# CrawlProtect-2-0-0 #---------------------------------------------------------------------- # Protect you website from hackers #---------------------------------------------------------------------- # Author: Jean-Denis Brun #---------------------------------------------------------------------- # Website: www.crawlprotect.com #---------------------------------------------------------------------- # That script is distributed under GNU GPL license #---------------------------------------------------------------------- # file: .htaccess #---------------------------------------------------------------------- # Last update: 20/06/2010 #---------------------------------------------------------------------- RewriteEngine On #------------------------------- #Code injection blocage #---------------------------------------- RewriteCond %{REQUEST_METHOD} (GET) [NC] #-------------------------------------------------------------------------------- #the following rules can block some off your url, in case of problem try to suppress them one per one until you solve it RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)(h|%68|%48)(t|%74|%54)(t|%74|%54)(p|%70|%50)(s|%73|%53)(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)(h|%68|%48)(t|%74|%54)(t|%74|%54)(p|%70|%50)(s|%73|%53)%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)(h|%68|%48)(t|%74|%54)(t|%74|%54)(p|%70|%50)(%3A|:)(/|%2F){2}(.*)$ [NC] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)(h|%68|%48)(t|%74|%54)(t|%74|%54)(p|%70|%50)%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)(f|%66|%46)(t|%74|%54)(p|%70|%50)(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)(h|%68|%48)(t|%74|%54)%20(t|%74|%54)(p|%70|%50)(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)(h|%68|%48)(t|%74|%54)(t|%74|%54)%20(p|%70|%50)(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)(h|%68|%48)(t|%74|%54)(t|%74|%54)(p|%70|%50)%20(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)(h|%68|%48)%20(t|%74|%54)(t|%74|%54)(p|%70|%50)(%3A|:)(/|%2F){2}(.*)$ [NC,OR] #end of potential issue rules RewriteRule (.*) /homez.378/laiterie/www/crawlprotect/noaccess/noaccess1.php [L] #------------------------------- #Sql injection blocage #---------------------------------------- RewriteCond %{REQUEST_METHOD} (GET|POST) [NC] RewriteCond %{QUERY_STRING} ^(.*)(%20(S|%73|%53)(E|%65|%45)(L|%6C|%4C)(E|%65|%45)(C|%63|%43)(T|%74|%54)%20|%20(I|%69|%49)(N|%6E|%4E)(S|%73|%53)(E|%65|%45)(R|%72|%52)(T|%74|%54)%20|(C|%63|%43)(H|%68|%48)(A|%61|%41)(R|%72|%52)\(|%20(U|%75|%55)(P|%70|%50)(D|%64|%44)(A|%61|%41)(T|%74|%54)(E|%65|%45)%20|%20(R|%72|%52)(E|%65|%45)(P|%70|%50)(L|%6C|%4C)(A|%61|%41)(C|%63|%43)(E|%65|%45)%20)(.*)$ [NC] RewriteRule (.*) /homez.378/laiterie/www/crawlprotect/noaccess/noaccess1.php [L] #------------------------------- #Code injection blocage #---------------------------------------- RewriteCond %{REQUEST_METHOD} (GET|POST) [NC] RewriteCond %{QUERY_STRING} ^(.*)(%3C|<)/?