT_Update1|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:sm_b_style|!ARGS:success|!ARGS:/^css/|!ARGS:vthumb|!ARGS:introduction|!ARGS:register_at|!ARGS:revnews_ad_120|!ARGS:/icon/|!ARGS:/ftp/|!ARGS:button_dir|!ARGS:x_organizational|!ARGS:answer|!ARGS:intro|!ARGS:/about_us/|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:problem|!ARGS:archive_chrono|!ARGS:thm|!ARGS:_RW_|!ARGS:/rss/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redirect/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:helpbox|!ARGS:redir|!ARGS:ret|!ARGS:oaparams|!ARGS:loc|!ARGS:resource|!ARGS:wimpyApp|!ARGS:wimpySkin|!ARGS:params[altTag]|!ARGS:inc|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:Post|!ARGS:reply|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:stories_cat|!ARGS:view|!ARGS:howhear|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:/signature/|!ARGS:disc|!ARGS:utmr|!ARGS:Query|!ARGS:steps|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:storage_path|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:/^wimpy/|!ARGS:/_ref/|!ARGS:/^pr_/|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^rsargs/|!ARGS:op|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:ret|!ARGS:area|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:st_widget|!ARGS:def|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:/GlobalFooter/|!ARGS:/^dynafield/|!ARGS:wysiwyg|!ARGS:banner|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:/license/|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:/^k2extra/|!ARGS:github|!ARGS:linkedin|!ARGS:stack_overflow "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)://(.*)$" "phase:2,deny,log,auditlog,status:403,capture,id:340162,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,chain,rev:308,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection Attack detected (Unauthorized URL detected as argument)',logdata:'%{TX:0},%{matched_var_name}'" +SecRule TX:1 "!@beginsWith %{request_headers.host}" "t:none,t:lowercase" +#SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" "t:none,t:urlDecodeUni,t:lowercase" + + +#if its not encoded (which is why we dont use the transform), skip it as its already been reviewed in 340162 +SecRule REQUEST_URI "=(?:ht|f)tps?://" "phase:2,id:333815,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_INJECTION_RULES_1" + +# Rule 340165: Generic PHP code injection protection in URI w/ anti-evasion for encoded cases where ARGS doesnt work +SecRule REQUEST_URI "\://%{SERVER_NAME}/" "phase:2,id:333816,pass,t:none,t:urlDecodeUni,t:lowercase,nolog,noauditlog,skipAfter:END_INJECTION_RULES_1" +SecRule REQUEST_URI "(?:(?:site|ur(?:l|i)\]?|s(?:earch|itemap|earch(?:text|key)|ubject|ervice|rc)|r(?:dfrom|equest)|utm_(?:source|term|c(?:tr|ontent))|owa_[a-z0-9]+|value|virtuemart|l(?:oc|ink)|off|war|youtube_id|k(?:eywords?|larna_order)|vid|next|snip?pet|feeds|name_ip|profile_id|details|go|r(?:esource|e(?:turn|f|pository|f?fer))|b(?:inary|vpage|ack|2w)|dns|media|page|hostname|filter[a-z]+|location|img|picture|path|\&u|destination|img_select|pattern_select|target|targetservice|web|referr?er|field-1|image|video|redirect|to|mp4|str|plugin_source|url_spam|chl|refid|r) ?= ?https?://|/\?(?:r(?:eturn|edirect)|redirect_to|br)=http|=https?://localhost/|^/site-content/|^/[a-z0-9\/\-]+/(?:new|edit)/[0-9]+/(?:confirm|edit)$|^/staff/index\.php\?_m=ticket|^/ar/l\?|^/index\.php\?(?:\&eid=powermaileidmarketing|route=checkout/checkout&edit&setting_id=[0-9]+&admin=http)|^/amember/admin-users/autocomplete?term=|^\?amoptimizer_bundle_check)" "phase:2,id:333817,rev:17,pass,t:none,t:urlDecodeUni,t:lowercase,nolog,noauditlog,skipAfter:END_INJECTION_RULES_1" + +SecRule REQUEST_URI "!(^/index\.php\?cmd=hbchat|^/wp-admin/admin\.php|cf/cf\.php|^/index\.php\?segment=pageurl|^/wp-admin/post-new\.php\?(calypsoify=[0-9]+)?&?(block-editor=[0-9]+)?&?frame-nonce=[0-9]+\:[0-9]+\:[a-f0-9]+&origin=http)" "chain,phase:2,deny,log,auditlog,status:403,capture,id:340165,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,rev:292,severity:2,msg:'Atomicorp.com WAF Rules: Uniencoded possible Remote File Injection attempt in URI (AE)',logdata:'%{MATCHED_VAR}'" +SecRule REQUEST_URI "=(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)://" "t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase" + +SecMarker END_INJECTION_RULES_1 + + +#include injection attack +SecRule REQUEST_URI "^/admin/structure/block/manage" "phase:2,id:353896,pass,t:none,t:urlDecodeUni,t:lowercase,nolog,noauditlog,skipAfter:END_INJECTION_RULES_340855" +##include(http://bad) +SecRule ARGS|!ARGS:filecontent|!ARGS:/gen_header/|!ARGS:/template/|!ARGS:/content/|!ARGS:/description/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/message/ "include ?\(['\" ]?['\" ]?['\" ]? ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(ht|f)tps?):/" "phase:2,deny,log,auditlog,status:403,capture,id:340855,t:none,t:urlDecodeUni,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,t:lowercase,chain,rev:9,severity:2,msg:'Atomicorp.com WAF Rules: Include Remote File Injection attempt in argument',logdata:'%{TX.0}'" +SecRule MATCHED_VAR "!(https?://%{SERVER_NAME}/)" + +SecMarker END_INJECTION_RULES_340855 + +# Rule 340031: remote file inclusion generic attack signature +SecRule REQUEST_URI "\.(?:dat|gif|jpe?g|png|bmp|txt|vir|dot)\?" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,chain,id:340031,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Remote file inclusion'" +SecRule REQUEST_URI|ARGS "(?:(?:pm_path|pagina|path|include_location|root|page|open)=(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)|(?:cmd|command|inc)=)" + +SecMarker END_INJECTION_RULES + +SecMarker END_INJECTION_RULES_ALL + +#types that do not have RFI at all +SecRule TX:STATIC "@eq 1" "phase:2,id:'334818',pass,t:none,nolog,noauditlog,skipAfter:END_INJECTION_RULES_MULTI" + +#additional types +SecRule TX:NONPHP "@eq 1" "phase:2,id:'333818',pass,t:none,nolog,noauditlog,skipAfter:END_INJECTION_RULES_MULTI" + +#File types that may have args, but can not be injected +SecRule REQUEST_URI "^/eprocservice/supplierinboundservice" "phase:2,id:337819,rev:2,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_INJECTION_RULES_MULTI" +# +#RFI/injection rules +SecRule ARGS|REQUEST_URI|!ARGS:SAMLResponse|!ARGS:templatecode|!ARGS:areas "@pm http:// https:// ftp:// ftps:// ogg:// tls:// zlib:// gopher:// compress.zlib" "phase:2,id:333819,t:none,t:replaceNulls,t:compressWhitespace,t:urlDecodeUni,multimatch,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:334371,t:none,pass,nolog,noauditlog,skipAfter:END_INJECTION_RULES_MULTI" + +# Rule 340038: +# Header anomaly for texture compression +SecRule REQUEST_HEADERS:Content-Encoding "Texture" "phase:1,log,auditlog,deny,status:501,msg:'Atomicorp.com WAF Rules: Header Anomaly (Texture)',id:340038" + + +SecRule REQUEST_METHOD "!(?:GET|POST)" "id:371112,phase:2,t:none,skipAfter:END_INJECTION_RULES_MULTI,nolog,noauditlog,pass" + +# Rule 340163: Generic PHP code injection protection in URI w/ anti-evasion and multimatch +SecRule REQUEST_URI "(?:\/(?:(?:wp-admin\/(page|post|widgets|network/site-settings\.php|link|options|themes/basic/themify/img\.php\?src=|admin\.php?cf/cf\.php)|admin\/(?:edittemplate|webpage_update|theme-options|add_edit_)|(?:signup|cpinquiry|profile))\.php|p(?:(?:hpbb\/install\/install\.ph|l\/download\?file=htt)p|roxy\/cb_proxy\.\?a=http:\/\/)|i(?:ndex\.php\/admin\/system_config\/save\/section\/payment\/|mp\/compose\.php)|tiki-(?:objectpermissions|editpage|view_cache)|jomsocial\/[a-z]+\/(?:edit|add))|^(?:\/(?:(?:[a-z0-9\-]+\/events\?(?:utm_|trk_)|node\/[0-9]+\/(?:edit|add)|[a-z]+\/unsubscribe)|(?:mysqldumper\/dump|xmlrpc)\.php$|go\.php\?u=affilorama&t=http:\/\/|\.services\/sitelogout)|/(?:b/ss/mxmacromedia|horde/services/go|node/add|cas/))|(?:(?:jw_allvideos_player|mod_mp3player)\?(?:file|playlist)=htt|ubbthreads\/admin\/dofeatures\.ph)p|ad-?server\/adjs|\?mode=addshout|^/administrator/index\.php\?option=com_rsform|^/index\.php/profile/register/registerprofile|^/[a-z]+/edit|^/(?:admin/media|elements)/(?:s(?:ave|ettings?)|appearance)/|^/index\.php\?loginerror=incorrectpassword$|^/panel\?comd=nlwebform|^/cocms/index\.php\?s=|^/ls_javascript_combine/|^/index\.php\?option=com_rsform|^/killboard/\?a=admin_idfeedsyndication|^/api/users|^/numo/module/form_handler/|^/admin/add_edit_document|^/\?br=|^/app\.php/dl_ext/\?view=upload|^/index\.php\?option=com_uniform|^/\?_task=mail|^/index\.php\?p=admin/actions/elements/|^/?amoptimizer_bundle_check|^/\?wc-ajax|^/index\.php\?get=film&doaction=resultat)" "phase:2,id:333702,rev:6,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_INJECTION_RULES_MULTI" + +SecRule ARGS|!ARGS:/^acf/|!ARGS:/^colissimo/|!ARGS:sld|!ARGS:carpeta|!ARGS:imej|!ARGS:/saml/|!ARGS:/affwp/|!ARGS:/search/|!ARGS:/containers/|!ARGS:r|!ARGS:/refid/|!ARGS:/r3f5x9JS/|!ARGS:chl|!ARGS:/^tw247/|!ARGS:ujk|!ARGS:_custom_|!ARGS:loc_db|!ARGS:/^woo/|!ARGS:/^replace/|!ARGS:pwd|!ARGS:/^objectTo/|!ARGS:1_1_8|!ARGS:/journal/|!ARGS:username|!ARGS:/website/|!ARGS:video|!ARGS:fb|!ARGS:/cdn/|!ARGS:/^xing/|!ARGS:directories|!ARGS:/bookmark/|!ARGS:/case_name/|!ARGS:f_success|!ARGS:f_error|!ARGS:/userOption/|!ARGS:name|!ARGS:/target/|!ARGS:/^_d$/|!ARGS:klarna_order|!ARGS:/to$/|!ARGS:/schema/|!ARGS:/brochure/|!ARGS:protocol|!ARGS:str|!ARGS:/query/|!ARGS:/from/|!ARGS:/forward/|!ARGS:/_script/|!ARGS:ads|!ARGS:/^addon-/|!ARGS:application|!ARGS:/graphic/|!ARGS:/virtuemart/|!ARGS:UF_VK|!ARGS:/powermail/|!ARGS:mp4|!ARGS:/confirmation/|!ARGS:/cloudflare/|!ARGS:/^ref_/|!ARGS:/hsw_ash/|!ARGS:/_online_/|!ARGS:/reason/|!ARGS:installFull|!ARGS:b2w|!ARGS:/^es-field/|!ARGS:term|!ARGS:/email/|!ARGS:/source_array/|!ARGS:/button/|!ARGS:/bestand/|!ARGS:/^request/|!ARGS:m_wb|!ARGS:/customfield/|!ARGS:/shopvk/|!ARGS:/keyword/|!ARGS:embed|!ARGS:/^cmsform/|!ARGS:social_network|!ARGS:scope|!ARGS:/^vfb-/|!ARGS:to|!ARGS:pu|!ARGS:/^meta/|!ARGS:sima|!ARGS:/movie/|!ARGS:dns|!ARGS:source_code|!ARGS:/_form/|!ARGS:listserv|!ARGS:p_zoho|!ARGS:sugarroot|!ARGS:cyswllt|!ARGS:/^attribute/|!ARGS:/^channel/|!ARGS:/^wdf_joodb/|!ARGS:options[alter][path]|!ARGS:/css_frame/|!ARGS:ad_code|!ARGS:tickets|!ARGS:war|!ARGS:slug|!ARGS:/whereto/|!ARGS:pack|!ARGS:/extra_info/|!ARGS:origem|!ARGS:str_sitio|!ARGS:post-id|!ARGS:/metatags/|!ARGS:xml|!ARGS:radio|!ARGS:shire|!ARGS:/^svc_id/|!ARGS:/live$/|!ARGS:RelayState|!ARGS:ds_source|!ARGS:/contact_/|!ARGS:next|!ARGS:clip|!ARGS:txt|!ARGS:kotisivu|!ARGS:mb|!ARGS:jibber|!ARGS:wordpress_extra|!ARGS:origin|!ARGS:pattern_select|!ARGS:fail|!ARGS:success|!ARGS:move_to|!ARGS:/^listingfields/|!ARGS:svc_id|!ARGS:/_contact/|!ARGS:hq|!ARGS:/flsrv/|!ARGS:svc_id|!ARGS:/foto/|!ARGS:junkWords|!ARGS:name_ip|!ARGS:/stream/|!ARGS:canonical|!ARGS:/addy/|!ARGS:rel_path|!ARGS:aim|!ARGS:/^field/|!ARGS:details|!ARGS:/^complete_action/|!ARGS:profile_id|!ARGS:api|!ARGS:/^option_value/|!ARGS:button_src|!ARGS:cc_list_id|!ARGS:/buzz/|!ARGS:/jform/|!ARGS:/liveUpdate/|!ARGS:/service/|!ARGS:marqueur|!ARGS:/vertex/|!ARGS:metavalue|!ARGS:binary|!ARGS:snippet|!ARGS:/^ZA_ARTICLE/|!ARGS:obr|!ARGS:^/xcpr_/|!ARGS:/pic/|!ARGS:/plaatje/|!ARGS:profile|!ARGS:repository|!ARGS:/export/|!ARGS:os|!ARGS:ticketmaster|!ARGS:/destination/|!ARGS:r|!ARGS:/speedtest/|!ARGS:voice|!ARGS:/tripadvisor/|!ARGS:/iTunes/|!ARGS:lang_default_value|!ARGS:weather|!ARGS:/metakey/|!ARGS:/^pass/|!ARGS:/password/|!ARGS:/note/|!ARGS:/form_/|!ARGS:/theme/|!ARGS:ip|!ARGS:/afbeelding/|!ARGS:/screenshot/|!ARGS:embed_code|!ARGS:/^input_/|!ARGS:/^flb/|!ARGS:gwefan|!ARGS:/xthreads/|!ARGS:flv|!ARGS:languageChange|!ARGS:/^perch_/|!ARGS:music|!ARGS:/^p_posts/|!ARGS:/resolv/|!ARGS:/^install_package/|!ARGS:/address/|!ARGS:wlp|!ARGS:hp|!ARGS:refsrc|!ARGS:/censor/|!ARGS:UpdateNote|!ARGS:regx_root|!ARGS:file|!ARGS:/avatar/|!ARGS:obj_itop|!ARGS:/feed/|!ARGS:value_string_9|!ARGS:/^cf/|!ARGS:/uri/|!ARGS:color_chart|!ARGS:ui|!ARGS:armoury|!ARGS:reverbnation|!ARGS:/return/|!ARGS:/site/|!ARGS:_ref|!ARGS:owa_protocol|!ARGS:/home/|!ARGS:live|!ARGS:/^func_key/|!ARGS:/trackback/|!ARGS:gmaps|!ARGS:locationhp|!ARGS:pfad|!ARGS:CUSTID|!ARGS:/img/|!ARGS:/^obj_/|!ARGS:/photo/|!ARGS:/media/|!ARGS:/icon/|!ARGS:back|!ARGS:/facebook/|!ARGS:/instagram/|!ARGS:/pinterest/|!ARGS:/twitter/|!ARGS:/flickr/|!ARGS:/youtube/|!ARGS:parent_name|!ARGS:/blog/|!ARGS:/vid/|!ARGS:_update_failure|!ARGS:_update_success|!ARGS:hdwok|!ARGS:hdwnook|!ARGS:OpenID|!ARGS:/^hilit/|!ARGS:/reciprocal/|!ARGS:importremote|!ARGS:/callback/|!ARGS:/sponsors/|!ARGS:/^akID/|!ARGS:want2Read|!ARGS:/thumb/|!ARGS:subject|!ARGS:direct|!ARGS:fflv|!ARGS:direct|!ARGS:source_location/|!ARGS:/^fetch/|!ARGS:/web/|!ARGS:/openid/|!ARGS:/adres/|!ARGS:/logo/|!ARGS:go|!ARGS:resolution|!ARGS:/link/|!ARGS:/vimeo/|!ARGS:new_channel|!ARGS:/wsdl/|!ARGS:/soap/|!ARGS:path[alias]|!ARGS:/message/|!ARGS:/^utm/|!ARGS:fighter_name|!ARGS:/^