Веб-защита
Сигнатуры DDoS-атак
WAF защищает ваши веб-приложения от различных угроз и атак, используя сигнатурный анализ, который основан на списке известных сигнатур DDoS-атак.
Сигнатура атаки — это совокупность характеристик или паттернов, используемая для обнаружения атаки или злонамеренной деятельности.
В таблице ниже перечислены все сигнатуры, на основе которых WAF может произвести анализ и отразить DDoS-атаки.
- ID сигнатуры — идентификатор сигнатуры;
- Тип — тип правила:
- RL — правило чёрного списка,
- RLx — правило чёрного списка с использованием регулярного выражения,
- WL — правило белого списка,
- WLx — правило белого списка с использованием регулярного выражения;
- Сигнатура — путь или паттерн, используемый для совершения атаки;
- Тег — тип уязвимости;
- Значимость — цифровой показатель значимости атаки;
- Зона применения — место обнаружения и анализа вредоносной активности.
|
ID сигнатуры |
Тип |
Сигнатура |
Тег |
Значимость |
Зона применения |
|
30 |
RL |
{{ '{' }}{{ '{' }} |
Injection | 2 | BODY |
|
31 |
RLx |
(\d+\s*,\s*){4,} |
SQLi |
4 |
BODY URL ARGS HEADERS |
| 32 | RLx | \W&&\W | SQLi | 2 |
BODY URL ARGS HEADERS |
| 33 | RLx | \W@@\w | SQLi | 2 |
BODY URL ARGS HEADERS |
| 34 | RLx | \W\|\|\W | SQLi | 2 |
BODY URL ARGS |
| 35 | RLx | \{\{[^{}]+\}\} | Injection | 8 | ARGS |
| 36 | RL | $( | Injection | 2 |
BODY URL ARGS HEADERS |
| 37 | RL | ${ | Injection | 2 |
BODY URL ARGS HEADERS |
| 39 | RL | /* | SQLi | 1 |
BODY URL ARGS Cookie User-agent |
| 40 | RL | */ | SQLi | 1 |
BODY URL ARGS Cookie User-agent |
| 51 | RL | ; | SQLi | 2 |
URL ARGS |
| 52 | RL | ' | SQLi | 2 |
URL ARGS User-Agent |
| 53 | RL | ? | Evasion | 2 |
URL ARGS User-agent |
| 54 | RL | ['# | RCE | 8 | URL |
| 55 | RL | \'% | SQLi | 2 |
BODY URL ARGS |
| 56 | RL | %\' | SQLi | 2 |
BODY URL ARGS |
| 57 | RLx | (\.)+(\\|\/)+(\.)+(\\|\/)+ | LFI | 8 |
BODY URL ARGS HEADERS |
| 58 | RL | =\" | SQLi | 2 |
BODY URL ARGS |
| 59 | RL | =\' | SQLi | 2 |
BODY URL ARGS |
| 60 | RL | *\' | SQLi | 4 |
BODY URL ARGS |
| 61 | RL | != | SQLi | 6 |
URL ARGS |
| 66 | RL | \\ | Evasion | 2 |
BODY URL ARGS |
| 67 | RL | ../ | LFI | 8 |
BODY URL ARGS HEADERS |
| 68 | RL | -- | SQLi | 2 |
BODY URL ARGS User-agent |
| 69 | RL | # | SQLi | 1 |
BODY URL ARGS Cookie User-agent |
| 70 | RL | ..;/ | LFI | 8 |
BODY URL ARGS HEADERS |
| 71 | RL | ..\..\ | LFI | 8 |
BODY URL ARGS HEADERS |
| 74 | RLx | \\x[0-9a-z]{2,2} | Evasion | 0 |
BODY URL ARGS HEADERS MLA |
| 76 | RLx | (\\|%)u[0-9a-f]{4,4} | Evasion | 0 |
BODY URL ARGS HEADERS MLA |
| 77 | RL | ././ | LFI | 8 |
BODY URL ARGS HEADERS |
| 98 | RLx | [&=<]\.0 | XSS | 6 |
BODY URL ARGS |
| 99 | RLx | [\^<>]0\. | XSS | 6 |
BODY URL ARGS |
| 100 | WLx | sitemap[\w\-\.]+\.gz$ | WL | 0 | URL |
| 101 | WLx | (\d+\s*,\s*){4,} | WL | 0 |
Cookie Referer |
| 104 | WLx | utm_referrer=https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} | WL | 0 | ARGS |
| 105 | WLx | \-+\w | WL | 0 | Content-Type |
| 106 | WL | xn--p1ai | WL | 0 |
BODY URL ARGS HEADERS |
| 109 | WL | ?from= | WL | 0 | ARGS |
| 110 | WL | <?xml | WL | 0 | BODY |
| 111 | WLx | \{\{[a-z0-9.]+\}\} | WL | 0 | ARGS |
| 500 | RL | /.source | XSS | 12 |
BODY URL ARGS HEADERS |
| 502 | RLx | (\s|\.)src(\s|\+)*= | XSS | 2 |
BODY URL ARGS HEADERS |
| 504 | RLx | (^|\W)eval\(|@eval\W | XSS | 12 |
BODY URL ARGS HEADERS |
| 505 | RLx | <svg(\s|\+) | XSS | 4 |
BODY URL ARGS HEADERS |
| 508 | RLx | (^|\W)alert\/?(\.(source|call|apply|bind|valueof))?[\(\`\&\]] | XSS | 8 |
BODY URL ARGS HEADERS |
| 509 | RL | symbol.replace | XSS | 8 |
BODY URL ARGS HEADERS |
| 510 | RLx | array\.(map|from|prototype) | XSS | 8 |
BODY URL ARGS HEADERS |
| 511 | RLx | (^|\W)document(\.[a-z]+)+\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 512 | RL | </noscript | XSS | 4 |
BODY URL ARGS HEADERS |
| 513 | RL | </xmp | XSS | 4 |
BODY URL ARGS HEADERS |
| 514 | RL | </style | XSS | 4 |
BODY URL ARGS HEADERS |
| 515 | RL | </script | XSS | 12 |
BODY URL ARGS HEADERS |
| 516 | RLx | <img(\s|\+) | XSS | 2 |
BODY URL ARGS HEADERS |
| 517 | RLx | <base(\s|\+) | XSS | 4 |
BODY URL ARGS HEADERS |
| 518 | RLx | <i?frame\W | XSS | 6 |
BODY URL ARGS HEADERS |
| 528 | RLx | on(error|cut|begin|wheel|blur|change|input|reset|select|down|keypress|keyup|paste|copy|toggle)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 532 | RLx | onmouse(down|enter|leave|move|out|over|up|wheel)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 534 | RL | </title | XSS | 2 |
BODY URL ARGS HEADERS |
| 535 | RL | svg> | XSS | 4 |
BODY URL ARGS HEADERS |
| 536 | RL | << | XSS | 4 |
URL ARGS |
| 537 | RLx | <script(\s|\+|\/|\>) | XSS | 12 |
BODY URL ARGS HEADERS |
| 538 | RL | >> | XSS | 4 |
URL ARGS |
| 540 | RLx | on(aux|dbl)?click(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 542 | RLx | ontouchcancel(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 543 | RLx | (^|\W)set(Timeout|Interval|Immediate)\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 544 | RLx | (^|\W)execscript\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 545 | RL | crypto.generateCRMFRequest | XSS | 12 |
BODY URL ARGS HEADERS |
| 548 | RL | Range.createContextualFragment | XSS | 12 |
BODY URL ARGS HEADERS |
| 549 | RLx | window[?]?\.(location|alert|name) | XSS | 12 |
BODY URL ARGS HEADERS |
| 550 | RLx | document[.;](location|domain|cookie) | XSS | 8 |
BODY URL ARGS HEADERS |
