2_waf.yml

---

defaults_waf:
  # NOTE: the block-code is very limited if you want to use an errorfile!
  #   see: https://www.haproxy.com/documentation/haproxy-configuration-manual/latest/#http-request%20return
  block_code: 400
  block_errorfile: true

  # todo: search parameters and body of http requests for SQLi/Path-Traversal/XSS/...

  # see also: https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/blob/master/_generator_lists/bad-user-agents.list
  user_agents:
    # Well-known user-agents used by scripting languages for very basic security-filtering
    # matching is done case-insensitive
    script:
      # NOTE: empty user-agent is also matched
      full: []

      # NOTE: these are sub-strings inside the user-agent header
      sub:
        # cli tools
        - 'curl'
        - 'wget'
        - 'Apache'
        - 'OpenSSL'
        - 'nmap'
        - 'Metasploit'
        # automation tools
        - 'headless'
        - 'cypress'
        - 'Nessus'
        - 'MechanicalSoup'
        # golang
        - 'go-http-client'
        - 'zgrab'
        - 'grpc-go'
        - 'colly'
        # python
        - 'python'
        - 'httpx'
        - 'httpcore'
        - 'aiohttp'
        - 'httputil'
        - 'urllib'
        # php
        - 'GuzzleHttp'
        - 'phpcrawl'
        - 'Zend_Http_Client'
        - 'Wordpress'
        - 'Symfony-HttpClient'
        # others
        - 'cpp-httplib'  # c++
        - 'java'
        - 'perl'
        - 'axios'  # JS
        - 'ruby'
        - 'okhttp'
        - 'Nutch'
        - 'apify'

    bad_crawlers:
      full:
        - 'ALittle Client'
        # bad spoofing
        - 'Chrome'
        - 'Linux Mozilla'
      sub:
        - 'spider'
        - 'test-bot'
        - 'tiny-bot'
        - 'fidget-spinner-bot'
        - 'download'
        - 'scan'
        - 'nmap'
        - 'Metasploit'
        - 'ImageVacuum'
        - 'ELinks'
        - 'Mozilla/3.0'
        - 'Mozilla/4.0'
        # python
        - 'scrapy'
        # golang
        - 'zgrab'

    search_engines:
      # NOTE: can be spoofed without verification
      # google
      #   https://developers.google.com/search/docs/crawling-indexing/overview-google-crawlers
      #   https://developers.google.com/search/docs/crawling-indexing/verifying-googlebot
      # bing
      #   https://www.bing.com/webmasters/help/which-crawlers-does-bing-use-8c184ec0
      sub:
        # google
        - 'Googlebot'
        - 'Storebot-Google'
        - 'AdsBot-Google'
        - 'FeedFetcher-Google'
        - 'GoogleProducer'
        - 'Mediapartners-Google'
        # bing
        - 'bingbot'
        - 'adidxbot'
        - 'MicrosoftPreview'
        # yandex
        - 'Yandexbot'
        # baidu
        - 'Baidu'
        # apple
        - 'Applebot'
        # ahrefs (SEO)
        - 'AhrefsBot'
        # duck duck go
        - 'DuckDuckBot'
        - 'DuckDuckGo'
        # yahoo
        - 'Yahoo'

    any:
      - 'bot'
      - 'spider'
      - 'photon'
      - 'adsdefender'
      - 'crawl'
      - 'robot'
      - 'image'
      - 'proxy'
      - 'download'
      - 'scan'
      - 'Chrome-Lighthouse'
      - 'whatsapp'
      - 'fetcher'
      - 'office'
      - 'facebook'
      - 'feed'
      - 'data'
      - 'agent'
      - 'inspect'
      - 'github-camo'

  script_kiddy:
    disable: []  # matches that should not be blocked (user-defined); checked at templating stage

    exclude:  # sub-string safelist to be excluded (user-defined); checked at runtime
      - '.well-known/acme-challenge'

    path_beg:
      - '/cgi-bin/'
      - '/manager/'
      - '/php'
      - '/program/'
      - '/pwd/'
      - '/shaAdmin/'
      - '/typo3/'
      - '/dbadmin/'
      - '/db/'
      - '/solr/'
      - '/weaver/'
      - '/joomla/'
      - '/App/'
      - '/webdav/'
      - '/xmlrpc'
      - '/%'
      - '/.'
      - '//'
      - '/securityRealm/'
      - '/magmi/'
      - '/HNAP1'
      - '/vendor/'
      - '/login.action'
      - 'google.com:443'  # test CONNECT method
      - '/actuator/'
      - '/telescope/requests'
      - '/geoserver/'
      # information gathering
      - '/server-status'
      - '/FPURL.xml'
      - '/.vscode/'
      - '/.idea/'
      - '/config.json'
      # data extraction
      - '/backup'
      - '/old'
      - '/new'
      - '/home'
      - '/main'
      - '/www/'
      - '/etc/'
      - '/config/aws.yml'
      - '/aws.yml'
      - '/aws-secret.yaml'
      - '/.aws/'
      # MS Exchange
      - '/ecp/'
      - '/ews/'
      - '/autodiscover/'
      # Wordpress
      - '/wp'
      - '/wordpress'

    path_end:
      - 'login.jsp'
      - 'logon.htm'
      - 'logon.html'
      - 'logincheck'
      # scripts etc
      - '.php'
      - '.php7'
      - '.php8'
      - '.asp'
      - '.aspx'
      - '.esp'
      - '.lua'
      - '.rsp'
      - '.ashx'
      - '.dll'
      - '.bin'
      - '.cgi'
      - '.cs'
      - '.application'
      - '.exe'
      - '.cfm'
      - '.pl'
      - '.shtml'
      - '.jsp'
      - '.jsa'
      - '.mwsl'
      # information gathering
      - '.git/config'
      - '.git/HEAD'
      - '.git/index'
      - '.DS_Store'
      - '.aws/config'
      - '.config'
      - '.settings'
      - '.properties'
      # data extraction
      - '.zip'
      - '.tar'
      - '.tgz'
      - '.gz'
      - '.bz2'
      - '.rar'
      - '.7z'
      - '.sql'
      - '.sqlite3'
      - '.bak'
      - '.yml'
      - '.yaml'

    path_sub:
      - '/../'
      - '/.%2e/'
      - '/%%32%65%%32%65/'
      - '/.env'
      - 'eval'
      - 'shell'
      - '/.git/'
      - '/;'
      - '/bin/'
      - 'phpinfo'
      - '/debug'
      - '/admin/'

  # todo: query/body
  #  * filter hex/hashes
  #    also in this format: 'C%97%85%EC%86%8C%F0%9F%90%89%EC%97'
  #  * curl/wget/chmod/chown
  #  * filter sqli
  #    AAA%20or%201=0%20&username=admin&password=shagenda--%20-