Skip to content

Commit 132db32

Browse files
wireghoulwireghoul
authored
Merge pull request #72 from EMSeek/master
Rules update
2 parents 675eaa9 + 08608cc commit 132db32

File tree

9 files changed

+46
-15
lines changed

9 files changed

+46
-15
lines changed

‎signatures/default.db‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,14 @@ unsafeAddr([[:space:]]+|[[:space:]]*\()
33
addr[[:space:]]*\(
44
fmt[[:space:]]*\([[:space:]]*['"][Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+.*\{[a-zA-Z0-9]+\]
55
# Execution
6-
exec[[:space:]]*\([^;]*\$[\(\{]?[_a-zA-Z0-9][^\)]*\)[[:space:]]*[\);]
6+
exec[[:space:]]*\([^;\)]*\$[\(\{]?[_a-zA-Z0-9][^\)]*\)[[:space:]]*[\);]
77
passthru[[:space:]]*\(.*\)
88
popen[[:space:]]*\(.*\$.*\)
99
shell_exec[[:space:]]*\(.*\$.*\)
1010
system[[:space:]]*\([^;]*\$[^\)]+\)
11-
#deprecate this `[^`]*\$[^`]+`
12-
`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
11+
call_user_func[[:space:]]*\(.?.?\$.*,.?\$.*
12+
[= (]`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
13+
^`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
1314
#Otherstuffs
1415
#XSS signature needs to stop matching before LF when color=on #bug(1)
1516
echo.*\$_.*\[.*\]
@@ -18,13 +19,13 @@ eval[[:space:]]*\(.*\$.*\)
1819
(mysql.?_|pg_|sqlsrv_|::)query[[:space:]]*\(.*\$.*\)
1920
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*=.*\$[^; ]+
2021
([Ww][Hh][Ee][Rr][Ee]|[Aa][Nn][Dd]|[Oo][Rr])[[:space:]]+.*[[:space:]]+[Ll][Ii][Kk][Ee][[:space:]]+.*\$
21-
(include|include_once|require|require_once)[[:space:]]*\([^\;\}\{]*\$.*\)
22+
^[[:space:]]*(include|include_once|require|require_once)[[:space:]]*\([^\;\}\{]*\$.*\)
2223
print.*param[[:space:]]*\(.*\);
2324
extract[[:space:]]*\(\$_(GET|POST|REQUEST|COOKIE|SERVER)
2425
new[[:space:]]+\$_(GET|REQUEST|POST|COOKIE).*\(
2526
\.cookie[[:space:]]*\(.*\.(query|param)
2627
\.location\.hash\.slice[[:space:]]*\(
27-
.innerHTML[[:space:]]*=.*\.(location\.hash|query|param)
28+
.innerHTML[[:space:]]*=[^;]*\.(location\.hash|query|param)
2829
require\(['"]adm-zip['"]\)
2930
\.createWriteStream[[:space:]]*\(
3031
\.runIn(New|This)?Context[[:space:]]*\(

‎signatures/js.db‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,15 @@ require[[:space:]]*\([^))+[Yy][Aa][Mm][Ll].?\)\.load\(
5151
#MySQL rules
5252
\.createConnection\(.*
5353
\.query\(.*\)
54+
[Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+\${[^}]+
55+
[Ff][Rr][Oo][Mm][[:space:]]+\${[^}]+
56+
[Ii][Nn][Ss][Ee][Rr][Tt][[:space:]]+[Ii][Nn][Tt][Oo][[:space:]]+\${[^}]+
57+
(UPDATE|update).+\${[^}]+
58+
[Ll][Ii][Mm][Ii][Tt][[:space:]]+\${[^}]+
59+
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*\${[^}]+
60+
[Aa][Nn][Dd][[:space:]]+.*=[[:space:]]*\${[^}]+
61+
[Ll][Ii][Kk][Ee][[:space:]]+['"]*\${[^}]+
62+
(group|GROUP|order|ORDER)[[:space:]]+[Bb][Yy][[:space:]]+\${[^}]+
5463
renderToString[[:space:]]*\(
5564
to_html[[:space:]]*\(
5665
\.render[[:space:]]*\(