element/|!ARGS:ucapi|!ARGS:clickTag1|!ARGS:rf|!ARGS:/title/|!ARGS:embeddump|!ARGS:/www/|!ARGS:/page/|!ARGS:hdwok|!ARGS:result|!ARGS:/^setting/|!ARGS:store|!ARGS:continue|!ARGS:/href/|!ARGS:lec_rm|!ARGS:n-state|!ARGS:eself|!ARGS:tax23_RefDocLoc|!ARGS:goback|!ARGS:OVRAW|!ARGS:outputfile|!ARGS:background|!ARGS:dcsref|!ARGS:path|!ARGS:ico|!ARGS:big|!ARGS:/^clickTagFrame/|!ARGS:/^attr/|!ARGS:gmu|!ARGS:entry|!ARGS:tos|!ARGS:/image/|!ARGS:user_xup|!ARGS:value_3|!ARGS:confirm|!ARGS:/^groups/|!ARGS:prodDownload|!ARGS:/^stylevar/|!ARGS:dcsqry|!ARGS:/^GARS_existing/|!ARGS:rules|!ARGS:/^config/|!ARGS:/^revchurch/|!ARGS:goto|!ARGS:loc|!ARGS:/body/|!ARGS:/^product_long/|!ARGS:/server/|!ARGS:/content/|!ARGS:/banner/|!ARGS:heading|!ARGS:cl_post|!ARGS:/msg/|!ARGS:/html/|!ARGS:arg2|!ARGS:/^cf_field_/|!ARGS:/comment/|!ARGS:enquiry|!ARGS:/desc/|!ARGS:/footer/|!ARGS:FAQTitle|!ARGS:/host/|!ARGS:/text/|!ARGS:/Piwik/|!ARGS:fetch|!ARGS:/pingback/|!ARGS:/http/|!ARGS:mesg|!ARGS:forward|!ARGS:announce_post|!ARGS:/^data/|!ARGS:/template/|!ARGS:teaser_js|!ARGS:/^item_/|!ARGS:u|!ARGS:/header/|!ARGS:action|!ARGS:cptpl_dir|!ARGS:arg6|!ARGS:copyright|!ARGS:ima|!ARGS:art_summary|!ARGS:art_source|!ARGS:stretch|!ARGS:cat_sponsor|!ARGS:automode|!ARGS:myfilm1|!ARGS:/^tp_article/|!ARGS:newsettings[files_dir]|!ARGS:var_value[usps_labels_help_2]|!ARGS:/story/|!ARGS:vinculo|!ARGS:cts|!ARGS:response|!ARGS:hd_request|!ARGS:relocate|!ARGS:add_fd3|!ARGS:soundname|!ARGS:/^bbcode_/|!ARGS:/google/|!ARGS:definition|!ARGS:tpl_cont|!ARGS:/domain/|!ARGS:new_tng_path|!ARGS:babynaam|!ARGS:Comentario|!ARGS:/^dynadata/|!ARGS:paypal_ipn|!ARGS:right_frame|!ARGS:l1_bdy|!ARGS:edit_full|!ARGS:article|!ARGS:forum|!ARGS:/^ViewState/|!ARGS:postvars|!ARGS:base1|!ARGS:layout|!ARGS:GMAP_KEY|!ARGS:source|!ARGS:Infos|!ARGS:rev_you_tube|!ARGS:GMAP_KEY|!ARGS:newsBody|!ARGS:user_sig|!ARGS:cur|!ARGS:yahoo|!ARGS:sig|!ARGS:KT_Update1|!ARGS:theVisibility|!ARGS:friend_M|!ARGS:before|!ARGS:sm_b_style|!ARGS:/^css/|!ARGS:introduction|!ARGS:register_at|!ARGS:revnews_ad_120|!ARGS:option[78]|!ARGS:/ftp/|!ARGS:button_dir|!ARGS:x_organizational|!ARGS:/wpforms/|!ARGS:answer|!ARGS:intro|!ARGS:/about_us/|!ARGS:back_to|!ARGS:/sql/|!ARGS:prefix|!ARGS:clickTAG|!ARGS:problem|!ARGS:archive_chrono|!ARGS:thm|!ARGS:_RW_|!ARGS:/rss/|!ARGS:/url/|!ARGS:lnk|!ARGS:/gplus/|!ARGS:/pinterest/|!ARGS:/redir/|!ARGS:outbound|!ARGS:out|!ARGS:/refer/|!ARGS:helpbox|!ARGS:oaparams|!ARGS:resource|!ARGS:/^wimpy/|!ARGS:/altTag/|!ARGS:inc|!ARGS:fck_brief|!ARGS:resource_box|!ARGS:areaContent2|!ARGS:ref|!ARGS:Post|!ARGS:reply|!ARGS:tresc|!ARGS:pay_list_type|!ARGS:stories_cat|!ARGS:view|!ARGS:howhear|!ARGS:/^FCKeditor/|!ARGS:excerpt|!ARGS:saved_data|!ARGS:/signature/|!ARGS:disc|!ARGS:storage_path|!ARGS:utmr|!ARGS:Query|!ARGS:steps|!ARGS:jumpTo|!ARGS:memo|!ARGS:flvSource|!ARGS:_docSelector|!ARGS:footer|!ARGS:cmstr|!ARGS:remotefile|!ARGS:location|!ARGS:dest|!ARGS:Dialog30|!ARGS:Dialog7|!ARGS:/^wimpy/|!ARGS:/_ref/|!ARGS:/^pr_/|!ARGS:addendum|!ARGS:utmp|!ARGS:whydowork_code|!ARGS:value_190|!ARGS:/ajax/|!ARGS:backto|!ARGS:/^rsargs/|!ARGS:op|!ARGS:ret|!ARGS:old_file[]|!ARGS:zajawka|!ARGS:summary|!ARGS:input_name[4]|!ARGS:input_name[0]|!ARGS:area|!ARGS:Brief_Profile|!ARGS:summary|!ARGS:data|!ARGS:st_widget|!ARGS:def|!ARGS:playlist|!ARGS:enlace|!ARGS:data_codepress|!ARGS:Store_OUI_GlobalFooter|!ARGS:map|!ARGS:/^dynafield/|!ARGS:wysiwyg|!ARGS:subdir[0]|!ARGS:x_Instructions|!ARGS:f_license|!ARGS:env_ping_list|!ARGS:xsponsor2|!ARGS:code|!ARGS:/^k2extra/|!ARGS:github|!ARGS:linkedin|!ARGS:stack_overflow "^(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?)://(.*)$" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:lowercase,multimatch,id:340163,rev:308,severity:2,msg:'Atomicorp.com WAF Rules: Remote File Injection Attack Blocked (Unauthorized URL detected as argument)',chain" +SecRule TX:1 "!@beginsWith %{request_headers.host}" "t:none,t:lowercase" +#SecRule MATCHED_VARS "!@rx ://%{SERVER_NAME}/" + +SecMarker END_INJECTION_RULES_MULTI + + +#Remote command protection rules +SecRule REQUEST_URI|ARGS|!ARGS:fileContent|!ARGS:/msg/|!ARGS:/sql/|!ARGS:prefix|!ARGS:/body/|!ARGS:/message/|!ARGS:/text/|!ARGS:templatecode|!ARGS:areas|!ARGS:/illegalusernames/|!ARGS:/image/|!ARGS:resolution|!ARGS:depth|!ARGS:/email/|!ARGS:/comment/|!ARGS:mailbox|!ARGS:/descr/|!ARGS:/resolution/|!ARGS:/solution/|!ARGS:/txt/|!ARGS:body|!ARGS:/message/|!ARGS:/content/|!ARGS:/password/|!ARGS:FoxyData|!ARGS:/jform/|!ARGS:areas|!ARGS:templatecode|!ARGS:site_first|!ARGS:sendDescription|!ARGS:templatecode|!ARGS:areas|!ARGS:wpSummary|!ARGS:/keyword/ "@pm cd perl killall python rpm yum apt-get emerge lynx links mkdir elinks pwd wget ftpget lwp- id uname cvs svn rcp scp ssh rsh sftp netstat netcat rexec smbclient ftp curl telnet cc g++ whoami kill rm rsync nasm cmd command git" "phase:2,id:334820,t:none,t:urlDecodeUni,t:cmdline,pass,nolog,noauditlog,skip:1" +# SecAction phase:2,id:354372,t:none,pass,nolog,noauditlog,skipAfter:END_CMD2_ATTACKS +# Rule 340023: Generic remote comand attack signature +SecRule REQUEST_URI|ARGS|!ARGS:fileContent|!ARGS:/disallowed/|!ARGS:/msg/|!ARGS:post|!ARGS:/sql/|!ARGS:prefix|!ARGS:/body/|!ARGS:/search/|!ARGS:/message/|!ARGS:/text/|!ARGS:templatecode|!ARGS:areas|!ARGS:/illegalusernames/|!ARGS:/image/|!ARGS:resolution|!ARGS:depth|!ARGS:/email/|!ARGS:/comment/|!ARGS:mailbox|!ARGS:/descr/|!ARGS:/resolution/|!ARGS:/solution/|!ARGS:/txt/|!ARGS:body|!ARGS:/message/|!ARGS:/content/|!ARGS:/password/|!ARGS:FoxyData|!ARGS:/jform/|!ARGS:areas|!ARGS:templatecode|!ARGS:site_first|!ARGS:sendDescription|!ARGS:templatecode|!ARGS:areas|!ARGS:wpSummary|!ARGS:/keyword/ "(?:\b(?:cd|perl|killall|traceroute|python|r(?:pm|sync)|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|(?:w|ftp)get|lwp-(?:download|request|mirror|rget)|id|uname|cvs|svn|(?:s|r)(?:cp|sh)|n(?:et(?:stat|cat)|asm)|rexec|smbclient|t?ftp|ncftp|curl|telnet|g(?:cc|it)|cc|g\+\+|whoami)\b |\brm\b \-[a-z] |\bcat\b /|\bc(?:ommand|md)\.(?:exe|com)\b ?(?:/.*)?/[ck] )" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:cmdline,multimatch,capture,id:340023,rev:7,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - remote command execution',logdata:'%{TX.0}'" + +SecMarker END_CMD2_ATTACKS + +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|!ARGS:jql|!ARGS:/^jform/|!ARGS:ausgabe|!ARGS:before_head|!ARGS:/jql/|!ARGS:img_title_format|!ARGS:headcode|!ARGS:/prod_/|!ARGS:/custom-js/|!ARGS:code|!ARGS:jqanote|!ARGS:/html/|!ARGS:/footer/|!ARGS:/message/|!ARGS:/header/|!ARGS:/scripttag/|!ARGS:input_10|!ARGS:/^tb/|!ARGS:param.code|!ARGS:templatecode|!ARGS:teaser_js|!ARGS:/^rsargs/|!ARGS:areas|!ARGS:/note/|!ARGS:printinfo|!ARGS:announcement|!ARGS:/content/|!ARGS:/wysiwyg/|!ARGS:pages|!ARGS:html|!ARGS:/prefix/|!ARGS:/suffix/|!ARGS:server_validation|!ARGS:/^data/|!ARGS:tv2|!ARGS:snippet|!ARGS:ausgabe|!ARGS:response|!ARGS:cs_preview_state|!ARGS:/editfile/|!ARGS:yaml|!ARGS:sqzr|!ARGS:/^_popupally/|!ARGS:SAMLResponse|!ARGS:/ARGS:/field_id/|!ARGS:codetocheck|!ARGS:/shortcode/|!ARGS:wpSummary|!ARGS:source|!ARGS:Form|!ARGS:/comment/|!ARGS:/field_image/|!ARGS:myDevEditControl_html|!ARGS:/details/|!ARGS:UserData|!ARGS:problem|!ARGS:resolution|!ARGS:subject|!ARGS:/body/|!ARGS:/^widget-section/|!ARGS:/template/|!ARGS:/^eip_/|!ARGS:/sql/|!ARGS:prefix|!ARGS:/keyword/|!ARGS:/msg/|!ARGS:metadata|!ARGS:parent_name|!ARGS:topic|!ARGS:/^serendipity/|!ARGS:comment|!ARGS:summary|!ARGS:configoptionname|!ARGS:Definition|!ARGS:/php/|!ARGS:/Metatags/|!ARGS:/layout/|!ARGS:/message/|!ARGS:email|!ARGS:/^acf/|!ARGS:/desc/|!ARGS:body|!ARGS:/text/|!ARGS:/txt/|!ARGS:properties|!ARGS:params.code|!ARGS:php|!ARGS:code|!ARGS:/database/|!ARGS:SAMLResponse|!ARGS:/insertstring/|!ARGS:pagetext|!ARGS:templatecode|!ARGS:areas|!ARGS:comment|!ARGS:/kaliforms/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:/prefix/|!ARGS:/suffix/|!ARGS:definition "@rx (?i)\b(?:i(?:s(?:_(?:in(?:t(?:eger)?|finite)|n(?:u(?:meric|ll)|an)|(?:calla|dou)ble|s(?:calar|tring)|f(?:inite|loat)|re(?:source|al)|l(?:ink|ong)|a(?:rray)?|object|bool)|set)|n(?:(?:clud|vok)e|t(?:div|val))|(?:mplod|dat)e|conv)|s(?:t(?:r(?:(?:le|sp)n|coll)|at)|(?:e(?:rializ|ttyp)|huffl)e|i(?:milar_text|zeof|nh?)|p(?:liti?|rintf)|(?:candi|ubst)r|y(?:mlink|slog)|o(?:undex|rt)|leep|rand|qrt)|f(?:ile(?:(?:siz|typ)e|owner|pro)|l(?:o(?:atval|ck|or)|ush)|(?:rea|mo)d|t(?:ell|ok)|unction|close|gets|stat|eof)|c(?:h(?:o(?:wn|p)|eckdate|root|dir|mod)|o(?:(?:(?:nsta|u)n|mpac)t|sh?|py)|lose(?:dir|log)|(?:urren|ryp)t|eil)|e(?:x(?:(?:trac|i)t|p(?:lode)?)|a(?:ster_da(?:te|ys)|ch)|r(?:ror_log|egi?)|mpty|cho|nd)|l(?:o(?:g(?:1[0p])?|caltime)|i(?:nk(?:info)?|st)|(?:cfirs|sta)t|evenshtein|trim)|d(?:i(?:(?:skfreespac)?e|r(?:name)?)|e(?:fined?|coct)|(?:oubleva)?l|ate)|r(?:e(?:(?:quir|cod|nam)e|adlin[ek]|wind|set)|an(?:ge|d)|ound|sort|trim)|m(?:b(?:split|ereg)|i(?:crotime|n)|a(?:i[ln]|x)|etaphone|y?sql|hash)|u(?:n(?:(?:tain|se)t|iqid|link)|s(?:leep|ort)|cfirst|mask)|a(?:s(?:(?:se|o)rt|inh?)|r(?:sort|ray)|tan[2h]?|cosh?|bs)|t(?:e(?:xtdomain|mpnam)|a(?:int|nh?)|ouch|ime|rim)|h(?:e(?:ader(?:s_(?:lis|sen)t)?|brev)|ypot|ash)|p(?:a(?:thinfo|ck)|r(?:intf?|ev)|close|o[sw]|i)|g(?:et(?:t(?:ext|ype)|date)|mdate)|o(?:penlog|ctdec|rd)|b(?:asename|indec)|n(?:atsor|ex)t|k(?:sort|ey)|quotemeta|wordwrap|virtual|join)(?:\s|/\*.*\*/|//.*|#.*)*\(.*\)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:urlDecodeUni,t:removeComments,t:compressWhiteSpace,t:lowercase,msg:'Atomicorp.com WAF Rules: PHP payload detected',id:380026,rev:24,logdata:'%{TX.0}',severity:'2',tag:'SQLi',tag:'RCE'" + +############ PHP URL ATTACKS #################### +# +#PHP applications +SecRule REQUEST_FILENAME "\.php" "phase:2,id:333820,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:334372,t:none,pass,nolog,noauditlog,skipAfter:END_PHP_GENERIC_ATTACKS" + +# Rule 340117: General [url] php forum protections (phpbb and others, to protect against script injection attacks in url links) +SecRule REQUEST_URI|ARGS|!ARGS:templatecode|!ARGS:areas "\[url ?= ?(?:script|javascript|applet|about|chrome|activex|qx?ss|embed):/.*\].*\[ ?/ ?url ?\]" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,id:340117,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: General [url] php forum protections'" + +# Rule 340039: generic php attack sigs +SecRule REQUEST_FILENAME "!(/mod_cmd/index\.php)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,chain,id:340039,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: PHP command injection attempt'" +SecRule REQUEST_URI "(?:&(?:cmd|command)=(?:id|uname) |cmd\?(?:cmd|command)=|(?:spy|cmd|cmd_out|sh)\.(?:gif|jpg|png|bmp|txt)\?&(?:cmd|command)=|\.php\?&(?:cmd|command)=)" + +# Rule 340137: Generic PHP avatar upload exploits +#SecRule REQUEST_BODY "content-disposition\: form-data\; name=\"avatar\"\;" "phase:2,deny,status:403,t:none,t:lowercase,t:compressWhitespace,phase:2,id:340137,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: PHPBB avatar exploit',chain" +#SecRule REQUEST_BODY "\<\? ?php" chain +#SecRule REQUEST_BODY "\? ?>" +# +# Rule 340021: PHP Injection Attack generic signature +#SecRule REQUEST_URI|ARGS|!ARGS:templatecode|!ARGS:areas|!ARGS:/description/|!ARGS:/resolution/|!ARGS:/problem/ "(?:\?(?:(?:local|include|pear|squizlib)_path|action|content|dir|name|menu|pm_path|pathtoroot|cat|pagina|path|include_location|root|page|gorumdir|site|topside|pun_root|open|seite)=(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|(?:cmd|command)=(?:cd|\;|perl |killall |python |rpm |yum |apt-get |emerge |lynx |links |mkdir |elinks |id|cmd|pwd|wget |lwp-(?:download|request|mirror|rget) |uname|cvs |svn |(?:s|r)(?:cp|sh) |net(?:stat|cat) |rexec |smbclient |t?ftp |ncftp |curl |telnet |gcc |cc |g\+\+ |\./|whoami|killall |rm \-[a-z]))" "phase:2,deny,status:403,t:none,t:lowercase,t:replaceNulls,t:compressWhitespace,t:normalisePath,id:340021,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: PHP Injection Attack 1'" +#SecRule REQUEST_URI "!(/lightboxjs\.php\?path=http:/)" "t:none,t:lowercase" + + +# Rule 340022: PHP Injection Attack generic signature +#SecRule REQUEST_URI "\.php\?(?:(?:(?:local|include|pear|squizlib)_path|action|content|dir|name|menu|pm_path|pagina|path|pathtoroot|cat|include_location|gorumDir|root|page|site|topside|pun_root|open|seite)=(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|.*(?:cmd|command)=(?:cd|\;|perl |killall |python |rpm |yum |apt-get |emerge |lynx |links |mkdir |elinks |cmd|pwd|wget |lwp-(?:download|request|mirror|rget) |id|uname |cvs |svn |(?:s|r)(?:cp|sh) |net(?:stat|cat)|rexec |smbclient |t?ftp |ncftp |curl |telnet |gcc |cc |g\+\+ |whoami|\./|killall |rm \-[a-z]))" "capture,chain,id:340022,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: PHP Injection Attack 2',logdata:'%{TX.0}'" +#SecRule REQUEST_URI "!