better-staridc-MNBT
1<?php
2webscan_error();
3//引用配置文件
4require_once('webscan_cache.php');
5//get拦截规则
6$getfilter = "\\<.+javascript:window\\[.{1}\\\\x|<.*=(&#\\d+?;?)+?>|<.*(data|src)=data:text\\/html.*>|\\b(alert\\(|confirm\\(|expression\\(|prompt\\(|benchmark\s*?\(.*\)|sleep\s*?\(.*\)|\\b(group_)?concat[\\s\\/\\*]*?\\([^\\)]+?\\)|\bcase[\s\/\*]*?when[\s\/\*]*?\([^\)]+?\)|load_file\s*?\\()|<[a-z]+?\\b[^>]*?\\bon([a-z]{4,})\s*?=|^\\+\\/v(8|9)|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.*\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT\s*(\(.+\)\s*|@{1,2}.+?\s*|\s+?.+?|(`|'|\").*?(`|'|\")\s*)|UPDATE\s*(\(.+\)\s*|@{1,2}.+?\s*|\s+?.+?|(`|'|\").*?(`|'|\")\s*)SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE)@{0,2}(\\(.+\\)|\\s+?.+?\\s+?|(`|'|\").*?(`|'|\"))FROM(\\(.+\\)|\\s+?.+?|(`|'|\").*?(`|'|\"))|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)|<.*(iframe|frame|style|embed|object|frameset|meta|xml)";
7//post拦截规则
8$postfilter = "<.*=(&#\\d+?;?)+?>|<.*data=data:text\\/html.*>|\\b(alert\\(|confirm\\(|expression\\(|prompt\\(|benchmark\s*?\(.*\)|sleep\s*?\(.*\)|\\b(group_)?concat[\\s\\/\\*]*?\\([^\\)]+?\\)|\bcase[\s\/\*]*?when[\s\/\*]*?\([^\)]+?\)|load_file\s*?\\()|<[^>]*?\\b(onerror|onmousemove|onload|onclick|onmouseover)\\b|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.*\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT\s*(\(.+\)\s*|@{1,2}.+?\s*|\s+?.+?|(`|'|\").*?(`|'|\")\s*)|UPDATE\s*(\(.+\)\s*|@{1,2}.+?\s*|\s+?.+?|(`|'|\").*?(`|'|\")\s*)SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE)(\\(.+\\)|\\s+?.+?\\s+?|(`|'|\").*?(`|'|\"))FROM(\\(.+\\)|\\s+?.+?|(`|'|\").*?(`|'|\"))|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)|<.*(iframe|frame|style|embed|object|frameset|meta|xml)";
9//cookie拦截规则
10$cookiefilter = "benchmark\s*?\(.*\)|sleep\s*?\(.*\)|load_file\s*?\\(|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.*\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT\s*(\(.+\)\s*|@{1,2}.+?\s*|\s+?.+?|(`|'|\").*?(`|'|\")\s*)|UPDATE\s*(\(.+\)\s*|@{1,2}.+?\s*|\s+?.+?|(`|'|\").*?(`|'|\")\s*)SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE)@{0,2}(\\(.+\\)|\\s+?.+?\\s+?|(`|'|\").*?(`|'|\"))FROM(\\(.+\\)|\\s+?.+?|(`|'|\").*?(`|'|\"))|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
11//referer获取
12$webscan_referer = empty($_SERVER['HTTP_REFERER']) ? array() : array('HTTP_REFERER'=>$_SERVER['HTTP_REFERER']);
13
14/**
15 * 关闭用户错误提示
16 */
17function webscan_error() {
18 if (ini_get('display_errors')) {
19 ini_set('display_errors', '0');
20 }
21}
22
23/**
24 * 数据统计回传
25 */
26function webscan_slog($logs) {
27 //日志记录
28 return true;
29}
30/**
31 * 参数拆分
32 */
33function webscan_arr_foreach($arr) {
34 static $str;
35 static $keystr;
36 if (!is_array($arr)) {
37 return $arr;
38 }
39 foreach ($arr as $key => $val ) {
40 $keystr=$keystr.$key;
41 if (is_array($val)) {
42
43 webscan_arr_foreach($val);
44 } else {
45
46 $str[] = $val.$keystr;
47 }
48 }
49 return implode($str);
50}
51
52/**
53 * 防护提示页
54 */
55function webscan_pape(){
56 $pape=<<<HTML
57<html>
58<head>
59<meta http-equiv="content-type" content="text/html;charset=utf-8"/>