| 551 | RLx | (^|\W)location\.(assign|reload|replace|tostring)\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 552 | RLx | (^|\W)history(\.[a-z]+)+\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 553 | RLx | (^|\W)(local|session)Storage\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 554 | RL | <svg/on | XSS | 12 |
BODY URL ARGS HEADERS |
| 555 | RLx | (^|\W)createElement\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 1000 | RLx | [^-:=\.\w\|]where[^-:=\.\w\|] | SQLi | 3 |
BODY URL ARGS HEADERS |
| 1001 | RLx | [^-:=\.\w\|]update[^-:=\.\w\|] | SQLi | 3 |
BODY URL ARGS HEADERS |
| 1002 | RLx | [^-:=\.\w\|]table[^-:=\.\w\|] | SQLi | 3 |
BODY URL ARGS HEADERS |
| 1003 | RLx | group[^-:=\.\w\|/]+by | SQLi | 2 |
BODY URL ARGS HEADERS |
| 1005 | RLx | order[^-:=\.\w\|]+by | SQLi | 3 |
BODY URL ARGS HEADERS |
| 1006 | RLx | [^-:=\.\w\|]limit[^-:=\.\w\|] | SQLi | 3 |
BODY URL ARGS HEADERS |
| 1007 | RLx | [^-:=\.\w\|]select[^-:=\.\w\|] | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1008 | RLx | [^-:=\.\w\|]insert[^-:=\.\w\|] | SQLi | 3 |
BODY URL ARGS HEADERS |
| 1010 | RLx | [^-:=\.\w\|]truncate[^-:=\.\w\|] | SQLi | 3 |
BODY URL ARGS HEADERS |
| 1011 | RLx | (^|\W)benchmark\( | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1012 | RLx | (^|\W)((var)?char|chr)\W*[(@]+[\d\s] | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1016 | RLx | [^-:=\.\w\|]if[^-:=\.\w\|] | SQLi | 2 |
BODY URL ARGS HEADERS |
| 1021 | RLx | select[^-:=\.\w\|]{1,50}(.|\s){0,50}from | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1023 | RL | extractvalue | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1024 | RLx | (^|\W)concat\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1025 | RL | updatexml | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1026 | RLx | (^|\W)system\( | RCE | 8 |
BODY URL ARGS HEADERS |
| 1027 | RLx | (^|\W)extractvalue\( | SQLi | 6 |
BODY URL ARGS HEADERS |
| 1028 | RLx | (^|\W)elt\( | SQLi | 6 |
BODY URL ARGS HEADERS |
| 1031 | RLx | (encode|decode)\W*[\(\)] | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1032 | RL | group_concat | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1033 | RLx | \Wrlike\( | SQLi | 6 |
BODY URL ARGS HEADERS |
| 1034 | RLx | [^-:=\.\w\|]database[^-:=\.\w\|] | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1035 | RL | system_user | SQLi | 6 |
BODY URL ARGS HEADERS |
| 1036 | RL | version() | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1037 | RLx | (^|\W)not\W+in\( | SQLi | 6 |
BODY URL ARGS HEADERS |
| 1038 | RLx | json(_\w+){1,2}\( | SQLi | 6 |
BODY URL ARGS Cookie |
| 1039 | RLx | [^-:=\.\w\|]contains[^-:=\.\w\|] | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1040 | RLx | [^-:=\.\w\|]sleep[^-:=\.\w\|] | SQLi | 6 |
BODY URL ARGS HEADERS |
| 1042 | RL | table_name | SQLi | 6 |
BODY URL ARGS |
| 1043 | RLx | \`\`\s*\`\` | SQLi | 2 |
BODY URL ARGS |
| 1044 | RL | table.name | SQLi | 6 |
BODY URL ARGS |
| 1045 | RL | isnull | SQLi | 2 |
BODY URL ARGS HEADERS |
| 1046 | RLx | _(en|de)crypt\( | SQLi | 6 |
BODY URL ARGS HEADERS |
| 1049 | RL | create_digest | SQLi | 6 |
BODY URL ARGS HEADERS |
| 1050 | RLx | log\d+\W*(\(|\)) | SQLi | 8 |
URL ARGS |
| 1053 | RLx | /(bin|sbin)/ | Other | 4 |
BODY URL ARGS HEADERS |
| 1055 | RL | to_base64 | SQLi | 6 |
BODY URL ARGS HEADERS |
| 1056 | RLx | [^-:=\.\w\|]replace[^-:=\.\w\|] | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1057 | RL | master_pos_wait | SQLi | 8 |
URL ARGS |
| 1059 | RL | str_replace | SQLi | 8 |
BODY ARGS |
| 1060 | RL | user_meta | SQLi | 8 |
BODY URL ARGS |
| 1061 | RL | regexp | SQLi | 2 |
BODY ARGS |
| 1063 | RLx | \d+[\'\`] | SQLi | 8 | URL |
| 1064 | RL | wp_comment | SQLi | 8 |
BODY URL ARGS |
| 1065 | RL | wp_usermeta | SQLi | 8 |
BODY URL ARGS |
| 1066 | RL | wp_post | SQLi | 8 |
BODY URL ARGS |
| 1067 | RL | wp_term | SQLi | 8 |
BODY URL ARGS |
| 1068 | RL | wp_user | SQLi | 8 |
BODY ARGS |
| 1069 | RL | wp_options | SQLi | 8 |
BODY ARGS |
| 1072 | RLx | (^|\W)print(_r|ln)?\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1075 | RLx | \d\'\s*\w+=(\d+|\') | SQLi | 12 |
URL ARGS |
| 1077 | RLx | =(\-\w+|\w+[\'\)\"])(.|\s){0,30}\s+where\s+(.|\s){0,30}\s+(OR|AND) | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1078 | RLx | ctx=web\&cache_filename=.+\.php.+IMresizedData=\<\?php | SQLi | 12 | BODY |
| 1081 | RLx | \w+=\d+\'($|\s) | SQLi | 12 |
URL ARGS |
| 1085 | RLx | \d+[\'\`] | SQLi | 2 |
BODY ARGS HEADERS |
| 1086 | RLx | (\b(m(s(ysaccessobjects|ysaces|ysobjects|ysqueries|ysrelationships|ysaccessstorage|ysaccessxml|ysmodules|ysmodules2|db)|aster\.\.sysdatabases|ysql\.db)\b|s(ys(\.database_name|aux)\b|chema(\W*\(|_name\b)|qlite(_temp)?_master\b)|d(atabas|b_nam)e\W*\(|information_schema\b|pg_(catalog|toast)\b|northwind\b|tempdb\b)) | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1087 | RLx | sleep\((\s*?)(\d*?)(\s*?)\)|benchmark\((.{0,50}?),(.{0,50}?)\) | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1088 | RLx | (((select|;)\s+(benchmark|if|sleep)\s*?\(\s*?\(?\s*?\w+)) | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1090 | RLx | ((alter\s*?\w+.{0,50}?(character|char)\s+set\s+\w+)|([\"'`];*?\s*?waitfor\s+(time|delay)\s+[\"'`])|([\"'`];.{0,50}\s*?\Wgoto\W)) | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1091 | RLx | (^|\W)union(.|\s){1,50}select(.|\s){1,50}from\W | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1092 | RLx | ((select\s*?pg_sleep)|(waitfor\s*?delay\s?[\"'`]+\s?\d)|(;\s*?shutdown\s*?(;|--|#|/\*|{))) | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1093 | RLx | ["\[]\$(ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|x?or|div|like|between|and|where)["\]] | Injection | 12 |
