Skip to content

Commit 7ade156

Browse files
MaikuolanMaikuolan
committed
Modules update.
1 parent 0f6f0cf commit 7ade156

File tree

3 files changed

+100
-26
lines changed

3 files changed

+100
-26
lines changed

‎modules/module_badhosts.php‎

Lines changed: 11 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Bad hosts blocker module (last modified: 2025.07.27).
11+
* This file: Bad hosts blocker module (last modified: 2025.08.11).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -113,28 +113,22 @@
113113

114114
$Trigger(preg_match('~shadowserver\.org$~', $HN), 'Regular unauthorised proxy tunnel attempts'); // 2023.09.15
115115

116-
$Trigger(preg_match(
117-
'~(?:iweb|privatedns)\.com$|iweb\.ca$|^(?:www\.)?iweb~',
118-
$HN
119-
), 'Domain Snipers'); // 2017.02.15 mod 2021.06.28
116+
$Trigger(preg_match('~(?:iweb|privatedns)\.com$|iweb\.ca$|^(?:www\.)?iweb~', $HN), 'Domain Snipers'); // 2017.02.15 mod 2021.06.28
120117

121118
$Trigger(preg_match('~amazonaws\.com$~', $HN) && (
122-
!preg_match(
123-
'~alexa|postrank|twitt(?:urly|erfeed)|bitlybot|unwindfetchor|met' .
124-
'auri|pinterest|slack|silk-accelerated=true$~',
125-
$UANoSpace
126-
) &&
127-
!preg_match(
128-
'~(?:Feedspot http://www\.feedspot\.com|developers\.snap\.com/robots)$~',
129-
$CIDRAM['BlockInfo']['UA']
130-
)
119+
!preg_match('~alexa|postrank|twitt(?:urly|erfeed)|bitlybot|unwindfetchor|metauri|pinterest|slack|silk-accelerated=true$~', $UANoSpace) &&
120+
!preg_match('~(?:Feedspot http://www\.feedspot\.com|developers\.snap\.com/robots)$~', $CIDRAM['BlockInfo']['UA'])
131121
), 'Amazon Web Services'); // 2023.02.28
132122

133123
$Trigger(preg_match('/\.local$/', $HN), 'Spoofed/Fake Hostname'); // 2017.02.06
134124

135-
// See: https://zb-block.net/zbf/showthread.php?t=25
125+
/**
126+
* @link https://zb-block.net/zbf/showthread.php?t=25
127+
*/
136128
$Trigger(preg_match('/shodan\.io|(?:serverprofi24|aspadmin|project25499)\./', $HN), 'AutoSploit Host'); // 2018.02.02 mod 2021.02.07
137129

130+
$this->trigger(preg_match('~\.cypex\.ai$~', $HN), 'Unauthorised security scanner'); // 2025.08.11
131+
138132
/** These signatures can set extended tracking options. */
139133
if (
140134
$Trigger(substr($HN, 0, 2) === '()', 'Banned hostname (Bash/Shellshock)') || // 2017.01.21
@@ -180,7 +174,7 @@
180174
) {
181175
if ($Trigger(preg_match('~(?<!\w)tor(?!\w)|anonym|makesecure\.nl$|proxy~i', $HN), 'Proxy host')) {
182176
$CIDRAM['AddProfileEntry']('Tor endpoints here');
183-
} // 2021.03.18
177+
} // 2021.03.18 mod 2022.07.07
184178
}
185179

186180
/** WordPress cronjob bypass. */
@@ -207,7 +201,7 @@
207201
} elseif (strpos($CIDRAM['BlockInfo']['WhyReason'], 'CAPTCHA cracker host') !== false) {
208202
$CIDRAM['Reporter']->report([15], ['CAPTCHA cracker detected at this address.'], $CIDRAM['BlockInfo']['IPAddr']);
209203
} elseif (strpos($CIDRAM['BlockInfo']['WhyReason'], 'esonicspider') !== false) {
210-
$CIDRAM['Reporter']->report([21], ['esonicspider detected at this address.'], $CIDRAM['BlockInfo']['IPAddr']);
204+
$CIDRAM['Reporter']->report([19, 21], ['esonicspider detected at this address.'], $CIDRAM['BlockInfo']['IPAddr']);
211205
}
212206
};
213207

