Skip to content

Commit 923d5fd

Browse files
MaikuolanMaikuolan
committed
Modules update.
1 parent aa85ef5 commit 923d5fd

File tree

3 files changed

+28
-26
lines changed

3 files changed

+28
-26
lines changed

‎modules/module_botua.php‎

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Bot user agents module (last modified: 2025.10.31).
11+
* This file: Bot user agents module (last modified: 2025.11.06).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -114,7 +114,7 @@
114114
'in(?:cest|come|vestment)|' .
115115
'jailbreak|' .
116116
'kamagra|keylog|' .
117-
'l(?:axative|esbian|evitra|exap|i(?:ker\.profile|nk(?:ba|che)ck|pitor)|olita|uxury|ycosa\.se)|' .
117+
'l(?:axative|esbian|evitra|exap|i(?:ker\.profile|nkback|pitor)|olita|uxury|ycosa\.se)|' .
118118
'm(?:ail\.ru|e(?:laleuca|nthol)|ixrank|rie8pack)|' .
119119
'n(?:erdybot|etzcheckbot|eurontin|olvadex)|' .
120120
'orgasm|outlet|' .
@@ -128,7 +128,7 @@
128128
'xanax|' .
129129
'zdorov~',
130130
$UANoSpace
131-
) || preg_match('~^go +\d|movable type|msie ?(?:\d{3,}|[2-9]\d|[0-8]\.)| (audit|href|mra |quibids )|\\(build 5339\\)~i', $UA), 'Spam UA'); // 2022.07.09 mod 2024.08.27
131+
) || preg_match('~^go +\d|movable type|msie ?(?:\d{3,}|[2-9]\d|[0-8]\.)| (audit|href|mra |quibids )|\\(build 5339\\)~i', $UA), 'Spam UA'); // 2022.07.09 mod 2025.11.06
132132

133133
$Trigger(preg_match('/[\'"`]\+[\'"`]/', $UANoSpace), 'XSS attack'); // 2017.01.03
134134
$Trigger(strpos($UANoSpace, '`') !== false, 'Execution attempt'); // 2017.01.13
@@ -152,7 +152,7 @@
152152
'~^(?:wp-iphone$|\'?test|-|default|foo)|_sitemapper|3mir|' .
153153
'a(?:boundex|dmantx|dnormcrawler|dvbot|lphaserver|thens|ttache)|' .
154154
'blekko|blogsnowbot|' .
155-
'cmscrawler|co(?:ccoc|llect|modo-webinspector-crawler|mpspy)|crawler(?:4j|\.feedback)|' .
155+
'cmscrawler|co(?:ccoc|llect|modo-webinspector-crawler|mpspy)|crawler\.feedback|' .
156156
'd(?:atacha|igout4uagent|ioscout|kimrepbot|sarobot)|' .
157157
'easou|exabot|' .
158158
'f(?:astenterprisecrawler|astlwspider|ind?bot|indlinks|loodgate|r[_-]?crawler)|' .
@@ -167,7 +167,7 @@
167167
'user-agent|visaduhoc|vonchimpenfurlr|webtarantula|wolf|' .
168168
'y(?:acy|isouspider|[ry]spider|unrang|unyun)|zoominfobot~',
169169
$UANoSpace
170-
) || strpos($UA, ' ') !== false, 'Banned UA'); // 2021.07.08 mod 2025.07.24
170+
) || strpos($UA, ' ') !== false, 'Banned UA'); // 2021.07.08 mod 2025.11.06
171171

