joao.goncalves
/
NgixProxy_Pathfinder
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat: Expande URIs suspeitas com padrões modernos de Cloud, Docker e Frameworks

This commit is contained in:
João Pedro Toledo Goncalves 2026-02-04 20:08:09 -03:00
parent 8635b05de8
commit 4058de3486
1 changed files with 19 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
snippets/security_maps.conf
View File

@ -30,12 +30,25 @@ map $http_user_agent $is_bad_bot {
# Atua antes do ModSecurity para economizar processamento do WAF em ataques óbvios. # Atua antes do ModSecurity para economizar processamento do WAF em ataques óbvios.
map $request_uri $is_suspicious_uri { map $request_uri $is_suspicious_uri {
default 0; default 0;
# Arquivos de Configuração, Credenciais e Metadados
~*(\.env|\.git|\.config|config\.php|wp-config\.php|composer\.json|web\.config) 1; # Cloud & Infrastructure Metadata (SSRF/Recon)
# Pastas e Dependências Sensíveis ~*(169\.254\.169\.254|/latest/meta-data/|/v1/metadata/|/metadata-flavor) 1;
~*(/vendor/|/node_modules/|/backup/|/sql/|/dump/|/_ignition/|/\.vscode/) 1; ~*(docker-compose\.ya?ml|Dockerfile|kubernetes\.s?yaml) 1;
# Tentativas de Exploração de Aplicação Conhecidas
~*(/setup\.php|/install\.php|/xmlrpc\.php|/eval-stdin\.php) 1; # Arquivos de Configuração, Credenciais e Segredos (Deep leaking)
~*(\.env(\..+)?|\.git|\.aws|\.ssh|\.docker|\.config|config\.php|wp-config\.php) 1;
~*(composer\.(json|lock)|package(-lock)?\.json|yarn\.lock|pnpm-lock\.yaml) 1;
~*(web\.config|appsettings\.json|settings\.py|local_settings\.py) 1;
# Backups, Dumps e Arquivos Temporários
~*(\.(bak|old|orig|save|sql|db|sqlite|tar\.gz|zip|swp|rar|7z)$|/autobackup/) 1;
# Framework Debugging & Admin Endpoints (Fast-Fail)
~*(/_ignition/|/_profiler/|/_telescope/|/actuator/|/eureka/|/api-docs) 1;
~*(/phpmyadmin|/wp-admin/setup-config\.php|/rails/info/properties) 1;
# Webshells e Exploração Ativa Conhecida
~*(/shell\.php|/cmd\.php|/eval-stdin\.php|/xmlrpc\.php|/setup\.php|/install\.php) 1;
} }
# Combined Block Request # Combined Block Request