(s|%73|%53)(c|%63|%43)(r|%72|%52)(i|%69|%49)(p|%70|%50)(t|%74|%54)(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)?(j|%6A|%4A)(a|%61|%41)(v|%76|%56)(a|%61|%31)(s|%73|%53)(c|%63|%43)(r|%72|%52)(i|%69|%49)(p|%70|%50)(t|%74|%54)(%3A|:)(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(d|%64|%44)(o|%6F|%4F)(c|%63|%43)(u|%75|%55)(m|%6D|%4D)(e|%65|%45)(n|%6E|%4E)(t|%74|%54)\.(l|%6C|%4C)(o|%6F|%4F)(c|%63|%43)(a|%61|%41)(t|%74|%54)(i|%69|%49)(o|%6F|%4F)(n|%6E|%4E)\.(h|%68|%48)(r|%72|%52)(e|%65|%45)(f|%66|%46)(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)(b|%62|%42)(a|%61|%41)(s|%73|%53)(e|%65|%45)(6|%36)(4|%34)(_|%5F)(e|%65|%45)(n|%6E|%4E)(c|%63|%43)(o|%6F|%4F)(d|%64|%44)(e|%65|%45)(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)(G|%67|%47)(L|%6C|%4C)(O|%6F|%4F)(B|%62|%42)(A|%61|%41)(L|%6C|%4C)(S|%73|%53)(=|[|%[0-9A-Z]{0,2})(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)(_|%5F)(R|%72|%52)(E|%65|%45)(Q|%71|%51)(U|%75|%55)(E|%65|%45)(S|%73|%53)(T|%74|%54)(=|[|%[0-9A-Z]{0,2})(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)(_|%5F)(v|%76|%56)(t|%74|%54)(i|%69|%49)(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)(M|%4D)(S|%53)(O|%4F)(f|%66)(f|%66)(i|%69)(c|%63)(e|%65)(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)(/|%2F)(e|%65)(t|%74)(c|%63)(/|%2F)(p|%70)(a|%61)(s|%73)(s|%73)(w|%77)(d|%64)(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)(S|%53)(h|%68)(e|%65)(l|%6C)(l|%6C)(A|%41)(d|%64)(r|%72)(e|%65)(s|%73)(i|%69).(T|%54)(X|%58)(T|%54)(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)\[(e|%65)(v|%76)(i|%69)(l|%6C)(_|%5F)(r|%72)(o|%6F)(o|%6F)(t|%74)\]?(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)\.\./\.\./\.\./(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)(/|%2F)(p|%70)(r|%72)(o|%6F)(c|%63)(/|%2F)(s|%73)(e|%65)(l|%C)(f|%66)(/|%2F)(e|%65)(n|%6E)(v|%76)(i|%69)(r|%72)(o|%6F)(n|%6E)(.*)$ RewriteRule (.*) /homez.378/laiterie/www/crawlprotect/noaccess/noaccess1.php [L] #------------------------------- #Bad bot and site copier blocage #------------------------------- RewriteCond %{HTTP_USER_AGENT} @nonymouse|ADSARobot|amzn_assoc|Anarchie|ASPSeek|Atomz|^[^?]*addresses\.com|Advanced\ Email\ Extractor|ah-ha|aktuelles|almaden|Art-Online|AspiWeb|ASSORT|ATHENS|attach|attache|autoemailspider|BackWeb|Bandit|BatchFTP|bdfetch|big.brother|BlackWidow|bmclient|Boston\ Project|Bot\ mailto:craftbot@yahoo.com|BravoBrian\ SpiderEngine\ MarcoPolo|Buddy|Bullseye|bumblebee|capture|CherryPicker|ChinaClaw|CICC|clipping|Crescent\ Internet\ ToolPack|cURL|Custo|cyberalert|Deweb|diagem|Digger|Digimarc|DIIbot|DirectUpdate|DISCo|Download\ Accelerator|Download\ Demon|Download\ Wonder|Downloader|Drip|DSurf15a|DTS.Agent|EasyDL|eCatch|echo\ extense|ecollector|efp@gmx\.net|EirGrabber|EmailCollector|Email\ Extractor|EmailSiphon|EmailWolf|Express\ WebPictures|ExtractorPro|EyeNetIE|fastlwspider|FavOrg|Favorites\ Sweeper|Fetch\ API\ Request|FEZhead|FileHound|FlashGet|FlickBot|fluffy|frontpage|GalaxyBot|Generic|Getleft|GetSmart|GetWeb!