(/lightboxjs\.php\?path=http://)" + + +SecMarker END_PHP_GENERIC_ATTACKS + + +############## BAD FILE NAMES ######################### +#ZenPhoto uses weird extensions when its using mod_rewite +#zp_user_auth + +SecRule REQUEST_URI "@pm .gif.txt .gif.dat .jpeg.txt .jpeg.dat .jpg.txt .jpg.dat .png.txt .png.dat .bmp.txt .bmp.dat .php.jpg .php.jpeg .php.flv .php.gif .php.mp3 .php.mp4 .php.mpg .php.mpeg .php.png .php.bmp .php.tif .php.txt .php.dat .php.avi .php.wmv .php.mp3" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,id:340035,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Bogus file extensions'" + +SecRule REQUEST_FILENAME "@pm .jpg.php .gif.php .png.php .jsp;gif .jsp;jpg .jsp;png" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,id:341137,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Potentially Bogus PHP file'" + +#SecMarker END_BAD_FILE_NAMES + +############# GENERIC COMMAND ATTACK SIGS ############## +#SecRule REQUEST_URI "@pm perl ; ' | nc telnet sh exec ogg gopher http ftp lynx wget links curl ogg:// tls:// gopher:// cp @ rsync ftp cvs svn traceroute" "phase:2,pass,nolog,noauditlog,skip:1" +#SecAction phase:2,pass,nolog,noauditlog,skipAfter:END_CMD_INJECTION_2 +# +# Rule 340037: generic attack sig +#SecRule REQUEST_URI "(?:cd |\;|php |echo |perl |killall |python |rpm |yum |apt-get |emerge |lynx |links |mkdir |elinks |wget |lwp-(?:download|request|mirror|rget) |id|uname |cvs |svn |(?:s|r)(?:cp|sh) |net(?:stat|cat) |rexec |smbclient |t?ftp |ncftp |curl |telnet |g?cc |cpp |g\+\+ |/bin/(xterm|id|bash|sh|echo|kill|chmod|ch?sh|python|perl|nasm|ping|mail))" "id:340037,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Generic command injection'" + +# Rule 3400XX: Generic argument protection rule against bad meta characters +#SecRule "ARGS" "!^[a-z0-9.&/?@_%=:;, -]+$" + +# Rule 340059: traceroute command attempt +#SecRule REQUEST_URI "traceroute" "chain,id:340059,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Command attempt (traceroute)'" +#SecRule REQUEST_URI " (?:[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)" + +# Rule 340083: very experimental generic remote download sig +# These are VERY experiemental, please report false positives/negatives, etc. +# foo IP or FQDN, or foo http/https/ftp://whatever +#SecRule REQUEST_URI "(?:(?:perl|t?ftp|links|elinks|lynx|ncftp|(?:s|r)(?:cp|sh)|wget|lwp-(?:download|request|mirror|rget)|curl|cvs|svn).* (?:(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|.*[a-z|0-9]\.[a-z]{2,4}/|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)|traceroute (?:[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)" "id:340083,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Generic Command attempt'" + +# Rule 340084: Command inline detection +#SecRule REQUEST_URI "(?: |\;|/|\'|,|\&|\=|\.)(?:(?:s|r)(?:sh|cp)) *(?:.*\@.*|(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|.*[a-z|0-9]\.[a-z]{2,4}/|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)" "chain,id:340084,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Command injection attempt'" +#SecRule REQUEST_URI "!(?:/scp/tickets\.php|/cgi-bin/stats\.cgi)" + +# Rule 340085: very experimental connect command sig +#SecRule REQUEST_URI "(?:(?:(?: |\;|/|\'|,|\&|\=|\.)(?:perl|nc|telnet|(?:r|s)sh|rexec) .*(?:[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|[a-z|0-9]\.[a-z]{2,4}|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)|\;perl [a-z|0-9]+;|(?:lynx|curl|wget|links) -dump |links (?:-(?:dump-(?:charset|width)|source)|(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/))|(?: |\;|/|\'|,|\&|\=|\.)(?:(?:s|r)(?:sh|cp)) *(?:.*\@.*|(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|.*[a-z|0-9]\.[a-z]{2,4}/|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)|(?:(?:perl|t?ftp|links|elinks|lynx|ncftp|(?:s|r)(?:cp|sh)|wget|lwp-(?:download|request|mirror|rget)|curl|cvs|svn).* (?:(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|.*[a-z|0-9]\.[a-z]{2,4}/|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)|traceroute (?:[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+))" "capture,id:340085,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Command injection attempt',logdata:'%{TX.0}'" + +#SecMarker END_CMD_INJECTION_2 + +########### SCANNER SIGS ####################### +SecRule REQUEST_URI "@pm nessus w00tw00t hacked" "phase:2,id:333823,t:none,t:urlDecodeUni,t:lowercase,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334374,t:none,pass,nolog,noauditlog,skipAfter:END_SCANNER_SIGS" + +# Rule 340069: nessus 1.X 404 probe +SecRule REQUEST_URI "(?:nessus(?:_is_probing_you_|test)|^/w00tw00t\.at\.)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,id:340069,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Web vulnerability scanner'" + +# Rule 340150: Dfind signature +# w00tw00t.at.ISC.SANS.DFind +# not likely to catch this, as it usually happens via an invalid +# HTTP/1.1 request without a hostname, which apache will reject therefore other rules +# WEB_ERROR_LOG will catch this +#SecRule REQUEST_URI "w00tw00t" "phase:1,deny,status:403,t:none,t:lowercase,id:340150,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: DFind scanner attempt'" + +# Rule 340141: wormsign +#SecRule REQUEST_URI "hacked ?by ?member ?of" "id:340141,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: worm'" + +SecMarker END_SCANNER_SIGS +################ PHP DEFENSES ######################## +# +#SecRule ARGS:PHPSESSID ";www" "phase:2,pass,nolog,noauditlog,skip:1" +#SecAction phase:2,pass,nolog,noauditlog,skipAfter:END_PHP_PROT_1 +# +#types that do not have RFI at all +SecRule TX:STATIC "@eq 1" "phase:2,id:'334819',pass,t:none,nolog,noauditlog,skipAfter:END_PHP_PROT_1" + +#additional types +SecRule TX:NONPHP "@eq 1" "phase:2,id:'333824',pass,t:none,nolog,noauditlog,skipAfter:END_PHP_PROT_1" +#SecRule REQUEST_FILENAME "\.(?:(?:m|j)pe?g4?|bmp|tiff?|p(?:(?:p|g|b)m|n(?:g|m)|df)|gif|js|css|ico|avi|flv|w(?:m(?:v|a)|ebp)|mp(?:3|4)|cgm|svg|swf|og(?:m|v|x)|doc|xls|od(?:t|s)|ppt|wbk|(?:ht|x)ml)$" phase:2,id:333824,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_PHP_PROT_1 + + +# Rule 340076: PHP defenses +SecRule ARGS:PHPSESSID "(?:!^[0-9a-z]*$|!^[0-9a-z]*;www)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,id:340076,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: PHP Session attack'" + + +# Rule 340079: PHP defenses +SecRule REQUEST_COOKIES:sessionid "![0-9a-z]*$" "phase:2,deny,log,auditlog,status:403,t:none,t:lowercase,id:340079,rev:10,severity:2,msg:'Atomicorp.com WAF Rules: PHP policy violation'" + +SecMarker END_PHP_PROT_1 + +############# APACHE PROTECTIONS ##################### +SecRule REQUEST_URI "@pm server-info server-status cwd= jsp desudesudesu" "id:333825,t:none,t:urlDecodeUni,phase:2,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334375,t:none,pass,nolog,noauditlog,skipAfter:END_APACHE_PROT" + +# Rule 340114: Apache /server-info accessible +SecRule REQUEST_URI "^/server-(?:info|status)/?$" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,chain,id:340114,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Apache admin service access attempt'" +SecRule REMOTE_ADDR "!@ipMatch 127.0.0.1,::1" "t:none" + +# Rule 340116: generic Common HTTP vulnerability +SecRule REQUEST_URI "(?:/\?cwd=/|a cat is fine too\.)" "phase:2,deny,log,auditlog,status:403,t:none,t:lowercase,t:compresswhitespace,id:340116,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Common HTTP vulnerability'" + +# Rule 340097: Tomcat view source attempt +SecRule REQUEST_URI "\x252ejsp" "phase:2,deny,log,auditlog,status:403,t:none,t:lowercase,id:340097,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Tomcat view source attempt'" + +SecMarker END_APACHE_PROT + + +################PHP CODE INJECTION ATTACKS ################### +#types that do not have RFI at all +SecRule TX:STATIC "@eq 1" "phase:2,id:'333826',pass,t:none,nolog,noauditlog,skipAfter:END_PHP_CODE_INJECTION_ATTACKS_4" + +#SecRule REQUEST_FILENAME "\.(?:(?:m|j)pe?g4?|bmp|tiff?|p(?:(?:p|g|b)m|n(?:g|m)|df)|gif|js|css|ico|avi|flv|w(?:m(?:v|a)|ebp)|mp(?:3|4)|cgm|svg|swf|og(?:m|v|x)|doc|xls|od(?:t|s)|ppt|wbk)$" phase:2,pass,t:none,t:lowercase,nolog,noauditlog,id:333826,skipAfter:END_PHP_CODE_INJECTION_ATTACKS_4 +SecRule REQUEST_URI "^/eprocservice/supplierinboundservice" "phase:2,id:363828,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_PHP_CODE_INJECTION_ATTACKS_4" + +SecRule REQUEST_FILENAME "(?:\.(?:pl|aspx?|f?cgi|do|exe|s?html)$|/cgi-bin/)" "phase:2,id:333828,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_PHP_CODE_INJECTION_ATTACKS_NOT_PERL" + +SecRule REQUEST_URI|REQUEST_BODY|ARGS|REQUEST_HEADERS|ARGS_NAMES|XML:/*|!ARGS:templatecode|!ARGS:areas "@pm chr system passthru serialize include php_uname preg_ mysql_query exec eval create_function create_function phpinfo decode_base64 base64_decode base64_url_decode rot13" "phase:2,id:334827,t:none,t:replaceNulls,t:compressWhiteSpace,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:334376,t:none,pass,nolog,noauditlog,skipAfter:END_PHP_CODE_INJECTION_ATTACKS_B64" + +SecRule REQUEST_URI "(/wp-login\.php\?vaultpress=true|/site-content/|^/admin/editform)" "t:none,t:lowercase,phase:2,id:334857,pass,nolog,noauditlog,skipAfter:END_PHP_CODE_INJECTION_ATTACKS_B64" + +SecRule REQUEST_URI|ARGS|!ARGS:templatecode|!ARGS:areas|!ARGS:/news/|!ARGS:rsargs|!ARGS:/note/|!ARGS:announcement|!ARGS:filedata|!ARGS:customizer|!ARGS:cs_preview_state|!ARGS:SAMLResponse|!ARGS:add_new|!ARGS:/content/|!ARGS:/wysiwyg/|!ARGS:/prefix/|!ARGS:/suffix/|!ARGS:/comment/|!ARGS:problem|!ARGS:resolution|!ARGS:subject|!ARGS:/body/|!ARGS:/^widget-section/|!ARGS:/template/|!ARGS:/^eip_/|!ARGS:/sql/|!ARGS:prefix|!ARGS:/keyword/|!ARGS:/msg/|!ARGS:metadata|!ARGS:post_content|!ARGS:parent_name|!ARGS:topic|!ARGS:file_content|!ARGS:/^serendipity/|!ARGS:comment|!ARGS:summary|!ARGS:configoptionname|!ARGS:Definition|!ARGS:/php/|!ARGS:/Metatags/|!ARGS:/footerfile/|!ARGS:/layout/|!ARGS:/message/|!ARGS:email|!ARGS:/desc/|!ARGS:body|!ARGS:content "(?:\(chr ?\( ?[0-9]{1,3} ?\)| ?= ?f(?:open|write) ?\(|\b(?:passthru|serialize|php_uname|phpinfo|shell_exec|preg_\w+|mysql_query|exec|include|eval|create_function|system|base64_decode|decode_base64|base64_url_decode|str_rot13)\b ?(?:\(|\:))" "phase:2,deny,log,auditlog,status:403,t:none,t:replaceNulls,t:compressWhiteSpace,t:lowercase,capture,id:340195,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - Base64 Encoded PHP function in Argument - this may be an attack.',logdata:'%{TX.0}'" + +SecMarker END_PHP_CODE_INJECTION_ATTACKS_B64 + +#non B64 rules +SecRule REQUEST_URI|ARGS|REQUEST_HEADERS|ARGS_NAMES|XML:/*|!ARGS:/template/|!ARGS:areas "@pm php chr fopen fwrite globals system passthru serialize include php_uname popen proc_open mysql_query exec eval create_function proc_nice proc_terminate proc_get_status proc_close pfsockopen leak apache_child_terminate posix_kill posix_mkfifo posix_setpgid posix_setsid posix_setuid phpinfo preg_ decode_base64 base64_decode base64_url_decode rot13 ?< ?name ?>.*\'\)\;)" "phase:2,log,auditlog,deny,log,status:403,t:none,t:lowercase,t:compressWhiteSpace,id:340118,rev:8,severity:2,msg:'Atomicorp.com WAF Rules: Generic XML-RPC attack'" + +SecRule XML:/* "(?:(\w+)and(\w+)char\([0-9]+\)|\b(?:execute|convert) ?\(|(?:\;delete.{1,100};(?:insert|declare @|varchar)|(?:and .{1,100} \(select |\b(?:drop|create)(\w+)table|declare .{1,100} varchar\())|convert\(varchar|null,(?:null,(?:null|accesslevel|user_name),|concat\()|union select |\bcast\b ?\({1,100} as|xecresultset|' ?; ?declare @|; ?set @)" "phase:2,deny,status:403,log,auditlog,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:390636,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: XMLRPC SQL injection attack'" + +# Rule 340121: Specific XML-RPC attacks on xmlrpc.php +SecRule XML:/* "(?:(?:(?:echo|uname) ?(?:\'|\")|; ?exit ?;)|(?:define|fgets|move_uploaded_file|readfile|ftp_put|ftp_fget|gzd?en?code|gzinflate|ftp_nb_put|bzopen|readdir|gzread|fopen|ftp_nb_f(put|get)|ftp_get|scandir|fscanf|readgzfile|fread|proc_open|fgetc|fgetss|ftp_fput|ftp_nb_get|session_start|fwrite|gzwrite|gzopen|gzcompress|curl_multi_exec|curl_exec|eval|create_function|base64_decode|base64_url_decode|decode_base64|str_rot13|php_uname|file_get_contents|include|parse_ini_file|shell_exec|mysql_query|popen|ini_(?:get|restore)|safe_mode|phpinfo|system|exec|passthru|serialize|php_uname|preg_\w+|execute) ?(?:\(|\: ?')|; ?(?:wget|ftpget|curl|fetch|lwp-(?:download|request|mirror|rget)|ncftp|ftp) ?