Skip to content

Commit f1cd41c

Browse files
MaikuolanMaikuolan
committed
Extras module update.
1 parent d510bb4 commit f1cd41c

2 files changed

Lines changed: 26 additions & 22 deletions

File tree

‎modules/module_extras.php‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Optional security extras module (last modified: 2025.02.13).
11+
* This file: Optional security extras module (last modified: 2025.03.03).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -57,8 +57,8 @@
5757
$Trigger(preg_match('~%5[cf]\.%5[cf]|%5[cf]{3,}|[\x00-\x1f\x7f]~', $LCNrURI), 'Bad request'); // 2017.01.13 mod 2024.02.08
5858
} // 2017.01.13 mod 2024.02.08
5959

60-
/** WordPress user enumeration (modified 2022.11.07). */
61-
if ($Trigger(preg_match('~\?author=\d+~i', $LCNrURI), 'WordPress user enumeration not allowed')) {
60+
/** WordPress user enumeration (modified 2025.03.03). */
61+
if ($Trigger(preg_match('~\?author=\d+~', $LCNrURI), 'WordPress user enumeration not allowed')) {
6262
$Bypass(
6363
strpos($LCNrURI, 'administrator/') !== false,
6464
'Joomla image inserting tool bypass (WordPress user enumeration conflict)'
@@ -77,11 +77,11 @@
7777

7878
/** Probing for unsecured backup files. */
7979
if ($Trigger(preg_match(
80-
'~(?:/backup|(?:backup|docroot|htdocs|public_html|site|www)\.(?:gz|rar|tar(?:\.gz)?|zip)|d(?:atabase|b|ump)\.sql)(?:$|[/?])~',
80+
'~(?:/backup|(?:archive|backup|docroot|htdocs|public_html|site|www)\.(?:gz|rar|tar(?:\.gz)?|zip)|d(?:atabase|b|ump)\.sql)(?:$|[/?])~',
8181
$LCNrURI
8282
), 'Probing for unsecured backup files not allowed')) {
8383
$CIDRAM['Reporter']->report([15], ['Caught probing for unsecured backup files.'], $CIDRAM['BlockInfo']['IPAddr']);
84-
} // 2023.08.13 mod 2023.08.21
84+
} // 2023.08.13 mod 2025.03.03
8585

