HTTP Request Smuggling exploits specially crafted HTTP messages that can be parsed/interpreted in different ways depending on the agent that receives them.
HTTP Response Splitting exploits a lack of input sanitization, which allows intruders to insert CR and LF characters and “splitting” the answer into 2 HTTP responses. The goal of the attack can vary from cache poisoning to cross site scripting.
| | Prevent Java Code Injection | Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application. This type of attack exploits poor handling of untrusted data. In this case injection uses Java code. | | Prevent Local File Inclusion (LFI) |The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a “dynamic file inclusion” mechanism implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation.
This can lead to something as minor as outputting the contents of the file, but depending on the severity, it can also lead to worse consequences.
| | Prevent Node.js Code Injection | A Code Injection attack using Node.js commands. | | Prevent PHP Code Injection | A Code Injection attack using PHP commands. | | Prevent Remote Command Execution: LogJam/Log4Shell (CVE-2021-44228) |LogJam is a library for writing system logs, for example to document the error messages of an application. To exploit the vulnerability, attackers only need to get the system to write an entry in the log.
Log4Shell is a remote code execution (RCE) vulnerability that allows attackers to execute code on affected systems and potentially gain control of the system.
| | Prevent Remote Command Execution: Spring4Shell/SpringShell (CVE-2022-22963) |A Spring4Shell vulnerability allows attackers to bypass the incomplete patch for the CVE-2010-1622, a 12-year old code injection vulnerability found in the Spring Core Framework.
The SpringShell (CVE-2022-22963) vulnerability allows an attacker unauthenticated remote code execution (RCE), which has been observed being exploited in the wild. The exploitation of this vulnerability could result in a webshell being installed onto the compromised server that allows further command execution.
| | Prevent Remote File Inclusion (RFI) | A file inclusion vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting runtime. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time | | Prevent Session Fixation | Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable web application. | | Prevent SQL Injection (SQLi) | SQL injection is the placement of malicious code into SQL statements, via web page input. It is one of the most common web attacks, and can result in data exfiltration or even database deletion. | | Prevent Unix/Windows Shell Injection | Unix/Windows command injection (also known as shell injection) is a web security vulnerability that allows an attacker to execute arbitrary operating system (OS) commands on the server that is running an application, and typically fully compromise the application and all its data. | | Prevent Vulnerability Scanning | Vulnerability scanning is the process of identifying security weaknesses and flaws in systems and software running on them. This is an integral component of a vulnerability management program, which has one overarching goal – to protect the organization from breaches and the exposure of sensitive data. | | Protect cPanel Website | cPanel is a Linux-based control panel used to conveniently manage your web hosting. The system operates similarly to a desktop application. There are some vulnerabilities in this, so enabling protection is recommended. | | Protect DokuWiki Website |DokuWiki is a simple to use and highly versatile Open Source wiki software that doesn't require a database.
There are some vulnerabilities in this, so enabling protection is recommended.
| | Protect Drupal Website |Drupal is a free and open-source content-management framework that can be tailored and customized to simple websites or complex web applications.
There are some vulnerabilities in this, so enabling protection is recommended.
| | Protect Nextcloud Website |Nextcloud is a suite of client-server software for creating and using file hosting services. Nextcloud provides functionally similar to Dropbox, Office 365 or Google Drive when used with integrated office suite solutions Collabora Online or OnlyOffice. It can be hosted in the cloud or on-premises.
There are some vulnerabilities in this, so enabling protection is recommended.
| | Protect Wordpress Website |WordPress is a content management system (CMS) that allows you to host and build websites.
There are some vulnerabilities in this, so enabling protection is recommended. These exclusions remedy false positives in a default WordPress install.
| | Protect XenForo Website |The primary application of XenForo is the forum system, allowing visitors to create and reply to threads of discussion. XenForo forums support structured question and answer threads, suggestion threads and forums, and a rich article authoring and display system.
There are some vulnerabilities in this, so enabling protection is recommended.
| | Specific rule exceptions (932110, 933210, 941100, 941120, 942100) |Rule Exceptions are:
Windows shell command injections (932110)
Variable Function Prevent Bypass (933210)
Libinjection - XSS Detection (941100)
XSS vectors making use of event handlers like onerror, onload etc (941120)
LibInjection Check (942100)