172172
if (!$Trigger((
173173
preg_match('~^python-requests/2\.27~', $UANoSpace) &&
@@ -192,7 +192,6 @@
192192
'e(?:(?:na|uro|xperi)bot|nvolk|stimatewebstats|vaal|zoom)|' .
193193
'f(?:dm|etch(?:er.0|or)|ibgen)|' .
194194
'g(?:alaxydownloads|et(?:download\.ws|ty|url11)|slfbot|umgum|urujibot)|' .
195-
'h(?:arvest|eritrix|olmes|ttp(?:fetcher|unit)|ttrack)|' .
196195
'i(?:mage(?:.fetcher|walker)|linkscrawler|nagist|ndocom|nfluencebot|track)|jakarta|jike|' .
197196
'k(?:eywenbot|eywordsearchtool|imengi|kman)|' .
198197
'l(?:abjs\.pro|arbin|ink(?:dex|walker)|iperhey|(?:t|ush)bot)|' .
@@ -208,7 +207,7 @@
208207
'w(?:arebay|auuu|bsearchbot|eb(?:alta|capture|download|mastercoffee|meup|ripper)|ikio|indows(?:3|seven)|ise-guys|khtmlto|orldbot|otbox)|' .
209208
'yoofind~',
210209
$UANoSpace
211-
), 'Backlink/SEO/Scraper UA'); // 2022.09.19 mod 2025.07.24
210+
), 'Backlink/SEO/Scraper UA'); // 2022.09.19 mod 2025.11.06
212211

213212
$Trigger(preg_match('~zombiebot~', $UANoSpace), 'Backlink/SEO'); // 2025.07.26
214213

@@ -226,9 +225,9 @@
226225
), 'Malware UA'); // 2017.04.23
227226

228227
$Trigger(preg_match(
229-
'~\.buzz|(?<!amazona)dbot/|(?:\W|^)(?:cu|pe)rl(?:\W|$)|#boss#|' .
228+
'~\.buzz|(?<!amazona)dbot/|(?:\W|^)(?:curl|libwww|perl)(?:\W|$)|#boss#|' .
230229
'^(?:[aim]$|(?!linkedinbot).*http-?(?:agent|client))|-xpanse|' .
231-
'a(?:bonti|ccserver|cme.spider|dreview/\d|jbaxy|nthill$|nyevent-http|ppengine|xios)|' .
230+
'a(?:bonti|ccserver|cme.spider|dreview/\d|jbaxy|nthill$|nyevent-http|ppengine)|' .
232231
'b(?:igbozz|itsight|lackbird|logsearch|logbot|salsa)|' .
233232
'c(?:astlebot|atexplorador|cleaner|k=\{\}|lickagy|liqzbot|ms-?checker|ontextad|orporama|ortex/\d|rowsnest|yberpatrol)|' .
234233
'd(?:eepfield|le_spider|nbcrawler|omainappender|ummyconnection|umprendertree)|' .
@@ -241,7 +240,7 @@
241240
'm(?:acinroyprivacyauditors|etaintelligence|ultipletimes)|' .
242241
'n(?:etcraft|ettrapport|icebot|mapscriptingengine|rsbot)|' .
243242
'ontheinternet|' .
244-
'p(?:4bot|4load|acrawler|ageglimpse|aloalto(?:company|network)|andalytics|arsijoo|egasusmonitoring|hantomjs|hpcrawl|ingdom|rlog)|' .
243+
'p(?:4bot|4load|acrawler|ageglimpse|aloalto(?:company|network)|andalytics|arsijoo|egasusmonitoring|hantomjs|hpcrawl|ingdom|rlog|ython-httpx)|' .
245244
'r(?:arelyused|obo(?:cop|spider)|yze)|' .
246245
's(?:/got|can\.lol|can(?:ner|info)|creener|eekport|itedomain|mut|nap(?:preview)?bot|oapclient|ocial(?:ayer|searcher)|oso|pyglass|quider|treetbot|ynapse)|' .
247246
't(?:omba|weezler|ryghost)|' .
@@ -254,7 +253,7 @@
254253
) || preg_match(
255254
'~^Mozilla/5\.0( [A-Za-z]{2,5}/0\..)?$~',
256255
$CIDRAM['BlockInfo']['UA']
257-
), 'Unauthorised'); // 2023.09.15 mod 2025.10.31
256+
), 'Unauthorised'); // 2023.09.15 mod 2025.11.06
258257