(?:h|f)ttps?:/)" "phase:2,capture,deny,status:403,log,auditlog,t:none,t:lowercase,t:replaceComments,t:compressWhiteSpace,id:340121,rev:7,severity:2,msg:'Atomicorp.com WAF Rules: XML-RPC attacks on xmlrpc.php',logdata:'%{TX.0}'" + +# Rule 340122: XML-RPC SQL injection generic signature +SecRule XML:/* "(?:\b(?:select|grant|drop|alter|replace|truncate|create|rename|describe)\b[[:space:]]+[a-z|0-9|\*|,]+[[:space:]](?:from|into|table|database|index|view)|union select |union all select|select (?:load_file|char\()|(?:insert|remark)test;|insert[[:space:]]+[a-z|0-9|\*|\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+\(|update [a-z0-9]+ set|delete from [a-z0-9]+ where)" "phase:2,deny,status:403,log,auditlog,capture,t:none,t:lowercase,t:replaceComments,t:compressWhiteSpace,id:340122,rev:7,severity:2,msg:'Atomicorp.com WAF Rules: XML-RPC SQL injection ',logdata:'%{TX.0}',tag:'SQLi'" + + +SecRule XML:/* "(?: ?eval\ ?\(|file_get_contents\ ?\(|\) ?;? exit ?;)" "phase:2,log,deny,log,status:403,auditlog,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:390635,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: XMLRPC encoded command injection attack'" + + +SecRule XML:/* "@pm select grant delete drop do alter replace truncate update create rename describe table database index view union load_file inserttest remarktest convert execute insert varchar table declare char exit uname define fgets move_uploaded_file readfile ftp_put ftp_fget gzd?en?code gzinflate ftp_nb_put bzopen readdir gzread fopen ftp_nb_f(put|get) ftp_get scandir fscanf readgzfile fread proc_open fgetc fgetss ftp_fput ftp_nb_get session_start fwrite gzwrite gzopen gzcompress curl_multi_exec curl_exec eval create_function base64_decode base64_url_decode decode_base64 str_rot13 uname file_get_contents include parse_ini_file shell_exec mysql_query popen ini_ safe_mode phpinfo preg_ system exec passthru serialize file_get_contents " "id:333948,phase:2,t:none,pass,nolog,noauditlog,skip:1" +SecAction "phase:2,id:334383,t:none,pass,nolog,noauditlog,skipAfter:END_XML_RPC_ATTACKS_B64" + +SecRule XML:/* "(?: ?eval\ ?\(|file_get_contents\ ?\(|\) ?;? exit ?;)" "phase:2,log,deny,log,status:403,auditlog,t:none,t:compressWhiteSpace,t:lowercase,id:393635,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: XMLRPC base64 encoded command injection attack'" + +# Rule 340122: XML-RPC SQL injection generic signature +SecRule XML:/* "(?:\b(?:select|grant|delete|drop|do|alter|replace|truncate|update|create|rename|describe)\b[[:space:]]+[a-z|0-9|\*|,]+[[:space:]](?:from|into|table|database|index|view)|union select |union all select|select (?:load_file|char\()|(?:insert|remark)test;|insert[[:space:]]+[a-z|0-9|\*|\,]+[[:space:]]+(?:from|into|table|database|index|view)[[:space:]]+\()" "phase:2,deny,status:403,log,auditlog,capture,t:none,t:lowercase,t:replaceComments,t:compressWhiteSpace,id:340123,rev:7,severity:2,msg:'Atomicorp.com WAF Rules: XML-RPC base64 encoded SQL injection ',logdata:'%{TX.0}',tag:'SQLi'" + +# Rule 340120: XML-RPC generic attack sigs +SecRule XML:/* "(?:(?:(?:echo|uname) ?(?:\'|\")|; ?exit ?;)|(?:define|fgets|move_uploaded_file|readfile|ftp_put|ftp_fget|gzd?en?code|gzinflate|ftp_nb_put|bzopen|readdir|gzread|fopen|ftp_nb_f(put|get)|ftp_get|scandir|fscanf|readgzfile|fread|proc_open|fgetc|fgetss|ftp_fput|ftp_nb_get|session_start|fwrite|gzwrite|gzopen|gzcompress|curl_multi_exec|curl_exec|eval|create_function|base64_decode|base64_url_decode|decode_base64|str_rot13|php_uname|file_get_contents|include|parse_ini_file|shell_exec|mysql_query|popen|ini_(?:get|restore)|safe_mode|phpinfo|system|exec|passthru|serialize|php_uname|preg_\w+|execute) ?(?:\(|\: ?'?)|; ?(?:wget|ftpget|curl|fetch|lwp-(?:download|request|mirror|rget)|ncftp|ftp) ?(?:h|f)ttps?:/)" "phase:2,deny,status:403,log,auditlog,t:none,t:lowercase,t:replaceComments,t:compressWhiteSpace,id:340120,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Generic XML-RPC attack'" + +SecRule XML:/* "(?:(\w+)and(\w+)char\([0-9]+\)|\b(?:execute|convert) ?\(|(?:\;delete.{1,100};(?:insert|declare @|varchar)|(?:and .{1,100} \(select |\b(?:drop|create)\b(\w+)table|declare .{1,100} varchar\())|convert\(varchar|null,(?:null,(?:null|accesslevel|user_name),|concat\()|union select | \bcast\b\ ?\(.{1,100} as |xecresultset|' ?; ?declare\b @|; ?set @)" "phase:2,deny,status:403,log,auditlog,t:none,t:replaceComments,t:compressWhiteSpace,t:lowercase,id:393636,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: XMLRPC base64 encoded SQL injection attack',tag:'SQLi'" + +SecMarker END_XML_RPC_ATTACKS_B64 + +SecMarker END_XML_RPC_ATTACKS +################ WORM SIGS ########################### +# +# Rule 340134: wormsign +SecRule REQUEST_HEADERS "xxxxxx+\: \+\+\+\+\+\+\+\+\+\+\+\+\+" "phase:2,log,auditlog,deny,log,status:403,t:none,t:lowercase,id:340134,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Worm signature'" + +#SecRule TX:STATIC "@eq 1" phase:2,id:'333835',pass,t:none,nolog,noauditlog,skipAfter:END_WORM_SIGS + +#SecRule REQUEST_FILENAME "\.(?:(?:m|j)pe?g4?|bmp|tiff?|p(?:(?:p|g|b)m|n(?:g|m)|df)|gif|js|css|ico|avi|flv|w(?:m(?:v|a)|ebp)|mp(?:3|4)|cgm|svg|swf|og(?:m|v|x)|doc|xls|od(?:t|s)|ppt|wbk)$" id:333835,phase:2,pass,t:none,t:lowercase,nolog,noauditlog,skipAfter:END_WORM_SIGS + +#SecRule REQUEST_URI|ARGS|XML:/* "@pm thmc _ghc/rst_ " "id:333836,t:none,t:urlDecodeUni,phase:2,pass,nolog,noauditlog,skip:1" +# SecAction phase:2,id:334384,t:none,pass,nolog,noauditlog,skipAfter:END_WORM_SIGS + +# Rule 340135: THMC worm +#SecRule REQUEST_URI|ARGS|XML:/* "(?:thmc\.\$dbhost\.thmc\.\$dbname\.thmc\.\$dbuser\.thmc\.\$dbpasswd\.thmc|echo _ghc/rst_)" "phase:2,deny,status:403,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340135,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: THMC or PHPBB worm'" + +#SecMarker END_WORM_SIGS +################# IMAGE FILE CHECKS ###################### + +#SecRule REQUEST_HEADERS:Content-Type "(?:image/gif|image/jpg|image/png|image/bmp)" +SecRule REQUEST_HEADERS:Content-Type "image/" "phase:2,id:333837,t:none,t:lowercase,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:334385,t:none,pass,nolog,noauditlog,skipAfter:END_IMAGE_CHECKS" + +# Rule 340138: Fake image file shell attacvk +SecRule REQUEST_BODY "(?:(?:chr|system|passthru|serialize|eval|create_function|exec) ?\(|< ?\? php)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase,id:340138,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: Fake image file shell attack'" + +# Rule 340140: bogus graphics file +SecRule REQUEST_HEADERS:Content-Disposition "\.(?:php|txt|asp|pl|exe|cgi)" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,id:340140,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: Bogus graphics file'" + +SecRule FILES|FILES_NAMES "\.(?:ph(?:p|tml|t)|txt|asp|pl|exe|cgi|php[0-9])$" "phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,id:340141,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Attack Blocked - upload attack - Attempt to upload a non-graphics file as a graphics file blocked'" + + +SecMarker END_IMAGE_CHECKS + +SecRule REQUEST_URI|REQUEST_HEADERS|ARGS "=(?:\(alert\)|alert\(|alert\[)" "phase:1,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,id:347198,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: Vulnerability scanner attempting cross site scripting attempt'" + +SecRule REQUEST_URI "< ?a ?href ?= ?'? ?javascript" "phase:1,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:lowercase,id:347197,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting attempt'" + +##############XSS RULES################################ +SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|QUERY_STRING|!ARGS:areas|!ARGS:templatecode "@pm self document this top window document cookie" "id:333138,phase:2,t:none,t:removeComments,t:urlDecodeUni,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:333139,t:none,pass,nolog,noauditlog,skipAfter:END_PRE_XSS_ATTACKS" + +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS|XML:/* "(?:self|document|this|top|window)\s*\)*(?:\[[^\]]+\]|\.\s*document|\.\s*cookie)" "id:333140,rev:11,severity:2,phase:2,deny,status:403,capture,t:none,t:removeComments,t:urlDecodeUni,msg:'Atomicorp.com WAF Rules: JavaScript global variable found',logdata:'Matched Data: Suspicious JS global variable found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',log,auditlog" + +SecMarker END_PRE_XSS_ATTACKS + +SecRule REQUEST_URI "^/\?customize_changeset_uuid=" "id:321113,rev:1,phase:2,t:urlDecodeUni,t:lowercase,pass,nolog,noauditlog,skipAfter:SKIP_AFTER_RULE_333141" + +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:XOTSSOCookie|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/*|!REQUEST_COOKIES:cf_clearance|!REQUEST_COOKIES:/user/|!ARGS:cart_description|!ARGS:/webtag/|!ARGS:/html/|!ARGS:/template/|!ARGS:/js/|!ARGS:/css/|!ARGS:/javascript/|!ARGS:/content/|!ARGS:/custom/|!ARGS:/shortcode/|!REQUEST_COOKIES:/activecollab/|!ARGS:vgo_ee "(?i)[\s\"'`;\/0-9=\x0B\x09\x0C\x3B\x2C\x28\x3B]+on[a-zA-Z]+[\s\x0B\x09\x0C\x3B\x2C\x28\x3B]*?=" "id:333141,rev:21,severity:2,phase:2,status:403,deny,capture,t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,msg:'Atomicorp.com WAF Rules: Potential XSS Attack detected',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,log,auditlog" + +SecMarker SKIP_AFTER_RULE_333141 + +SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|QUERY_STRING|!ARGS:areas|!ARGS:templatecode "@pm userpassword alert objectclass mail qss xss embed script expression html onevent onmouse ontouch uid onselect onsubmit onfocus onabort onblur onchange ondragdrop onkey ?= img src onload onerror import asfunction: background-image: fromcharcode frame input lowsrc mocha onblur onchange onclick onkeydown onkeypress onkeyup resize select unload shell: settimeout addimport @import url window.location < > env about applet activex chrome getparentfolder getspecialfolder href object eval img base" "id:333838,phase:2,t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,pass,nolog,noauditlog,skip:1,multimatch" + SecAction "phase:2,id:334386,t:none,pass,nolog,noauditlog,skipAfter:END_XSS_ATTACKS" + + +#Global rule for Qualys' fake XSS tests +SecRule REQUEST_URI|REQUEST_HEADERS|ARGS "(?:<|\(|\{)qx?ss" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:lowercase,t:removeComments,t:removeWhitespace,multimatch,id:347099,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: Vulnerability scanner attempting cross site scripting attempt'" + +SecRule REQUEST_URI|REQUEST_HEADERS|ARGS "=\(alert\)\(" "phase:2,deny,log,auditlog,status:403,t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:lowercase,t:removeComments,t:removeWhitespace,multimatch,id:347199,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: Vulnerability scanner attempting cross site scripting attempt'" + + +#Global rule for Qualys' fake XSS tests +#SecRule REQUEST_URI|REQUEST_HEADERS|ARGS "\; ?\( ?function ?\( ?\)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:lowercase,t:removeComments,multimatch,id:347098,rev:7,severity:2,msg:'Atomicorp.com WAF Rules: Vulnerability scanner attempting cross site scripting attempt'" + +# Rule 340099: cross site scripting attempt IMG onerror or onload +SecRule REQUEST_URI|REQUEST_HEADERS "\< ?(?:img ?/? src ?=|body\b|input\b).{1,100}\bon(?:error|load|focus)\b ?=" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:lowercase,t:compressWhitespace,t:removeComments,id:340099,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting attempt',multimatch" +SecRule REQUEST_URI|REQUEST_HEADERS "\< ?(?:img ?/? src ?=|body\b|input\b).{1,100}\bon(?:error|load|focus)\b ?=" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:compressWhitespace,t:lowercase,id:341099,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting attempt'" + +# Rule 340102: cross site scripting attempt STYLE + JSCRIPT +SecRule REQUEST_URI|REQUEST_HEADERS "type ?= ?[\'\"]text\/(?:j|vb|x-vb|ecma|java|x-java)script" "chain,phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,id:340102,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting attempt'" +SecRule REQUEST_URI "!(/(?:scripts|staff)/index\.php\?(?:action|_m)=)" + +# Rule 340106: cross site scripting attempt STYLE + EXPRESSION +SecRule REQUEST_URI|REQUEST_HEADERS "style ?= ?[\'\"]? ?x:expression ?\(" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,id:340106,rev:4,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting attempt STYLE + EXPRESSION'" + +# Rule 340109: cross site scripting attempt using XML +SecRule REQUEST_URI|REQUEST_HEADERS "\[ ?cdata ?\[<\]\]> ?script" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,id:340109,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting attempt using XML'" + +# Rule 340110: cross site scripting attempt executing hidden Javascript +SecRule REQUEST_URI|REQUEST_HEADERS "(?:eval[\s]*\([\s]*[^\.]