From a64140a870131446d55efb1bfea5f631ac687ba3 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Roland=20H=C3=A4der?= Date: Mon, 1 Apr 2019 18:19:28 +0200 Subject: [PATCH] Continued: - moved Windows-related strings to own "category" - added system.net.webclient and powershell, both not wanted in URLs - ... and POST data as well MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Signed-off-by: Roland Häder --- libs/lib_detector.php | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libs/lib_detector.php b/libs/lib_detector.php index 49d171e..265e241 100644 --- a/libs/lib_detector.php +++ b/libs/lib_detector.php @@ -91,8 +91,10 @@ function initCrackerTrackerArrays () { // Compiler/interpreter 'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh', - 'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe', - 'nc.exe', 'ftp.exe', + 'bin/tclsh', 'bin/nasm', '/perl', + + // Windows-related + 'cmd.exe', 'nc.exe', 'ftp.exe', 'powershell', 'system.net.webclient', // php.ini settings 'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode', @@ -162,8 +164,10 @@ function initCrackerTrackerArrays () { $GLOBALS['ctracker_ua_blacklist'] = [ // Compiler/interpreter 'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh', - 'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe', - 'nc.exe', 'ftp.exe', 'wget ', 'system(', 'curl ', + 'bin/tclsh', 'bin/nasm', '/perl', 'wget ', 'system(', 'curl ', + + // Windows-related + 'cmd.exe', 'nc.exe', 'ftp.exe', 'powershell', 'system.net.webclient', // php.ini settings 'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode', -- 2.39.5