‎signatures/js/sql.db‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,12 @@
1010
#MySQL rules
1111
\.createConnection\(.*
1212
\.query\(.*\)
13+
[Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+\${[^}]+
14+
[Ff][Rr][Oo][Mm][[:space:]]+\${[^}]+
15+
[Ii][Nn][Ss][Ee][Rr][Tt][[:space:]]+[Ii][Nn][Tt][Oo][[:space:]]+\${[^}]+
16+
(UPDATE|update).+\${[^}]+
17+
[Ll][Ii][Mm][Ii][Tt][[:space:]]+\${[^}]+
18+
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*\${[^}]+
19+
[Aa][Nn][Dd][[:space:]]+.*=[[:space:]]*\${[^}]+
20+
[Ll][Ii][Kk][Ee][[:space:]]+['"]*\${[^}]+
21+
(group|GROUP|order|ORDER)[[:space:]]+[Bb][Yy][[:space:]]+\${[^}]+

‎signatures/php.db‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,13 +34,14 @@ sqlite_create_function[[:space:]]*\(
3434
Closure::bind(To)?[[:space:]]*\(
3535
Closure::call[[:space:]]*\(
3636
# Execution
37-
exec[[:space:]]*\([^;]*\$[\(\{]?[_a-zA-Z0-9][^\)]*\)[[:space:]]*[\);]
37+
exec[[:space:]]*\([^;\)]*\$[\(\{]?[_a-zA-Z0-9][^\)]*\)[[:space:]]*[\);]
3838
passthru[[:space:]]*\(.*\)
3939
popen[[:space:]]*\(.*\$.*\)
4040
shell_exec[[:space:]]*\(.*\$.*\)
4141
system[[:space:]]*\([^;]*\$[^\)]+\)
42-
#deprecate this `[^`]*\$[^`]+`
43-
`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
42+
call_user_func[[:space:]]*\(.?.?\$.*,.?\$.*
43+
[= (]`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
44+
^`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
4445
#Otherstuffs
4546
#XSS signature needs to stop matching before LF when color=on #bug(1)
4647
echo.*\$_.*\[.*\]
@@ -49,7 +50,7 @@ eval[[:space:]]*\(.*\$.*\)
4950
(mysql.?_|pg_|sqlsrv_|::)query[[:space:]]*\(.*\$.*\)
5051
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*=.*\$[^; ]+
5152
([Ww][Hh][Ee][Rr][Ee]|[Aa][Nn][Dd]|[Oo][Rr])[[:space:]]+.*[[:space:]]+[Ll][Ii][Kk][Ee][[:space:]]+.*\$
52-
(include|include_once|require|require_once)[[:space:]]*\([^\;\}\{]*\$.*\)
53+
^[[:space:]]*(include|include_once|require|require_once)[[:space:]]*\([^\;\}\{]*\$.*\)
5354
print.*param[[:space:]]*\(.*\);
5455
extract[[:space:]]*\(\$_(GET|POST|REQUEST|COOKIE|SERVER)
5556
new[[:space:]]+\$_(GET|REQUEST|POST|COOKIE).*\(

‎signatures/php/default.db‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
# Execution
2-
exec[[:space:]]*\([^;]*\$[\(\{]?[_a-zA-Z0-9][^\)]*\)[[:space:]]*[\);]
2+
exec[[:space:]]*\([^;\)]*\$[\(\{]?[_a-zA-Z0-9][^\)]*\)[[:space:]]*[\);]
33
passthru[[:space:]]*\(.*\)
44
popen[[:space:]]*\(.*\$.*\)
55
shell_exec[[:space:]]*\(.*\$.*\)
66
system[[:space:]]*\([^;]*\$[^\)]+\)
7-
#deprecate this `[^`]*\$[^`]+`
8-
`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
7+
call_user_func[[:space:]]*\(.?.?\$.*,.?\$.*
8+
[= (]`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
9+
^`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
910
#Otherstuffs
1011
#XSS signature needs to stop matching before LF when color=on #bug(1)
1112
echo.*\$_.*\[.*\]
@@ -14,7 +15,7 @@ eval[[:space:]]*\(.*\$.*\)
1415
(mysql.?_|pg_|sqlsrv_|::)query[[:space:]]*\(.*\$.*\)
1516
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*=.*\$[^; ]+
1617
([Ww][Hh][Ee][Rr][Ee]|[Aa][Nn][Dd]|[Oo][Rr])[[:space:]]+.*[[:space:]]+[Ll][Ii][Kk][Ee][[:space:]]+.*\$
17-
(include|include_once|require|require_once)[[:space:]]*\([^\;\}\{]*\$.*\)
18+
^[[:space:]]*(include|include_once|require|require_once)[[:space:]]*\([^\;\}\{]*\$.*\)
1819
print.*param[[:space:]]*\(.*\);
1920
extract[[:space:]]*\(\$_(GET|POST|REQUEST|COOKIE|SERVER)
2021
new[[:space:]]+\$_(GET|REQUEST|POST|COOKIE).*\(