\.innerhtml[\s]*\)|window\.execscript[\s]*\()" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,id:340110,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting attempt executing hidden Javascript'" + +# Rule 340112: cross site scripting attempt to execute Javascript code +SecRule REQUEST_URI|REQUEST_HEADERS "(?:(?:(?:url|src|href|lowsrc)[\s]*=)|(?:url[\s]*[\(]))[\s]*[\'\"]*javascript[\:]" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,id:340112,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting attempt to execute Javascript code'" + +# Rule 340003: XSS insertion into headers +SecRule REQUEST_HEADERS|REQUEST_URI "(?:<[[:space:]]*(?:script|about|applet|activex|chrome)|\bon(?:abort|blur|change|click|event|submit|dragdrop|focus|keydown|keypress|keyup|mouse(?:down|move|out|over|up))\b ?= ?(\"|\')? ?\w|<( |\+)?img( |\+)?src( |\+)?=)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,chain,id:340003,rev:10,severity:2,msg:'Atomicorp.com WAF Rules: XSS attack in request headers'" +SecRule REQUEST_URI "!(modules/tinytinymce/tinymce/jscripts/tiny_mce/utils/validate\.js$)" "chain,t:none,t:lowercase" +SecRule REQUEST_HEADERS:Referer "!(clientscript/yui/connection/javascript\:false$)" "t:none,t:lowercase" + +Secrule REQUEST_URI "(?:^/eprocservice/supplierinboundservice|^/[a-z0-9/]+?\?fl_builder)" "phase:2,id:345358,t:none,t:lowercase,pass,nolog,noauditlog,skipAfter:END_XSS_SPECIAL_2" + +# Rule 340211: stealth VBscript injection +SecRule REQUEST_URI|ARGS "(?i:(((url|src|href|lowsrc)[\s]*=)|(url[\s]*[\(]))[\s]*['\x22]*[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*b[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:])" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:normalisePathWin,t:lowercase,chain,id:340211,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting stealth attempt to access shell',logdata:'%{TX.0}'" +SecRule REQUEST_URI "!(?:\/(?:index\.php\?(?:(?:module=blocks&type=admin&func=updat|eid=tx_cms_showpic&fil)e)|node\/[0-9]+\/(?:webform\/components\/|edit))|/(?:node/add/|admin/page/edit))" "t:none,t:lowercase" + +#Rule 341211 +#Jsencoded window eval +SecRule REQUEST_URI|ARGS "(?:window ?\[ ?\' ?eval|\( ?\|? ?(?:mail|uid|userpassword|objectclass) ?= ?\* ?\))" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,id:341211,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: potentially untrusted encoded javascript detected',logdata:'%{TX.0}'" + +SecRule REQUEST_URI|ARGS "ontouch(?:move|end|start)=" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,multimatch,id:341217,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: potentially untrusted encoded javascript detected',logdata:'%{TX.0}'" + +# Rule 340210: cross site scripting stealth attempt to access shell +SecRule REQUEST_URI|ARGS "(?i:(((url|src|href|lowsrc)[\s]*=)|(url[\s]*[\(]))[\s]*['\x22]*[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*h[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*[\:])" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:normalisePathWin,t:lowercase,chain,id:340210,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: cross site scripting stealth attempt to access shell',logdata:'%{TX.0}'" +SecRule REQUEST_URI "!(?:\/(?:index\.php\?(?:(?:module=blocks&type=admin&func=updat|eid=tx_cms_showpic&fil)e))|/(?:node/add/|admin/page/edit)|node\/[0-9]+\/(?:webform\/components\/|edit|add))" "t:none,t:lowercase" + +SecMarker END_XSS_SPECIAL_2 + +SecRule SERVER_PORT "^844[3-5]$" "id:333839,phase:2,t:none,pass,nolog,noauditlog,skipAfter:END_PLESK1" + +SecRule REQUEST_URI "(?:\/(?:index\.php\?(?:(?:module=blocks&type=admin&func=updat|eid=tx_cms_showpic&fil)e))|/(?:node/add/|admin/page/edit)|\?tab=admin|/admin_2s/|^/ndxz-?studio/|node\/[0-9]+\/(?:webform\/components\/|edit|add)|/mail/composemessage|/filemanager/filemanager\.php|/html/scripts/index\.php\?ukey|^/upload/js|^/admin\.php\?templates|/typo3conf/ext/t3quixplorer/|^/eprocservice/supplierinboundservice|^/services/ajax\.php/imp/sendmessage|^/sogo/|^/smb/file-manager/code-editor)|^/\?et_pb_preview=" "id:357839,phase:2,t:none,t:lowercase,pass,nolog,noauditlog,skipAfter:END_PLESK1" + +# Rule 340113 341211: cross site scripting stealth attempt to execute Javascript code +SecRule ARGS|!ARGS:/^dnn/|!ARGS:html|!ARGS:/analitic/|!ARGS:/analytic/|!ARGS:ta|!ARGS:/wpcf7/|!ARGS:/htmlcode/|!ARGS:areas|!ARGS:templatecode|!ARGS:code|!ARGS:/^jform/|!ARGS:/content/|!ARGS:/tpl/|!ARGS:/header/|!ARGS:/rawcode/|!ARGS:/^tv/|!ARGS:/footer/|!ARGS:livezillacode|!ARGS:/script/|!ARGS:p_posts_va|!ARGS:description_short_1|!ARGS:senddescription|!ARGS:widget_code|!ARGS:/fckeditor/|!ARGS:emailmessage|!ARGS:wrap|!ARGS:/template/|!ARGS:cid|!ARGS:form_confirmation_message "(?i:(((url|src|href|lowsrc)[\s]*=)|(url[\s]*[\(]))[\s]*['\x22]*[\x09\x0a\x0b\x0c\x0d]*j[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:])" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:normalisePathWin,t:lowercase,capture,id:340113,rev:36,severity:2,msg:'Atomicorp.com WAF Rules: Potential attempt to inject javascript ',logdata:'%{TX.0},%{matched_var_name}'" + +SecMarker END_PLESK1 +# Rule 340020: +#XSS in referrer and UA headers +#SecRule REQUEST_HEADERS:REFERER|REQUEST_HEADERS:User-Agent "(?:<[[:space:]]*(?:script|about|applet|activex|chrome)|activexobject|(?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec)script|\.fromcharcode|get(?:parent|special)folder|< ?iframe |\.innerhtml|\|\")|>(?: |\+)?<(?: |\+)?img(?: |\+)?src(?: |\+)?=(?: |\+)?(?:ht|f)tps?:/)" "phase:2,deny,status:403,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,capture,id:340020,rev:34,severity:2,msg:'Atomicorp.com WAF Rules: XSS in referrer and UA headers',chain,logdata:'%{TX.0}'" +#SecRule REQUEST_HEADERS:REFERER "!(^http://%{SERVER_NAME}/|pagead[0-9]\.googlesyndication\.com/pagead/|/gills\.swf?txt= ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<|> ?\"? ?(>|<)|< ?/?i?frame|\%env)""t:none,t:removeNulls,t:utf8tounicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhiteSpace,t:lowercase" + + +#XSS generic filter and suspicious web code detector +SecRule REQUEST_URI "!(?:/(?:admin/(?:(?:build(?:/translate|language/edit|/edit)?|catalog_category)/|settings/site-information|catalog/edit)|(?:miadmin/catalog_product|sitebuilder)/|wizard/edit/html|node/add/|filter-xss|(?:p(?:age_save|roduct_groups/edit/)|[a-z]+/[0-9]+/edit))|\/(?:admin\/(?:surveys\/[0-9]+\/edit\/|\?page=spageedit)|node\/[0-9]+\/(?:webform\/components\/|edit|clone))|^(?:(/~[a-z0-9]+)?/\?q=node/[0-9]+/edit|\?(?:s|v))|c=myaccount&m=update_profile$|mt\.cgi|/nav\.php\?nav=addnews|/products\.php\?action=(?:edit|update)|/systemadmin/configproducts\.php|/admin/catalog_product/|/index\.php\?tab=admincatalog|/admin/settings/customerror|^/ndxz-?studio/\?a=|/editform\?|/wizard/edit/|\?tab=admin|\?content=admin|\?action=modif|\?exec=articles_edit$|/admin/preview\.php|/sysext/tstemplate/|/site-builder/|/(?:new|edit)/[0-9]+/(?:confirm|add)|/admin/editform|/cms/admin/editform|^/filemanager/filemanager\.php|^/([a-z]+/)?admin/structure/|^/support/agent/|^/content/item/edit/|^/index\.php/admin/system_config/|^/administrator/\?option=com_civicrm|^/za/zcadm|^/blog/roller-ui/authoring/entryedit|^/admin/(?:p(?:age_save|roduct_groups/edit/)|[a-z]+/[0-9]+/(?:edit|add))|^/em/admin/\?page=send|^/eprocservice/supplierinboundservice|^/cp/index\.php\?controller=adminmodules|^/services?/bmwidget\.json|^/[a-z0-9/]+?\?fl_builder)" "id:333840,phase:2,t:none,t:lowercase,t:urlDecodeUni,pass,nolog,noauditlog,skip:1,rev:7" + SecAction "phase:2,id:334387,t:none,t:urlDecodeUni,t:lowercase,pass,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_D1" + +#Filenames +SecRule REQUEST_FILENAME "!(/file-manager/edit/)" "id:366840,phase:2,t:none,t:lowercase,t:urlDecodeUni,pass,nolog,noauditlog,skip:1,rev:2" + SecAction "phase:2,id:336687,t:none,t:urlDecodeUni,t:lowercase,pass,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_D1" + +SecRule REQUEST_URI "(?:^/[a-z0-9/]+?panels/ajax/editor/edit-pane/panelizer|^/[a-z]+/media/ajax/image|^/admin/[a-z]+/(?:[0-9]+|create)|^/file/ajax/|^/manage/[a-z0-9]+/edit/|^/smb/file-manager/code-editor/|^/index\.php\?route=extension/d_quickcheckout/[a-z0-9]+/update|^/[a-z0-9]+?/?admin[a-z0-9]+?/index\.php\?controller=admin|^/wp-admin/edit\.php\?post_type=event&page=events-manager-options)" "id:366870,phase:2,t:none,t:lowercase,t:urlDecodeUni,pass,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_D1" + +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|!ARGS:text|!ARGS:settings|!ARGS:post "@rx {{.*?}}" "id:340130,rev:5,phase:2,deny,status:403,log,auditlog,capture,t:none,msg:'Atomicorp.com WAF Rules: AngularJS client side template injection detected',logdata:'Matched Data: Suspicious payload found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', tag:'attack-xss',ctl:auditLogParts=+E,severity:'CRITICAL'" + +SecRule REQUEST_URI "^/index\.php\?ajax-proxy/" "id:321114,rev:1,phase:2,t:urlDecodeUni,t:lowercase,pass,nolog,noauditlog,skipAfter:END_XSS_ATTACKS" + +# Rule 340147: Generic XSS filter +SecRule REQUEST_URI|REQUEST_HEADERS:X_FORWARDED_FOR|ARGS|!ARGS:input_65|!ARGS:/^cont/|!ARGS:/introtext/|!ARGS:_message|!ARGS:/com_liferay/|!ARGS:/fbmcc/|!ARGS:/ide_/|ARGS_NAMES|!ARGS:/^aftax/|!ARGS:/bsr_/|!ARGS:nav-menu-data|!ARGS:/contact_map/|!ARGS:/adsense/|!ARGS:rtel|!ARGS:/TextArea/|!ARGS:insp_code|!ARGS:/marketing_code/|!ARGS:addthis|!ARGS:/go_code/|!ARGS:/shortcode/|!ARGS:/analitics/|!ARGS:/area_id/|!ARGS:/theme/|!ARGS:/ga_code/|!ARGS:/analytic/|!ARGS:/_js_/|!ARGS:/schema/|!ARGS:/^ifeature/|!ARGS:/^redux/|!ARGS:/analyticscode/|!ARGS:/suffix/|!ARGS:/sadrzaj/|!ARGS:js_includes|!ARGS:/m1_source/|!ARGS:/geodir/|!ARGS:/banner_block/|!ARGS:/introcopy/|!ARGS:eingabe|!ARGS:ausgabe|!ARGS:/previewdata/|!ARGS:/tracking_extra/|!ARGS:/^groups/|!ARGS:video|!ARGS:/google_map/|!ARGS:/field_map/|!ARGS:/gacode/|!ARGS:code1|!ARGS:ga_code|!ARGS:customized|!ARGS:code_analytics|!ARGS:uvod|!ARGS:/^field_video/|!ARGS:q|!ARGS:/^textarea-video/|!ARGS:leirro|!ARGS:lomake|!ARGS:vastaus|!ARGS:/^texte$/|!ARGS:vraag|!ARGS:qti_data|!ARGS:tracklist|!ARGS:i_google|!ARGS:code_area_text|!ARGS:/log_code/|!ARGS:/^ADVERT_/|!ARGS:UserData|!ARGS:areas|!ARGS:templatecode|!ARGS:/prevObject/|!ARGS:/replaceAll/|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:/prependTo/|!ARGS:/appendTo/|!ARGS:/mapcode/|!ARGS:googleCode|!ARGS:/sidebar/|!ARGS:/ad_code/|!ARGS:/^recipient/|!ARGS:optional_head|!ARGS:/^form/|!ARGS:/^var_value/|!ARGS:variable_data|!ARGS:/^instance/|!ARGS:/customfield/|!ARGS:notice|!ARGS:/formcode/|!ARGS:/ajax/|!ARGS:all|!ARGS:allowedTags|!ARGS:/google_analytics/|!ARGS:/widget/|!ARGS:ad_code|!ARGS:/keycaptcha_code/|!ARGS:/jscode/|!ARGS:postcontents|!ARGS:video1|!ARGS:/updateAds/|!ARGS:map|!ARGS:gmapcode|!ARGS:/^Sidebar/|!ARGS:/^wpTextbox/|!ARGS:paragrafo|!ARGS:/question/|!ARGS:/style/|!ARGS:tracking_code|!ARGS:whats-new|!ARGS:analyticscode|!ARGS:top_news|!ARGS:data[config]|!ARGS:fulltext|!ARGS:introtext|!ARGS:offertext|!ARGS:block|!ARGS:livezillacode|!ARGS:/embed/|!ARGS:/desc/|!ARGS:/script/|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/cms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:match_report|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:phpcode|!ARGS:intro|!ARGS:Snippet|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:input[Desarrollo]|!ARGS:move2|!ARGS:hoperation|!ARGS:login_form|!ARGS:/product_benefits/|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:bbcode_tpl|!ARGS:Right_photo_1|!ARGS:embedVideo|!ARGS:/^K2ExtraField/|!ARGS:mentorhelp|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:/signature/|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:embeddump|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:/pagimenu/|!ARGS:/^jms/|!ARGS:/note/|!ARGS:Post|!ARGS:/^field_id/|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/footer/|!ARGS:/link/|!ARGS:text|!ARGS:txt|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/|!ARGS:perch_39__blocks_4_youtubevideo|!ARGS:/^rwx97/|!ARGS:/infobox/|!ARGS:frdata|!ARGS:itdata "(?:< ?/? ?script|(?:<|< ?/)(?:(?:java|vb)script|about|applet|activex|chrome|qx?ss|embed)|< ?/?i?frame\b|< ?img src ?=|< ?base href ?