<p class="shortdesc">在接入层网关实现对请求的过滤，减少业务系统的非正常请求。</p> <ul class="ul" id="safty-rules__ul_qgr_mpc_fsb"> <li class="li"><strong class="ph b">（PAFA-CLOUD-KONG 1.3.5版本及以上适用）</strong></li> <li class="li">对接公司安全规范，内置16种安全规则（具体规则内容可看下方内置规则说明）。</li> <li class="li">同时用户可以按照配置要求自定义规则内容，实现请求过滤。</li> </ul> <section class="section" id="safty-rules__section_vzx_ppc_fsb"><h2 class="doc-tairway">使用方式</h2> <p class="p">即配置安全规则，如果请求匹配规则，则返回配置的信息。</p> </section> <section class="section" id="safty-rules__section_ns5_tpc_fsb"><h2 class="doc-tairway">配置参数说明</h2> <div class="p"> <table class="table" id="safty-rules__table_dd2_wpc_fsb"><caption></caption><colgroup><col><col><col><col><col></colgroup><thead class="thead"> <tr class="row"> <th class="entry align-left" id="safty-rules__table_dd2_wpc_fsb__entry__1">参数名</th> <th class="entry align-left" id="safty-rules__table_dd2_wpc_fsb__entry__2">参数类型</th> <th class="entry align-left" id="safty-rules__table_dd2_wpc_fsb__entry__3">是否必须</th> <th class="entry align-left" id="safty-rules__table_dd2_wpc_fsb__entry__4">默认值</th> <th class="entry align-left" id="safty-rules__table_dd2_wpc_fsb__entry__5">参数说明</th> </tr> </thead><tbody class="tbody"> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__1 ">resp_code</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__2 ">string</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__3 ">Y</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__4 ">400</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__5 ">返回结果内的状态码</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__1 ">resp_msg</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__2 ">string</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__3 ">Y</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__4 ">security error</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__5 ">返回消息</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__1 ">resp_code_field</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__2 ">string</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__3 ">Y</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__4 ">code</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__5 ">返回状态码的字段名</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__1 ">resp_msg_field</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__2 ">string</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__3 ">Y</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__4 ">msg</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__5 ">返回消息的字段名</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__1 ">builtin_rules</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__2 ">array</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__3 ">Y</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__4 ">[]</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__5 ">启用的规则</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__1 ">custom_rules</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__2 ">array</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__3 ">N</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__4 ">[]</td> <td class="entry align-left" headers="safty-rules__table_dd2_wpc_fsb__entry__5 ">自定义规则</td> </tr> </tbody></table> </div> </section> <section class="section" id="safty-rules__section_lcp_wpc_fsb"><h2 class="doc-tairway">配置示例</h2> <p class="p">配置示例如下：</p> <pre class="pre codeblock" id="safty-rules__codeblock_kwp_ypc_fsb"><code>{ "resp_code": "400", "resp_msg": "security error", "resp_code_field": "code", "resp_msg_field": "msg", "builtin_rules": ["command_inject", "linux_file"], "custom_rules": [ { "output" : { "operator" : "OR", "rules" : [ {"field":"respdata", "operator":"MATCH", "value":"linux1"} ] } }, { "input" : { "operator" : "OR", "rules" : [ {"field":"query", "operator":"MATCH","value_type": "multi", "value_operator":"AND", "values":["linux", "test"]} ] } }, { "input" : { "operator" : "OR", "rules" : [ {"field":"query", "operator":"MATCH","value_type": "multi", "value_operator":"AND", "values":["linux", "test"]} ] }, "output" : { "operator" : "OR", "rules" : [ {"field":"respdata", "operator":"MATCH", "value":"linux1"} ] }, "operator": "AND" } ] }</code></pre> <p class="p">返回结果示例如下：</p> <pre class="pre codeblock" id="safty-rules__codeblock_xrn_1qc_fsb"><code>{ code : 400, msg : "security error" }</code></pre> <p class="p"><img class="image" id="safty-rules__image_xsb_hqc_fsb" src="https://obs-cn-shanghai.fincloud.pinganyun.com/pacloud/20220910180811-1205930a9ef7.png" width="800"></p> </section> <section class="section" id="safty-rules__section_epd_3qc_fsb"><h2 class="doc-tairway">内置规则</h2> <p class="p">内置16种规则：[“linux_file”,”xss”,”struts2”,”sql”,”git”,”svn”,”burpsuite”,”caidao_link”,”htaccess”,”php_code”,”backup_file”,”php_inject”,”windows”,”weblogic”,”catalog”,”command_inject”]</p> <ol class="ol" id="safty-rules__ol_fdb_lqc_fsb"> <li class="li"><strong class="ph b">数据来源说明</strong><table class="table" id="safty-rules__table_kdv_lqc_fsb"><caption></caption><colgroup><col><col></colgroup><thead class="thead"> <tr class="row"> <th class="entry align-left" id="safty-rules__table_kdv_lqc_fsb__entry__1">字段</th> <th class="entry align-left" id="safty-rules__table_kdv_lqc_fsb__entry__2">说明</th> </tr> </thead><tbody class="tbody"> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">url</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">请求链接</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">postdata</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">请求体内容</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">query</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">请求参数，即拼接在链接后面的参数名参数值对</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">header</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">请求头（会包含有cookie/user_agent/refer这些数据）</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">cookie</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">请求中的cookie</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">user_agent</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">请求的user agent</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">refer</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">来源网站</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">method</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">请求方法</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">status</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">上游服务返回的状态码</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__1 ">respdata</td> <td class="entry align-left" headers="safty-rules__table_kdv_lqc_fsb__entry__2 ">上游服务返回的结果数据</td> </tr> </tbody></table></li> <li class="li"><strong class="ph b">operator说明</strong><table class="table" id="safty-rules__table_wn2_nqc_fsb"><caption></caption><colgroup><col><col></colgroup><thead class="thead"> <tr class="row"> <th class="entry align-left" id="safty-rules__table_wn2_nqc_fsb__entry__1">值</th> <th