Edge rules

This page lists the edge rules implemented in STACKIT Content Delivery Network (CDN) Web Application Firewall (WAF).

Rule collection - OWASP CRS request

Rule group: 911 - Method enforcement

Code	Rule
911100	Method is not allowed by policy

Rule group: 913 - Scanner detection

These rules focus on detecting security tools and scanners.

Code	Rule
913100	Found user-agent associated with security scanner

Rule group: 922 - Multipart attack

Code	Rule
922100	Multipart content type global _charset_ definition is not allowed by policy
922110	Illegal MIME multipart header content-type: charset parameter
922120	Content-Transfer-Encoding was deprecated by RFC 7578 in 2015 and should not be used

Rule group: 921 - Protocol attack

The rules in this table target specific attacks on the HTTP protocol, such as HTTP request smuggling and response splitting.

Code	Rule
921110	HTTP Request Smuggling Attack
921120	HTTP Response Splitting Attack
921130	HTTP Response Splitting Attack
921140	HTTP Header Injection Attack via headers
921150	HTTP Header Injection Attack via payload (CR/LF detected)
921160	HTTP Header Injection Attack via payload (CR/LF and header-name detected)
921190	HTTP Splitting (CR/LF in request filename detected)
921200	LDAP Injection Attack
921421	Content-Type header: Dangerous content type outside the mime type declaration
921240	mod_proxy attack attempt detected
921151	HTTP Header Injection Attack via payload (CR/LF detected)
921422	Content-Type header: Dangerous content type outside the mime type declaration
921230	HTTP Range Header detected
921180	HTTP Parameter Pollution ( %{TX.1} )
921210	HTTP Parameter Pollution after detecting bogus char after parameter array
921220	HTTP Parameter Pollution possible via array notation

Rule group: 930 - Application attack LFI

These rules detect attempts to include files that are local to the web server and should not be accessible to users. Exploiting this type of attack can compromise the web application or server.

Code	Rule
930100	Path Traversal Attack (/../) or (/…/)
930110	Path Traversal Attack (/../) or (/…/)
930120	OS File Access Attempt
930130	Restricted File Access Attempt
930121	OS File Access Attempt in REQUEST_HEADERS

Rule group: 931 - Application attack RFI

These rules detect attempts to include remote resources in the web application that may be executed. Exploiting this type of attack can compromise the web application or server.

Code	Rule
931100	Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address
931110	Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload
931120	Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character
931130	Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link
931131	Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link

Rule group: 932 - Application attack RCE

Code	Rule
932230	Remote Command Execution: Unix Command Injection (2-3 chars)
932235	Remote Command Execution: Unix Command Injection (command without evasion)
932120	Remote Command Execution: Windows PowerShell Command Found
932125	Remote Command Execution: Windows Powershell Alias Command Injection
932130	Remote Command Execution: Unix Shell Expression Found
932140	Remote Command Execution: Windows FOR/IF Command Found
932250	Remote Command Execution: Direct Unix Command Execution
932260	Remote Command Execution: Direct Unix Command Execution
932330	Remote Command Execution: Unix shell history invocation
932160	Remote Command Execution: Unix Shell Code Found
932170	Remote Command Execution: Shellshock (CVE-2014-6271)
932171	Remote Command Execution: Shellshock (CVE-2014-6271)
932175	Remote Command Execution: Unix shell alias invocation
932180	Restricted File Upload Attempt
932370	Remote Command Execution: Windows Command Injection
932380	Remote Command Execution: Windows Command Injection
932231	Remote Command Execution: Unix Command Injection
932131	Remote Command Execution: Unix Shell Expression Found
932200	RCE Bypass Technique
932205	RCE Bypass Technique
932206	RCE Bypass Technique
932220	Remote Command Execution: Unix Command Injection with pipe
932240	Remote Command Execution: Unix Command Injection evasion attempt detected
932210	Remote Command Execution: SQLite System Command Execution
932300	Remote Command Execution: SMTP Command Execution
932310	Remote Command Execution: IMAP Command Execution
932320	Remote Command Execution: POP3 Command Execution
932236	Remote Command Execution: Unix Command Injection (command without evasion)
932239	Remote Command Execution: Unix Command Injection found in user-agent or referer header
932161	Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS
932232	Remote Command Execution: Unix Command Injection
932237	Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS
932238	Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS
932190	Remote Command Execution: Wildcard bypass technique attempt
932301	Remote Command Execution: SMTP Command Execution
932311	Remote Command Execution: IMAP Command Execution
932321	Remote Command Execution: POP3 Command Execution
932331	Remote Command Execution: Unix shell history invocation