8686
/** Probing for unsecured SQL dumps. */
8787
if ($Trigger(preg_match(
@@ -107,13 +107,13 @@
107107
'\.w(?:ell-known|p-cli)/.*(?:a(?:bout|dmin)[\da-z]*|fierza[\da-z]*|install[\da-z]*|moon[\da-z]*|shell[\da-z]*|wp-login[\da-z]*|x)|' .
108108
'\.?rxr(?:_[\da-z]+)?|' .
109109
'\d{3,5}[a-z]{3,5}|\d+-?backdoor|0byte|0[xz]|10+|1337|4price|85022df0ed31|991176|' .
110-
'a(?:b1ux1ft|dmin-heade\d*|dminfuns|hhygskn|lexus|lfa(?:-rex|_data|a?cgiapi|ioxi|new)?\d*|njas|pismtp|xx)|' .
110+
'a(?:b1ux1ft|dmin-heade\d*|hhygskn|lexus|lfa(?:-rex|_data|a?cgiapi|ioxi|new)?\d*|njas|pismtp|xx)|' .
111111
'b(?:0|3d2acc621a0|ak|ala|ibil_0day)|' .
112-
'c(?:(?:9|10)\d+|adastro-2|asper[\da-z]+|d(?:.*tmp.*rm-rf|chmod.*\d{3,})|fom[-_]files|(?:gi-bin|ss)/(?:luci/;|moon|newgolden|radio|sgd|stok=/|uploader|well-known|wp-login)|jfuns|lasssmtps|olors/blue/uploader|ong|ontentloader1|ss/colors/coffee/index)|' .
113-
'd(?:7|eadcode\d*|epotcv|isagraep|kiz|ummyyummy/wp-signup)|' .
114-
'ee|' .
115-
'f(?:ddqradz|ilefuns?)|' .
116-
'g(?:el4y|etid3-core|h[0o]st|lab-rare|zismexv)|' .
112+
'c(?:(?:9|10)\d+|adastro-2|asper[\da-z]+|d(?:.*tmp.*rm-rf|chmod.*\d{3,})|fom[-_]files|(?:gi-bin|ss)/(?:luci/;|moon|newgolden|radio|sgd|stok=/|uploader|well-known|wp-login)|lass(?:smtps|withtostring)|olors/blue/uploader|omfunctions|ong|ontentloader1|opypaths|ss/colors/coffee/index)|' .
113+
'd(?:7|eadcode\d*|elpaths|epotcv|isagraep|kiz|oiconvs|ummyyummy/wp-signup)|' .
114+
'e(?:e|pinyins)|' .
115+
'f(?:ddqradz|ilefun)|' .
116+
'g(?:dftps|el4y|etid3-core|h[0o]st|lab-rare|zismexv)|' .
117117
'h(?:[4a]x+[0o]r|6ss|anna1337|ehehe|sfpdcd|tmlawedtest)|' .
118118
'i(?:\d{3,}[a-z]{2,}|cesword|ndoxploit|optimize|oxi/alfa-ioxi|r7szrsouep|itsec|xr/(?:allez|wp-login))|' .
119119
'kvkjguw|' .
@@ -124,23 +124,24 @@
124124
'p(?:erl\.alfa|hp(?:1|_niu_\d+)|oison|riv8|wnd|zaiihfi)|' .
125125
'rendixd|' .
126126
's(?:ession91|h[3e]llx?\d*|hrift|idwso|ilic|kipper(?:shell)?|onarxleetxd|pammervip|rc/util/php/(?:eval(?:-stdin)?|kill))|' .
127-
't(?:62|enda\.sh.*tenda\.sh|emplates/beez/index|hemes/(?:finley/min|pridmag/db|universal-news/www)|hreefox(?:_exploit/index)?|inymce/(?:langs/about|plugins/compat3x/css/index)|k_dencode_\d+|mp/vuln|opxoh/(?:drsx|wdr))|' .
127+
't(?:62|enda\.sh.*tenda\.sh|emplates/beez/index|hemes/(?:finley/min|pridmag/db|universal-news/www)|ermps|homs|hreefox(?:_exploit/index)?|inymce/(?:langs/about|plugins/compat3x/css/index)|k_dencode_\d+|mp/vuln|opxoh/(?:drsx|wdr))|' .
128128
'u(?:bh/up|nisibfu|pfile(?:_\\(\d\\))?|ploader_by_cloud7_agath|tchiha(?:_uploader)?)|' .
129129
'v(?:endor/bin/loader|zlateam)|' .
130-
'w(?:[0o]rm\d+|0rdpr3ssnew|alker-nva|ebshell-[a-z\d]+|idgets-nva|idwsisw|loymzuk)|' .
131-
'wp[-_](?:2019|22|(?:admin(?:/images)?|content|css(?:/colors)?|includes(?:/ixr|/customize|/pomo)?|js(?:/widgets)?|network)/(?:dropdown|fgertreyersd|(?:images|widgets)/include|install|js/privacy-tools\.min|(?:random_compat/|requests/)?class(?:_api|-wp-page-[\da-z]{5,})|repeater|simple|text/about|themes/hello-element/footer|uploads/error_log|vuln|wp-login)|conflg|content/plugins/(?:backup-backup/includes/hro|cache/dropdown|contact-form-7/.+styles-rtl|contus-hd-flv-player/uploadvideo|(?:core-plugin/|wordpresscore/)?include|dzs-zoomsounds/savepng|fix/up|(?:view-more/)?ioxi|wp-file-manager/lib/php/connector\.minimal)|filemanager|setups|sigunq|sts|p)|' .
130+
'w(?:[0o]rm\d+|0rdpr3ssnew|alker-nva|ebshell-[a-z\d]+|idgets-nva|idwsisw|loymzuk|orksec)|' .
131+
'wp[-_](?:2019|22|(?:admin(?:/images)?|content|css(?:/colors)?|includes(?:/ixr|/customize|/pomo)?|js(?:/widgets)?|network)/(?:aaa|dropdown|fgertreyersd|(?:images|widgets)/include|includes/lint-branch|install|js/privacy-tools\.min|maint/(?:aaa|fie|lint-branch)|(?:random_compat/|requests/)?class(?:_api|-wp-page-[\da-z]{5,})|repeater|simple|text/about|themes/hello-element/footer|uploads/error_log|vuln|wp-login)|conflg|content/plugins/(?:backup-backup/includes/hro|cache/dropdown|contact-form-7/.+styles-rtl|contus-hd-flv-player/uploadvideo|(?:core-plugin/|wordpresscore/)?include|dzs-zoomsounds/savepng|fix/up|(?:view-more/)?ioxi|wp-file-manager/lib/php/connector\.minimal)|filemanager|setups|sigunq|sts|p)|' .
132132
'wp-(?:configs|l0gins?)|' .
133133
'ws[ou](?:yanz)?(?:[\d.]*|[\da-z]{4,})|wwdv|' .
134134
'x{3,}|xiaom|xichang/x|x+l(?:\d+|eet(?:mailer|-shell)?x?)|xm(?:lrpcs|lrpz|rlpc)|xw|' .
135135
'ya?nz|yyobang/mar|' .
136136
'zone_hackbar(?:_beutify_other)?|' .
137137
'(?:plugins|themes)/(?:ccx|ioptimization|yyobang)|' .
138138
'版iisspy|大马|一句话(?:木马|扫描脚本程序)?' .
139-
')\.php[57]?(?:$|[/?])~',
139+
')\.php[57]?(?:$|[/?])|' .
140+
'funs\.php[57]?(?:$|[/?])~',
140141
$LCNrURI
141142
), 'Probing for webshells/backdoors')) {
142143
$CIDRAM['Reporter']->report([15, 20, 21], ['Caught probing for webshells/backdoors. Host might be compromised.'], $CIDRAM['BlockInfo']['IPAddr']);
143-
} // 2023.08.18 mod 2025.02.13
144+
} // 2023.08.18 mod 2025.03.03
144145