class="entry align-left" id="safty-rules__table_wn2_nqc_fsb__entry__2">说明</th> </tr> </thead><tbody class="tbody"> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__1 ">OR</td> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__2 ">即规则之间是或的关系，只要有一条满足即该规则满足要求</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__1 ">AND</td> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__2 ">规则之间是与的关系，需要所有规则都匹配才满足要求</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__1 ">EQUAL</td> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__2 ">需要值完全匹配</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__1 ">NOT</td> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__2 ">需要值不相等</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__1 ">CONTAIN</td> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__2 ">需要包含规则中的值</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__1 ">MATCH</td> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__2 ">需要匹配规则中的值</td> </tr> <tr class="row"> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__1 ">NOTMATCH</td> <td class="entry align-left" headers="safty-rules__table_wn2_nqc_fsb__entry__2 ">不匹配规则中的值</td> </tr> </tbody></table><p class="p"><strong class="ph b">注意</strong>： 如果匹配值中有小于号/大于号，请用\u003c \u003e代替。</p></li> <li class="li"><strong class="ph b">使用场景</strong><ul class="ul" id="safty-rules__ul_hrg_qqc_fsb"> <li class="li"><strong class="ph b">linux_file</strong><p class="p"><strong class="ph b">使用场景</strong>：如果系统有读取本地文件的需求，此规则可以限制对linux密码文件的读取，避免服务器密码外露。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验（OR） AND 输出校验。</p><pre class="pre codeblock" id="safty-rules__codeblock_fdt_tqc_fsb"><code> { input = { operator = "OR", rules = { {field="url", operator="CONTAIN", value="etc/passwd"}, {field="postdata", operator="CONTAIN", value="etc/passwd"}, {field="query", operator="CONTAIN", value="etc/passwd"}, {field="header", operator="CONTAIN", value="etc/passwd"}, {field="cookie", operator="CONTAIN", value="etc/passwd"}, {field="user_agent", operator="CONTAIN", value="etc/passwd"} } }, output = { operator = "OR", rules = { {field="respdata", operator="CONTAIN", value="root:x:0:0:root"} } }, operator = "AND" }</code></pre></li> <li class="li"><strong class="ph b">xss</strong><p class="p">XSS是指恶意攻击者利用网站没有对用户提交数据进行转义处理或者过滤不足的缺点，进而添加一些代码，嵌入到web页面中去。使别的用户访问都会执行相应的嵌入代码。从而盗取用户资料、利用用户身份进行某种动作或者对访问者进行病毒侵害的一种攻击方式。</p><p class="p">插件会屏蔽可能造成XSS攻击的输入内容。</p><p class="p"><strong class="ph b">使用场景</strong>：存在表单数据提交的系统都适用。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验（OR） AND 输出校验。</p><pre class="pre codeblock" id="safty-rules__codeblock_usr_zqc_fsb"><code> { input = { operator = "OR", rules = { {field="query", operator="CONTAIN", value="alert%("}, {field="query", operator="CONTAIN", value="prompt%("}, {field="header", operator="CONTAIN", value="alert%("}, {field="cookie", operator="CONTAIN", value="alert%("}, {field="user_agent", operator="CONTAIN", value="alert%("} } }, output = { operator = "OR", rules = { {field="respdata", operator="CONTAIN", value="script\\u003ealert%("} } }, operator = "AND" }</code></pre></li> <li class="li"><strong class="ph b">struts2</strong><p class="p">当Struts2获取前台所传参数的内容的时候，他会先获得用户提交的参数名，然后从值栈（Value Stack）中找到符合参数值的内容，并打印。在查询的过程中，表达式会被执行，这才使得攻击者有可乘之机，利用这个方法来执行一些恶意的行为。</p><p class="p"><strong class="ph b">使用场景</strong>：系统有用到struts2.3以下版本时适用。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验（OR）。