Rule group: 933 - Application attack PHP

Code	Rule
933100	PHP Injection Attack: PHP Open Tag Found
933110	PHP Injection Attack: PHP Script File Upload Found
933120	PHP Injection Attack: Configuration Directive Found
933130	PHP Injection Attack: Variables Found
933140	PHP Injection Attack: I/O Stream Found
933200	PHP Injection Attack: Wrapper scheme detected
933150	PHP Injection Attack: High-Risk PHP Function Name Found
933160	PHP Injection Attack: High-Risk PHP Function Call Found
933170	PHP Injection Attack: Serialized Object Injection
933180	PHP Injection Attack: Variable Function Call Found
933210	PHP Injection Attack: Variable Function Call Found
933151	PHP Injection Attack: Medium-Risk PHP Function Name Found
933131	PHP Injection Attack: Variables Found
933161	PHP Injection Attack: Low-Value PHP Function Call Found
933111	PHP Injection Attack: PHP Script File Upload Found
933190	PHP Injection Attack: PHP Closing Tag Found
933211	PHP Injection Attack: Variable Function Call Found

Rule group: 934 - Application attack GENERIC

Code	Rule
934100	Node.js Injection Attack 1/2
934110	Possible Server Side Request Forgery (SSRF) Attack: Cloud provider metadata URL in Parameter
934130	JavaScript Prototype Pollution
934150	Ruby Injection Attack
934160	Node.js DoS attack
934170	PHP data scheme attack
934101	Node.js Injection Attack 2/2
934120	Possible Server Side Request Forgery (SSRF) Attack: URL Parameter using IP Address
934140	Perl Injection Attack
934100	Node.js Injection Attack

Rule group: 941 - Application attack XSS

Code	Rule
941100	XSS Attack Detected via libinjection
941110	XSS Filter - Category 1: Script Tag Vector
941130	XSS Filter - Category 3: Attribute Vector
941140	XSS Filter - Category 4: Javascript URI Vector
941160	NoScript XSS InjectionChecker: HTML Injection
941170	NoScript XSS InjectionChecker: Attribute Injection
941180	Node-Validator Deny List Keywords
941190	IE XSS Filters - Attack Detected
941200	IE XSS Filters - Attack Detected
941210	IE XSS Filters - Attack Detected
941220	IE XSS Filters - Attack Detected
941230	IE XSS Filters - Attack Detected
941240	IE XSS Filters - Attack Detected
941250	IE XSS Filters - Attack Detected
941260	IE XSS Filters - Attack Detected
941270	IE XSS Filters - Attack Detected
941280	IE XSS Filters - Attack Detected
941290	IE XSS Filters - Attack Detected
941300	IE XSS Filters - Attack Detected
941310	US-ASCII Malformed Encoding XSS Filter - Attack Detected
941350	UTF-7 Encoding IE XSS - Attack Detected
941360	JSFuck / Hieroglyphy obfuscation detected
941370	JavaScript global variable found
941390	Javascript method detected
941400	XSS JavaScript function without parentheses
941101	XSS Attack Detected via libinjection
941120	XSS Filter - Category 2: Event Handler Vector
941150	XSS Filter - Category 5: Disallowed HTML Attributes
941181	Node-Validator Deny List Keywords
941320	Possible XSS Attack Detected - HTML Tag Handler
941330	IE XSS Filters - Attack Detected
941340	IE XSS Filters - Attack Detected
941380	AngularJS client side template injection detected

Rule group: 942 - Application attack SQL injection

This table lists rules that protect against SQL injection (SQLi) attacks. SQL injection occurs when an attacker sends specially crafted control characters to parameters intended for data only. The application then passes these characters to the database, which can alter the intended meaning of the SQL query.

Code	Rule
942100	SQL Injection Attack Detected via libinjection
942140	SQL Injection Attack: Common DB Names Detected
942151	SQL Injection Attack: SQL function name detected
942160	Detects blind sqli tests using sleep() or benchmark()
942170	Detects SQL benchmark and sleep injection attempts including conditional queries
942190	Detects MSSQL code execution and information gathering attempts
942220	Looking for integer overflow attacks, these are taken from skipfish, except 2.2.2250738585072011e-308 is the “magic number” crash
942230	Detects conditional SQL injection attempts
942240	Detects MySQL charset switch and MSSQL DoS attempts
942250	Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections
942270	Looking for basic sql injection. Common attack string for mysql, oracle and others
942280	Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts
942290	Finds basic MongoDB SQL injection attempts
942320	Detects MySQL and PostgreSQL stored procedure/function injections
942350	Detects MySQL UDF injection and other data/structure manipulation attempts
942360	Detects concatenated basic SQL injection and SQLLFI attempts
942500	MySQL in-line comment detected
942540	SQL Authentication bypass (split query)
942560	MySQL Scientific Notation payload detected
942550	JSON-Based SQL Injection
942120	SQL Injection Attack: SQL Operator Detected
942130	SQL Injection Attack: SQL Boolean-based attack detected
942131	SQL Injection Attack: SQL Boolean-based attack detected
942150	SQL Injection Attack: SQL function name detected
942180	Detects basic SQL authentication bypass attempts 1/3
942200	Detects MySQL comment-/space-obfuscated injections and backtick termination
942210	Detects chained SQL injection attempts 1/2
942260	Detects basic SQL authentication bypass attempts 2/3
942300	Detects MySQL comments, conditions and ch(a)r injections
942310	Detects chained SQL injection attempts 2/2
942330	Detects classic SQL injection probings 1/3
942340	Detects basic SQL authentication bypass attempts 3/3
942361	Detects basic SQL injection based on keyword alter or union
942362	Detects concatenated basic SQL injection and SQLLFI attempts
942370	Detects classic SQL injection probings 2/3
942380	SQL Injection Attack
942390	SQL Injection Attack
942400	SQL Injection Attack
942410	SQL Injection Attack
942470	SQL Injection Attack
942480	SQL Injection Attack
942430	Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)
942440	SQL Comment Sequence Detected
942450	SQL Hex Encoding Identified
942510	SQLi bypass attempt by ticks or backticks detected
942520	Detects basic SQL authentication bypass attempts 4.0/4
942521	Detects basic SQL authentication bypass attempts 4.1/4
942522	Detects basic SQL authentication bypass attempts 4.1/4
942101	SQL Injection Attack Detected via libinjection
942152	SQL Injection Attack: SQL function name detected
942321	Detects MySQL and PostgreSQL stored procedure/function injections
942251	Detects HAVING injections
942490	Detects classic SQL injection probings 3/3
942420	Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)
942431	Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)
942460	Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters
942511	SQLi bypass attempt by ticks detected
942530	SQLi query termination detected
942421	Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)