=)" "phase:2,deny,log,auditlog,status:403,t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:replaceComments,t:compressWhitespace,t:lowercase,capture,id:340147,rev:163,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" + +# Rule 340149: XSS injection +SecRule ARGS|REQUEST_HEADERS:X_FORWARDED_FOR|!ARGS:/^jms/|!ARGS:/^cont/|!ARGS:/_com_liferay/|!ARGS:/fbmcc/|!ARGS:/refuse_code/|!ARGS:/ide_/|!ARGS:/bsr_/|!ARGS:/^aftax/|!ARGS:emailMessage|!ARGS:/adsense/|!ARGS:rtel|!ARGS:/TextArea/|!ARGS:pr_text|!ARGS:/introtext/|!ARGS:/^asteria/|!ARGS:/^dbem/|!ARGS:insp_code|!ARGS:/marketing_code/|!ARGS:addthis|!ARGS:agreement|!ARGS:/go_code/|!ARGS:/custom/|!ARGS:/shortcode/|!ARGS:/analitics/|!ARGS:/area_id/|!ARGS:/theme/|!ARGS:/ga_code/|!ARGS:/analytic/|!ARGS:/_js_/|!ARGS:/schema/|!ARGS:/^ifeature/|!ARGS:/^redux/|!ARGS:/analyticscode/|!ARGS:/suffix/|!ARGS:actionfilter|!ARGS:js_includes|!ARGS:/m1_source/|!ARGS:/geodir/|!ARGS:/suffix/|!ARGS:/banner_block/|!ARGS:/introcopy/|!ARGS:eingabe|!ARGS:ausgabe|!ARGS:/previewdata/|!ARGS:/tracking_extra/|!ARGS:SAMLResponse|!ARGS:/^groups/|!ARGS:video|!ARGS:/google_map/|!ARGS:/gacode/|!ARGS:code1|!ARGS:ga_code|!ARGS:customized|!ARGS:code_analytics|!ARGS:uvod|!ARGS:/^field_video/|!ARGS:q|!ARGS:leirro|!ARGS:lomake|!ARGS:vastaus|!ARGS:vraag|!ARGS:qti_data|!ARGS:tracklist|!ARGS:i_google|!ARGS:code_area_text|!ARGS:/log_code/|!ARGS:/^ADVERT_/|!ARGS:payment_extrainfo|!ARGS:UserData|!ARGS:clone|!ARGS:areas|!ARGS:templatecode|!ARGS:/replaceAll/|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:/prependTo/|!ARGS:/appendTo/|!ARGS:/prevObject/|!ARGS:/mapcode/|!ARGS:googleCode|!ARGS:/sidebar/|!ARGS:/ad_code/|!ARGS:/^recipient/|!ARGS:optional_head|!ARGS:/^data\[News\]/|!ARGS:d|!ARGS:/^form/|!ARGS:/^var_value/|!ARGS:/^instance/|!ARGS:/customfield/|!ARGS:val333|!ARGS:notice|!ARGS:/formcode/|!ARGS:val333|!ARGS:all|!ARGS:allowedTags|!ARGS:/tracking/|!ARGS:/google_analytics/|!ARGS:/widget/|!ARGS:ad_code|!ARGS:/keycaptcha_code/|!ARGS:/jscode/|!ARGS:postcontents|!ARGS:video1|!ARGS:/updateAds/|!ARGS:map|!ARGS:ide_text|!ARGS:gmapcode|!ARGS:/^Sidebar/|!ARGS:/^wpTextbox/|!ARGS:paragrafo|!ARGS:/question/|!ARGS:/style/|!ARGS:sidebar|!ARGS:text1|!ARGS:analyticscode|!ARGS:top_news|!ARGS:data[config]|!ARGS:fulltext|!ARGS:tracking_code|!ARGS:introtext|!ARGS:offertext|!ARGS:block|!ARGS:livezillacode|!ARGS:/desc/|!ARGS:/footer/|!ARGS:/embed/|!ARGS:/script/|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/wyscms/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:match_report|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:pay_inst_1|!ARGS:sml_prt_1|!ARGS:/form/|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:input[Desarrollo]|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:move2|!ARGS:hoperation|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:mes|!ARGS:/signature/|!ARGS:paepdc|!ARGS:/VB_announce/|!ARGS:/^autoDS/|!ARGS:newyddionc|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/header/|!ARGS:/submit/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:text|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/|!ARGS:/infobox/ "(?:< ?i?frame ?src ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|(?:\.add|\@)import |asfunction\:|background-image\:|\be(?:cma|xec)script\b|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:/|<) ?(?:java|live|j|vb)script!s|lowsrc ?=|mocha\:|\bon(?:abort|blur|change|click|submit|select|dragdrop|event|focus|key(?:down|press|up)|mouse(?:down|move|out|over|up))\b ?=.|window\.location|asfunction:_root\.launch)" "phase:2,deny,log,auditlog,status:403,t:none,t:removeNulls,t:utf8tounicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhiteSpace,t:lowercase,capture,id:340149,rev:162,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" + +SecRule REQUEST_BODY "^< ?\??( |\+)?xml" "phase:2,id:333704,pass,t:none,t:urlDecodeUni,t:lowercase,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_D1" + +#suspicious code +SecRule REQUEST_URI "(?:/admin/(?:[a-z]+/(?:save|module/update/|edit)|publish|\?op=edit|content/update|appearance/settings/|d/1/|pages/update|[a-z/]+/editform|block_edit)|/secure/roundcube/|/backend\.php/property/save|/edit/|/home/add|/\?act=edit|/site-content/|/project/update/|/index\.php\?option=com_?(?:easyblog|resource&controller=article|comprofiler&task=my_profile|aclassif)|/index\.php/datafeedmanager/adminhtml_datafeedmanager/save|/index\.php\?mode=(?:new|edit)story|^/filemanager/filemanager\.php|^/user_info/edit_profile/|/admin/editor/|^/user\.php\?op=edituser&htmltext=|^/admin/structure/|option=com_rsform&task=forms\.edit|^/ndxz-?studio/\?a=|^/support/agent|^/elements/save|^/settings/in_place_save/|^/ndxz2/|^/([a-z]+/)?index\.php/admin/s(?:ystem_config|ubject)/|^/(a-z)+/admin/programs/update_program|^/backoffice/\?op=edit|^/za/zcadm|^/efthuko\.php\?mod=editnews|^/mm-panel/index\.php|/ndxzstudio/|destination=admin/structure|/cms/db_manage\.php|^/mod_pagespeed|^/\?q=admin/appearance/settings|^/articles/(?:save|add|edit)|^/\?ptype=|/whmadmcp/addonmodules\.php|^/sh/file/|/multimediasave\.do|^/cms/|^/panel/index\.php|^/microagility/([a-z]+/)?useredit\.php|^/content_multigroup/|^/posts/edit|^/teksty/edytuj_akapit|^/egisportal/|/templatesavechanges|^/\?_task=mail|^/cpsess[0-9]+/scripts2?/|control_panel/manage\?p_p_id=com_liferay|^/[a-z0-9]+?/?admin[a-z0-9]+?/index\.php\?controller=admin|^/wp-admin/edit\.php\?post_type=event&page=events-manager-options)" "phase:2,id:333732,pass,t:none,t:urlDecodeUni,t:lowercase,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_D1" + + +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|!ARGS:allowedTags|!ARGS:compiled_css|!ARGS:/^addon/|!ARGS:/content/|!ARGS:fl_builder_data|!ARGS:/shortcode/|!ARGS:frdata|!ARGS:itdata|!ARGS:/document/|!ARGS:affiliatelinks|!ARGS:input_13\.2|!ARGS:prop_des|!ARGS:/footer/|!ARGS:/header/|!ARGS:/body/|!ARGS:/note/|!ARGS:input_65|!ARGS:/description/|!ARGS:con|!ARGS:/text/|!ARGS:/mail/|!ARGS:act|!ARGS:jfo|!ARGS:con|!ARGS:/html/|!ARGS:customized|!ARGS:/signature/|!ARGS:page_settings|!ARGS:/message/|XML:/* "@rx (?i)<[^\w<>]*(?:[^<>\"'\s]*:)?[^\w<>]*(?:\W*?s\W*?c\W*?r\W*?i\W*?p\W*?t|\W*?f\W*?o\W*?r\W*?m|\W*?s\W*?t\W*?y\W*?l\W*?e|\W*?s\W*?v\W*?g|\W*?m\W*?a\W*?r\W*?q\W*?u\W*?e\W*?e|(?:\W*?l\W*?i\W*?n\W*?k|\W*?o\W*?b\W*?j\W*?e\W*?c\W*?t|\W*?e\W*?m\W*?b\W*?e\W*?d|\W*?a\W*?p\W*?p\W*?l\W*?e\W*?t|\W*?p\W*?a\W*?r\W*?a\W*?m|\W*?i?\W*?f\W*?r\W*?a\W*?m\W*?e|\W*?b\W*?a\W*?s\W*?e|\W*?b\W*?o\W*?d\W*?y|\W*?m\W*?e\W*?t\W*?a|\W*?i\W*?m\W*?a?\W*?g\W*?e?|\W*?v\W*?i\W*?d\W*?e\W*?o|\W*?a\W*?u\W*?d\W*?i\W*?o|\W*?b\W*?i\W*?n\W*?d\W*?i\W*?n\W*?g\W*?s|\W*?s\W*?e\W*?t|\W*?a\W*?n\W*?i\W*?m\W*?a\W*?t\W*?e)[^>\w])|(?:<\w[\s\S]*[\s\/]|['\"](?:[\s\S]*[\s\/])?)(?:formaction|style|background|src|lowsrc|ping|on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start|drop|over)?|op)|i(?:s(?:c(?:hargingtimechange|onnect(?:ing|ed))|abled)|aling)|ata(?:setc(?:omplete|hanged)|(?:availabl|chang)e|error)|urationchange|ownloading|blclick)|Moz(?:M(?:agnifyGesture(?:Update|Start)?|ouse(?:PixelScroll|Hittest))|S(?:wipeGesture(?:Update|Start|End)?|crolledAreaChanged)|(?:(?:Press)?TapGestur|BeforeResiz)e|EdgeUI(?:C(?:omplet|ancel)|Start)ed|RotateGesture(?:Update|Start)?|A(?:udioAvailable|fterPaint))|c(?:o(?:m(?:p(?:osition(?:update|start|end)|lete)|mand(?:update)?)|n(?:t(?:rolselect|extmenu)|nect(?:ing|ed))|py)|a(?:(?:llschang|ch)ed|nplay(?:through)?|rdstatechange)|h(?:(?:arging(?:time)?ch)?ange|ecking)|(?:fstate|ell)change|u(?:echange|t)|l(?:ick|ose))|m(?:o(?:z(?:pointerlock(?:change|error)|(?:orientation|time)change|fullscreen(?:change|error)|network(?:down|up)load)|use(?:(?:lea|mo)ve|o(?:ver|ut)|enter|wheel|down|up)|ve(?:start|end)?)|essage|ark)|s(?:t(?:a(?:t(?:uschanged|echange)|lled|rt)|k(?:sessione|comma)nd|op)|e(?:ek(?:complete|ing|ed)|(?:lec(?:tstar)?)?t|n(?:ding|t))|u(?:ccess|spend|bmit)|peech(?:start|end)|ound(?:start|end)|croll|how)|b(?:e(?:for(?:e(?:(?:scriptexecu|activa)te|u(?:nload|pdate)|p(?:aste|rint)|c(?:opy|ut)|editfocus)|deactivate)|gin(?:Event)?)|oun(?:dary|ce)|l(?:ocked|ur)|roadcast|usy)|a(?:n(?:imation(?:iteration|start|end)|tennastatechange)|fter(?:(?:scriptexecu|upda)te|print)|udio(?:process|start|end)|d(?:apteradded|dtrack)|ctivate|lerting|bort)|DOM(?:Node(?:Inserted(?:IntoDocument)?|Removed(?:FromDocument)?)|(?:CharacterData|Subtree)Modified|A(?:ttrModified|ctivate)|Focus(?:Out|In)|MouseScroll)|r(?:e(?:s(?:u(?:m(?:ing|e)|lt)|ize|et)|adystatechange|pea(?:tEven)?t|movetrack|trieving|ceived)|ow(?:s(?:inserted|delete)|e(?:nter|xit))|atechange)|p(?:op(?:up(?:hid(?:den|ing)|show(?:ing|n))|state)|a(?:ge(?:hide|show)|(?:st|us)e|int)|ro(?:pertychange|gress)|lay(?:ing)?)|t(?:ouch(?:(?:lea|mo)ve|en(?:ter|d)|cancel|start)|ime(?:update|out)|ransitionend|ext)|u(?:s(?:erproximity|sdreceived)|p(?:gradeneeded|dateready)|n(?:derflow|load))|f(?:o(?:rm(?:change|input)|cus(?:out|in)?)|i(?:lterchange|nish)|ailed)|l(?:o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|evelchange|y)|g(?:amepad(?:(?:dis)?connected|button(?:down|up)|axismove)|et)|e(?:n(?:d(?:Event|ed)?|abled|ter)|rror(?:update)?|mptied|xit)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|valid|put))|o(?:(?:(?:ff|n)lin|bsolet)e|verflow(?:changed)?|pen)|SVG(?:(?:Unl|L)oad|Resize|Scroll|Abort|Error|Zoom)|h(?:e(?:adphoneschange|l[dp])|ashchange|olding)|v(?:o(?:lum|ic)e|ersion)change|w(?:a(?:it|rn)ing|heel)|key(?:press|down|up)|(?:AppComman|Loa)d|no(?:update|match)|Request|zoom))[\s\x08]*?=" "id:342259,rev:126,severity:2,phase:2,deny,status:403,capture,t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,msg:'Atomicorp.com WAF Rules: Possible HTML Injection',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',log,auditlog" + + + +SecRule ARGS|ARGS_NAMES|!ARGS:/rules/|!ARGS:dt|!ARGS:/^utm_/|!ARGS:/^ADVERT_/|!ARGS:actionRemarks|!ARGS:ad|!ARGS:/submenu/|!ARGS:/area_id/|!ARGS:/snippet/|!ARGS:accesshash|!ARGS:/motd/|ARGS:cont|!ARGS:/comenter/|!ARGS:/contenu/|!ARGS:/background/|!ARGS:styles|!ARGS:/^go/|!ARGS:raw|!ARGS:/sig/|!ARGS:/overlay/|!ARGS:/ads?code/|!ARGS:AUTOR01|!ARGS:third_party_code|!ARGS:/partial/|!ARGS:/adsense/|!ARGS:/bericht/|!ARGS:/mensaje/|!ARGS:whereOptions|!ARGS:/wyswie/|!ARGS:/what/|!ARGS:opis|!ARGS:dims|!ARGS:/cbPay/|!ARGS:/social/|!ARGS:/__dnn/|!ARGS:/^system/|!ARGS:/pfield/|!ARGS:/go_code/|!ARGS:/app_list/|!ARGS:/^epp/|!ARGS:/^akID/|!ARGS:/shortcode/|!ARGS:/custom/|!ARGS:head|!ARGS:/_mail_/|!ARGS:tpl|!ARGS:/object/|!ARGS:export|!ARGS:/introcopy/|!ARGS:cont|!ARGS:/geodir/|!ARGS:omesg|!ARGS:/terms/|!ARGS:/google/|!ARGS:/pass/|!ARGS:code|!ARGS:/^custom/|!ARGS:tele|!ARGS:/color/|!ARGS:/center/|!ARGS:/widget/|!ARGS:/theme/|!ARGS:/^value/|!ARGS:/itinerary/|!ARGS:repair|!ARGS:nw_brief|!ARGS:/definition/|!ARGS:/subject/|!ARGS:process|!ARGS:/daten/|!ARGS:/Beschreibung/|!ARGS:/desc/|!ARGS:/destination/|!ARGS:ausgabe|!ARGS:eingabe|!ARGS:/included/|!ARGS:Lead|!ARGS:/training/|!ARGS:/Education/|!ARGS:/wp_autosave/|!ARGS:aname|!ARGS:datos|!ARGS:/^profile_/|!ARGS:return_to|!ARGS:ad|!ARGS:/overview/|!ARGS:/^mce_/|!ARGS:namestyle|!ARGS:/ULTIMATUM/|!ARGS:/agree/|!ARGS:/ARGS:uutinen/|!ARGS:tracklist|!ARGS:/artwork/|!ARGS:/gacode/|!ARGS:btnApply|!ARGS:/Button/|!ARGS:/^VALUE\[1\]$/|!ARGS:connectorPassword|!ARGS:sample|!ARGS:sotenson|!ARGS:/source_code/|!ARGS:/Settings/|!ARGS:code1|!ARGS:/promo/|!ARGS:view|!ARGS:record_json|!ARGS:/offer/|!ARGS:op|!ARGS:geweest|!ARGS:send|!ARGS:pressestimmen|!ARGS:name|!ARGS:imagemap|!ARGS:/^extra/|!ARGS:afbeelding|!ARGS:action_name|!ARGS:nieuwsbrief|!ARGS:/locatie/|!ARGS:ingredients|!ARGS:priceField|!ARGS:inhoud|!ARGS:f_main|!ARGS:error|!ARGS:komentar|!ARGS:uvod|!ARGS:/^field_/|!ARGS:customized|!ARGS:/fullnews/|!ARGS:vraag|!ARGS:/^textarea-video/|!ARGS:/_layout_/|!ARGS:/^FieldValue/|!ARGS:areacomum|!ARGS:lomake|!ARGS:vastaus|!ARGS:target|!ARGS:areaprivativa|!ARGS:areas|!ARGS:qti_data|!ARGS:templatecode|!ARGS:i_google|!ARGS:code_area_text|!ARGS:/^help_/|!ARGS:quote|!ARGS:notice|!ARGS:userdata|!ARGS:source|!ARGS:/^book/|!ARGS:/leftcol/|!ARGS:mes|!ARGS:sisalto|!ARGS:reg_rules|!ARGS:/sidebar/|!ARGS:/ad_code/|!ARGS:json|!ARGS:wpreason|!ARGS:extended|!ARGS:/Kirjoitukset/|!ARGS:item_list|!ARGS:/x_line_item/|!ARGS:/^var_value/|!ARGS:valori|!ARGS:/rightcol/|!ARGS:/^instance/|!ARGS:/pimage/|!ARGS:/allowedTags/|!ARGS:/^zcck/|!ARGS:/includes/|!ARGS:/^button/|!ARGS:/accommodation/|!ARGS:/restaurant/|!ARGS:/^breves/|!ARGS:/testimonial/|!ARGS:feature|!ARGS:headstone|!ARGS:/formcode/|!ARGS:/log/|!ARGS:/metatags/|!ARGS:/^customfield/|!ARGS:/^fields/|!ARGS:/embed/|!ARGS:val333|!ARGS:/banner/|!ARGS:/synopsis/|!ARGS:cb_talks|!ARGS:log|!ARGS:/^bt_|!ARGS:/next/|!ARGS:changedept|!ARGS:receipt_address|!ARGS:narrative|!ARGS:/results/|!ARGS:/teaser/|!ARGS:EnTrar|!ARGS:cv|!ARGS:dati|!ARGS:/experience/|!ARGS:/plan/|!ARGS:do|!ARGS:properties|!ARGS:/para/|!ARGS:do|!ARGS:perex|!ARGS:/highlight/|!ARGS:/bio/|!ARGS:/short/|!ARGS:advanced|!ARGS:/contact/|!ARGS:/google_analytics/|!ARGS:review|!ARGS:rules|!ARGS:meta|!ARGS:/observacao/|!ARGS:/caption/|!ARGS:/feed/|!ARGS:/bbclosed/|!ARGS:logoutRequest|!ARGS:video1|!ARGS:/js_payload/|!ARGS:/abstract/|!ARGS:pc_main|!ARGS:/^property/|!ARGS:/notice/|!ARGS:/config/|!ARGS:/welcome/|!ARGS:des|!ARGS:pwd|!ARGS:structure|!ARGS:/tweet/|!ARGS:/table/|!ARGS:tag|!ARGS:ad_code|!ARGS:romancode|!ARGS:model|!ARGS:thecode|!ARGS:rqst|!ARGS:/^input_/|!ARGS:dhltrack|!ARGS:reflection|!ARGS:media|!ARGS:blurb|!ARGS:Thankyou|!ARGS:/OSDCS/|!ARGS:continue|!ARGS:do|!ARGS:waarde|!ARGS:img_alt|!ARGS:notes|!ARGS:drugs|!ARGS:/writing/|!ARGS:terms|!ARGS:/announ/|!ARGS:highlights|!ARGS:/^eeta-/|!ARGS:profile|!ARGS:/^prod/|!ARGS:/^News/|!ARGS:request|!ARGS:copy|!ARGS:/MapField/|!ARGS:/email/|!ARGS:main|!ARGS:/admin/|!ARGS:/suffix/|!ARGS:/prefix/|!ARGS:validatepromo|!ARGS:payment_sel|!ARGS:/title/|!ARGS:/submit/|!ARGS:contenu|!ARGS:/xjxargs/|!ARGS:block|!ARGS:btnCheckout|!ARGS:nav|!ARGS:/instructions/|!ARGS:/info/|!ARGS:recompose|!ARGS:compose|!ARGS:/^bname/|!ARGS:groupWelcomeScreen|!ARGS:langbericht|!ARGS:next|!ARGS:xsym_sym_brief|!ARGS:creategallery|!ARGS:/^copyright/|!ARGS:lease|!ARGS:livezillacode|!ARGS:cleaning|!ARGS:/^gui/|!ARGS:/Import_Cell/|!ARGS:/reply/|!ARGS:/^bbcode/|!ARGS:subhead|!ARGS:_cc|!ARGS:resume|!ARGS:addtoclass|!ARGS:/intro/|!ARGS:/answer/|!ARGS:registration_prices|!ARGS:registration_discounts|!ARGS:venue|!ARGS:/opportunit/|!ARGS:agenda|!ARGS:workshop|!ARGS:/^mainman/|!ARGS:features|!ARGS:/problem/|!ARGS:/question/|!ARGS:entry|!ARGS:/form/|!ARGS:/qualification/|!ARGS:/detail/|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/cms/|!ARGS:eventDescription|!ARGS:/script/|!ARGS:/^product/|!ARGS:/report/|!ARGS:/^room_/|!ARGS:eip_value|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:phpcode|!ARGS:Snippet|!ARGS:oid|!ARGS:Submit2|!ARGS:/^obj_/|!ARGS:layout|!ARGS:pageset|!ARGS:/^site_/|!ARGS:/translation/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:input[Desarrollo]|!ARGS:move2|!ARGS:hoperation|!ARGS:login_form|!ARGS:/product_benefits/|!ARGS:/custom_code/|!ARGS:arg2|!ARGS:resumoDetalhe|!ARGS:bbcode_tpl|!ARGS:Right_photo_1|!ARGS:/embed/|!ARGS:/^K2ExtraField/|!ARGS:mentorhelp|!ARGS:/submitcode/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:/^fck/|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:/^_qf_/|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:/VB_announce/|!ARGS:guardar|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:/solution/|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:ticket_response|!ARGS:/element/|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions|!