误报提交入口

更新nginx防火墙9.3.8后minio上传文件仍然误报参数超过8000拦截






以上是参数超过8000拦截，如果文件比较小不会超过8000的，偶尔会报sql注入：

GET /?s=TURN+INTO+LOVE&type=post HTTP/1.1
accept-language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7
cookie:
accept-encoding: gzip, deflate, br, zstd
sec-ch-ua-platform: "Android"
sec-fetch-site: same-origin
sec-fetch-dest: document
referer: https://www.xxx.xxx/page/2?s=+Let+Me+Love+U+&type=post
host: www.xxx.xxx
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-user: ?1
sec-fetch-mode: navigate
sec-ch-ua-mobile: ?1
upgrade-insecure-requests: 1
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
user-agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Mobile Safari/537.36


TURN INTO LOVE 这也能拦截？

可道云上传pdf文件误报。
可道云上传excel pdf等办公文件经常会误报。。。

GET /?s=stay+or+leave&type=post HTTP/1.1
accept-language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
host: www.xxx.xxx
sec-fetch-site: same-origin
sec-fetch-dest: document
sec-fetch-mode: navigate
upgrade-insecure-requests: 1
referer: https://xxx.xxx/
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0

rewalax 发表于 2024-4-2 09:02
更新nginx防火墙9.3.8后minio上传文件仍然误报参数超过8000拦截

这个更新到9.3.9 即可。如果还有问题。请联系我QQ

rewalax 发表于 2024-3-13 17:17
防火墙更新后，minio（使用亚马逊的PHP接口）上传webp格式的图片会报sql注入，其他格式的图片正常

...

更新就可以了

muyu007 发表于 2024-3-28 06:37
误报了

这个看起来是真实拦截的

kop5 发表于 2024-4-8 22:01
GET /?s=stay+or+leave&type=post HTTP/1.1
accept-language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3
acce ...

已经修复。更新或者修复到8.3.9   需要2024-4-10  9：20 之后。修复或者更新才生效。

防火墙的这个能优化一下吗
每次更改成【增强模式】后，然后再改回【标准模式】，【地区人机验证】里选定的地区全部都会清空，能保留一下这个设置吗，不要每次换回【标准模式】就直接清空【地区人机验证】

POST /admin.php/article/add.html HTTP/1.1
accept-language: zh-TW,zh;q=0.9
content-type: application/x-www-form-urlencoded
connection: keep-alive
content-length: 9722
cache-control: max-age=0
host: xxx.com
cookie: xxxxxxxxxx
accept-encoding: gzip, deflate
origin: http://xxx.com
referer: http://xxx.com/admin.php/article/add.html
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

文章不能修改：POST /index.php?m=content&c=content&a=edit HTTP/1.1
sec-ch-ua-platform:"Windows"
eagleeye-traceid:7827c3a917128896223258235e
host:www.xxx.com
cookie:Hm_lvt_3b6d904a3b1f60dba9266ee796678582=1704282652; Hm_lvt_77ff918529cb55da3697a20cd6b3deda=1704282652; PHPSESSID=30mmna07f56s20dr82jnq65gd1; bEIUg_admin_username=303cNdocnmUKfUX_qmGpg0AtWdn5dwkapB2Bnu84uu_Lrg; bEIUg_siteid=7eda3g_9jMesgO6SI6ohEsLYAk9bz_0RdzkkBxvc; bEIUg_userid=242acm5A8QjxidNXFRdMm-f_ya-Ze3PYa8IRMDpnTA; bEIUg_admin_email=d7fdT8Dz1qIaifgC9rmiqoNbuHOv3dC3vJ9mGisiy-Z9u6wxkqLKUviL; bEIUg_sys_lang=bc6dRnXG-lAjs_oCUfL3BKDR-pzIfxOnw1xiLnIKlwjGxA; bEIUg_module=3bdcOlJMlKtkw-Or1CMqjRrNFL4bjHD2T7DgI_uix5Dqq9_j; bEIUg_catid=0879LiEA7JstwkQm_jrWj8G7Z7z1DI2-VqymFs52UA; sYQDUGqqzHrefersh_time=1
sec-fetch-user:?1
accept-language:zh-CN,zh;q=0.9
accept-encoding:gzip, deflate, br
referer:https://www.xxx.com/index.php?m=content&c=content&a=edit&catid=15&id=43166&pc_hash=245l7w
upgrade-insecure-requests:1
sec-fetch-dest:document
sec-fetch-mode:navigate
x-forwarded-for:120.41.124.223
content-type:multipart/form-data; boundary=----WebKitFormBoundaryRAYYs2Y8R0w7W6iU
ali-swift-stat-host:level2.www.xxx.com
content-length:10970
sec-fetch-site:same-origin
accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
cache-control:max-age=0
ali-swift-log-host:www.xxx.com
origin:https://www.xxx.com
x-client-scheme:https
via:cn2974.l1, cache21.cn2974, l2cn1803.l2, cache44.l2cn1803
sec-ch-ua-mobile:?0
ali-cdn-real-ip:120.41.124.223
sec-ch-ua:";Not A Brand";v="99", "Chromium";v="94"
user-agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 Core/1.94.225.400 QQBrowser/12.2.5544.400

我这URL关键词拦截里面就没有这个词啊，怎么还拦截了？

GET /null HTTP/1.1
accept-language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
connection: keep-alive
accept: image/avif,image/webp,*/*
accept-encoding: gzip, deflate
host: 1.460.icu
cache-control: no-cache
pragma: no-cache
cookie: PHPSESSID=um1gc0qide10gpif7i2u6cvf26; mysid=2790b5232fc54352a3f46735c3f10651; op=false
referer: http://1.460.icu/?cid=1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0

这个看一下

rewalax 发表于 2024-4-2 09:02
更新nginx防火墙9.3.8后minio上传文件仍然误报参数超过8000拦截

更新即可