|GetWebPage|gigabaz|Girafabot|Go!Zilla|Go-Ahead-Got-It|GornKer|Grabber|GrabNet|Grafula|Green\ Research|Harvest|hhjhj@yahoo|hloader|HMView|HomePageSearch|HTTP\ agent|HTTPConnect|httpdown|http\ generic|HTTrack|^[^?]*iaea\.org|IBM_Planetwide|^[^?]*\.ideography\.co\.uk|Image\ Stripper|Image\ Sucker|imagefetch|IncyWincy|Indy\ Library|informant|Ingelin|InterGET|Internet\ Ninja|InternetLinkAgent|InternetSeer\.com|Iria|Irvine|iOpus|IPiumBot\ laurion(dot)com|Jakarta|JBH*Agent|JetCar|JustView|Kapere|KWebGet|Lachesis|larbin|LeechFTP|LexiBot|lftp|libwww|likse|Link*Sleuth|LINKS\ ARoMATIZED|LinkWalker|LWP|lwp-trivial|Magnet|Mac\ Finder|Mag-Net|Mass\ Downloader|MemoWeb|MCspider|Microsoft\ URL\ Control|MIDown\ tool|minibot\(NaverRobot\)|Missigua\ Locator|Mister\ PiX|MMMtoCrawl\/UrlDispatcherLLL|MSProxy|multithreaddb|nationaldirectory|Navroad|NearSite|NetAnts|NetCarta|netfactual|netcraft|NetMechanic|netprospector|NetResearchServer|NetSpider|Net\ Vampire|NetZIP|NEWT|nicerspro|NPBot|Octopus|Offline\ Explorer|Offline\ Navigator|OpaL|Openfind|OpenTextSiteCrawler|OutWit|PackRat|PageGrabber|Papa\ Foto|pavuk|pcBrowser|PersonaPilot|PingALink|Pockey|Program\ Shareware|psbot|PSurf|puf|Pump|PushSite|QRVA|QuepasaCreep|RealDownload|Reaper|Recorder|ReGet|replacer|RepoMonkey|Robozilla|Rover|RPT-HTTPClient|Rsync|SearchExpress|searchhippo|searchterms\.it|Second\ Street\ Research|Shai|sitecheck|SiteMapper|SiteSnagger|SlySearch|SmartDownload|snagger|SpaceBison|Spegla|SpiderBot|SqWorm|Star\ Downloader|Stripper|Sucker|SuperBot|SuperHTTP|Surfbot|SurfWalker|Szukacz|tAkeOut|tarspider|Teleport\ Pro|Telesoft|Templeton|traffixer|TrueRobot|TuringOS|TurnitinBot|TV33_Mercator|UIowaCrawler|URL_Spider_Pro|UtilMind|Vacuum|vagabondo|vayala|visibilitygap|vobsub|VoidEYE|vspider|w3mir|web\.by\.mail|Web\ Data\ Extractor|Web\ Downloader|Web\ Image\ Collector|Web\ Sucker|WebAuto|webbandit|Webclipping|webcollector|webcollage|WebCopier|webcraft@bea|WebDAV|webdevil|webdownloader|Webdup|WebEmailExtractor|WebFetch|WebGo\ IS|WebHook|Webinator|WebLeacher|WebMiner|WebMirror|webmole|WebReaper|WebSauger|WEBsaver|Website\ eXtractor|Website\ Quester|WebSnake|Webster|WebStripper|websucker|webvac|webwalk|webweasel|WebWhacker|WebZIP|Wget|whizbang|WhosTalking|Widow|WISEbot|WUMPUS|Wweb|WWWOFFLE|Wysigot|Xaldon\ WebSpider|XGET|x-Tractor|Zeus.* [OR] RewriteCond %{HTTP_REFERER} ^XXX RewriteRule (.*) /homez.378/laiterie/www/crawlprotect/noaccess/noaccess2.php [L] #------------------------------- # Filter against PHPSHELL.PHP, REMOTEVIEW, c99Shell and others #------------------------------- RewriteCond %{REQUEST_URI} .*((php|my)?shell|remview.*|phpremoteview.*|sshphp.*|pcom|nstview.*|c99|r57|webadmin.*|phpget.*|phpwriter.*|fileditor.*|locus7.*|storm7.*)\.(p?s?x?htm?l?|txt|aspx?|cfml?|cgi|pl|php[3-9]{0,1}|jsp?|sql|xml) [NC,OR] RewriteCond %{REQUEST_METHOD} (GET|POST) [NC] RewriteCond %{QUERY_STRING} ^(.*)=(/|%2F)(h|%68|%48)(o|%6F|%4F)(m|%6D|%4D)(e|%65|%45)(.+)?(/|%2F)(.*)(/|%2F)(.*)$ [OR] RewriteCond %{QUERY_STRING} ^work_dir=.*$ [OR] RewriteCond %{QUERY_STRING} ^command=.*&output.*$ [OR] RewriteCond %{QUERY_STRING} ^nts_[a-z0-9_]{0,10}=.