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^elm/|!ARGS:verbiage|!ARGS:news|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:order|!ARGS:/post/|!ARGS:youtube|!ARGS:reply|!ARGS:business|!ARGS:/homePage/|!ARGS:/pagimenu/|!ARGS:/^jms/|!ARGS:/note/|!ARGS:Post|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/_section_/|!ARGS:/css/|!ARGS:/^prop_/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/footer/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/|!ARGS:/tagline/|!ARGS:/senior/|!ARGS:/^addon/ "(?:> ?< ?(?:img ?src|a ?href) ?= ?(?:ht|f)tps?:/|\" ?> ?<|\" ?[a-z]+ ?<|> ?\"? ?(?:>|<)|< ?/?i?frame|^\"\>|\' ?\} ?\) ?;)" "chain,phase:2,deny,log,auditlog,status:403,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:replaceNulls,t:compressWhiteSpace,t:lowercase,id:350147,rev:168,severity:2,msg:'Atomicorp.com WAF Rules: Potentially Untrusted Web Content Detected'" +SecRule MATCHED_VARS "!@rx ((?:submit(?:\+| )?(request)?(?:\+| )?>+|<<(?:\+| )remove|(?:sign ?in|log ?(?:in|out)|next|modifier|envoyer|add|continue|weiter|account|results|select)(?:\+| )?>+)$|^< ?\??(?: |\+)?xml|^> ?$)" "t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase" + +SecMarker END_XSS_ATTACKS_D1 + +SecRule REQUEST_HEADERS:REFERER|REQUEST_URI "(?:/plugins/editors/tinymce/jscripts/|/modules/tinymce/tinymce/jscripts|/phpinfo_iframe\.php|^pagead[0-9]\.googlesyndication\.com/pagead/|/wp-admin/press-this\.php|&(?:loc|u)='https?://|^/[a-z0-9/]+?\?fl_builder)" "phase:2,nolog,noauditlog,id:343732,pass,t:none,t:urlDecodeUni,t:lowercase,skipAfter:END_XSS_ATTACKS_D2" + +#XSS in referrer +SecRule REQUEST_HEADERS:REFERER "(?:= ?\' ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|< ?(?:script|about|applet|activex|chrome)|activexobject|(?:\.add|\@)import|asfunction\:|background-image\:|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml||lowsrc ?=|mocha\:|<{1,200}.\bon(?:abort|blur|change|click|dragdrop|event|focus|keydown|move|resize|select|submit|unload|key(?:press|up)|load|mouse(?:down|move|out|over|up))\b|settimeout|shell:|< ?i(?:mg|frame) ?src ?=( |\+)?(?:\"|\')?(ht|f)tps?:/)" "phase:2,deny,log,auditlog,status:403,capture,id:340158,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,rev:20,severity:2,msg:'Atomicorp.com WAF Rules: XSS in referrer',logdata:'%{TX.0}'" +SecMarker END_XSS_ATTACKS_D2 + +#special exclusion for drupal webforms +SecRule REQUEST_URI "node/[0-9]+/webform/components/" "phase:2,deny,log,auditlog,status:403,capture,chain,t:none,t:urlDecodeUni,t:lowercase,id:320476,rev:6,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|!ARGS:/^extra/|!ARGS:op|!ARGS:/desc/|!ARGS:areas|!ARGS:templatecode|!ARGS:value[value]|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^code_tscript/|!ARGS:quote-form|!ARGS:value|!ARGS:paepdc|!ARGS:/VB_announce/|!ARGS:/^autoDS/|!ARGS:newyddionc|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:s_query|!ARGS:bedrijfsprofiel|!ARGS:finish_survey|!ARGS:embeddump|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:/tekst/|!ARGS:/sql/|!ARGS:prefix|!ARGS:query|!ARGS:c_features|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:verbiage|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:usr1|!ARGS:resolution|!ARGS:problem|!ARGS:/^product_options/|!ARGS:eintrag|!ARGS:/edit/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:Returnid|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:order|!ARGS:youtube|!ARGS:business|!ARGS:/homePage/|!ARGS:/post/|!ARGS:navig|!ARGS:preview__hidden|!ARGS:/page/|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:meta_info|!ARGS:ta|!ARGS:/data/|!ARGS:search_theme_form_keys|ARGS_NAMES|!ARGS_NAMES:user[click_or_onmouseover]|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/note/|!ARGS:/xml/|!ARGS:/^doc/|!ARGS:/desc/|!ARGS:tekst|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:/submit/|!ARGS:/message/|!ARGS:/header/|!ARGS:/html/|!ARGS:/content/|!ARGS:/link/|!ARGS:text|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|file|data|php|zlib|zip|glob|s3|phar|rar|s(?:sh2?|cp)|dict|expect|(?:ht|f)tps?):/|\" ?> ?<|(?:\.add|\@)import|asfunction\:|background-image\:|\be(?:cma|xec)script\b|\.fromcharcode|get(?:parentfolder|specialfolder)|\.innerhtml|\< ?input|(?:java|live|j|vb)script!s|lowsrc ?=|mocha\:|\bon(?:abort|blur|change|click|select|dragdrop|event|focus|keydown|keypress|keyup|mouse(?:down|move|out|over|up))\b|shell\:|window\.location|asfunction:_root\.launch|\%env)" "t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase" + + +#Rule 340152: IE XSS attack +#SecRule REQUEST_URI_RAW|REQUEST_BODY "(?:< ?object[ /+\t].*?((type)|(codetype)|(classid)|(code)|(data))[ /+\t]*=|< ?applet[ /+\t].*?code[ /+\t]*=|< ?base[ /+\t].*?href[ /+\t]*=|)" "phase:2,t:none,t:lowercase,log,auditlog,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack (IE variant)',id:340152,rev:24" + + +SecMarker END_XSS_ATTACKS + +SecRule REQUEST_URI|REQUEST_HEADERS|REQUEST_BODY|ARGS|QUERY_STRING|!ARGS:areas|!ARGS:templatecode "@pm script expression html onevent onmouse img src onload onerror import asfunction: background-image: fromcharcode frame input lowsrc mocha onblur onselect onchange onclick ondragdrop onkeydown onkeypress onkeyup resize select unload shell: settimeout addimport @import url window.location < > env about applet activex chrome getparentfolder getspecialfolder href object" "id:333841,phase:2,t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,multimatch,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:334388,t:none,pass,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_2" + +#special exclusion for drupal webforms +SecRule REQUEST_URI "^/node/[0-9]+/webform/components/" "phase:2,deny,log,auditlog,status:403,chain,capture,t:none,t:urlDecodeUni,t:replaceComments,t:compressWhiteSpace,t:replaceNulls,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:320475,rev:3,severity:2,msg:'Atomicorp.com WAF Rules: Cross Site Scripting Attack',logdata:'%{TX.0}'" +SecRule REQUEST_URI|ARGS|!ARGS:areas|!ARGS:templatecode|ARGS_NAMES|!ARGS:/desc/|!ARGS:value|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:/^value/|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:pagimenu_inhoud|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:/desc/|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/submit/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:/code/|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/ "(?:< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(ht|f)tps?)\:/|(?:alert|document\.write) ?\(||\" ?> ?<|\" ?[a-z]+ ?<|> ?\"? ?>|< ?/?i?frame|\%env)" "t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,multiMatch" + +# Rule 340148: XSS injection with multimatch checks +#XSS generic filter and suspicious web code detector +SecRule REQUEST_URI |!ARGS:/^aftax/|"!(?:/(?:admin/(?:(?:build(?:/translate|/language/edit|/edit)?|catalog_category)/|settings/site-information|catalog/edit)|(?:miadmin/catalog_product|sitebuilder)/|wizard/edit/html|node/add/|filter-xss)|\/(?:admin\/(?:surveys\/[0-9]+\/edit\/|\?page=spageedit)|node\/[0-9]+\/(?:webform\/components\/|edit|clone))|^(?:\/\?(?:q=node\/[0-9]+\/edit|(s|v))|\?(s|v))|c=myaccount&m=update_profile$|mt\.cgi|/nav\.php\?nav=addnews|/products\.php\?action=(?:edit|update)|/systemadmin/configproducts\.php|/admin/catalog_product/|/index\.php\?tab=admincatalog|/admin/settings/customerror|^/ndxz-?studio/\?a=|/editform\?|/wizard/edit/|\?tab=admin|\?content=admin|\?action=modif|\?exec=articles_edit$|/admin/preview\.php|/sysext/tstemplate/|/site-builder/|/(?:new|edit)/[0-9]+/(?:confirm|add)|/admin/editform|/cms/admin/editform|^/filemanager/filemanager\.php|^/([a-z]+/)?admin/structure/|^/index.php/admin/system_config/|^/administrator/\?option=com_civicrm|^/za/zcadm|^/blog/roller-ui/authoring/entryedit|^/admin/(?:p(?:age_save|roduct_groups/edit/)|[a-z]+/[0-9]+/)|^/services?/bmwidget\.json|^/file/ajax/|^/manage/car/[a-z0-9]+/|^/[a-z0-9/]+?\?fl_builder|^/index\.php\?route=extension/d_quickcheckout/[a-z0-9_]+/update|^/[a-z0-9]+?/?admin[a-z0-9]+?/index\.php\?controller=admin|^/wp-admin/edit\.php\?post_type=event&page=events-manager-options)" "id:333842,rev:4,phase:2,t:none,t:lowercase,t:urlDecodeUni,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:334389,t:none,pass,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_D2" +#Filenames +SecRule REQUEST_FILENAME "!(/file-manager/edit/)" "id:366841,phase:2,t:none,t:lowercase,t:urlDecodeUni,pass,nolog,noauditlog,skip:1,rev:2" + SecAction "phase:2,id:336688,t:none,t:urlDecodeUni,t:lowercase,pass,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_D2" + +SecRule REQUEST_URI "^/index\.php\?ajax-proxy/" "id:321115,rev:1,phase:2,t:urlDecodeUni,t:lowercase,pass,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_2" + +# Rule 340148: XSS injection with multimatch checks +SecRule ARGS|REQUEST_HEADERS:X_FORWARDED_FOR|ARGS_NAMES|!ARGS:input_65|!ARGS:/^cont/|!ARGS:/introtext/|!ARGS:_message|!ARGS:/com_liferay/|!ARGS:/fbmcc/|!ARGS:/refuse_code/|!ARGS:/ide_/|!ARGS:/bsr_/|!ARGS:nav-menu-data|!ARGS:/sc_stats/|!ARGS:/contact_map/|!ARGS:/adsense/|!ARGS:rtel|!ARGS:/TextArea/|!ARGS:/^dbem/!ARGS:insp_code|!ARGS:/marketing_code/|!ARGS:addthis|!ARGS:/option_tree/|!ARGS:/go_code/|!ARGS:/custom/|!ARGS:/shortcode/|!ARGS:/analitics/|!ARGS:/area_id/|!ARGS:/_head_/|!ARGS:/theme/|!ARGS:/ga_code/|!ARGS:/analytic/|!ARGS:/_js_/|!ARGS:/schema/|!ARGS:/^ifeature/|!ARGS:/^redux/|!ARGS:/analyticscode/|!ARGS:/suffix/|!ARGS:/sadrzaj/|!ARGS:js_includes|!ARGS:/m1_source/|!ARGS:/geodir/|!ARGS:/suffix/|!ARGS:/banner_block/|!ARGS:/introcopy/|!ARGS:ausgabe|!ARGS:eingabe|!ARGS:/previewdata/|!ARGS:/tracking_extra/|!ARGS:SAMLResponse|!ARGS:/^groups/|!ARGS:video|!ARGS:/google_map/|!ARGS:/gacode/|!ARGS:code1|!ARGS:sotenson|!ARGS:ga_code|!ARGS:customized|!ARGS:code_analytics|!ARGS:uvod|!ARGS:/^field_video/|!ARGS:q|!ARGS:/^textarea-video/|!ARGS:leirro|!ARGS:lomake|!ARGS:vastaus|!ARGS:vraag|!ARGS:qti_data|!ARGS:tracklist|!ARGS:i_google|!ARGS:code_area_text|!ARGS:/log_code/|!ARGS:/^ADVERT_/|!ARGS:UserData|!ARGS:areas|!ARGS:templatecode|!ARGS:/prevObject/|!ARGS:/replaceAll/|!ARGS:/insertBefore/|!ARGS:/insertAfter/|!ARGS:/prependTo/|!ARGS:/appendTo/|!ARGS:/mapcode/|!ARGS:googleCode|!ARGS:/^recipient/|!ARGS:optional_head|!ARGS:/^form/|!ARGS:/^var_value/|!ARGS:variable_data|!ARGS:/customfield/|!ARGS:val333|!ARGS:notice|!ARGS:/formcode/|!ARGS:/ajax/|!ARGS:all|!ARGS:allowedTags|!ARGS:/tracking/|!ARGS:/google_analytics/|!ARGS:/widget/|!ARGS:ad_code|!ARGS:/jscode/|!ARGS:postcontents|!ARGS:/keycaptcha_code/|!ARGS:video1|!ARGS:/updateAds/|!ARGS:map|!ARGS:gmapcode|!ARGS:/^Sidebar/|!ARGS:/^wpTextbox/|!ARGS:paragrafo|!ARGS:/question/|!ARGS:/style/|!ARGS:sidebar|!ARGS:analyticscode|!ARGS:top_news|!ARGS:tracking_code|!ARGS:data[config]|!ARGS:fulltext|!ARGS:introtext|!ARGS:offertext|!ARGS:block|!ARGS:livezillacode|!ARGS:whats-new|!ARGS:/embed/|!ARGS:/desc/|!ARGS:/sidebar/|!ARGS:/ad_code/|!ARGS:/footer/|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/wyscms/|!ARGS:/script/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:/^field_/|!ARGS:match_report|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:/^instance/|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:eip_value|!ARGS:phpcode|!ARGS:intro|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:_qf_Select_next|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:layout|!ARGS:pageset|!ARGS:contact_form_information|!ARGS:/^site_/|!ARGS:/^translations/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:move2|!ARGS:input[Desarrollo]|!ARGS:hoperation|!ARGS:arg2|!ARGS:login_form|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:bbcode_tpl|!ARGS:embedVideo|!ARGS:/submitcode/|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:/signature/|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:resolution|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:embeddump|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:/pagimenu/|!ARGS:/^jms/|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/^field_id/|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/|!ARGS:/infobox/ "(?:< ?