60<title>输入内容存在危险字符，安全起见，已被本站拦截</title>
61<style>
62body, h1, h2, p,dl,dd,dt{margin: 0;padding: 0;font: 12px/1.5 微软雅黑,tahoma,arial;}
63body{background:#efefef;}
64h1, h2, h3, h4, h5, h6 {font-size: 100%;cursor:default;}
65ul, ol {list-style: none outside none;}
66a {text-decoration: none;color:#447BC4}
67a:hover {text-decoration: underline;}
68.ip-attack{width:600px; margin:200px auto 0;}
69.ip-attack dl{ background:#fff; padding:30px; border-radius:10px;border: 1px solid #CDCDCD;-webkit-box-shadow: 0 0 8px #CDCDCD;-moz-box-shadow: 0 0 8px #cdcdcd;box-shadow: 0 0 8px #CDCDCD;}
70.ip-attack dt{text-align:center;}
71.ip-attack dd{font-size:16px; color:#333; text-align:center;}
72.tips{text-align:center; font-size:14px; line-height:50px; color:#999;}
73</style>
74</head>
75<body>
76<div class="ip-attack">
77<dl>
78<dt><img src='http://p2.qhimg.com/t016dd70ac04d942b1b.png' /></dt>
79<dt><a href="javascript:history.go(-1)">返回上一页</a></dt>
80</dl>
81</div>
82</body>
83</html>
84HTML;
85 echo $pape;
86}
87
88/**
89 * 攻击检查拦截
90 */
91function webscan_StopAttack($StrFiltKey,$StrFiltValue,$ArrFiltReq,$method) {
92 $StrFiltValue=webscan_arr_foreach($StrFiltValue);
93 if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1){
94 webscan_slog(array('ip' => $_SERVER["REMOTE_ADDR"],'time'=>date("Y-m-d H:i:s"),'page'=>$_SERVER["PHP_SELF"],'method'=>$method,'rkey'=>$StrFiltKey,'rdata'=>$StrFiltValue,'user_agent'=>$_SERVER['HTTP_USER_AGENT'],'request_url'=>$_SERVER["REQUEST_URI"]));
95 exit(webscan_pape());
96 }
97 if (preg_match("/".$ArrFiltReq."/is",$StrFiltKey)==1){
98 webscan_slog(array('ip' => $_SERVER["REMOTE_ADDR"],'time'=>date("Y-m-d H:i:s"),'page'=>$_SERVER["PHP_SELF"],'method'=>$method,'rkey'=>$StrFiltKey,'rdata'=>$StrFiltKey,'user_agent'=>$_SERVER['HTTP_USER_AGENT'],'request_url'=>$_SERVER["REQUEST_URI"]));
99 exit(webscan_pape());
100 }
101
102}
103/**
104 * 拦截目录白名单
105 */
106function webscan_white($webscan_white_name,$webscan_white_url=array()) {
107 $url_path=$_SERVER['SCRIPT_NAME'];
108 $url_var=$_SERVER['QUERY_STRING'];
109 if (preg_match("/".$webscan_white_name."/is",$url_path)==1&&!empty($webscan_white_name)) {
110 return false;
111 }
112 foreach ($webscan_white_url as $key => $value) {
113 if(!empty($url_var)&&!empty($value)){
114 if (stristr($url_path,$key)&&stristr($url_var,$value)) {
115 return false;
116 }
117 }
118 elseif (empty($url_var)&&empty($value)) {
119 if (stristr($url_path,$key)) {
120 return false;
121 }
122 }
123
124 }
125
126 return true;
127}
128
129if ($webscan_switch&&webscan_white($webscan_white_directory,$webscan_white_url)) {
130 if ($webscan_get) {
131 foreach($_GET as $key=>$value) {
132 webscan_StopAttack($key,$value,$getfilter,"GET");
133 }
134 }
135 if ($webscan_post) {
136 foreach($_POST as $key=>$value) {
137 webscan_StopAttack($key,$value,$postfilter,"POST");
138 }
139 }
140 if ($webscan_cookie) {
141 foreach($_COOKIE as $key=>$value) {
142 webscan_StopAttack($key,$value,$cookiefilter,"COOKIE");
143 }
144 }
145 if ($webscan_referre) {
146 foreach($webscan_referer as $key=>$value) {
147 webscan_StopAttack($key,$value,$postfilter,"REFERRER");
148 }
149 }
150}
151
152?>