| Server IP : 216.92.14.13 / Your IP : 216.73.216.171 Web Server : Apache System : Linux vps4089.pairvps.com 5.15.0-190-generic #200-Ubuntu SMP Fri Aug 7 15:06:04 UTC 2026 x86_64 User : rmlac2fmr ( 1040637) PHP Version : 8.2.32 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /etc/fail2ban/filter.d/ |
Upload File : |
# Fail2Ban configuration file # # Regexp to catch people trying to do directory traversal via lfi vulns. [Definition] # Stupid python regex is stupid, %% == % # Literal match: '(\\x5C.\\x5C.|%%32%65%%32%65/|.%2e/.%2e/|\.\./|\.\.%2f)+/?(sh|wp-config\.php|bin|usr|etc/passwd|etc/shadow|proc/self|%00)' lfipayload = (\\x5C.\\x5C.|%%%%32%%65%%%%32%%65/|.%%2e/.%%2e/|\.\./|\.\.%%2f)+/?(sh|wp-config\.php|bin|usr|etc/passwd|etc/shadow|proc/self|%%00) failregex = ^.* <HOST> .*"(GET|POST|HEAD).*%(lfipayload)s ignoreregex = # DEV Notes: # More info about lfi vulns: # https://pairsec.net/resources/html/meeting_7_plans.html#php-file-inclusion-vulnerabilities---lfi-rfi # # Fun fact that null byte injection '%00' has been dead since php 5.3.4. But # its still in all the logs so kinda a self report on the hackers behalf lol. # # Author: John Radford