/? ?script|< ?(?:i?frame ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(ht|f)tps?)\:/|document\.write ?\(|(?:<|< ?/) ?(?:(?:java|vb)script|applet|activex|chrome|qx?ss|embed)|< ?/?i?frame\b|< ?img src ?=|< ?base href ?=)" "phase:2,deny,log,auditlog,status:403,capture,t:none,t:removeNulls,t:utf8tounicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhiteSpace,t:lowercase,multiMatch,id:340148,rev:162,severity:2,msg:'Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack',logdata:'%{TX.0}'" + +SecRule REQUEST_BODY "^< ?\??( |\+)?xml" "phase:2,id:333706,pass,t:none,t:urlDecodeUni,t:lowercase,nolog,noauditlog,skipAfter:END_XSS_ATTACKS_D2" + +# Rule 350148: potentially malicious web code with multimatch checks +SecRule REQUEST_URI "!(?:/admin/(?:[a-z]+/(?:save|module/update/|edit)|publish|\?op=edit|content/update|appearance/settings/|d/1/|pages/update|block_edit)|/secure/roundcube/|/edit/|/backend\.php/property/save|/home/add|/\?act=edit|/site-content/|/project/update/|/index\.php\?option=com_(?:easyblog|resource&controller=article|comprofiler&task=my_profile|aclassif)|/index.php/datafeedmanager/adminhtml_datafeedmanager/save|/index\.php\?mode=(?:new|edit)story|^/filemanager/filemanager\.php|^/user_info/edit_profile/|/admin/editor/|^/user.php\?op=edituser&htmltext=|^/admin/structure/|option=com_rsform&task=forms\.edit|^/ndxz-?studio/\?a=|^/support/agent|^/elements/save|^/settings/in_place_save/|^/ndxz2/|^/([a-z]+/)?index\.php/admin/s(?:ystem_config|ubject)/|^/(a-z)+/admin/programs/update_program|^/backoffice/\?op=edit|^/za/zcadm|^/efthuko\.php\?mod=editnews|^/mm-panel/index\.php|/ndxzstudio/|destination=admin/structure|/smart_forms/live/save_section\.php|^/mod_pagespeed|^/\?q=admin/appearance/settings|^/articles/(?:save|edit|add)|^/\?ptype=|/whmadmcp/addonmodules\.php|^/sh/file/|/multimediasave\.do|^/cms/|^/panel/index\.php|^/posts/edit|^/teksty/edytuj_akapit|^/egisportal/|/templatesavechanges|^/\?_task=mail|^/cpsess[0-9]+/scripts2?/|control_panel/manage\?p_p_id=com_liferay|^/[a-z0-9]+?/?admin[a-z0-9]+?/index\.php\?controller=admin|/wp-admin/edit\.php\?post_type=event&page=events-manager-options)" "capture,phase:2,deny,log,auditlog,status:403,chain,t:none,t:urlDecodeUni,t:lowercase,capture,id:350148,rev:169,severity:2,msg:'Atomicorp.com WAF Rules: Potentially Untrusted Web Content Detected ',logdata:'%{TX.0},%{matched_var}'" +SecRule ARGS|!ARGS:cont|!ARGS:/^addon/|!ARGS:/comenter/|!ARGS:/contenu/|!ARGS:/motd/|!ARGS:styles|!ARGS:/background/|!ARGS:/^go/|!ARGS:/overlay/|!ARGS:raw|!ARGS:accesshash|!ARGS:AUTOR01|!ARGS:/ads?code/|!ARGS:third_party_code|!ARGS:/partial/|!ARGS:/adsense/|!ARGS:/bericht/|!ARGS:whereOptions|!ARGS:/what/|!ARGS:/mensaje/|!ARGS:opis|!ARGS:/wyswie/|!ARGS:/cbPay/|!ARGS:dims|!ARGS:/__dnn/|!ARGS:/social/|!ARGS:/pfield/|!ARGS:/rules/|!ARGS:/go_code/|!ARGS:/app_list/|!ARGS:/^epp/|!ARGS:/shortcode/|!ARGS:/^akID/|!ARGS:/area_id/|!ARGS:head|!ARGS:tpl|!ARGS:export|!ARGS:/object/|!ARGS:cont|!ARGS:/custom/|!ARGS:/terms/|!ARGS:/snippet/|!ARGS:omesg|!ARGS:/google/|!ARGS:/geodir/|!ARGS:tele|!ARGS:code|!ARGS:dt|!ARGS:/color/|!ARGS:/theme/|!ARGS:/center/|!ARGS:/widget/|!ARGS:/^value/|!ARGS:/^custom/|!ARGS:/pass/|!ARGS:repair|!ARGS:/definition/|!ARGS:/daten/|!ARGS:/subject/|!ARGS:nw_brief|!ARGS:/Beschreibung/|!ARGS:process|!ARGS:/introcopy/|!ARGS:ausgabe|!ARGS:eingabe|!ARGS:Lead|!ARGS:/desc/|!ARGS:/itinerary/|!ARGS:/included/|!ARGS:/destination/|!ARGS:/training/|!ARGS:/^room_/|!ARGS:aname|!ARGS:/Education/|!ARGS:/wp_autosave/|!ARGS:return_to|!ARGS:/^profile_/|!ARGS:/^utm_/|!ARGS:ad|!ARGS:namestyle|!ARGS:/ULTIMATUM/|!ARGS:/^mce_/|!ARGS:/uutinen/|!ARGS:/agree/|!ARGS:/artwork/|!ARGS:/overview/|!ARGS:/_section_/|!ARGS:/Button/|!ARGS:/^prod/|!ARGS:btnApply|!ARGS:/^VALUE\[1\]$/|!ARGS:/^system/|!ARGS:/gacode/|!ARGS:sample|!ARGS:/source_code/|!ARGS:/Settings/|!ARGS:code1|!ARGS:sotenson|!ARGS:view|!ARGS:record_json|!ARGS:geweest|!ARGS:send|!ARGS:pressestimmen|!ARGS:name|!ARGS:imagemap|!ARGS:/^extra/|!ARGS:afbeelding|!ARGS:action_name|!ARGS:nieuwsbrief|!ARGS:/locatie/|!ARGS:ingredients|!ARGS:priceField|!ARGS:inhoud|!ARGS:op|!ARGS:f_main|!ARGS:/error/|!ARGS:uvod|!ARGS:/^field_/|!ARGS:customized|!ARGS:/fullnews/|!ARGS:/^textarea-video/|!ARGS:komentar|!ARGS:/_layout_/|!ARGS:/^FieldValue/|!ARGS:/includes/|!ARGS:areacomum|!ARGS:lomake|!ARGS:vastaus|!ARGS:target|!ARGS:vraag|!ARGS:areaprivativa|!ARGS:qti_data|!ARGS:tracklist|!ARGS:i_google|!ARGS:quote|!ARGS:/^help_/|!ARGS:/^ADVERT_/|!ARGS:userdata|!ARGS:source|!ARGS:sisalto|!ARGS:reg_rules|!ARGS:areas|!ARGS:code_area_text|!ARGS:datos|!ARGS:templatecode|!ARGS:/sidebar/|!ARGS:/ad_code/|!ARGS:mes|!ARGS:json|!ARGS:wpreason|!ARGS:extended|!ARGS:/Kirjoitukset/|!ARGS:/x_line_item/|!ARGS:item_list|!ARGS:/^var_value/|!ARGS:valori|!ARGS:/pimage/|!ARGS:/^instance/|!ARGS:/allowedTags/|!ARGS:/^button/|!ARGS:/^zcck/|!ARGS:/accommodation/|!ARGS:/^breves/|!ARGS:/restaurant/|!ARGS:/testimonial/|!ARGS:headstone|!ARGS:/^book/|!ARGS:/log/|!ARGS:/metatags/|!ARGS:/^customfield/|!ARGS:/embed/|!ARGS:/leftcol/|!ARGS:/rightcol/|!ARGS:feature|!ARGS:/banner/|!ARGS:cb_talks|!ARGS:/synopsis/|!ARGS:/^fields/|!ARGS:notice|!ARGS:/formcode/|!ARGS:val333|!ARGS:receipt_address|!ARGS:changedept|!ARGS:/teaser/|!ARGS:EnTrar|!ARGS:cv|!ARGS:dati|!ARGS:/qualification/|!ARGS:/results/|!ARGS:/experience/|!ARGS:/plan/|!ARGS:/detail/|!ARGS:log|!ARGS:do|!ARGS:narrative|!ARGS:/promo/|!ARGS:/offer/|ARGS_NAMES|!ARGS:do|!ARGS:/^bt_|!ARGS:/short/|!ARGS:perex|!ARGS:/contact/|!ARGS:advanced|!ARGS:/google_analytics/|!ARGS:/bio/|!ARGS:rules|!ARGS:meta|!ARGS:/next/|!ARGS:ad_code|!ARGS:review|!ARGS:/feed/|!ARGS:/bbclosed/|!ARGS:/observacao/|!ARGS:/caption/|!ARGS:logoutRequest|!ARGS:/js_payload/|!ARGS:video1|!ARGS:/abstract/|!ARGS:/para/|!ARGS:/highlight/|!ARGS:/config/|!ARGS:/welcome/|!ARGS:des|!ARGS:/notice/|!ARGS:structure|!ARGS:/table/|!ARGS:tag|!ARGS:romancode|!ARGS:model|!ARGS:pwd|!ARGS:thecode|!ARGS:/tweet/|!ARGS:do|!ARGS:/^input_/|!ARGS:dhltrack|!ARGS:reflection|!ARGS:media|!ARGS:rqst|!ARGS:blurb|!ARGS:/OSDCS/|!ARGS:Thankyou|!ARGS:img_alt|!ARGS:waarde|!ARGS:/statement/|!ARGS:continue|!ARGS:/writing/|!ARGS:drugs|!ARGS:text1|!ARGS:terms|!ARGS:/announ/|!ARGS:/^eeta-/|!ARGS:/^News/|!ARGS:main|!ARGS:notes|!ARGS:validatepromo|!ARGS:payment_sel|!ARGS:request|!ARGS:copy|!ARGS:/MapField/|!ARGS:/email/|!ARGS:/admin/|!ARGS:profile|!ARGS:contenu|!ARGS:/suffix/|!ARGS:/prefix/|!ARGS:pc_main|!ARGS:/instructions/|!ARGS:/submit/|!ARGS:/title/|!ARGS:/xjxargs/|!ARGS:/info/|!ARGS:nav|!ARGS:recompose|!ARGS:compose|!ARGS:/^bname/|!ARGS:/^property/|!ARGS:groupWelcomeScreen|!ARGS:block|!ARGS:xsym_sym_brief|!ARGS:langbericht|!ARGS:btnCheckout|!ARGS:lease|!ARGS:/^copyright/|!ARGS:creategallery|!ARGS:cleaning|!ARGS:/reply/|!ARGS:/^gui/|!ARGS:/sig/|!ARGS:/Import_Cell/|!ARGS:livezillacode|!ARGS:/^bbcode/|!ARGS:_cc|!ARGS:resume|!ARGS:next|!ARGS:addtoclass|!ARGS:/intro/|!ARGS:registration_discounts|!ARGS:/opportunit/|!ARGS:registration_prices|!ARGS:workshop|!ARGS:venue|!ARGS:/^mainman/|!ARGS:features|!ARGS:/problem/|!ARGS:subhead|!ARGS:agenda|!ARGS:/question/|!ARGS:/answer/|!ARGS:entry|!ARGS:/form/|!ARGS:/footer/|!ARGS:/^p_process_chats/|!ARGS:obj_itop|!ARGS:/wyscms/|!ARGS:/script/|!ARGS:eventDescription|!ARGS:/^product/|!ARGS:/description/|!ARGS:/report/|!ARGS:/product_desc/|!ARGS:/^usergroup/|!ARGS:sendDescription|!ARGS:email_id|!ARGS:obj_itop|!ARGS:sml_prt_1|!ARGS:pay_inst_1|!ARGS:/^jform/|!ARGS:eip_value|!ARGS:phpcode|!ARGS:/product_benefits/|!ARGS:Snippet|!ARGS:/^_qf_/|!ARGS:move2|!ARGS:oid|!ARGS:Submit2|!ARGS:layout|!ARGS:pageset|!ARGS:/^site_/|!ARGS:/translation/|!ARGS:create_tables|!ARGS:insertfile|!ARGS:video_credits|!ARGS:move2|!ARGS:input[Desarrollo]|!ARGS:hoperation|!ARGS:arg2|!ARGS:login_form|!ARGS:resumoDetalhe|!ARGS:Right_photo_1|!ARGS:/^K2ExtraField/|!ARGS:bbcode_tpl|!ARGS:/embed/|!ARGS:/submitcode/|!ARGS:mentorhelp|!ARGS:/custom_code/|!ARGS:beschrijving|!ARGS:custombannercode|!ARGS:bannercode|!ARGS:privatecapacity|!ARGS:diz|!ARGS:FormLayout|!ARGS:parent_name|!ARGS:/^fck/|!ARGS:/^code_tscript/|!ARGS:_qf_Group_next|!ARGS:project_company|!ARGS:categories_title|!ARGS:antwoord|!ARGS:project_company|!ARGS:signature|!ARGS:paepdc|!ARGS:tpl_source|!ARGS:teaser_js|!ARGS:/^autoDS/|!ARGS:FrmSide|!ARGS:mainKeywords|!ARGS:guardar|!ARGS:/VB_announce/|!ARGS:/serendipity/|!ARGS:omschrijving|!ARGS:/solution/|!ARGS:newyddionc|!ARGS:bericht|!ARGS:property_copy|!ARGS:/^outpay/|!ARGS:bedrijfsprofiel|!ARGS:s_query|!ARGS:finish_survey|!ARGS:photolater|!ARGS:/element/|!ARGS:ticket_response|!ARGS:option[vbpclosedreason]|!ARGS:/introduction/|!ARGS:/contenido/|!ARGS:query|!ARGS:/sql/|!ARGS:prefix|!ARGS:c_features|!ARGS:/tekst/|!ARGS:other_clubs|!ARGS:/^elm/|!ARGS:/^saes/|!ARGS:dlv_instructions!ARGS:/^cymr/|!ARGS:_qf_Register_upload|!ARGS:verbiage|!ARGS:/^wz/|!ARGS:tiny_vals|!ARGS:sSave|!ARGS:/article/|!ARGS:/about/|!ARGS:/^elm/|!ARGS:news|!ARGS:/Summarize/|!ARGS:/^product_options/|!ARGS:/SiteStructure/|!ARGS:/anmerkung/|!ARGS:/summary/|!ARGS:/edit/|!ARGS:reply|!ARGS:/story/|!ARGS:resource_box|!ARGS:preview__hidden|!ARGS:order|!ARGS:youtube|!ARGS:/post/|!ARGS:reply|!ARGS:business|!ARGS:navig|!ARGS:/submenu/|!ARGS:/pagimenu/|!ARGS:/^jms/|!ARGS:/note/|!ARGS:/page/|!ARGS:/homePage/|!ARGS:Post|!ARGS:area|!ARGS:/detail/|!ARGS:/comment/|!ARGS:LongDesc|!ARGS:ta|!ARGS:/data/|!ARGS:Returnid|!ARGS:busymess|!ARGS_NAMES:/^V\*/|!ARGS_NAMES:/^S\*/|!ARGS:/^quickrise_advertise/|!ARGS:rt_xformat|!ARGS:/wysiwyg/|!ARGS:contingut|!ARGS:/^werg/|!ARGS:/body/|!ARGS:/css/|!ARGS:/^section/|!ARGS:/msg/|!ARGS:t_cont|!ARGS:/^doc/|!ARGS:/xml/|!ARGS:googlemap|!ARGS:tekst|!ARGS:formsubmit|!ARGS:invoice_snapshot|!ARGS:submit|!ARGS:/message/|!ARGS:/html/|!ARGS:/content/|!ARGS:/footer/|!ARGS:/header/|!ARGS:/link/|!ARGS:/text/|!ARGS:/txt/|!ARGS:/refer/|!ARGS:/referrer/|!ARGS:/template/|!ARGS:/ajax/|!ARGS:/senior/ "(?:< ?(?:(?:img|i?frame) ?src|a ?href) ?= ?(?:ogg|tls|ssl|gopher|zlib|(?:ht|f)tps?)\:/|(?:alert|document\.write) ?\(||< ?/?i?frame|\' ?\} ?\) ?;)" "t:none,t:removeNulls,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsdecode,t:cssdecode,t:removeComments,t:compressWhitespace,t:lowercase,multiMatch,chain" +SecRule MATCHED_VARS "!@rx ((?:submit(?:\+| )?(request)?(?:\+| )?>+|<<(?:\+| )remove|(?:sign ?in|log ?(?:in|out)|next|add|envoyer|modifier|select|continue|weiter|account|results)(?:\+| )?>+)$|^< ?\??(?: |\+)?xml|^> ?$)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace" +#SecRule MATCHED_VARS "!((submit(\+| )?(request)?(\+| )?>>$|<<(\+| )remove|(sign ?in|login|next|add|continue|weiter|account|results)?(\+| )?>>)$|^< ?\??( |\+)?xml|^)" "phase:2,capture,deny,log,auditlog,status:403,t:none,id:380006,rev:11,severity:2,msg:'Atomicorp.com WAF Rules: XSS Generic attack',logdata:'%{TX.0}'" +SecMarker END_380006 + +# Rule 380007: generic SQL injection sigs using PCRE +SecRule REQUEST_URI "!(/immagini/)" "phase:2,deny,log,auditlog,status:403,chain,t:none,t:lowercase,id:380007,rev:5,severity:2,msg:'Atomicorp.com WAF Rules: SQL Inject Generic signature',tag:'SQLi'" +SecRule REQUEST_URI|ARGS|!ARGS:areas|!ARGS:templatecode "/\w*(\x27|\’)(\x6f|o|\x4f)(\x72|r|\x52).*!(\.(jpe?g|png|bmp|gif|mpe?g|avi|flv|wmv|ico)$)" + +SecMarker END_MISC_CHECKS + + +################### SSI injection ############################# +# +SecRule ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!ARGS:areas|!ARGS:/template/ "@pm echo exec printenv include cmd" "id:333844,phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,pass,nolog,noauditlog,skip:1" + SecAction "phase:2,id:334391,t:none,pass,nolog,noauditlog,skipAfter:END_SSI_ATTACKS" + +SecRule ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!ARGS:areas|!ARGS:templatecode|!ARGS:/description/|!ARGS:/text/|!ARGS:/message/|!ARGS:/msg/|!ARGS:content "