BODY URL ARGS HEADERS |
| 1094 | RLx | ((procedure\s+analyse\s*?\()|(;\s*?(declare|open)\s+[\w-]+)|(create\s+(procedure|function)\s*?\w+\s*?\(\s*?\)\s*?-)|(declare[^\w]+[@#]\s*?\w+)|(exec\s*?\(\s*?@)) | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1096 | RLx | xp_(servicecontrol|regread|regwrite|regdeletevalue|regdeletekey|fileexist|enumerrorlogs|readerrorlogs|enumdsn|enumgroups|ntsec_enumdomains) | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1099 | RLx | (^|&)src=[^&]*?(http|ftp) | SQLi | 12 | URL |
| 1100 | RLx | [?&]home=[^&]*?(http|ftp) | Other | 12 | URL |
| 1102 | RLx | [?&]size=[^&]*?\x3b | SQLi | 12 | ARGS |
| 1104 | RL | action=getTopic | SQLi | 8 | BODY |
| 1105 | RLx | \[\#markup\]\=\S+\s+\S+ | RCE | 12 |
BODY URL ARGS |
| 1107 | RL | found_rows | SQLi | 8 |
URL ARGS |
| 1108 | RL | tceles | SQLi | 4 |
URL ARGS Cookie |
| 1109 | RLx | information(_|\.)schema | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1110 | RLx | (\s|\+)(infile|outfile|dumpfile)(\s|\+) | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1111 | RL | noinu | SQLi | 4 |
URL ARGS |
| 1112 | RL | substring% | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1115 | RL | @@version | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1116 | RL | schema | SQLi | 6 |
URL ARGS |
| 1117 | RL | datadir | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1118 | RL | hostname | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1119 | RL | rowcount | SQLi | 4 |
BODY URL ARGS HEADERS |
| 1120 | RLx | \s;\s | SQLi | 8 |
URL ARGS |
| 1121 | RL | coercibility | SQLi | 8 |
URL ARGS |
| 1123 | RL | COLLATION | SQLi | 8 |
URL ARGS |
| 1124 | RL | CONNECTION_ID | SQLi | 8 |
URL ARGS |
| 1125 | RL | current_user | SQLi | 4 |
URL ARGS |
| 1126 | RL | last_insert_id | SQLi | 8 |
URL ARGS |
| 1127 | RL | row_count | SQLi | 8 |
URL ARGS |
| 1128 | RL | session_user | SQLi | 8 |
URL ARGS |
| 1129 | RL | @user | SQLi | 8 |
URL ARGS |
| 1130 | RLx | /%?\*(.|\s){0,50}\*%?/ | SQLi | 6 |
URL ARGS |
| 1131 | RLx | /%?\*(.|\s){0,50}\*%?/ | SQLi | 2 | BODY |
| 1132 | RLx | ((/%?\*(.|\s){0,50}\*%?/)(.|\s){0,50}){3,} | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1133 | RLx | name\[\d+.{20,}\] | SQLi | 12 | BODY |
| 1134 | RLx | admin(istrator)?'-- | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1136 | RLx | ^(file|ftps?|https?)://(.{0,500})$ | SQLi | 8 | ARGS |
| 1137 | RLx | %0(.|\s){0,50}([a-z]%){3,} | SQLi | 12 |
BODY URL ARGS HEADERS |
| 1138 | RLx | (%\w%.{0,50}){5,} | SQLi | 8 |
BODY URL ARGS HEADERS |
| 1139 | RL | validate_password_strength | SQLi | 8 |
URL ARGS |
| 1141 | RL | libraryContent | SQLi | 8 | BODY |
| 1142 | RL | base64_decode | SQLi | 8 | BODY |
| 1143 | RL | globals[ | RCE | 8 |
BODY URL ARGS |
| 1144 | RLx | (^|\W)response\.(write|flush|clear)\( | Injection | 12 |
BODY URL ARGS HEADERS |
| 1145 | RLx | \w=\/?\.{1,2}(\\|\/) | LFI | 8 |
BODY ARGS Referer |
| 1311 | RL | <? | RCE | 4 | BODY |
| 1312 | RL | ?> | RCE | 4 | BODY |
| 1313 | RL | <?php | RCE | 12 |
BODY URL ARGS HEADERS |
| 1314 | RLx | \$_\w{1,15}\[ | Other | 12 |
BODY URL ARGS HEADERS |
| 1316 | RL | get_defined_functions | RCE | 12 |
BODY URL ARGS HEADERS |
| 1317 | RL | _PHPLIB[libdir] | Other | 8 |
BODY URL ARGS HEADERS |
| 1318 | RLx | auto_prepend_file|auto_append_file | RFI | 12 |
URL ARGS |
| 1322 | RL | burpcollaborator.net | Scanner | 12 |
BODY URL ARGS HEADERS |
| 1324 | RL | constructor.constructor | Other | 8 | BODY |
| 1352 | RL | XAttacker.php | Other | 12 |
BODY URL ARGS |
| 1397 | RLx | include.?dir\x3D | Other | 12 | URL |
| 1398 | RLx | path=(https?|ftps?|php) | Other | 12 | URL |
| 1399 | RLx | php\?goto=(https?|ftps?|php) | RFI | 12 | URL |
| 1431 | RLx | /(admin/addcontent\.inc|images/psg)\.php | Other | 12 | URL |
| 1459 | RL | svg> | XSS | 3 | BODY |
| 1491 | RLx | [^-:\.\w\|]exec[^-:\.\w\|\/] | Injection | 8 |
BODY URL ARGS HEADERS |
| 1493 | RLx | (^|\W)die\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 1497 | RLx | (.{1,50}\(.{1,50}\)){3,} | Other | 12 | URL |
| 1500 | RLx | \.(.{0,250})~($|\s) | UWA | 12 | URL |
| 1501 | RLx | src=https?\x3a\x2f[^\x26\x20]*?(\x24\x28|%24%28) | UWA | 12 |
URL ARGS |
| 1502 | RL | .vscode | Other | 12 | URL |
| 1505 | RLx | \.(gemfile|gemfile|rb|irbrc)($|\s|\:) | UWA | 12 | URL |
| 1506 | RLx | \.(bzr|project|sublime(-workspace)?|md|svn|gitkeep|s3cfg|(git|hg|cvs)(ignore)?|subversion|csproj|(ftp)?config|cfg|atom|vb|vscode|circleci|npmrc)($|\s|\/|\:) | UWA | 12 | URL |
| 1512 | RLx | \.php[^3-7\/s][\w\-\_~]*(\.\w+)?$ | UWA | 12 | URL |
| 1513 | RLx | \.(py|pl|cgi)($|\s|\:) | UWA | 8 | URL |
| 1515 | RL | .ds_store | UWA | 12 | URL |
| 1516 | RLx | \.(jar|jsp|jspx|jspf|java|coffee|war|yml|cfm)($|\s|\:) | UWA | 12 | URL |
| 1517 | RLx | \.(conf|ssh|ini|inc|env|inc|viminfo|properties|dead\.letter|passwd|schema)($|\s|\:) | UWA | 8 | URL |
| 1518 | RLx | \.(phpinc|save|sav|swp|swo|lock|old|orig|log|tmp|temp|restore|suspected)($|\s|\:) | UWA | 12 | URL |
| 1519 | RLx | \.(bz2|gz|tar|xz|lzma)($|\s|\:) | UWA | 4 | URL |
| 1521 | RL | sftp-config.json | UWA | 12 | URL |
| 1522 | RL | .idea/ | UWA | 12 | URL |
| 1523 | RLx | ^/wp-content/plugins/($|\s) | UWA | 12 | URL |
| 1524 | RLx | /wp-content/plugins/.{1,50}/cache/ | UWA | 12 | URL |
| 1526 | RLx | \.(mdb|db|sqlite|sql)($|\s|\:) | UWA | 12 | URL |
| 1528 | RLx | id_(rsa|dsa)\.ppk($|\s|\:) | UWA | 12 | URL |
| 1559 | RLx | etc/(passwd|shadow) | UWA | 12 |
BODY URL ARGS HEADERS |
| 1560 | RLx | \W(win|system|php)\.ini | UWA | 8 |
BODY URL ARGS HEADERS |