259258
if ($Trigger(preg_match('~ivre-|masscan~', $UANoSpace), 'Port scanner and synflood tool detected')) {
260259
$CIDRAM['Reporter']->report([14, 15, 19], ['MASSCAN port scanner and synflood tool detected.'], $CIDRAM['BlockInfo']['IPAddr']);
@@ -319,32 +318,35 @@
319318
} // 2022.05.08
320319

321320
if ($Trigger(preg_match(
322-
'~80legs|' .
323-
'a(?:dbar|i2bot|ihitbot|i.?searchbot|liyun|ndibot|nonymous-?coward|wario)|' .
324-
'b(?:anana-?bot|edrockbot|ot-?test|rands-?bot|rightbot|ytespider)|' .
325-
'c(?:asperbot|cbot|hinaclaw|lark-?crawler|ohere-)|' .
321+
'~^http_get|2bone|80legs|' .
322+
'a(?:dbar|i2bot|ihitbot|i.?searchbot|liyun|ndibot|nonymous-?coward|wario|xios)|' .
323+
'b(?:anana-?bot|edrockbot|ot-?test|rands-?bot|rightbot|rings_?you|ytespider)|' .
324+
'c(?:asperbot|cbot|hinaclaw|lark-?crawler|ohere-|rawler4j)|' .
326325
'd(?:atenbank|eep-?research|iffbot)|' .
327326
'echobo[tx]|' .
328327
'f(?:idget-?spinner-?bot|irecrawl|lyriver|riendly-?(?:crawler|spider))|' .
329-
'i(?:askspider|magesift|mg2dataset)|' .
328+
'h(?:arvest|eritrix|tt(?:pfetcher|punit|rack))|' .
329+
'i(?:askspider|magesift|mg2dataset|p_address)|' .
330330
'jaddjabot|' .
331331
'k(?:angaroobot|eys-?so-?bot)|' .
332+
'l(?:9explore|ink(?:check|fluence))|' .
332333
'm(?:amac(?:asper|yber)|istral|ozilla/0|ycentralai)|' .
333334
'n(?:etestate|ovaact)|' .
334335
'o(?:mgili|rbbot)|' .
335-
'p(?:angubot|anscient|erplexity|hindbot|hxbot|oseidon|ublicwebcrawler)|' .
336+
'p(?:angubot|anscient|erplexity|hindbot|hxbot|lease_?block|oseidon|ublicwebcrawler)|' .
336337
'q(?:ualifiedbot|uillbot)|' .
337338
'research.?crawler|' .
338339
's(?:bintuition|crap[ey]|idetrade|p(?:hi|y)der|torm-?crawler|ummalybot)|' .
339-
't(?:est-?bot|heknowledgeai|hesis-?research-?bot|hinkchaos|impi|iny-?(?:bot|test)|rafilatura)|' .
340+
't(?:est[-_]?(?:bot|phase)|heknowledgeai|hesis-?research-?bot|hink(?:bot|chaos)|impi|iny-?(?:bot|test)|rafilatura)|' .
340341
'velenpublic|' .
341-
'w(?:ardbot|ebzio|hatstuffwherebot|inhttp)|' .
342+
'w(?:ardbot|ebsite[-_]?scraper|ebzio|hatstuffwherebot|inhttp)|' .
342343
'xtractorpro|' .
344+
'yak/|' .
343345
'z(?:ephuli-?bot|grab)~',
344346
$UANoSpace
345347
), 'Scraper UA')) {
346348
$CIDRAM['Tracking options override'] = 'extended';
347-
} // 2023.11.17 mod 2025.10.31
349+
} // 2023.11.17 mod 2025.11.06
348350

349351
$Trigger(preg_match('~ct‑git‑scanner/~i', $CIDRAM['BlockInfo']['UA']), 'Unauthorised Git scanner'); // 2025.07.05
350352