‎modules/module_extras.php‎

Lines changed: 85 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Optional security extras module (last modified: 2025.08.10).
11+
* This file: Optional security extras module (last modified: 2025.08.13).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -120,7 +120,7 @@
120120
'l(?:ock0?360|eaf_mailer|eaf_php|ufix(?:-shell)?|uuf)|' .
121121
'm(?:akeasmtp|iin|oduless|u-plugins/db-safe-mode|y1)|' .
122122
'njima|' .
123-
'o(?:ld(?:/wp-admin/install|-up-ova)|rvx(?:-shell)?|thiondwmek)|' .
123+
'o(?:ld(?:/wp-admin/install|-up-ova)|va-uname|rvx(?:-shell)?|thiondwmek)|' .
124124
'p(?:erl\.alfa|hp(?:1|_niu_\d+)|huploader|lugins/(?:backup_index|vwcleanerplugin/bump|zedd/\d+)|oison|rayer_intentions|riv8|wnd|zaiihfi)|' .
125125
'qxuho|' .
126126
'r(?:andkeyword|endixd)|' .
@@ -140,7 +140,7 @@
140140
')\.php[578]?(?:$|[/?])|' .
141141
'funs\.php[578]?(?:$|[/?])~',
142142
$LCNrURI
143-
), 'Probing for webshells/backdoors') || // 2023.08.18 mod 2025.08.10
143+
), 'Probing for webshells/backdoors') || // 2023.08.18 mod 2025.08.11
144144
$Trigger(preg_match('~(?:^|[/?])(?:brutalshell|css/dmtixucz/golden-access|fierzashell\.html?|perl.alfa|search/label/php-shells|wp-ksv1i\.ph)(?:$|[/?])~', $LCNrURI), 'Probing for webshells/backdoors') || // 2025.05.12 mod 2025.08.07
145145
$Trigger(preg_match('~(?:^|[/?])(?:moon\.php|ss\.php)\?(?:f_c|p)=~', $LCNrURI), 'Probing for webshells/backdoors') // 2025.08.07
146146
) {
@@ -319,9 +319,89 @@
319319
} // 2025.08.07
320320

321321
/** Probing for exposed SQLite databases. */
322-
if ($Trigger(preg_match('~(?:^|[/?])database\.sqlite(?:$|[/?])~', $LCNrURI), 'Probing for exposed SQLite databases')) {
322+
if ($Trigger(preg_match('~(?:^|[/?])\.?database\.sqlite(?:$|[/?])~', $LCNrURI), 'Probing for exposed SQLite databases')) {
323323
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed SQLite databases.'], $CIDRAM['BlockInfo']['IPAddr']);
324-
} // 2025.08.07
324+
} // 2025.08.07 mod 2025.08.13
325+
326+
/** Probing for exposed Yarn configuration file. */
327+
if ($Trigger(preg_match('~(?:^|[/?])\.?yarnrc(?:$|[/?])~', $LCNrURI), 'Probing for exposed Yarn configuration file')) {
328+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Yarn configuration file.'], $CIDRAM['BlockInfo']['IPAddr']);
329+
} // 2025.08.13
330+
331+
/** Probing for exposed Yarn lock file. */
332+
if ($Trigger(preg_match('~(?:^|[/?])yarn\.lock(?:$|[/?])~', $LCNrURI), 'Probing for exposed Yarn lock file')) {
333+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Yarn lock file.'], $CIDRAM['BlockInfo']['IPAddr']);
334+
} // 2025.08.13
335+
336+
/** Probing for exposed NPM configuration file. */
337+
if ($Trigger(preg_match('~(?:^|[/?])\.?npmrc(?:$|[/?])~', $LCNrURI), 'Probing for exposed NPM configuration file')) {
338+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed NPM configuration file.'], $CIDRAM['BlockInfo']['IPAddr']);
339+
} // 2025.08.13
340+
341+
/** Probing for exposed Composer configuration file. */
342+
if ($Trigger(preg_match('~(?:^|[/?])composer\.json(?:$|[/?])~', $LCNrURI), 'Probing for exposed Composer configuration file')) {
343+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Composer configuration file.'], $CIDRAM['BlockInfo']['IPAddr']);
344+
} // 2025.08.13
345+
346+
/** Probing for exposed Composer lock file. */
347+
if ($Trigger(preg_match('~(?:^|[/?])composer\.lock(?:$|[/?])~', $LCNrURI), 'Probing for exposed Composer lock file')) {
348+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Composer lock file.'], $CIDRAM['BlockInfo']['IPAddr']);
349+
} // 2025.08.13
350+
351+
/** Probing for exposed Composer OAuth keys. */
352+
if ($Trigger(preg_match('~(?:^|[/?])\.?co(?:mposer/auth\.json|nfig/composer)(?:$|[/?])~', $LCNrURI), 'Probing for exposed Composer OAuth keys')) {
353+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Composer OAuth keys.'], $CIDRAM['BlockInfo']['IPAddr']);
354+
} // 2025.08.13
355+
356+
/** Probing for exposed Bundler/Ruby lock file. */
357+
if ($Trigger(preg_match('~(?:^|[/?])gemfile\.lock(?:$|[/?])~', $LCNrURI), 'Probing for exposed Bundler/Ruby lock file')) {
358+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Bundler/Ruby lock file.'], $CIDRAM['BlockInfo']['IPAddr']);
359+
} // 2025.08.13
360+
361+
/** Probing for exposed Pipenv/Python lock file. */
362+
if ($Trigger(preg_match('~(?:^|[/?])pipfile\.lock(?:$|[/?])~', $LCNrURI), 'Probing for exposed Pipenv/Python lock file')) {
363+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Pipenv/Python lock file.'], $CIDRAM['BlockInfo']['IPAddr']);
364+
} // 2025.08.13
365+
366+
/** Probing for exposed Eclipse configuration file. */
367+
if ($Trigger(preg_match('~(?:^|[/?])\.settings(?:$|[/?])~', $LCNrURI), 'Probing for exposed Eclipse configuration file')) {
368+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Eclipse configuration file.'], $CIDRAM['BlockInfo']['IPAddr']);
369+
} // 2025.08.13
370+
371+
/** Probing for exposed Docker image. */
372+
if ($Trigger(preg_match('~(?:^|[/?])\.?dockerfile(?:$|[/?])~', $LCNrURI), 'Probing for exposed Docker image')) {
373+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Docker image.'], $CIDRAM['BlockInfo']['IPAddr']);
374+
} // 2025.08.13
375+
376+
/** Probing for exposed Gradle configuration file. */
377+
if ($Trigger(preg_match('~(?:^|[/?])build\.gradle(?:$|[/?])~', $LCNrURI), 'Probing for exposed Gradle configuration file')) {
378+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Gradle configuration file.'], $CIDRAM['BlockInfo']['IPAddr']);
379+
} // 2025.08.13
380+
381+
/** Probing for exposed PHP configuration file. */
382+
if ($Trigger(preg_match('~(?:^|[/?])php\d?\.ini(?:$|[/?])~', $LCNrURI), 'Probing for exposed PHP configuration file')) {
383+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed PHP configuration file.'], $CIDRAM['BlockInfo']['IPAddr']);
384+
} // 2025.08.13
385+
386+
/** Probing for exposed Laravel/OpenCart error logs. */
387+
if ($Trigger(preg_match('~(?:^|[/?])storage/logs/error\.log(?:$|[/?])~', $LCNrURI), 'Probing for exposed Laravel/OpenCart error logs')) {
388+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Laravel/OpenCart error logs.'], $CIDRAM['BlockInfo']['IPAddr']);
389+
} // 2025.08.13
390+
391+
/** Probing for exposed Apache logs. */
392+
if ($Trigger(preg_match('~(?:^|[/?])var/log/httpd(?:$|[/?])~', $LCNrURI), 'Probing for exposed Apache logs')) {
393+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Apache logs.'], $CIDRAM['BlockInfo']['IPAddr']);
394+
} // 2025.08.13
395+
396+
/** Probing for exposed Nginx logs. */
397+
if ($Trigger(preg_match('~(?:^|[/?])var/log/nginx(?:$|[/?])~', $LCNrURI), 'Probing for exposed Nginx logs')) {
398+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Nginx logs.'], $CIDRAM['BlockInfo']['IPAddr']);
399+
} // 2025.08.13
400+
401+
/** Probing for exposed error logs. */
402+
if ($Trigger(preg_match('~(?:^|[/?])(?:tmp/errors[._]log|php_error_log)(?:$|[/?])~', $LCNrURI), 'Probing for exposed error logs')) {
403+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed error logs.'], $CIDRAM['BlockInfo']['IPAddr']);
404+
} // 2025.08.13
325405
}
326406