| 1561 | RLx | \.(ksh|rsh|tcsh|csh|zsh|zshrc|bash|bash_profile|rksh|sh_history)($|\s|\:) | UWA | 12 | URL |
| 1562 | RLx | \.(bat|exe|dll|dat)($|\s|\:) | UWA | 12 | URL |
| 1808 | RL | composer.json | UWA | 8 | URL |
| 1811 | RLx | %psmodulepath%|%public%|%appdata%|%localappdata% | UWA | 12 |
URL ARGS |
| 1812 | RLx | %allusersprofile%|%userdata%|%username%|%userprofile% | UWA | 12 |
URL ARGS |
| 1813 | RLx | %homedrive%|%homepath% | UWA | 12 |
URL ARGS |
| 1814 | RLx | %homedrive%|%homepath% | UWA | 12 |
URL ARGS |
| 1816 | RLx | %systemdrive%|%systemroot%|%windir%|%comspec% | UWA | 12 |
URL ARGS |
| 1818 | RLx | %path%|%pathext% | UWA | 8 |
URL ARGS |
| 1819 | RLx | %computername%|%logonserver%|%prompt%|%userdomain% | UWA | 8 |
URL ARGS |
| 1820 | RL | db_details_importdocsql.php | UWA | 8 | URL |
| 1821 | RLx | /(global|dnewsweb|swsrv|ikonboard)\.cgi | UWA | 8 | URL |
| 1822 | RL | /math_sum.mscgi | UWA | 8 |
URL ARGS |
| 1823 | RLx | /(ksh|rsh|tcsh|csh|zsh|zshrc|bash|bash_profile|rksh)($|\s) | UWA | 12 |
URL ARGS |
| 1826 | RLx | \/(math_sum.mscgi|htsearch|printenv|db2www|document.d2w) | UWA | 12 | URL |
| 1827 | RL | /admentor/admin/admin.asp | UWA | 8 | URL |
| 1830 | RL | /timthumb.php | UWA | 4 | URL |
| 1831 | RL | /timthumbdir/cache | UWA | 4 | URL |
| 1832 | RL | /w3tc/dbcache | UWA | 8 | URL |
| 1834 | RL | php:// | UWA | 12 |
BODY URL ARGS HEADERS |
| 1835 | RL | ftp:// | UWA | 12 |
BODY ARGS |
| 1836 | RL | zlib:// | UWA | 12 |
BODY URL ARGS HEADERS |
| 1837 | RL | data:// | UWA | 12 |
BODY URL ARGS HEADERS |
| 1838 | RL | glob:// | UWA | 12 |
BODY URL ARGS HEADERS |
| 1839 | RL | phar:// | UWA | 12 |
BODY URL ARGS HEADERS |
| 1840 | RL | file:// | UWA | 12 |
BODY ARGS |
| 1841 | RL | /cfide/componentutils | UWA | 12 | URL |
| 1842 | RL | /mysqldumper | UWA | 12 | URL |
| 1843 | RLx | php(pg|my)admin | UWA | 12 | URL |
| 1845 | RL | /bin/sh | UWA | 12 |
BODY URL ARGS HEADERS |
| 1846 | RL | .htpasswd | UWA | 12 |
URL ARGS |
| 1847 | RL | .htaccess | UWA | 12 |
URL ARGS |
| 1848 | RL | whitelist.pac | UWA | 12 | URL |
| 1849 | RL | proxy.pac | UWA | 12 | URL |
| 1850 | RL | (?p=b)((?p=b)(?j:(?p<b>c)(?p<b>a(?p=b)))>wgxcredits) | UWA | 12 |
BODY ARGS HEADERS |
| 1851 | RL | 0000::1 | UWA | 12 | X-Forward-For |
| 1852 | RL | 127.0.0 | UWA | 12 | X-Forward-For |
| 1853 | RL | (?j:(?|(:(?|(?'r')(\k'r')|((?'r')))h'rk'rf)|s(?'r')))) | UWA | 12 | HEADERS |
| 1854 | RL | /var/www/ | UWA | 12 |
URL ARGS |
| 1856 | RL | /philboard_admin.asp | UWA | 12 |
URL ARGS |
| 1857 | RL | /cgi-bin/ls | UWA | 8 |
URL ARGS |
| 1860 | RL | /wp-includes/rss-functions.php | UWA | 12 | URL |
| 1861 | RL | /wp-content/themes/RightNow/includes/uploadify/upload_settings_image.php | UWA | 12 | BODY |
| 1866 | RLx | stdin|stdout|stderr | UWA | 4 |
BODY URL ARGS HEADERS |
| 1868 | RL | X-Pingback-Forwarded-For: | UWA | 8 | X-Forward-For |
| 1869 | RLx | /dev/(tcp|udp) | UWA | 12 |
BODY ARGS HEADERS |
| 1870 | RL | /sqlite/main.php | UWA | 12 |
URL ARGS |
| 1871 | RLx | (^|\W)php(_uname|credits|info|version)\( | Injection | 12 |
BODY URL ARGS HEADERS |
| 1872 | RLx | /~(root|ftp|nobody) | UWA | 12 |
BODY URL ARGS |
| 1873 | RL | /htmlscript | UWA | 12 | URL |
| 1876 | RL | /post-query | UWA | 8 | URL |
| 1879 | RLx | [^/]https?:/ | UWA | 8 | URL |
| 1882 | RLx | (^|\W)javascript: | XSS | 8 |
BODY URL ARGS HEADERS |
| 1883 | RL | /DatabaseFunctions.php | UWA | 8 | URL |
| 1884 | RL | /GlobalFunctions.php | UWA | 8 | URL |
| 1885 | RL | /UpdateClasses.php | UWA | 8 | URL |
| 1886 | RL | /scripts/setup.php | UWA | 12 | URL |
| 1887 | RLx | (phpinfo|phpsysinfo)\.php | UWA | 12 | URL |
| 1888 | RL | /server_sync.php | UWA | 12 | URL |
| 1891 | RL | PageServices | UWA | 8 |
URL ARGS |
| 1892 | RL | /htgrep | UWA | 8 | URL |
| 1893 | RL | /WEB-INF/ | UWA | 12 | URL |
| 1894 | RL | /proc/self/ | UWA | 12 |
BODY URL ARGS |
| 1895 | RL | phpb8b5f2a0-3c92-11d3-a3a9-4c7b08c10000 | UWA | 4 | ARGS |
| 1896 | RLx | phpe9568f3(4|5|6)-d428-11d2-a769-00aa001acf42 | UWA | 4 | ARGS |
| 1897 | RLx | /_vti_(adm|bin)/ | UWA | 12 | URL |
| 1898 | RL | /_vti_rpc | UWA | 12 | URL |
| 1899 | RL | /server-status | UWA | 12 | URL |
| 1900 | RL | /balancer-manager | UWA | 12 | URL |
| 1901 | RL | /host-manager/ | UWA | 12 | URL |
| 1902 | RL | fx29shcook | UWA | 8 | URL |
| 1903 | RLx | act=\S+&(d|f)= | UWA | 12 |
BODY ARGS |
| 1904 | RLx | act=(fxmailselfremove|encoder|eval|sql|phpinfo) | UWA | 12 |
BODY ARGS |
| 1905 | RLx | _act=(execute|list\s+files|upload) | UWA | 12 |
BODY ARGS |
| 1906 | RL | cmd_txt=1 | UWA | 8 | ARGS |
| 1907 | RL | c99.php | UWA | 12 | URL |
| 1908 | RLx | (\s|\+|#)cmd= | UWA | 12 |
BODY URL ARGS HEADERS |
| 1909 | RLx | c999sh_surl|c999shvars | UWA | 12 | Cookie |
| 1910 | RL | webconfig.txt.php | UWA | 12 | URL |
| 1911 | RL | wpad.dat | UWA | 12 | URL |
| 1913 | RL | composer.phar | UWA | 8 | URL |
| 1914 | RLx | adminer.*\.php | UWA | 12 | URL |
| 1915 | RLx | (wso|r57|r57shell)\.php | UWA | 12 | URL |
| 1917 | RL | /admin/templates/header.php | UWA | 8 | URL |
| 1918 | RL | /soapcaller.bs | UWA | 12 | URL |
| 1919 | RL | /plugin_googlemap2_proxy.php | UWA | 12 | URL |
| 1920 | RL | /images/stories/story.php | UWA | 12 | URL |
| 1921 | RLx | /plugins/system/.{1,50}\.php | UWA | 12 | URL |
| 1922 | RL | /.ssh/ | UWA | 12 | URL |
| 1923 | RL | /known_hosts | UWA | 12 | URL |
| 1924 | RL | /authorized_keys | UWA | 12 | URL |
| 1925 | RLx | \.(key|pem|id_rsa|id_dsa)($|\s) | UWA | 12 | URL |
| 1926 | RLx | \.(sh|bash|nano|irb|psql|mysql)_history($|\s) | UWA | 12 | URL |