</p><pre class="pre codeblock" id="safty-rules__codeblock_qmq_crc_fsb"><code> { input = { operator = "OR", rules = { {field="url", operator="CONTAIN", value="ognlUtil"}, {field="query", operator="CONTAIN", value="ognlUtil"}, {field="header", operator="CONTAIN", value="ognlUtil"}, {field="cookie", operator="CONTAIN", value="ognlUtil"}, {field="user_agent", operator="CONTAIN", value="ognlUtil"} } } }</code></pre></li> <li class="li"><strong class="ph b">sql</strong><p class="p">SQL注入即是指web应用程序对用户输入数据的合法性没有判断或过滤不严，攻击者可以在web应用程序中事先定义好的查询语句的结尾上添加额外的SQL语句，在管理员不知情的情况下实现非法操作，以此来实现欺骗数据库服务器执行非授权的任意查询，从而进一步得到相应的数据信息。</p><p class="p">此插件会校验结果输出，如果存在如下校验内容则屏蔽输出，避免数据库内容泄露。不过sql脚本还是会执行，建议是后端程序防止sql注入。</p><p class="p"><strong class="ph b">使用场景</strong>：系统有输入性内容查询时适用。</p><p class="p"><strong class="ph b">校验规则</strong>：输出校验（OR）。</p><pre class="pre codeblock" id="safty-rules__codeblock_s4w_grc_fsb"><code>{ output = { operator = "OR", rules = { {field="respdata", operator="MATCH", value=".*sql syntax.*mysql.*"}, {field="respdata", operator="MATCH", value=".*valid mysql result.*"}, {field="respdata", operator="MATCH", value=".*postgresql.*error.*"}, {field="respdata", operator="MATCH", value=".*microsoft ole db provider for odbc drivers.*"}, {field="respdata", operator="MATCH", value=".*syntax error in string in query expression.*"}, {field="respdata", operator="MATCH", value=".*You have an error in your sql syntax;.*"}, {field="respdata", operator="MATCH", value=".*incorrect syntax near.*"}, {field="respdata", operator="MATCH", value=".*unable to perform query.*"}, {field="respdata", operator="MATCH", value=".*sqlclient.SqlException: .*"}, {field="respdata", operator="MATCH", value=".*java%.sql%.sqlexception:.*"}, {field="respdata", operator="MATCH", value=".*%[1054%]:Unknown column.*"}, {field="respdata", operator="MATCH", value=".*Microsoft OLE DB Provider for.*"}, {field="respdata", operator="MATCH", value=".*Incorrect syntax near .*"}, {field="respdata", operator="MATCH", value=".*SyntaxError: Unexpected .*"}, {field="respdata", operator="MATCH", value=".*ODBC SQL Server Driver.*"}, {field="respdata", operator="MATCH", value=".*You have an error in your SQL syntax.*"}, {field="respdata", operator="MATCH", value=".*ERROR: parser: parse error at or near.*"}, {field="respdata", operator="MATCH", value=".*java%.lang%.NumberFormatException: For input string:.*"} } } }</code></pre></li> <li class="li"><strong class="ph b">git</strong><p class="p">系统部署时pull了整个项目文件，也会将这个储存了所有的版本信息的.git文件夹下载到服务器的Web目录下 , 攻击者就可以利用这个目录 , 去下载git文件夹 , 就可以利用其中储存的版本控制信息 , 完全恢复网站后台的代码和目录。此规则会屏蔽对git文件的读取。建议在部署时屏蔽.git文件减少风险。</p><p class="p"><strong class="ph b">使用场景</strong>：使用git做代码管理的系统。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验AND 输出校验。</p><pre class="pre codeblock" id="safty-rules__codeblock_dln_4rc_fsb"><code> { input = { operator = "OR", rules = { {field="url", operator="CONTAIN", value="/%.git/config"} } }, output = { operator = "OR", rules = { {field="respdata", operator="CONTAIN", value="repositoryformatversion"} } }, operator = "AND" }</code></pre></li> <li class="li"><strong class="ph b">svn</strong><p class="p">风险同.git泄露类似，同样是没有将代码版本文件删除。此规则将屏蔽.svn文件的泄露。建议部署时屏蔽.svn文件。</p><p class="p"><strong class="ph b">使用场景</strong>：用.svn管理项目代码的系统。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验AND 输出校验（AND）。