327407
/**

‎modules/modules.dat‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ module_abuseipdb.php:
144144
module_badhosts.php:
145145
Name: "Bad hosts blocker module"
146146
False Positive Risk: "Medium"
147-
Version: "2025.208.0"
147+
Version: "2025.224.0"
148148
Dependencies:
149149
PHP: "^5.4|^7|^8"
150150
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -156,7 +156,7 @@ module_badhosts.php:
156156
To:
157157
- "module_badhosts.php"
158158
Checksum:
159-
- "cba13c69d7f2b58e617bb85ab0c6d4295481e62081e0eac6457f8a443510bf3d:9295"
159+
- "0e829dbe57d7df97baee6c1764789059135e3ea3556db178d163486bff11316b:9327"
160160
Used with: "modules"
161161
Reannotate: "modules.dat"
162162
module_badtlds.php:
@@ -239,7 +239,7 @@ module_cookies.php:
239239
module_extras.php:
240240
Name: "Optional security extras module"
241241
False Positive Risk: "Medium"
242-
Version: "2025.221.0"
242+
Version: "2025.224.0"
243243
Dependencies:
244244
PHP: "^5.4|^7|^8"
245245
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -254,7 +254,7 @@ module_extras.php:
254254
- "module_extras.php"
255255
- "module_extras.yaml"
256256
Checksum:
257-
- "c38fbbb9051b7fbef34c00e67700075039035bc290fc837dc0c53e83bc16fa40:41938"
257+
- "8d8d054847eeca00640708ecf8acf8b193a9c9a74b0d105e0c67d108f4855836:47550"
258258
- "7b891d1fa4b1c52c410220bc758e8cb7064bd6040430fb149a5b60e9ae2e0838:890"
259259
Used with: "modules"
260260
Reannotate: "modules.dat"

0 commit comments

Comments
 (0)