| 1927 | RLx | \.(bac|bak|bkp|bkf|bkp|back|backup|bakup)($|\s) | UWA | 12 | URL |
| 1928 | RLx | \.(history|histfile)($|\s) | UWA | 12 | URL |
| 1929 | RL | proftpdpasswd | UWA | 12 | URL |
| 2100 | RLx | nessus|acunetix|nmap|sqlmap|[nw]ikto|dirbuster|gobuster|w3af|webster|openvas|meterpreter|network-services-auditor|wpscan|hydra|XSpider|Nuclei|l9explore | Scanner | 12 | User-agent |
| 2101 | RLx | absinthe|autogetcolumn|bsqlbf|cisco-torch|crimscanner|appscan_fingerprint|amiga-aweb|digimarc webreader | Scanner | 12 | User-agent |
| 2102 | RLx | sql\s+power\s+injector|dav\.pm|prog.customcrawler|whcc|grendel-scan|masscan | Scanner | 12 | User-agent |
| 2103 | RLx | shellshock-scan|thanks-rob|WebCruiser|webinspect|whisker|chinaclaw|whatweb|wordpress hash grabber | Scanner | 12 | User-agent |
| 2104 | RLx | mysqloit|netsparker|paros|pavuk|uil2pn|friendly-scanner|sundayddr|zmeu|sqlspider|Evasions | Scanner | 12 | User-agent |
| 2105 | RLx | apachebench|datacha0s|nv32ts|brutus|arachni|synapse|havij|sucuri|sitelock|scanalert | Scanner | 12 | User-agent |
| 2106 | RLx | http_get_vars|n-stealth|picscout|t34mh4k|webshag|mozilla/\d+\.\d+\s+sf | Scanner | 12 | User-agent |
| 2107 | RL | ++++++++result | Scanner | 12 | URL |
| 2112 | RL | /jmx-console/htmladaptor | Scanner | 12 | URL |
| 2115 | RLx | php/\d+\.|python-httplib|winhttprequest|pymills-spider/|^\. | Scanner | 1 | User-agent |
| 2116 | RL | internal dummy connection | Scanner | 12 | User-agent |
| 2400 | RL | base64 | Evasion | 2 |
URL ARGS |
| 2401 | RL | cghwaw5mbygpoyag | Evasion | 12 |
BODY URL ARGS HEADERS |
| 2402 | RL | http://http:// | Other | 12 | HEADERS |
| 2403 | RLx | boundary=\S+[,|;] | Evasion | 8 | Content-Type |
| 2404 | RL | mid% | Evasion | 8 |
URL ARGS |
| 2405 | RL | dual | Evasion | 2 |
URL ARGS |
| 2406 | RL | strcmp( | RCE | 8 |
URL ARGS |
| 2407 | RLx | (\\[0-7]{1,3}){3,} | Evasion | 8 |
BODY URL ARGS HEADERS |
| 2409 | RLx | &#\d+;? | Evasion | 0 |
BODY URL ARGS HEADERS MLA |
| 2411 | RLx | (&#x[2-7]\w;(.|\s){0,50}){5,} | Evasion | 0 |
BODY URL ARGS HEADERS MLA |
| 2413 | RLx | (file|ftps?|https?)://(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) | Evasion | 12 | ARGS |
| 2414 | RLx | ((merge.{0,50}?using\s*?\()|(execute\s*?immediate\s*?[\"'`])|(match\s*?[\w(),+-]+\s*?against\s*?\()) | RCE | 8 |
ARGS Cookie |
| 2415 | RL | data:image | Evasion | 12 | URL |
| 2416 | RLx | (^|\W)(un)?hex\( | Evasion | 12 |
BODY URL ARGS HEADERS |
| 2700 | RL | .exec( | RCE | 12 |
BODY ARGS Content-Type |
| 2702 | RL | /invoker/ejbinvokerservlet | Other | 12 |
BODY URL |
| 2703 | RL | service:wanipconnection: | Other | 12 | BODY |
| 2704 | RL | /struts2-blank/ | RCE | 12 | URL |
| 2705 | RLx | <[\s\+]*![\s\+]*(doctype|entity)[\s\+]+%*[\s\+]*[a-za-z1-9_-]*[\s\+]+system | Other | 12 | BODY |
| 2706 | RLx | multipart/form-data;\s*boundary=[a-zA-Z0-9_-]{4000,} | Other | 12 | Content-Type |
| 2707 | RL | java.beans.eventhandler | RCE | 12 |
BODY ARGS |
| 2708 | RL | java.lang. | RCE | 12 |
BODY ARGS |
| 2709 | RL | typo3_conf | Other | 12 | ARGS |
| 2711 | RLx | \(\s{0,50}\)\s{0,50}\{\s{0,50}\: | Other | 12 |
BODY ARGS HEADERS |
| 2712 | RL | name[0%20 | Other | 12 | BODY |
| 2716 | RLx | script_fields.{0,50}import.{0,50}java\.util | RCE | 12 |
BODY ARGS |
| 2717 | RL | java.io. | RCE | 12 |
BODY ARGS |
| 2718 | RL | java.util. | RCE | 12 |
BODY ARGS |
| 2719 | RL | fill 'url | Other | 12 | BODY
URL ARGS |
| 2720 | RL | $mft | Other | 8 |
BODY ARGS |
| 2721 | RLx | \.\./|php | Other | 12 |
ARGS $URL:/components/com_hdflvplayer/hdflvplayer/download.php |
| 2722 | RL | .ph | Other | 12 | $URL:/uploader/server/php/ |
| 2723 | RL | swp_url=http | Other | 12 |
ARGS $URL:/wp-admin/admin-post.php |
| 2725 | RL | system.listmethods | Other | 12 |
$URL:/xmlrpc.php BODY |
| 2726 | RL | system.getcapabilities | Other | 12 |
$URL:/xmlrpc.php BODY |
| 2727 | RL | pingback.ping | UWA | 12 |
$URL:/xmlrpc.php BODY |
| 2728 | RLx | ['"`)][\s\+]*(OR|AND|\|\||\&\&)(\s+NOT)?[\s\+]+(.{1,25})[\s\+]*([\!\<\>]?\=|\<|\>)[\s\+]*(.{1,25}) | SQLi | 12 |
BODY URL ARGS User-agent |
| 2729 | RLx | (^|\W)((var)?char|chr)\W*=\W*["'] | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2730 | RLx | (^|\W)name_const\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2731 | WL | %C0 | WL | 0 | Cookie |
| 2733 | RLx | \.([~-][\w]?|\$+)($|\s|\:) | UWA | 12 | URL |
| 2734 | RLx | \w=\/(etc|usr|var|bin|sbin|lib|lib64|run|sys|dev|root|home|opt|srv|mnt)\/ | Other | 12 |
BODY ARGS |
| 2735 | RLx | (^|\W)draggable(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2736 | WLx | FBCR\/(\&\#\d+\-)+ | WL | 0 | User-agent |
| 2737 | RLx | filename\s*=\s*.+\.(php|pht|py|js\W|rb|pl|pm|cgi|aspx) | Other | 8 | Content-Disposition |
| 2738 | RLx | (^|\W)xbshell\W | Other | 12 |
BODY URL ARGS HEADERS |
| 2739 | RLx | (^|\W)union(\s|\+)+(all(\s|\+)+)?select\W | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2740 | RL | deployment-config.json | UWA | 12 | URL |
| 2741 | RL | ftpsync.settings | UWA | 12 | URL |
| 2742 | RLx | (^|\W)convert\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2743 | RLx | (^|\W)(md5|crc32|sha1|hash|crypt)\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2744 | RLx | (^|\W)HashBytes\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2745 | RLx | (^|\W)extractvalue\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2746 | RLx | waitfor(\s|\+)+delay\W | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2747 | RLx | img(\s|\+)*src=\"?(https?\:\/\/)?[\w|\.|\-|\/]+\.(txt|php|py|cgi|asp) | RFI | 12 | BODY |