‎signatures/secrets.db‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ A[SK]IA[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z
1111
[Ss][Ee][Cc][Rr][Ee][Tt][_\-\.]?([Kk][Ee][Yy])?[\'\"]?[[:space:]]*[=:][[:space:]]*[a-zA-Z0-9\'\"_\-][a-zA-Z0-9/+_\-][a-zA-Z0-9/+_\-]+[a-zA-Z0-9/+=_\-]+[a-zA-Z0-9\'\"+=_\-]$
1212
[_\&\.\-]?[Pp][Aa][Ss][Ss][Ww][Oo]?[Rr]?[Dd][[:space:]]*=[[:space:]]*[a-zA-Z0-9\'\"_\-][a-zA-Z0-9/+_\-][a-zA-Z0-9/+_\-]+[a-zA-Z0-9/+=_\-][a-zA-Z0-9+=_\-]+[\'\" ]
1313
[_\&\.\-]?[Pp][Aa][Ss][Ss][Ww][Oo]?[Rr]?[Dd][[:space:]]*=[[:space:]]*[a-zA-Z0-9\'\"_\-][a-zA-Z0-9/+_\-][a-zA-Z0-9/+_\-]+[a-zA-Z0-9/+=_\-][a-zA-Z0-9+=_\-]+[a-zA-Z0-9/+=\'\"_\-]$
14+
[Pp][Aa][Ss][Ss][Ww]([Oo][Rr])?[Dd]?[[:space:]]*=.*[\'\"\`][^\$\{][a-zA-Z0-9\!\@\#\$\%\^\&\*\(\)\_\+-\=\:\<\>\{\}\?\,\.\/\\\|]+[\'\"\`];?$
1415
-----BEGIN( RSA| OPENSSH| DSA| EC| PGP| ENCRYPTED)? PRIVATE KEY( BLOCK)?-----
1516
[Pp][Rr][Ii][Vv]([Aa][Tt][Ee])?[_\.\-]?[Kk][Ee][Yy][\'\"]?[[:space:]]*[=:][[:space:]]*[a-zA-Z0-9\'\"_\-][a-zA-Z0-9/+_\-][a-zA-Z0-9/+_\-]+[a-zA-Z0-9/+=_\-][a-zA-Z0-9+=_\-]+
1617
PuTTY-User-Key-File-2\:

‎signatures/sql.db‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,15 @@ StoredProcedure[[:space:]]*\(
5959
#MySQL rules
6060
\.createConnection\(.*
6161
\.query\(.*\)
62+
[Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+\${[^}]+
63+
[Ff][Rr][Oo][Mm][[:space:]]+\${[^}]+
64+
[Ii][Nn][Ss][Ee][Rr][Tt][[:space:]]+[Ii][Nn][Tt][Oo][[:space:]]+\${[^}]+
65+
(UPDATE|update).+\${[^}]+
66+
[Ll][Ii][Mm][Ii][Tt][[:space:]]+\${[^}]+
67+
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*\${[^}]+
68+
[Aa][Nn][Dd][[:space:]]+.*=[[:space:]]*\${[^}]+
69+
[Ll][Ii][Kk][Ee][[:space:]]+['"]*\${[^}]+
70+
(group|GROUP|order|ORDER)[[:space:]]+[Bb][Yy][[:space:]]+\${[^}]+
6271
# PHP - Database
6372
mysql_connect[[:space:]]*\(.*\$.*\)
6473
mysql_pconnect[[:space:]]*\(.*\$.*\)

‎signatures/typescript.db‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ secureProtocol.*TLSv1_method
88
(min|max)Version.*TLSv1.1
99
\.cookie[[:space:]]*\(.*\.(query|param)
1010
\.location\.hash\.slice[[:space:]]*\(
11-
.innerHTML[[:space:]]*=.*\.(location\.hash|query|param)
11+
.innerHTML[[:space:]]*=[^;]*\.(location\.hash|query|param)
1212
require\(['"]adm-zip['"]\)
1313
\.createWriteStream[[:space:]]*\(
1414
\.runIn(New|This)?Context[[:space:]]*\(

‎signatures/typescript/default.db‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
\.cookie[[:space:]]*\(.*\.(query|param)
22
\.location\.hash\.slice[[:space:]]*\(
3-
.innerHTML[[:space:]]*=.*\.(location\.hash|query|param)
3+
.innerHTML[[:space:]]*=[^;]*\.(location\.hash|query|param)
44
require\(['"]adm-zip['"]\)
55
\.createWriteStream[[:space:]]*\(
66
\.runIn(New|This)?Context[[:space:]]*\(

0 commit comments

Comments
 (0)