</p><pre class="pre codeblock" id="safty-rules__codeblock_l4g_yrc_fsb"><code> { input = { operator = "OR", rules = { {field="url", operator="CONTAIN", value="/%.svn/entries"} } }, output = { operator = "OR", rules = { {field="respdata", operator="CONTAIN", value="svn"}, {field="respdata", operator="CONTAIN", value="dir"} } }, operator = "AND" }</code></pre></li> <li class="li"><strong class="ph b">burpsuite</strong><p class="p">Burp Suite可以对某一个URL或者全站进行扫描，检测网站存在哪些漏洞。此规则用于Burp Suite扫描。</p><p class="p"><strong class="ph b">使用场景</strong>：存在对外公开的网页链接的系统。</p><pre class="pre codeblock" id="safty-rules__codeblock_nt2_fsc_fsb"><code>{ input = { operator = "OR", rules = { {field="all", operator="CONTAIN", value="burpcollaborator%.net"} } } }</code></pre></li> <li class="li"><strong class="ph b">caidao_link</strong><p class="p">黑客在入侵了一个网站后，通常会将asp或php后门文件与网站服务器WE目录下正常的网页文件混在一起，然后就可以使用浏览器或工具来访问asp或者php后门，得到一个命令执行环境，以达到控制网站服务器的目的。此规则额屏蔽相关脚步的执行。</p><p class="p"><strong class="ph b">使用个场景</strong>：以asp、php、jsp或者cgi等网页文件为页面解析脚本的系统。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验（AND）。</p><pre class="pre codeblock" id="safty-rules__codeblock_bkk_ssc_fsb"><code>{ input = { operator = "AND", rules = { {field="postdata", operator="CONTAIN", value="eval"}, {field="postdata", operator="CONTAIN", value="base64_decode"}, {field="postdata", operator="CONTAIN", value="->|"} } } }</code></pre></li> <li class="li"><strong class="ph b">htaccess</strong><p class="p">.htaccess是一个纯文本文件，它里面存放着Apache服务器配置相关的指令。此规则避免.htaccess文件的内容泄露。</p><p class="p"><strong class="ph b">使用场景</strong>：后端应用程序有用到apache做服务器软件时适用。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验 AND 输出校验。</p><pre class="pre codeblock" id="safty-rules__codeblock_o1b_btc_fsb"><code> { input = { operator = "OR", rules = { {field="url", operator="CONTAIN", value="/%.htaccess"} } }, output = { operator = "OR", rules = { {field="respdata", operator="MATCH", value_type="multi", value_operator="OR", values={".*RewriteEngine.*",".*RewriteCond.*",".*RewriteRule.*",".*AuthType.*",".*AuthName.*",".*AuthUserFile.*",".*ErrorDocument.*",".*deny from.*",".*AddType.*"}} } }, operator = "AND" }</code></pre></li> <li class="li"><strong class="ph b">php_code</strong><p class="p">后端应用程序出错或其他情况下将源码文件泄露给前端。此规则将屏蔽源码信息，只返回错误信息。</p><p class="p"><strong class="ph b">使用场景</strong>：后端开发语言为PHP时适用。</p><pre class="pre codeblock" id="safty-rules__codeblock_ism_dtc_fsb"><code>{ output = { operator = "OR", rules = { {field="respdata", operator="MATCH", value="\\u003c%?php"} } } }</code></pre></li> <li class="li"><strong class="ph b">backup_file</strong><p class="p">部分应用程序存在将备份文件及相关源码文件存在在部署目录，这样就会存在文件泄露问题。此规则屏蔽相关文件的读取请求。如果系统有需要下载相关文件，建议不要访问以此后缀结尾的下载链接。</p><p class="p"><strong class="ph b">使用场景</strong>：备份文件及项目源码有存放在部署目录下时适用。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验 AND 输出校验。</p><pre class="pre codeblock" id="safty-rules__codeblock_cdy_gtc_fsb"><code> { input = { operator = "OR", rules = { {field="url", operator="MATCH", value_type="multi", value_operator="OR", values={".*%.bak",".*%.inc",".*%.old",".*%.mdb",".*%.sql",".*%.backup",".*%.java",".*%.class",".*%.swp",".*%.gz",".*%.tar",".*%.zip",".*%.7z"}} } }, output = { operator = "OR", rules = { {field="status", operator="NOT", value="404"} } }, operator = "AND" }</code></pre></li> <li class="li"><strong class="ph b">php_inject</strong><p class="p">php系统在部署完成后没有及时删除这些提供环境测试的文件。比较常见的为phpinfo.php、1.php和test.php，虽然通过phpinfo获取的php环境以及变量等信息，但这些信息的泄露配合一些其它漏洞将有可能导致系统被渗透和提权。建议在部署完成后删除相关环境测试文件。</p><p class="p"><strong class="ph b">使用场景</strong>：后端是PHP语言开发，并且没有删除提供环境测试的文件。