10000 fix: detect IXMZUXBG by theseion · Pull Request #3130 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

fix: detect IXMZUXBG #3130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 19, 2023
Merged

fix: detect IXMZUXBG #3130

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
8000
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions regex-assembly/932240.ra
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@
##! Conceptually, we want to match:
##! - at least one character
##! - at least one character from an evasion technique
##! - we should apply this to words with 4 or more characters

10000 ##!+ i

Expand All @@ -31,5 +30,4 @@

\s*[a-z0-9_-]+
##!=>

##!<
6 changes: 3 additions & 3 deletions regex-assembly/include/unix-shell-4andup-with-params.ra
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,8 +243,8 @@ mysqlshow
nano{{space-or-redirect}}
nasm
nawk
nc.openbsd
nc.traditional
nc\.openbsd
nc\.traditional
ncat
neofetch
netcat
Expand Down Expand Up @@ -332,7 +332,7 @@ setenv
setfacl{{space-or-redirect}}
setsid
sftp
sh.distrib
sh\.distrib
##! match $SHELL and ${SHELL}
shell
shuf
Expand Down
2 changes: 1 addition & 1 deletion regex-assembly/include/unix-shell-upto3-with-params.ra
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@

##! These patterns are approximations of the patterns used by the cmdline
##! processor for `@` and `~`.
##!> define space-or-redirect [\s<>]
##!> define space-or-redirect [\s<>&|]
##!> define no-space [^\s]

7z
Expand Down
7 changes: 4 additions & 3 deletions
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,16 +7,17 @@ patterns:
# - [\x5c'\"\[)]: common evasion tokens and path expansion, e.g., `/bin/[c]''a""\t`
# - (?:\|\||&&)\s*: hiding of empty variables through logial operators, e.g., `nc&&$u -p 777`
# - \$[a-z0-9_@?!#{(*-]*: empty variable evasion, e.g., `n\$uc -p 777`
# - [\x5c'\"\[)], \$[a-z0-9_@?!#{(*-]*: arithmetic expansion evaision, e.g., `c$((9))9`
# - [\x5c'\"\[)], \$[a-z0-9_@?!#{(*-]*: arithmetic expansion evasion, e.g., `c$((9))9`
unix: |
[\x5c'\"\[)]*(?:(?:(?:\|\||&&)\s*)?\$[a-z0-9_@?!#{(*-]*)?\x5c?
windows: |
[\"\^]*
anti_evasion_suffix:
# - <>: redirection, e.g., `cat<foo`
# - ,: brace expansion, e.g., `""{nc,-p,777}`
## - &|: logical operators in headers, e.g., `a=nc&&$a -nlvp 555`
unix: |
[\s<>,].*
[\s<>,&|].*
# "more foo", "more,foo", "more;foo", "more.com", "more/e",
# "more<foo", "more>foo"
windows: |
Expand All @@ -33,7 +34,7 @@ patterns:
# It will _not_ match:
# python foo
unix: |
(?:[<>,]|(?:[\w\d._-][\x5c'\"\[]*(?:(?:(?:\|\||&&)\s*)?\$[a-z0-9_@?!#{*-]*)?\x5c?)+[\s<>,]).*
(?:[<>,&|]|(?:[\w\d._-][\x5c'\"\[]*(?:(?:(?:\|\||&&)\s*)?\$[a-z0-9_@?!#{*-]*)?\x5c?)+[\s<>,&|]).*
# This will match:
#
# python,foo
Expand Down
Loading
0