From c735dab40d702aedd0003244221fa1bb51cbe618 Mon Sep 17 00:00:00 2001 From: jd82k <135953914+jd82k@users.noreply.github.com> Date: Wed, 24 Apr 2024 22:23:37 +0800 Subject: [PATCH 1/2] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E6=8F=90=E4=BA=A4?= =?UTF-8?q?=E6=AD=A3=E5=88=99=E8=BF=87=E6=BB=A4=E6=97=B6=EF=BC=8C=E5=9B=A0?= =?UTF-8?q?=E4=B8=BA=E6=AD=A3=E5=88=99=E4=B8=AD=E5=AD=98=E5=9C=A8=E5=86=92?= =?UTF-8?q?=E5=8F=B7=EF=BC=8C=E9=94=99=E8=AF=AF=E7=9A=84=E5=B0=86=E6=89=80?= =?UTF-8?q?=E6=9C=89=E7=9A=84=E5=86=92=E5=8F=B7=E7=94=A8=E4=BA=8E=E5=88=86?= =?UTF-8?q?=E5=89=B2=EF=BC=8C=E5=BA=94=E8=AF=A5=E5=8F=AA=E4=BD=BF=E7=94=A8?= =?UTF-8?q?=E7=AC=AC=E4=B8=80=E4=B8=AA=E5=86=92=E5=8F=B7=E5=88=86=E5=89=B2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- plugins/op_waf/index.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/op_waf/index.py b/plugins/op_waf/index.py index 60d409d46..0f14caaf8 100755 --- a/plugins/op_waf/index.py +++ b/plugins/op_waf/index.py @@ -40,11 +40,11 @@ def getArgs(): if args_len == 1: t = args[0].strip('{').strip('}') - t = t.split(':') + t = t.split(':', 1) tmp[t[0]] = t[1] elif args_len > 1: for i in range(len(args)): - t = args[i].split(':') + t = args[i].split(':', 1) tmp[t[0]] = t[1] return tmp From 8a0e8e9c178d307ee22c1af40a2f329109616bad Mon Sep 17 00:00:00 2001 From: jd82k <135953914+jd82k@users.noreply.github.com> Date: Wed, 24 Apr 2024 22:42:05 +0800 Subject: [PATCH 2/2] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E4=BA=86=E4=B8=80?= =?UTF-8?q?=E4=BA=9B=E9=9D=9E=E6=B3=95=E6=89=AB=E6=8F=8F=E5=99=A8=E5=8F=8A?= =?UTF-8?q?=E8=84=9A=E6=9C=AC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 通过1年的日志分析，收集了一些非法扫描器、脚本、爬虫的UA --- plugins/op_waf/waf/rule/user_agent.json | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/plugins/op_waf/waf/rule/user_agent.json b/plugins/op_waf/waf/rule/user_agent.json index b5220f555..3e8a87a05 100755 --- a/plugins/op_waf/waf/rule/user_agent.json +++ b/plugins/op_waf/waf/rule/user_agent.json @@ -2,5 +2,7 @@ [1,"(HTTrack|Apache-HttpClient|harvest|audit|dirbuster|pangolin|nmap|sqln|hydra|Parser|libwww|BBBike|sqlmap|w3af|owasp|Nikto|fimap|havij|zmeu|BabyKrokodil|netsparker|httperf| SF/)","关键词过滤1",0], [1,"(ApacheBench)","AB测试",0], [1,"(Amazonbot)","Amazon爬虫",0], - [1,"(SemrushBot)","Semrush爬虫",0] -] \ No newline at end of file + [1,"(SemrushBot)","Semrush爬虫",0], + [1,"(^$|Apache-HttpClient|colly|curl|okhttp|Go-http-client|python-requests|Python-urllib|python-httpx|Scrapy|aiohttp|Nmap Scripting Engine|Java|fasthttp|Wget)","非法脚本",0], + [1,"(CensysInspect|intelx\\.io_bot|InternetMeasurement|ips-agent|MJ12Bot|NetcraftSurveyAgent|SemrushBot|l9scan|SEOlyt|kirkland-signature|ZoominfoBot|Expanse|CheckMarkNetwork|dotbot|Pandalytics|Screaming Frog SEO Spider|W3C_CSS_Validator_JFouffa)","非法扫描器",0] +]