iniApp
/
modsecurity-waf
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
modsecurity-waf/nginx-waf/61_asl_recons_dlp.conf

293 lines
58 KiB
Plaintext
Raw Permalink Blame History

# http://www.atomicorp.com/
# Atomicorp (Gotroot.com) ModSecurity rules
# Search Engine Recon/Search Engine Hacks Security Rules for modsec 2.x
#
# Created by Prometheus Global (http://www.prometheus-group.com)
# Copyright 2005-2011 by Prometheus Global, all rights reserved.
# Redistribution is strictly prohibited in any form, including whole or in part.
# Distribution of this work or derivative of this work in any form is
# prohibited unless prior written permission is obtained from the
# copyright holder.
#
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
# THE POSSIBILITY OF SUCH DAMAGE.
#
#---ASL-CONFIG-FILE---
# Do not edit this file!
# This file is generated and changes will be overwritten.
#
# If you need to make changes to the rules, please follow the procedure here:
# http://www.atomicorp.com/wiki/index.php/Mod_security
# Note: For modsecurity 2.5 and above only
# Use 404 for these rules to trick attackers and search engines
# TODO - dont check internal referrers
SecDefaultAction "log,deny,auditlog,phase:2,status:404"
SecRule REQUEST_HEADERS:Referer "@pm ext:inc ext:ini ext:cfg ext:cgi ext:wml ext:dca ext:ccm ext:cdx ext:dbf ext:jbf ext:ics ext:reg ext:dat ext:vmx ext:vmdk ext:pqi ext:gho ext:txt ext:log ext:conf ext:nsf ext:ldif ext:php ext: ext:htm ext:dhtml filetype: username public sensitive vulnerability receipt admin confidential restricted intranet security passwd password passlist assessment secret index" "id:333890,phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,pass,nolog,noauditlog,skip:1"
SecAction "phase:2,id:313498,t:none,pass,nolog,noauditlog,skipAfter:END_RECON_CHECKS_DLP_ALL"
#possible info leak probes
SecRule REQUEST_HEADERS:Referer "@pm public sensitive vulnerability receipt admin confidential restricted intranet security assessment safeguard unclassified" "id:333891,phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,pass,nolog,noauditlog,skip:1"
SecAction "phase:2,id:315409,t:none,pass,nolog,noauditlog,skipAfter:END_RECON_CHECKS_DLP"
SecRule REQUEST_HEADERS:Referer "not for public release" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371253,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "(?:security (?:related|restricted)|safeguards?|sensitive but unclassified|unclassified controlled nuclear) information" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373254,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "host vulnerability summary report " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371436,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "performed by beyond security's automated scanning" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371931,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "network vulnerability assessment report" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371437,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "thank you for your order \+receipt" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371438,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "site:edu grades admin" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371463,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "not for distribution confidential" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371439,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "you have requested access to a restricted area of our website\. please authenticate yourself to continue\." "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371760,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "shadow security scanner performed a vulnerability assessment" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371925,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "the following report contains confidential information vulnerability" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371926,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "network host assessment report internet scanner" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371972,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "welcome to intranet" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:372024,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecMarker END_RECON_CHECKS_DLP
SecRule REQUEST_HEADERS:Referer "@pm passwd password protected username ap-secrets passlist" "id:333892,phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,pass,nolog,noauditlog,skip:1"
SecAction "phase:2,id:302904,t:none,pass,nolog,noauditlog,skipAfter:END_RECON_CHECKS_PASSWORD"
SecRule REQUEST_HEADERS:Referer "inurl:(?:p|ch)ap-secrets -cvs " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373092,rev:2,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:log username putty" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371004,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:sql password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371122,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:reg reg hkey_current_user username" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371006,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "login: \* password: \* filetype:xls" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371037,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:sql insert into.*pass" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371040,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "your password is filetype:log" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371054,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "\[wfclient\] password= filetype:ica" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371059,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer " filetype:sql \(passwd values \*\*\*\* \| password values \*\*\*\* \| pass values \*\*\*\* \)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371070,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: '"
SecRule REQUEST_HEADERS:Referer "filetype:sql \(values \* md5 \* \| values \* password \* \| values \* encrypt \*\)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371071,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:netrc password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371128,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:dat password\.dat" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371136,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:cfm cfapplication name password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371148,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:htpasswd htpasswd" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371153,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:xls username password email" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371158,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:mdb standard jet \(password \| username \| user \| pass\)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371571,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl.*(?:passlist|passwords?|passwds?)\.txt" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:350013,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Password list Search Engine Recon attempt'"
SecRule REQUEST_HEADERS:Referer "inurl:-cfg in(?:text|body):enable password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371036,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:ventrilo_srv\.ini adminpassword" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371047,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:server\.cfg rcon password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371065,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:grc\.dat in(?:text|body):password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371080,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:lilo\.conf filetype:conf password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371114,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:ospfd\.conf in(?:text|body):password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371119,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:zebra\.conf in(?:text|body):password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371120,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:wvdial\.conf in(?:text|body):password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371133,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:log inurl:password\.log" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371137,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:properties inurl:db in(?:text|body):password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371143,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:changepassword\.asp" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371440,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:changepassword\.cgi -cvs" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371590,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "please enter a valid password! inurl:polladmin" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373698,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "web-based management please input password to login" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373702,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "in(?:text|body):master account domain name password inurl:/cgi-bin/qmailadmin " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373740,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "you can now password \| this is a special page only seen by you\. your profile visitors inurl:imchaos" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373991,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:wp-login\.php register username password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:372283,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "please re-enter your password it must match exactly" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371018,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "\+htpasswd \+ws_ftp\.log filetype" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371034,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "parent directory \+proftpdpasswd" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371048,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "autocreate=true password=\*" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371108,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "your password is \* remember this for later use" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371115,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "access denied for user using password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371212,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "dumping data for table ?(?:user|passw)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371391,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "site info for enter admin password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371715,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:index.of.(?:password|protected)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371646,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "inurl:passlist\.txt" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373154,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecMarker END_RECON_CHECKS_PASSWORD