| 2748 | RL | eval-stdin.php | UWA | 12 | URL |
| 2749 | RLx | \s(OR|\|\||AND|\&\&)(\s*not)?\s*(['")]\w*['"(]|\w*)\s*[!]?=\s*(['")]\w*['"(]|\w*)\s*\-\- | SQLi | 12 |
BODY URL ARGS User-agent |
| 2750 | RL | @pdiscoveryio | Scanner | 12 | User-agent |
| 2751 | RLx | (^|\W)function\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 2752 | RLx | (sql|old|bkp|bck|bckp|back|backup|archive)\.(zip|rar|7zip|bz2|gz|xz|lzma|tar|gz|tar\.gz)($|\s|\:) | UWA | 12 | URL |
| 2753 | RLx | (^|\W)includecomponent\( | RCE | 12 | BODY |
| 2754 | RLx | (^|\W)__schema\W*\{ | Other | 12 |
BODY ARGS |
| 2755 | RLx | \/\.\.[\;\+] | UWA | 12 | URL |
| 2756 | RLx | (^|\W)script[\s\+]+xmlns | XSS | 12 |
BODY URL ARGS HEADERS |
| 2757 | RLx | (^|\W)tostring\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 2758 | RLx | (^|\W)shell_exec\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2759 | RLx | \=[\s\+]*\$\{\w+[\+\-\*\/]\w+\} | RCE | 12 |
BODY ARGS |
| 2760 | RLx | (^|\W)nslookup\W | RCE | 12 |
BODY URL ARGS HEADERS |
| 2761 | RLx | \|[\s\+]*([\/]*(\w|\.)+[\/]+)?(bash|perl|python|php)\W | RCE | 8 |
BODY URL ARGS HEADERS |
| 2762 | RLx | (^|\W)gethostbyname\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2763 | RLx | ['"`)][\s\+]*(OR|AND|\|\||\&\&)(\s+NOT)?[\s\+\"\'\(\)]+(.{1,25})[\s\+\"\'\(\)]+([\!\<\>]?\=|\<|\>)[\s\+\"\'\(\)]+(.{1,25}) | SQLi | 12 |
BODY URL ARGS User-agent |
| 2764 | WLx | \w\-\-\w | WL | 0 |
BODY URL ARGS HEADERS |
| 2766 | RLx | bxss\W*\.me | Scanner | 12 |
BODY URL ARGS HEADERS |
| 2767 | RL | sysdate( | Injection | 12 |
BODY URL ARGS HEADERS |
| 2768 | RLx | on(waiting|pause|show|start|end|unload|drop|submit|close|after(print|scriptexecute)|contextmenu|cellchange)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2769 | RLx | on(cuechange|(de)?activate|finish|fullscreenchange|hashchange|invalid|message|repeat)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2770 | RLx | on(resize|scroll|search|seeked|seeking|timeupdate|touchend|touchmove|touchstart|volumechange)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2771 | RLx | on(mozfullscreenchange|pagehide|pageshow|popstate|progress|readystatechange|transitioncancel|transitionrun|transitionstart|unhandledrejection)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2772 | RLx | onwebkitanimation(end|iteration|start|end)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2773 | RLx | onbefore((de)?activate|copy|cut|editfocus|paste|update|scriptexecute|input)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2774 | RLx | onpointer(down|enter|leave|move|out|over|rawupdate|up)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2775 | RLx | onanimation(cancel|iteration|start|end)(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2776 | RLx | (^|\W)strrev\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2777 | RLx | (djy|qpy)l18\.com | Other | 12 | ARGS |
| 2778 | RLx | (^|\W)execute\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2779 | RLx | (^|\W)(atob|btoa)\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 2780 | RL | Fuzz Faster | Scanner | 12 | User-agent |
| 2781 | RLx | (^|\W)get(Runtime|Response|Writer|Property|InputStream)\( | RCE | 12 |
BODY Content-Type |
| 2782 | RL | .start( | RCE | 12 |
BODY Content-Type |
| 2783 | RL | X-Scanner: Netsparker | Scanner | 12 | X-Scanner |
| 2784 | RL | codepoints-to-string( | Injection | 12 |
BODY URL ARGS HEADERS |
| 2785 | RLx | (^|\W)substring\( | Injection | 8 |
BODY URL ARGS HEADERS |
| 2786 | RL | string-length( | Injection | 12 |
BODY URL ARGS HEADERS |
| 2787 | RLx | (^|\W)starts-with\( | Injection | 12 |
BODY URL ARGS HEADERS |
| 2788 | RLx | (^|\W)contains\( | Injection | 8 |
BODY URL ARGS HEADERS |
| 2789 | RL | db.collection.find( | Injection | 12 |
BODY URL ARGS HEADERS |
| 2790 | RLx | (^|\W)match\( | Injection | 8 |
BODY URL ARGS HEADERS |
| 2791 | RLx | (^|\W)document\[('|"|`)\w+('|"|`)\] | XSS | 12 |
BODY URL ARGS HEADERS |
| 2792 | RL | knoxss.me | Scanner | 12 |
BODY URL ARGS HEADERS |
| 2793 | RLx | (^|\W)confirm(\.call)?\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 2794 | RLx | (^|\W)array\( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2795 | RL | array_map( | Injection | 12 |
BODY URL ARGS HEADERS |
| 2796 | RL | base_convert( | Injection | 12 |
BODY URL ARGS HEADERS |
| 2797 | RL | scaninfo@expanseinc.com | Scanner | 12 | User-agent |
| 2798 | RL | .xss.ht | Scanner | 12 |
BODY URL ARGS HEADERS |
| 2799 | RLx | =\$\{\d+[+\-*%]\d+\} | Injection | 8 |
BODY ARGS |
| 2800 | RL | load_file( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2801 | RLx | (^|\W)start-sleep[\s\+]+\- | RCE | 12 |
BODY URL ARGS HEADERS |
| 2802 | RLx | (^|\W)passthru\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2803 | RLx | (^|\W)sleep\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2804 | RLx | (^|\W)typeof\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2805 | RLx | \Wisfinite\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2806 | RLx | (^|\W)sleep[\s\+]+\d | Injection | 8 |
BODY URL ARGS HEADERS |
| 2807 | RLx | (^|\W)prompt(\.call)?[(,`] | XSS | 8 |
BODY URL ARGS HEADERS |
| 2808 | RLx | (^|\W)substr\( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2809 | RLx | (^|\W)ord\( | Injection | 8 |
BODY URL ARGS HEADERS |
| 2810 | RLx | (^|\W)mid\( | SQLi | 8 |
BODY URL ARGS HEADERS |
| 2811 | RLx | (^|\W)ifnull\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2812 | RLx | (^|\W)cast\( | SQLi | 8 |
BODY URL ARGS HEADERS |
| 2813 | RLx | (^|\W)database\( | SQLi | 8 |