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验（OR） AND 输出校验。</p><pre class="pre codeblock" id="safty-rules__codeblock_k1g_ktc_fsb"><code> { input = { operator = "OR", rules = { {field="query", operator="CONTAIN", value="phpinfo"}, {field="postdata", operator="CONTAIN", value="phpinfo"}, {field="header", operator="CONTAIN", value="phpinfo"}, {field="cookie", operator="CONTAIN", value="phpinfo"}, {field="user_agent", operator="CONTAIN", value="phpinfo"}, {field="refer", operator="CONTAIN", value="phpinfo"} } }, output = { operator = "OR", rules = { {field="respdata", operator="CONTAIN", value="\\u003ctitle\\u003ephpinfo%(%)\\u003c/title\\u003e"} } }, operator = "AND" }</code></pre></li> <li class="li"><strong class="ph b">windows</strong><p class="p">同linux任意文件读取规则，此规则适用于后端服务器为windows server</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验（OR） AND 输出校验。</p><pre class="pre codeblock" id="safty-rules__codeblock_m55_mtc_fsb"><code> { input = { operator = "OR", rules = { {field="all", operator="CONTAIN", value=".*boot%.ini.*"}, {field="all", operator="CONTAIN", value=".*win%.ini.*"} } }, output = { operator = "OR", rules = { {field="respdata", operator="CONTAIN", value="for 16%-bit app support"} } }, operator = "AND" }</code></pre></li> <li class="li"><strong class="ph b">weblogic</strong><p class="p">Weblogic的WLS Security组件对外提供webservice服务，其中使用了XMLDecoder来解析用户传入的XML数据，在解析的过程中出现反序列化漏洞，导致可执行任意命令，攻击者发送精心构造的xml数据甚至能通过反弹shell拿到权限。</p><p class="p"><strong class="ph b">使用场景</strong>：适用于运行在weblogic中的后端程序。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验（AND） OR 输入校验（AND）。</p><pre class="pre codeblock" id="safty-rules__codeblock_c4p_ptc_fsb"><code> { inputs = { rules = { { operator = "AND", rules = { {field="method", operator="EQUAL", value="post"}, {field="url", operator="CONTAIN", value="/wls%-wsat/CoordinatorPortType"} } }, { operator = "AND", rules = { {field="method", operator="EQUAL", value="post"}, {field="url", operator="CONTAIN", value="/wls%-wsat/ParticipantPortType"} } } }, operator = "OR" } }</code></pre></li> <li class="li"><strong class="ph b">catalog</strong><p class="p">WEB中间件或后端程序如果开启了目录浏览功能，当用户访问Web应用时，Web服务器会将Web应用的目录结构、文件信息返回给客户端，攻击者可能利用这些敏感信息对Web应用进行攻击。</p><p class="p"><strong class="ph b">使用场景</strong>：适用于WEB中间件开启了目录浏览或后端程序开启了目录浏览功能。</p><strong class="ph b">输出校验</strong>：<pre class="pre codeblock" id="safty-rules__codeblock_qx2_stc_fsb"><code> { output = { operator = "OR", rules = { {field="respdata", operator="MATCH", value="\\u003ctitle\\u003e.*index of.*\\u003ctitle\\u003e"} } } }</code></pre></li> <li class="li"><strong class="ph b">command_inject</strong><p class="p">在Web应用中，有时候会用到一些命令执行的函数，如php中system、exec、shell_exec等，当对用户输入的命令没有进行限制或者过滤不严导致用户可以执行任意命令时，就会造成命令执行漏洞。</p><p class="p"><strong class="ph b">使用场景</strong>：适用于后端应用程序中存在命令执行函数的系统。</p><p class="p"><strong class="ph b">校验规则</strong>：输入校验（OR）。</p><div class="p"><strong class="ph b">输入校验</strong>：<pre class="pre codeblock" id="safty-rules__codeblock_ixh_wtc_fsb"><code> { input = { operator = "OR", rules = { {field="all", operator="MATCH", value_type="multi", value_operator="OR", values={".*ping[ %%].*",".*nslookup[ %%].*",".*wget[ %%].*",".*curl[ %%].*",".*echo[ %%].*"}}, {field="query", operator="CONTAIN", value_type="multi", value_operator="AND", values={"cat", "/passwd"}}, {field="postdata", operator="CONTAIN", value_type="multi", value_operator="AND", values={"cat", "/passwd"}} } } }</code></pre></div></li> </ul></li> </ol> </section>