Prevent more probes for /etc/passwd

nigelhorne · Oct 21, 2024 · da54982 · da54982
1 parent b6d828d
commit da54982
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/sniff2ban.c b/sniff2ban.c
@@ -295,6 +295,8 @@ static	const	char	*http_probes[] = {
 	"GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php",
 	/* OpenWRT hack */
 	"GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country",
+	"..%252Fetc%252Fpasswd",
+	"GET /forum/viewforum.php?f=6&f=..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd",
 	NULL
 };
 static	size_t	*http_probelens;