Rule group: 943 - Application attack session fixation

These rules protect against session fixation attacks.

Code	Rule
943100	Possible Session Fixation Attack: Setting Cookie Values in HTML
943110	Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referer
943120	Possible Session Fixation Attack: SessionID Parameter Name with No Referer

Rule group: 944 - Application attack Java

Code	Rule
944100	Remote Command Execution: Suspicious Java class detected
944110	Remote Command Execution: Java process spawn (CVE-2017-9805)
944120	Remote Command Execution: Java serialization (CVE-2015-4852)
944130	Suspicious Java class detected
944140	Java Injection Attack: Java Script File Upload Found
944150	Potential Remote Command Execution: Log4j / Log4shell
944151	Potential Remote Command Execution: Log4j / Log4shell
944200	Magic bytes Detected, probable java serialization in use
944210	Magic bytes Detected Base64 Encoded, probable java serialization in use
944240	Remote Command Execution: Java serialization (CVE-2015-4852)
944250	Remote Command Execution: Suspicious Java method detected
944260	Remote Command Execution: Malicious class-loading payload
944300	Base64 encoded string matched suspicious keyword
944152	Potential Remote Command Execution: Log4j / Log4shell

Rule collection - OWASP CRS response

Rule group: 950 - Data leakages

These rules protect against general data leakages.

Code	Rule
950130	Directory Listing
950140	CGI source code leakage
950100	The Application Returned a 500-Level Status Code

Rule group: 951 - Data leakages SQL

These rules protect against data leakages from backend SQL servers, which often indicate the presence of SQL injection vulnerabilities.

Code	Rule
951110	Microsoft Access SQL Information Leakage
951120	Oracle SQL Information Leakage
951130	DB2 SQL Information Leakage
951140	EMC SQL Information Leakage
951150	firebird SQL Information Leakage
951160	Frontbase SQL Information Leakage
951170	hsqldb SQL Information Leakage
951180	informix SQL Information Leakage
951190	ingres SQL Information Leakage
951200	interbase SQL Information Leakage
951210	maxDB SQL Information Leakage
951220	mssql SQL Information Leakage
951230	mysql SQL Information Leakage
951240	postgres SQL Information Leakage
951250	sqlite SQL Information Leakage
951260	Sybase SQL Information Leakage

Rule group: 952 - Data leakages Java

These rules protect against data leakages caused by Java.

Code	Rule
952100	Java Source Code Leakage
952110	Java Errors

Rule group: 953 - Data leakages PHP

These rules protect against data leakages caused by PHP.

Code	Rule
953100	PHP Information Leakage
953110	PHP source code leakage
953120	PHP source code leakage
953101	PHP Information Leakage

Rule group: 954 - Data leakages IIS

These rules protect against data leakages caused by Microsoft IIS.

Code	Rule
954100	Disclosure of IIS install location
954110	Application Availability Error
954120	IIS Information Leakage
954130	IIS Information Leakage

Rule group: 955 - Web shells

Code	Rule
955100	Web shell detected
955110	r57 web shell
955120	WSO web shell
955130	b4tm4n web shell
955140	Mini Shell web shell
955150	Ashiyane web shell
955160	Symlink_Sa web shell
955170	CasuS web shell
955180	GRP WebShell
955190	NGHshell web shell
955200	SimAttacker web shell
955210	Unknown web shell
955220	lama’s’hell web shell
955230	lostDC web shell
955240	Unknown web shell
955250	Unknown web shell
955260	Ru24PostWebShell web shell
955270	s72 Shell web shell
955280	PhpSpy web shell
955290	g00nshell web shell
955300	PuNkHoLic shell web shell
955310	azrail web shell
955320	SmEvK_PaThAn Shell web shell
955330	Shell I web shell
955340	b374k m1n1 web shell
955350	webadmin.php file manager