BODY URL ARGS HEADERS |
| 2814 | RL | scaninfo@paloaltonetworks.com | Scanner | 12 | User-agent |
| 2815 | RLx | (^|\W)require\( | Injection | 8 |
BODY URL ARGS HEADERS |
| 2816 | RLx | (^|\W)endianness\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2817 | RL | charCodeAt( | XSS | 12 |
BODY URL ARGS HEADERS |
| 2818 | RLx | (^|\W)fillrect\( | XSS | 12 |
BODY URL ARGS HEADERS |
| 2819 | RL | fromcharcode( | XSS | 12 |
BODY URL ARGS HEADERS |
| 2820 | RLx | @Grab(Config|Resolver)?\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2821 | RLx | (^|\W)r87\.(com|me)\W | Scanner | 12 |
BODY URL ARGS HEADERS |
| 2822 | RLx | (^|\W)echo(\s|\+)+\$\( | OSCI | 8 |
BODY URL ARGS HEADERS |
| 2823 | RLx | (^|\W)echo(\s|\+)+(\-\w+(\s|\+)+)?[\'\"\`] | OSCI | 8 |
BODY URL ARGS HEADERS |
| 2824 | RLx | (database|db|dump)\.tar(\.gz)?($|\s|\:) | UWA | 12 | URL |
| 2826 | RLx | (^|\W)alert\.name\W | XSS | 12 |
BODY URL ARGS HEADERS |
| 2827 | RL | .newInstance( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2828 | RL | .forName( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2829 | RLx | config\.inc(\.(bz2|gz|xz|tar(\.(bz2|gz|lzma|xz))?))?($|\s|\:) | UWA | 12 | URL |
| 2830 | RLx | config\.(bz2|gz|xz|tar(\.(bz2|gz|lzma|xz))?)($|\s|\:) | UWA | 12 | URL |
| 2831 | WL | Open BSD | WL | 0 | User-agent |
| 2832 | RLx | (^|\W)db.bz2($|\s|\:) | UWA | 12 | URL |
| 2833 | RL | config_db.php | UWA | 12 | URL |
| 2834 | RLx | (^|\W)cat_code\W | SQLi | 8 |
BODY URL ARGS HEADERS |
| 2835 | RL | x-wvs-id | Scanner | 12 | HEADERS |
| 2836 | RLx | (^|\W)(un)?escape\W | XSS | 6 |
BODY URL ARGS HEADERS |
| 2837 | WLx | \$\{(ad_id|platform|campaign_id)\} | WL | 0 |
BODY ARGS HEADERS |
| 2838 | RLx | (^|\W)updatexml\( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2839 | RLx | (^|\W)valueOf\W*(\(|\'|\"|.) | XSS | 8 |
BODY URL ARGS HEADERS |
| 2840 | RL | JSON.stringify( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2841 | RLx | (^|\W)window\.[a-z] | XSS | 4 |
BODY URL ARGS HEADERS |
| 2842 | RLx | (^|\W)(global|window)eventhandlers\.[a-z] | XSS | 8 |
BODY URL ARGS HEADERS |
| 2843 | RLx | (^|\W)globalthis\W | XSS | 6 |
BODY URL ARGS HEADERS |
| 2844 | RLx | (^|\W)fopen\( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2845 | RLx | (^|\W)fputs\( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2846 | RLx | (^|\W)printenv\W | OSCI | 8 |
BODY URL ARGS HEADERS |
| 2847 | WL | gpg.key | WL | 0 | URL |
| 2848 | RLx | (^|\W)ini_set\( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2849 | RL | set_time_limit( | RCE | 12 |
BODY URL ARGS HEADERS |
| 2850 | RLx | (^|\W)isset\( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2851 | RL | /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | UWA | 12 | URL |
| 2852 | RL | .interact.sh | Scanner | 12 |
BODY URL ARGS HEADERS |
| 2853 | RL | reflect.apply( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2854 | RL | promise.all( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2855 | RL | .then(alert | XSS | 8 |
BODY URL ARGS HEADERS |
| 2856 | RL | /backup/ | UWA | 12 | URL |
| 2857 | RL | 0x00 | Evasion | 4 |
BODY URL ARGS HEADERS |
| 2858 | RL | string.fromcodepoint( | XSS | 12 |
BODY URL ARGS HEADERS |
| 2859 | RL | .tolowercase( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2860 | RL | netsystemsresearch.com | Scanner | 12 | User-agent |
| 2861 | RL | internet-structure-research-project-bot | Scanner | 12 | User-agent |
| 2862 | RL | /config.bak.php | UWA | 12 | URL |
| 2863 | RL | anonymousfox.co | Scanner | 12 | Referer |
| 2864 | RL | system.multicall | Other | 12 |
BODY $URL:/xmlrpc.php |
| 2865 | RLx | \/wp-config\.(orig|txt|php[._](bak|old|new)) | UWA | 12 | URL |
| 2866 | RLx | jndi\:(dns|rmi|iiop|ldap)\:\/\/ | RCE | 12 |
BODY URL ARGS HEADERS |
| 2867 | RLx | \$\{(lower|upper)\: | RCE | 8 |
BODY URL ARGS HEADERS |
| 2868 | RLx | \$[\\]?\{\:\:\-[jndilaprmso][\\]?\} | RCE | 8 |
BODY URL ARGS HEADERS |
| 2869 | RLx | \$[\\]?\{env\:ENV_NAME\:\-[jndilaprmso][\\]?\} | RCE | 8 |
BODY URL ARGS HEADERS |
| 2870 | RL | str_pad( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2871 | RL | mysqli:: | RCE | 8 |
BODY URL ARGS HEADERS |
| 2872 | RL | /.aws/credentials | UWA | 12 | URL |
| 2873 | RLx | \.pydevproject($|\s|\:) | UWA | 12 | URL |
| 2874 | RL | BluechipBacklinks | Scanner | 12 | User-agent |
| 2875 | RL | rookee.bot | Scanner | 12 | User-agent |
| 2876 | RLx | (alfa_data|alfacgiapi|cgialfa)\/.{0,50}\.alfa($|\s|\/|\:) | UWA | 12 | URL |
| 2877 | RL | .httpservletresponse | RCE | 8 |
BODY Content-Type |
| 2878 | RLx | \/(db|backup|config)\d*\.(bz2|gz|tar|xz|lzma)($|\s|\:) | UWA | 8 | URL |
| 2879 | RLx | (^|\W)var_dump\( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2880 | RL | wp_is_mobile | Scanner | 12 | User-agent |
| 2881 | RL | PHP/{5|6|7} | Scanner | 12 | User-agent |
| 2882 | RL | class.classloader.resources.dircontext.docbase | RCE | 8 | ARGS |
| 2883 | RL | github.com/gocolly | Scanner | 12 | User-agent |
| 2884 | RL | .get_host_address( | SQLi | 12 |
BODY URL ARGS HEADERS |
| 2885 | RLx | CensysInspect|censys\.io | Scanner | 12 | User-agent |
| 2886 | RLx | \.(git|svn) | UWA | 8 | URL |
| 2887 | RL | .touppercase( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2888 | RL | 0x[] | RCE | 8 | BODY |
| 2889 | RL | 0x[]=androxgh0st | RCE | 12 | BODY |
| 2890 | RLx | while\s*\( | RCE | 4 |
BODY URL ARGS HEADERS |
| 2891 | RL | .equals( | RCE | 4 |
BODY URL ARGS HEADERS |
| 2892 | RL | class.module.classLoader | RCE | 12 |
BODY URL ARGS HEADERS |