SecRule REQUEST_HEADERS:Referer "ext:" "id:333893,phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,pass,nolog,noauditlog,skip:1"
SecAction "phase:2,id:329543,t:none,pass,nolog,noauditlog,skipAfter:END_RECON_CHECKS_EXT"
SecRule REQUEST_HEADERS:Referer "ext:inc pwd= uid=" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371058,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:ini version=4\.0\.0\.4 password" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371076,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:ini eudora\.ini" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371077,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "liveice configuration file ext:cfg" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371090,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:urchin \(5\|3\|admin\) ext:cgi" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373261,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "contacts ext:wml " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371263,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:dca dca" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371272,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:ccm ccm -catacomb" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371273,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:cdx cdx" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371274,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:dbf dbf" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371275,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:jbf jbf" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371276,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:ics ics" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371278,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:reg username=\* putty" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371292,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:dat bpk\.dat" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371305,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:vmx vmx" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371310,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:vmdk vmdk" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371311,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:pqi pqi -database" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371312,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:gho gho" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371313,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:txt final encryption key " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371316,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "microsoft \(r\) windows \* \(tm\) version \* drwtsn32 copyright \(c\) ext:log" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371318,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:conf nocatauth -cvs" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371327,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:ldif ldif" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371346,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:log software: microsoft internet information services \*\.\*" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371349,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:member login note: your browser must have cookies enabled in order to log into the site\. ext:php or ext:cgi" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373756,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:cgi intitle:control panel enter your owner password to continue!" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373788,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:cfg radius\.cfg" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371938,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:middle frame of videoconference management system ext:htm" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373107,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "ext:dhtml intitle:document centre\|\(home\) or intitle:xerox" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373131,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecMarker END_RECON_CHECKS_EXT
SecRule REQUEST_HEADERS:Referer "filetype:" "id:333894,phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,pass,nolog,noauditlog,skip:1"
SecAction "phase:2,id:329544,t:none,pass,nolog,noauditlog,skipAfter:END_RECON_CHECKS_FILETYPE"
SecRule REQUEST_HEADERS:Referer "intitle.*php shell.*enable stderr.*filetype:\.?php" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:350016,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Vulnerable App Search Engine Recon attempt'"
SecRule REQUEST_HEADERS:Referer "phpkonsole phpshell filetype:php" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:373226,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:php haxplorer server files browser" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371027,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:bak createobject sa" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371046,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "admin account info filetype:log" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371053,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:inf sysprep " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371068,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:inc mysql_connect or mysql_pconnect" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371075,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:log see `ipsec --copyright" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371081,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:mdb wwforum" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371096,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ini wcx_ftp" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371099,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:conf oekakibbs " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371101,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ini servudaemon" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371106,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:pwl pwl" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371110,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:pwd service" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371121,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:sql \+identified by -cvs" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371123,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ldb admin" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371124,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:cfg mrtg target\[\*\] -sample -cvs -example" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371125,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:dat wand\.dat" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371126,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ini \+ws_ftp \+pwd" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371129,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "signin filetype:url" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371127,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:inc dbconn" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371132,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:conf slapd\.conf" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371135,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:reg reg hkey_current_user sshhostkeys " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371140,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "eggdrop filetype:user user" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371147,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:reg reg hkey_current_user sshhostkeys" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371248,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ps ps" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371269,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:qbw qbw" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371270,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "mysql dump filetype:sql 21232f297a57a5a743894a0e4a801fc3" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371281,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ora tnsnames" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371282,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ctt msn" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371296,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ctt contact" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371297,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:blt buddylist" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371299,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:myd myd -cvs" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371321,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:config web\.config -cvs" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371322,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ns1 ns1" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371323,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:pst pst -from -to -date" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371325,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:vcs vcs" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371348,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:asp dbq= & server\.mappath\(\*\.mdb\)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371351,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:pdb pdb backup \(pilot \| pluckerdb\) " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371352,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:reg terminal server client" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371355,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:rdp rdp" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371356,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:bkf bkf" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371358,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:qbb qbb" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371359,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:qdf qdf" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371361,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:cfg auto_inst\.cfg" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371368,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:fp7 fp7" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371369,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:fp3 fp3" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371370,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:fp5 fp5 -site:gov -site:mil -cvs log" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371371,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ora ora" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371374,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "data filetype:mdb -site:gov -site:mil" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371381,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "begin \(certificate\|dsa\|rsa\) filetype:csr" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371387,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "begin \(certificate\|dsa\|rsa\) filetype:key" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371388,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "e-mail address filetype:csv csv" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371389,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:mny mny" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371392,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:ctt ctt messenger" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371395,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:log access\.log -cvs" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371406,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:log cron\.log" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371407,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:wab wab " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371412,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "mysql dump filetype:sql" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371432,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "robots\.txt \+ disallow: filetype:txt" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371452,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "phpmyadmin mysql-dump filetype:txt" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371461,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:htaccess basic" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371464,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:wsdl wsdl" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371603,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:cnf my\.cnf -cvs -example" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371604,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:pl download: suse linux openexchange server ca " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371860,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:cfg login loginserver=" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371871,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "filetype:r2w r2w" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371887,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecMarker END_RECON_CHECKS_FILETYPE
SecRule REQUEST_HEADERS:Referer "(?:index.of|result index on line)" "id:333895,phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceNulls,t:compressWhiteSpace,t:lowercase,pass,nolog,noauditlog,skip:1"
SecAction "phase:2,id:329545,t:none,pass,nolog,noauditlog,skipAfter:END_RECON_CHECKS_INDEX"
SecRule REQUEST_HEADERS:Referer "intitle:index of \.(?:sh_history|bash_history)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371013,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of \.diz \.nfo last modified" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371298,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of \* admin news\.asp configview\.asp" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371336,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of inbox dbx" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371433,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of ws_ftp\.ini" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371445,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of dead\.letter" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371446,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of apache server at" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371447,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of.(?:etc|passlist|administrators|sites.ini)" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371159,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of cgiirc\.config'" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371459,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of haccess\.ctl" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371465,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of*config" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371610,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of robots\.txt" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371469,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of web-inf" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371620,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of /maildir/" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371621,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of abyss\.conf" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371630,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index.of / stats merchant" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371635,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of sc_serv\.conf sc_serv content" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371072,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of passwords modified" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371113,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of trillian\.ini" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371155,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of config\.php" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371161,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of\.\.etc passwd" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371162,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of spwd\.db passwd" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371163,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of \.htpasswd htgroup" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371164,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of \.htpasswd htpasswd\.bak" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371165,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of pwd\.db" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371166,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of master\.passwd" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371167,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of passwd passwd\.bak" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371168,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of people\.lst" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371169,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of \.mysql_history" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371171,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of upload size parent directory" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371333,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of cookies\.txt size" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371378,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of \+myd \+size" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371383,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of mysql\.conf or mysql_config" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371409,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "mystuff\.xml intitle:index of" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371462,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of mt-db-pass\.cgi" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371472,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of finances\.xls" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371474,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of finance\.xls" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371475,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of dbconvert\.exe chats" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371476,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of \* mode links bytes last-changed name" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371490,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of / modified php\.exe" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371606,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of /cfide/ administrator" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371631,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of parent directory desktop\.ini site:dyndns\.org" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371633,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of /phpmyadm" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371648,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of cfide" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371659,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index of c:\\windows" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371661,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index\.of\.personal" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371660,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index\.of\.secure" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371666,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index\.of\.winnt" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371667,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index\.of\.private" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371668,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "intitle:index\.of\.secret" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371669,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index.* perform\.ini" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371009,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index of / lck" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371010,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index of / upload" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371017,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index of ?/ ws_ftp\.ini parent directory" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371097,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "unable to jump to row on mysql result index on line" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371175,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index of / chat/logs " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371430,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index of rar r01 nfo modified 2004" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371624,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index.*of\.dcim" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371638,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index of / picasa\.ini " "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371645,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index of /network last modified" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371651,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index of cgi-bin" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371658,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "index of /backup" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:371670,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecRule REQUEST_HEADERS:Referer "copyright 2010\. software index" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:compressWhitespace,id:372393,rev:1,severity:2,msg:'Atomicorp.com WAF Rules: Search Engine Recon Attempt for sensitive information'"
SecMarker END_RECON_CHECKS_INDEX
SecMarker END_RECON_CHECKS_DLP_ALL
Reference in New Issue View Git Blame Copy Permalink