‎modules/module_extras.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Optional security extras module (last modified: 2025.09.22).
11+
* This file: Optional security extras module (last modified: 2025.11.06).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -155,7 +155,7 @@
155155
$Trigger(preg_match('~(?:^|[/?])modules/mod_simplefileuploadv1\.3/elements(?:$|[/?])~', $LCNrURI), $Exploit = 'CVE-2011-5148') || // 2025.07.20 mod 2025.08.07
156156
$Trigger(preg_match('~(?:^|[/?])ecp/current/exporttool/microsoft.exchange.ediscovery.exporttool.application(?:$|[/?])~', $LCNrURI), $Exploit = 'CVE-2021-28481') || // 2025.07.17 mod 2025.08.07
157157
$Trigger(preg_match('~(?:^|[/?])util/php/eval-stdin\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'CVE-2017-9841') || // 2025.07.16 mod 2025.08.07
158-
$Trigger(preg_match('~(?:^|[/?])elfinder/php/connector\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'elFinder') || // 2025.07.07 mod 2025.08.07 (possible matches: CVE-2019-1010178, CVE-2020-25213, CVE-2020-35235, CVE-2021-32682)
158+
$Trigger(preg_match('~(?:^|[/?])elfinder/php/connector(?:\.minimal)?\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'elFinder') || // 2025.07.07 mod 2025.11.06 (possible matches: CVE-2019-1010178, CVE-2020-25213, CVE-2020-35235, CVE-2021-32682)
159159
$Trigger(preg_match('~(?:^|[/?])tinymce/plugins/filemanager/dialog\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'TinyMCE Filemanager') || // 2025.07.07 mod 2025.08.07
160160
$Trigger(preg_match('~(?:^|[/?])civicrm/packages/openflashchart/php-ofc-library/ofc_upload_image\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'CIVI-SA-2013-001') || // 2025.07.05 mod 2025.08.07
161161
$Trigger(preg_match('~(?:^|[/?])library/openflashchart/php-ofc-library/ofc_upload_image\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'ZSL-2013-5126') || // 2025.07.10 mod 2025.08.07

‎modules/modules.dat‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ module_bgpview.php:
184184
module_botua.php:
185185
Name: "Bot user agents module"
186186
False Positive Risk: "Medium"
187-
Version: "2025.303.0"
187+
Version: "2025.309.0"
188188
Dependencies:
189189
PHP: "^5.4|^7|^8"
190190
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -196,7 +196,7 @@ module_botua.php:
196196
To:
197197
- "module_botua.php"
198198
Checksum:
199-
- "d053438d67738b7d8ad0882397edc479e47bdab149b79b272325f0892fbb13c2:27487"
199+
- "2d264e4ec2f91c56b9289d79d92844ddd46df8b761a3d9b24d1e50c9ad9b6eb3:27651"
200200
Used with: "modules"
201201
Reannotate: "modules.dat"
202202
module_cookies.php:
@@ -220,7 +220,7 @@ module_cookies.php:
220220
module_extras.php:
221221
Name: "Optional security extras module"
222222
False Positive Risk: "Medium"
223-
Version: "2025.264.0"
223+
Version: "2025.309.0"
224224
Dependencies:
225225
PHP: "^5.4|^7|^8"
226226
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -235,7 +235,7 @@ module_extras.php:
235235
- "module_extras.php"
236236
- "module_extras.yaml"
237237
Checksum:
238-
- "6e4e646a3270d63fb802e48cdfe141dbbfb18748114d0931e7623d12166387f9:53994"
238+
- "9845128add9806bea517f63bf6a5df57f430be3c890e3f14385009fff47acd37:54008"
239239
- "7b891d1fa4b1c52c410220bc758e8cb7064bd6040430fb149a5b60e9ae2e0838:890"
240240
Used with: "modules"
241241
Reannotate: "modules.dat"

0 commit comments

Comments
 (0)