Using htaccess in Apache to block query string input

.htaccessapache-2.2

I have been staring at this for a while not I can't fathom it, probably a wood for the trees scenario.

I am attempting to use HTACCESS to block certain inputs to a web server, so I have added the following directives:

#######################################
## QUERY STRING / HTTP METHOD BLOCKS ##
#######################################
# request query string contains /proc/self/environ
RewriteCond %{QUERY_STRING} proc\/self\/environ [NC,OR]
#request query string contains base64_encode / base64_decode
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
# Block <script> in query string
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [NC,OR]
# Prevent use of specified methods in HTTP Request 
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR] 
# Block out use of illegal or unsafe characters in the HTTP Request 
RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR] 
# Block out use of illegal or unsafe characters in the Referer Variable of the HTTP Request 
RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] 
# Block out use of illegal or unsafe characters in any cookie associated with the HTTP Request 
RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] 
# Block out use of illegal characters in URI or use of malformed URI 
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR] 
# Block out  use of illegal or unsafe characters in the User Agent variable 
RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] 
# Measures to block out  SQL injection attacks 
RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR] 
# Block out  reference to localhost/loopback/127.0.0.1 in the Query String 
RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR] 
# Block out  use of illegal or unsafe characters in the Query String variable 
RewriteCond %{QUERY_STRING} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC]
RewriteRule ^(.*)$ - [F]

After adding this I was expecting that if I opened the following URL:

I would get a 403 error back, however all I am seeing is page.php. Conclusion is that the directives are malformed and not being followed.

Could anybody offer any guidance on where I may have gone wrong?

Best Answer

Make sure you specify RewriteEngine On and that you have properly set it up to parse the htaccess file. Check your errorlogs for clues. If you make a simple rewrite that is not working, it probably did not load your htaccess. Try putting them in a httpd.conf and run httpd -S to syntax check. Gotta be sure rewrites are working first, then you can fix any regex misses.

Related Topic