| 2893 | RL | .getInputStream( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2894 | RL | .getRuntime( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2895 | RL | .getParameter( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2896 | RLx | \.queryselector(all)?\( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2897 | RL | springframework.context.support.FileSystemXmlApplicationContext | RCE | 8 |
BODY URL ARGS HEADERS |
| 2898 | RLx | reflect\.(apply|cons|def|del|get|has|isext|own|prev|set) | XSS | 4 |
BODY URL ARGS HEADERS |
| 2899 | RL | sort.call | XSS | 2 |
BODY URL ARGS HEADERS |
| 2900 | RL | eval.apply | XSS | 4 |
BODY URL ARGS HEADERS |
| 2901 | RL | .surf.ias-lab.de | Scanner | 12 | ARGS |
| 2902 | RL | .shift() | XSS | 2 |
BODY URL ARGS HEADERS |
| 2903 | RL | .with( | XSS | 2 |
BODY URL ARGS HEADERS |
| 2904 | RL | __class__ | RCE | 4 |
BODY ARGS HEADERS |
| 2905 | RLx | (^|\W)(wget|curl)\W | RCE | 2 |
BODY ARGS Referer |
| 2906 | RLx | (^|\W)alert\W | XSS | 4 |
BODY URL ARGS HEADERS |
| 2907 | RL | .getResource( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2908 | RLx | \{\s*php\s*\} | RCE | 4 |
BODY URL ARGS HEADERS |
| 2909 | RL | freemarker.template.utility.execute | RCE | 8 | BODY |
| 2910 | RLx | (^|\W)window\[ | XSS | 4 |
BODY URL ARGS HEADERS |
| 2911 | RL | MakeViewVariableOptionalSolution | RCE | 12 | BODY |
| 2912 | RLx | (^|\W)attr\( | XSS | 2 |
BODY URL ARGS HEADERS |
| 2913 | RL | @( | Injection | 2 |
BODY URL ARGS HEADERS |
| 2914 | RL | {$ | Injection | 2 |
BODY URL ARGS HEADERS |
| 2915 | RLx | :[\/\\]+windows[\/\\]+ | UWA | 8 |
BODY URL ARGS HEADERS |
| 2917 | RLx | ['"][\s+]*;[\s+]*return[\s+] | Injection | 4 |
BODY URL ARGS HEADERS |
| 2918 | RLx | ;[\s+]*([\/]([usrbinloca?]{3,5}[\/]){1,4})?([cat?]{3,3}|[les?]{4,4})[\s+]+[\/]?\w+ | Evasion | 2 |
BODY URL ARGS HEADERS |
| 2919 | RLx | echo[\s+]+var | Injection | 4 |
BODY URL ARGS HEADERS |
| 2920 | RLx | exec[\s+]+cmd | Injection | 4 |
BODY URL ARGS HEADERS |
| 2921 | RLx | (^|\W)location\.(ancestor|href|protocol|host|pathname|search|hash|origin) | XSS | 12 |
BODY URL ARGS HEADERS |
| 2922 | RL | <%= | Injection | 4 |
BODY URL ARGS HEADERS |
| 2923 | RLx | top\[.{1,50}\]\( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2924 | RL | .map( | XSS | 4 |
BODY URL ARGS HEADERS |
| 2925 | RLx | &([lr]par|quot|apos|grave|tab|nbsp); | Evasion | 0 |
BODY URL ARGS HEADERS MLA |
| 2926 | RLx | \/(etc|usr|var|bin|sbin)\/ | UWA | 2 |
BODY URL ARGS HEADERS |
| 2927 | RL | #{ | Injection | 2 |
BODY URL ARGS |
| 2928 | RLx | \{\{[_]*self.*\}\} | Injection | 8 |
BODY URL ARGS HEADERS |
| 2929 | RLx | ondata(available|setchanged|setcomplete)?(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2930 | RLx | ondrag(end|enter|leave|start|over)?(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2931 | RLx | onmove(end|start)?(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2932 | RLx | onrow(enter|exit|s(delete|inserted))(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2933 | RLx | on(load(start|eddata)?|focus(in|out)?|key(down|press|up)|pointer(over|enter|down|move|up|cancel|out|leave))(\s|\+)*\= | XSS | 12 |
BODY URL ARGS HEADERS |
| 2934 | RL | dict:// | UWA | 8 |
BODY ARGS |
| 2935 | RL | sftp:// | UWA | 8 |
BODY ARGS |
| 2936 | RL | tftp:// | UWA | 8 |
BODY ARGS |
| 2937 | RL | ldap:// | UWA | 8 |
BODY ARGS |
| 2938 | RL | gopher:// | UWA | 8 |
BODY ARGS |
| 2939 | RL | netdoc:// | UWA | 8 |
BODY ARGS |
| 2940 | RLx | \$(ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|x?or|div|like|between|and|where): | Injection | 4 |
BODY URL ARGS HEADERS |
| 2941 | RL | db.injection.insert( | Injection | 12 |
BODY URL ARGS HEADERS |
| 2942 | RLx | \.oast\.(me|pro) | Scanner | 12 |
BODY URL ARGS HEADERS |
| 2943 | RL | *{ | Injection | 2 | BODY
URL ARGS |
| 2944 | RL | BugBountyBot | Scanner | 12 | User-agent |
| 2945 | RLx | \$0\s*<<<\s*\$ | Evasion | 8 |
BODY URL ARGS HEADERS |
| 2946 | RL | console.log( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2947 | RL | navigation.onnavigate | XSS | 8 |
BODY URL ARGS HEADERS |
| 2948 | RL | document.queryselector( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2949 | RL | .setAttribute( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2950 | RL | json_depth( | SQLi | 8 |
BODY URL ARGS HEADERS |
| 2951 | RLx | (^|\W)printf\W | OSCI | 8 |
BODY URL ARGS HEADERS |
| 2952 | RL | x-web-scanner-info | Scanner | 8 | HEADERS |
| 2953 | RL | /(s(x)) | UWA | 2 | URL |
| 2954 | RLx | \|\s*set\s | OSCI | 8 |
BODY URL ARGS HEADERS |
| 2955 | RLx | [^-:=\.\w\|]json_(array|contains_path|depth|extract|keys|length|object|quote|search|type|unquote|valid)[^-:=\.\w\|] | SQLi | 4 |
BODY URL ARGS HEADERS |
| 2956 | RL | `id` | OSCI | 4 |
BODY URL ARGS HEADERS |
| 2957 | RL | curl_setopt( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2958 | RLx | (^|\W)stristr\( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2959 | RL | file_get_contents( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2960 | RLx | \$_(GET|POST|FILES)\[ | RCE | 8 |
BODY URL ARGS HEADERS |
| 2961 | RL | g=echo Sp3ctra; | UWA | 12 | Cookie |
| 2962 | RLx | {{ '{' }}{{ '{' }}\s*(\d+|'\d+')\s*[*+]\s*(\d+|'\d+')?\s*{{ '}' }}{{ '}' }} | Injection | 8 | BODY
URL ARGS |
| 2963 | RLx | {{ '{' }}{{ '{' }}\s*\d+\s*\|add:\s*\d+\s*{{ '}' }}{{ '}' }} | Injection | 8 | BODY
URL ARGS |
| 2964 | RLx | (^|\W)import\( | XSS | 8 |
BODY URL ARGS HEADERS |
| 2965 | RLx | (^|\W)fwrite\( | RCE | 8 |
BODY URL ARGS HEADERS |
| 2966 | RL | file_put_contents( | RCE | 8 |
BODY URL ARGS HEADERS |
