Apache: RewriteCond %{QUERY_STRING} issue

Question

I wished to block requests like http://anything.com/something.php?hack_attempt=select * from users.

For this I do in .htaccess

RewriteCond %{QUERY_STRING} ^.*(md5|benchmark|union|select|insert|cast|set|declare|drop|update).* [NC]

The problem is that this rule hits also http://anything.com/update.php As I know %{QUERY_STRING} should contain only get params string after ? , but it hits the URI. Can anyone advice where the problem can be?

UPDATE: full rule

<IfModule mod_rewrite.c>
 RewriteEngine On
 RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).*                                [NC,OR]
 #RewriteCond %{QUERY_STRING} ^.*(\.|\*|;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*                 [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*/ban_url/                                                           [NC,OR]
 #RewriteCond %{QUERY_STRING} ^.*(md5|benchmark|union|select|insert|cast|set|declare|drop|update).* [NC]
 RewriteCond %{QUERY_STRING} ^.*(md5|benchmark|union|insert|cast|set|declare|drop).* [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*\?.*(md5|benchmark|union|select|insert|cast|set|declare|drop|update).* [NC]

 RewriteRule ^(.*)$ - [R=400,L]
</IfModule>

if I uncomment

RewriteCond %{QUERY_STRING} ^.*(md5|benchmark|union|select|insert|cast|set|declare|drop|update).* [NC]

then Apache will block www.anything.com/update.php but it should block only www.anything.com/something.php?param=update

UPDATE 2: full conf

<IfModule mod_rewrite.c>
 RewriteEngine On
 RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).*                                [NC,OR]
 #RewriteCond %{QUERY_STRING} ^.*(\.|\*|;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*                 [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*/ban_url/                                                           [NC,OR]
 #RewriteCond %{QUERY_STRING} ^.*(md5|benchmark|union|select|insert|cast|set|declare|drop|update).* [NC]
 RewriteCond %{QUERY_STRING} ^.*(md5|benchmark|union|insert|cast|set|declare|drop).* [NC,OR]
 RewriteCond %{QUERY_STRING} ^.*\?.*(md5|benchmark|union|select|insert|cast|set|declare|drop|update).* [NC]

 RewriteRule ^(.*)$ - [R=400,L]

 RewriteCond %{REQUEST_URI} ^.*wp-*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*www\.zip*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*backup\.zip*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*public_html\.zip*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*\.tar\.gz*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*administrator*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*admin\.php*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*admin/index\.php*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*elrekt\.php*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*_adminer*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*accesson*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*agentui*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*trackback*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*wp-login*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*router\.php*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*AspCms_AdminAdd*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*public/js/wind*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*include/calendar/calendar-cn*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*app-ads*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*vendor/phpunit/*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*utility/*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*blackhat*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*data/admin/allowurl*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*js/varien*                                                           [NC,OR] #magento
 RewriteCond %{REQUEST_URI} ^.*js/mage*                                                           [NC,OR] #magento
 RewriteCond %{REQUEST_URI} ^.*magento_version*                                                           [NC,OR] #magento
 RewriteCond %{REQUEST_URI} ^.*db_z\.php*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*functions\.php*                                                           [NC,OR]
 RewriteCond %{REQUEST_URI} ^.*lottery-index*                                                           [NC]

 RewriteRule ^(.*)$ - [R=400,L]


</IfModule>

this conf file is applied in site conf like

<VirtualHost *:80>
    Include /var/www/url_blacklist.conf
        ServerName ...
        DocumentRoot ...
        ErrorLog ...
</VirtualHost>

Please post your RewriteRule and be more specific about the problem you are having. — Amit Verma
– Amit Verma, Commented Nov 27, 2020 at 14:05
@MykolaMykolayovichDolynskyi, is the string hack_attempt= is a sample one of a real string in your query string(if not then please do mention whatever could be there with samples)? Kindly confirm once. — RavinderSingh13
– RavinderSingh13, Commented Nov 28, 2020 at 4:47
@RavinderSingh13 not real, I just want to search for any forbidden words which are only in get params (after ? sign), but in real it also finds them in URI also. I can not use sample as I don`t know which kind of attack robots will deploy next time — Mykola Mykolayovich Dolynskyi
– Mykola Mykolayovich Dolynskyi, Commented Nov 29, 2020 at 20:36
“UPDATE: full rule” - is this your full rewrite configuration now, or are you doing other stuff as well? What you say is happening, can’t be explained by what you have shown so far, and a test tool like htaccess.madewithlove.be agrees. — C3roe
– C3roe, Commented Nov 30, 2020 at 8:21

RavinderSingh13 · Accepted Answer · 2020-11-28 04:25:25Z

2

I am assuming that you want to block/forbid all those requests which have select * in their query string along with their uri doesn't have update.php requested, if this is the case could you please try following once. These conditions are written as per requested conditions only, you could try to test it alone and then could try to merge them with your existing conditions too.

RewriteEngine On
RewriteCond %{REQUEST_URI} !^/update\.php [NC]
RewriteCond %{QUERY_STRING} select \* [NC]
RewriteRule ^ - [R=301,F]

answered Nov 28, 2020 at 4:25

RavinderSingh13

135k14 gold badges61 silver badges100 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Mykola Mykolayovich Dolynskyi Over a year ago

like that, I wish to redirect to 301 any request which have SQL expressions only in get params. At same time I need to allow ULRs like /update.php and so on (but QUERY_STRING hits URL also, I thought it should only include get params only)

RavinderSingh13 Over a year ago

@MykolaMykolayovichDolynskyi, looks like your conditions like RewriteCond %{REQUEST_URI} ^.*wp-* then RewriteCond %{REQUEST_URI} ^.*www\.zip* having an issue here, you did not put OR condition there so all are considered as an AND condition which can't be the case by seeing your regex(which isn't looking ok to me since everything is checking that it ^ starts from), kindly try to put OR condition once there?

Mykola Mykolayovich Dolynskyi Over a year ago

the [NC,OR] seems to be everywhere, may be have not scrolled code frame to right?

RavinderSingh13 Over a year ago

@MykolaMykolayovichDolynskyi, sorry usually conditions wouldn't have many spaces so I haven't scrolled right to it.

Collectives™ on Stack Overflow

Apache: RewriteCond %{QUERY_STRING} issue

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related