*$ [OR] RewriteCond %{QUERY_STRING} ^c=(t|setup|codes)$ [OR] RewriteCond %{QUERY_STRING} ^act=((about|cmd|selfremove|chbd|trojan|backc|massbrowsersploit|exploits|grablogins|upload.*)|((chmod|f)&f=.*))$ [OR] RewriteCond %{QUERY_STRING} ^act=(ls|search|fsbuff|encoder|tools|processes|ftpquickbrute|security|sql|eval|update|feedback|cmd|gofile|mkfile)&d=.*$ [OR] RewriteCond %{QUERY_STRING} ^&?c=(l?v?i?&d=|v&fnot=|setup&ref=|l&r=|d&d=|tree&d|t&d=|e&d=|i&d=|codes|md5crack).*$ [OR] RewriteCond %{QUERY_STRING} ^(.*)([-_a-z]{1,15})=(chmod|chdir|mkdir|rmdir|clear|whoami|uname|unzip|gzip|gunzip|grep|more|umask|telnet|ssh|ftp|head|tail|which|mkmode|touch|logname|edit_file|search_text|find_text|php_eval|download_file|ftp_file_down|ftp_file_up|ftp_brute|mail_file|mysql|mysql_dump|db_query)([^a-zA-Z0-9].+)*$ [OR] RewriteCond %{QUERY_STRING} ^(.*)(wget|shell_exec|passthru|system|exec|popen|proc_open)(.*)$ SetEnv PHP_VER 5 ############################################################## # Fichier .htaccess SPIP v 2.0 # # # # Permet de controler les URLs et la version de php utilisee # # Compatible avec les URLs 'html', 'propres' et 'propres2' # # Permet aussi d'effectuer la transition de .PHP 3 vers .PHP # # # # Pour utiliser ce fichier renommez-le '.htaccess' dans le # # repertoire racine du site, en veillant a ne pas ecraser un # # .htaccess personnalise qui s'y trouverait deja # # # # Attention certains hebergeurs desactivent tout ou partie # # des fonctions du fichier .htaccess ; celui-ci est donc # # indicatif - en cas de difficulte voir sur les forums SPIP # ############################################################## RewriteEngine On ################ CONFIGURATION ###################### #redirect mobile browsers # RewriteCond %{HTTP_USER_AGENT} ^.*iPhone.*$ # RewriteRule ^(.*)$ http://www.culturemediatic.fr/?page=ispip [R=301] ## don't apply the rules if you're already in the mobile directory, infintine loop ## you'll want to test against the host if you're using a subdomain # RewriteCond %{REQUEST_URI} !^http://www.culturemediatic.fr/?page=ispip.*$ ## if the browser accepts these mime-types, it's definitely mobile, or pretending to be # RewriteCond %{HTTP_ACCEPT} "text\/vnd\.wap\.wml|application\/vnd\.wap\.xhtml\+xml" [NC,OR] ## a bunch of user agent tests # RewriteCond %{HTTP_USER_AGENT} "sony|symbian|nokia|samsung|mobile|windows ce|epoc|opera" [NC,OR] # RewriteCond %{HTTP_USER_AGENT} "mini|nitro|j2me|midp-|cldc-|netfront|mot|up\.browser|up\.link|audiovox"[NC,OR] # RewriteCond %{HTTP_USER_AGENT} "blackberry|ericsson,|panasonic|philips|sanyo|sharp|sie-"[NC,OR] # RewriteCond %{HTTP_USER_AGENT} "portalmmm|blazer|avantgo|danger|palm|series60|palmsource|pocketpc"[NC,OR] # RewriteCond %{HTTP_USER_AGENT} "smartphone|rover|ipaq|au-mic,|alcatel|ericy|vodafone\/|wap1\.|wap2\.