145146
/** Probing for vulnerable plugins or webapps. */
146147
if (
@@ -184,14 +185,17 @@
184185
} // 2022.06.05
185186

186187
/** Probing for vulnerable webapps. */
187-
if ($Trigger(preg_match('~cgi-bin/(?:get_status|(?:web)?login)\.cgi(?:$|\?)|manager/text/list~i', $LCNrURI), 'Probing for vulnerable webapps')) {
188+
if ($Trigger(preg_match('~cgi-bin/(?:get_status|(?:web)?login)\.cgi(?:$|\?)|manager/text/list~', $LCNrURI), 'Probing for vulnerable webapps')) {
188189
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for vulnerable webapps.'], $CIDRAM['BlockInfo']['IPAddr']);
189-
} // 2022.06.05 mod 2023.09.15
190+
} // 2022.06.05 mod 2025.03.03
190191

191192
/** Probing for sendgrid env file. */
192-
if ($Trigger(preg_match('~/sendgrid\.env(?:$|[/?])~i', $LCNrURI), 'Probing for sendgrid env file')) {
193+
if ($Trigger(preg_match('~/sendgrid\.env(?:$|[/?])~', $LCNrURI), 'Probing for sendgrid env file')) {
193194
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for sendgrid env file.'], $CIDRAM['BlockInfo']['IPAddr']);
194-
} // 2024.05.02
195+
} // 2024.05.02 mod 2025.03.03
196+
197+
/** Attempts by broken bot to incorrectly access ReCaptcha files (treating reference to remote resource as local). */
198+
$Trigger(preg_match('~/www\.google\.com/recaptcha/api\.js(?:$|[/?])~', $LCNrURI), 'Bad request'); // 2025.03.03
195199
}
196200

197201
/**

‎modules/modules.dat‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ module_cookies.php:
239239
module_extras.php:
240240
Name: "Optional security extras module"
241241
False Positive Risk: "Medium"
242-
Version: "2025.43.0"
242+
Version: "2025.61.0"
243243
Dependencies:
244244
PHP: "^5.4|^7|^8"
245245
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -254,7 +254,7 @@ module_extras.php:
254254
- "module_extras.php"
255255
- "module_extras.yaml"
256256
Checksum:
257-
- "c9111df6d0aff6f93bccfb9b25bfdfc3e468c0b8afc22d480df3f4963f1e0950:29013"
257+
- "f8d1678868951f39e255c24af7952f30543f8f3bd97b4e315e3d893e16aa5b7d:29450"
258258
- "7b891d1fa4b1c52c410220bc758e8cb7064bd6040430fb149a5b60e9ae2e0838:890"
259259
Used with: "modules"
260260
Reannotate: "modules.dat"

0 commit comments

Comments
 (0)