'cmd=' broke to many legtime requests, cmd.exe should kill Windozer attacks a little...

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index b4044d93d2d22b7e7b94f43ea52f5521b2c46a98..c8e44636adcbb5e60a53d190e15973737e6eb175 100644 (file)
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -43,7 +43,7 @@ function initCrackerTrackerArrays () {
        // Attacks we should detect and block
        $GLOBALS['ctracker_get_blacklist'] = array(
                'chr(', 'chr=', 'chr%20', '%20chr', 'wget%20', '%20wget', 'wget(',
-               'cmd=', '%20cmd', 'cmd%20', 'rush=', '%20rush', 'rush%20',
+               'cmd.exe', '%20cmd', 'cmd%20', 'rush=', '%20rush', 'rush%20',
                'union%20', '%20union', 'union(', 'union=', 'echr(', '%20echr', 'echr%20', 'echr=',
                'esystem(', 'esystem%20', 'cp%20', '%20cp', 'cp(', 'mdir%20', '%20mdir', 'mdir(',
                'mcd%20', 'mrd%20', 'rm%20', '%20mcd', '%20mrd', '%20rm',
@@ -56,7 +56,7 @@ function initCrackerTrackerArrays () {
                'new_password', '&icq','/etc/passwd','/etc/shadow', '/etc/groups', '/etc/gshadow',
                'HTTP_USER_AGENT', 'HTTP_HOST', 'wget%20', 'uname\x20-', 'uname%20-', 'bin/id', '/bin/', '/chgrp',
                '/chown', '/usr/bin', 'g\+\+', 'bin/python', 'bin/tclsh', 'bin/nasm', 'perl%20', 'traceroute%20',
-               'ping%20', 'bin/xterm', 'lsof%20', '.conf', 'motd%20', 'HTTP/1.', '.inc.php', '.lib.php',
+               'ping%20', 'bin/xterm', 'lsof%20', '.conf', 'motd%20', 'HTTP/1.', '.inc.php', '.lib.php', '.class.php',
                'config.php', 'file\://', 'window.open', '<SCRIPT>', 'javascript\://', 'img src', 'img%20src', '.jsp',
                'ftp.exe', 'xp_enumdsn', 'xp_availablemedia', 'xp_filelist', 'xp_cmdshell', 'nc.exe', '.htpasswd',
                'servlet', '/etc/passwd', 'wwwacl', '~root', '~ftp', '.js', '.jsp', '.history', 'bash_history',