|iPhone|android"[NC] # RewriteCond %{REQUEST_URI} ^/$ # RewriteRule ^$ http://www.culturemediatic.fr/?page=ispip [L,R=302] ### Configuration sous-repertoire # Chez la plupart des hebergeurs il faut indiquer "RewriteBase /" # sinon modifiez cette ligne RewriteBase / # SPIP version 'php' - si vous avez d'anciennes adresses en '.php[3]', # supprimez le '#' sur les lignes qui suivent pour rediriger les acces # errones vers le .php correspondant #RewriteCond %{REQUEST_FILENAME} -f #RewriteRule ^(.+)\.php[3]$ $1.php [QSA,L] # Fin version ### ################ REGLAGES PERSONNALISES ###################### # Inscrivez ci-dessous vos reglages supplementaires ################ GESTIONS DES URLS SPIP ####################### # Deux pseudo-actions a present evacuees # N'y at-il pas moyen de REMPLACER un nom dans la QueryString ? RewriteCond %{QUERY_STRING} action=rss RewriteRule spip.php spip.php?page=rss [QSA,L] RewriteCond %{QUERY_STRING} action=ical RewriteRule spip.php spip.php?page=ical_prive [QSA,L] ### # Si le fichier ou repertoire demande existe # ignorer toutes les regles qui suivent RewriteCond %{REQUEST_FILENAME} -f RewriteRule "." - [skip=100] RewriteCond %{REQUEST_FILENAME} -d RewriteRule "." - [skip=100] # ### ### # Compatibilite avec les URLS "html" (pour transition sympa) # voir fichier ecrire/urls/html.php RewriteRule ^rubrique([0-9]+)(\.html)?$ spip.php?page=rubrique&id_rubrique=$1 [QSA,L] RewriteRule ^article([0-9]+)(\.html)?$ spip.php?page=article&id_article=$1 [QSA,L] RewriteRule ^breve([0-9]+)(\.html)?$ spip.php?page=breve&id_breve=$1 [QSA,L] RewriteRule ^mot([0-9]+)(\.html)?$ spip.php?page=mot&id_mot=$1 [QSA,L] RewriteRule ^auteur([0-9]+)(\.html)?$ spip.php?page=auteur&id_auteur=$1 [QSA,L] RewriteRule ^site([0-9]+)(\.html)?$ spip.php?page=site&id_syndic=$1 [QSA,L] # Compatibilite avec les anciennes URLS appelant directement des fichiers php RewriteRule ^(rubrique|article|breve|mot|auteur|site|agenda|backend|backend-breves|distrib|forum|ical|plan|recherche|sommaire|sommaire_texte)\.php3?$ spip.php?page=$1 [QSA,L] RewriteRule ^resume.php[3]? spip.php?page=sommaire [QSA,L] RewriteRule ^page.php[3]? spip.php [QSA,L] RewriteRule ^spip_cal\.php3?$ spip.php?page=ical_prive [QSA,L] RewriteRule ^spip_rss\.php3?$ spip.php?page=rss [QSA,L] # Fin compatibilite ### ### # URLs "propres", "propres2", "libres", "arbo" RewriteRule ^[^\.]+(\.html)?$ spip.php [QSA,E=url_propre:$0,L] # Fin URLs "propres" et "propres2" ### ### # Divers # bloquer les acces aux repertoires .svn/ (SPIP, plugins, squelettes...) RewriteRule ^(.*/)?\.svn/ - [F] ### # Fichiers "standards" (si absents de la racine) # RewriteRule ^robots[.]txt$ spip.php?page=robots.txt [QSA,L] RewriteRule ^sitemap[.]xml$ spip.php?page=sitemap.xml [QSA,L] ## # expirer les images (pour contourner gros bug MSIE sur le cache) # note : a decommenter si vous voulez tester # # ExpiresActive on # ExpiresByType image/gif A3600 # ExpiresByType image/jpeg A3600 # ExpiresByType image/png A3600 # ################################# # gestion des erreurs 404 # voir http://www.spip.net/fr_article3226.html # Pour que le serveur http renvoie les erreurs 404 vers SPIP, supprimer le '#' # ErrorDocument 404 /spip.php?page=404 # ###