Default Deny Rules

The group contains SQL injection deny rules for parameter values. The security level Basic prevents injection of new SQL statements (e.g. ; DROP TABLE) and set operations (e.g. UNION SELECT). The security level Standard further prevents injection of SQL sub queries and SQL expressions in single quote context (e.g. ' or 1=1--). The security level Strict further prevents SQLi in unquoted context (e.g. 1 or 1).

SQLI_PARAM_VALUE:

The group contains SQL injection deny rules for header values. The security level Basic prevents injection of new SQL statements (e.g. ; DROP TABLE) and set operations (e.g. UNION SELECT). The security level Standard further prevents injection of SQL sub queries and SQL expressions in single quote context (e.g. ' or 1=1--). The security level Strict further prevents SQLi in unquoted context (e.g. 1 or 1).

SQLI_HEADER_VALUE:

The group contains XSS deny rules for parameter values. The security level Basic prevents injection of <script> and known HTML event handlers (e.g. "onload"). The security level Standard prevents injection of JavaScript code in quoted context. The security level Strict prevents injection of JavaScript code in unquoted context.

XSS_PARAM_VALUE:

The group contains XSS deny rules for HTTP header values. The security level Basic prevents injection of <script> and known HTML event handlers (e.g. "onload"). The security level Standard prevents injection of JavaScript code in quoted context. The security level Strict prevents injection of JavaScript code in unquoted context.

XSS_HEADER_VALUE:

The group contains XSS deny rules for HTTP paths. The security level Basic prevents injection of <script> and known HTML event handlers (e.g. "onload"). The security level Standard prevents injection of JavaScript code in quoted context. The security level Strict prevents injection of JavaScript code in unquoted context.

XSS_PATH:

The group prevents template and expression language injections for various client-side and server-side templating engines.

TI:

The group prevents HTML injection through HTTP parameter values. The security level Basic does not prevent any HTML injection. The security level Standard prevents injection of well known HTML tags (e.g. <img src="path">) as well as injection of well known HTML attribute names in a single or double quoted attribute value (e.g. ' href="url"). The security level Strict prevents injection of any kind of HTML tags as well as injection of any kind of HTML attribute names in a single or double quoted attribute value.

The group prevents HTML injection through HTTP header values. The security level Basic does not prevent any HTML injection. The security level Standard prevents injection of well known HTML tags (e.g. <img src="path">) as well as injection of well known HTML attribute names in a single or double quoted attribute value (e.g. ' href="url"). The security level Strict prevents injection of any kind of HTML tags as well as injection of any kind of HTML attribute names in a single or double quoted attribute value.

HTML_HEADER_VALUE:

The group prevents HTML injection through HTTP paths. The security level Basic does not prevent any HTML injection. The security level Standard prevents injection of well known HTML tags (e.g. <img src="path">) as well as injection of well known HTML attribute names in a single or double quoted attribute value (e.g. ' href="url"). The security level Strict prevents injection of any kind of HTML tags as well as injection of any kind of HTML attribute names in a single or double quoted attribute value.

HTML_PATH:

The group contains deny rules preventing UNIX command injections through HTTP parameter values.

UNIXCMD_PARAM_VALUE:

The group contains deny rules preventing UNIX command injections through HTTP header values.

UNIXCMD_HEADER_VALUE:

The group contains deny rules preventing Windows command injections through HTTP parameter values.

WINCMD_PARAM_VALUE:

The group contains deny rules preventing Windows command injections through HTTP header values.

WINCMD_HEADER_VALUE:

Prevents LDAP query injection in parameter values

LDAP_PARAM_VALUE:

Prevents LDAP query injection in header values

LDAP_HEADER_VALUE:

Prevents PHP code injection in parameter values

PHP_PARAM_VALUE:

Prevents PHP code injection in header values

PHP_HEADER_VALUE:

Prevents OGNL injection

OGNL:

The group contains insecure direct object reference deny rules and file inclusion deny rules for parameter values. The security level Basic prevents directory traversal and injection of certain critical files (e.g. /etc/passwd). The security level Standard prevents injection of known top level directory paths (e.g. /etc/) and critical protocol schemes (e.g. "php://). The security level Strict further prevents injection of file paths with critical suffixes (e.g. .exe) any absolute Windows and UNIX directory path, any protocol scheme or path in universal naming convention format.

IDOR_PARAM_VALUE:

The group contains insecure direct object reference deny rules and file inclusion deny rules for HTTP paths. The security level Basic and Standard prevents directory traversal and injection of certain critical files (e.g. .htaccess). The security level Strict further prevents injection of file paths with critical suffixes (e.g. .exe).

IDOR_PATH:

Prevents NoSQL injection in parameter names

NOSQL_PARAM_NAME:

Prevents NoSQL injection in parameter values

NOSQL_PARAM_VALUE:

Prevents NoSQL injection in header values

NOSQL_HEADER_VALUE:

Prevents injection of special encoded characters in parameter names.

SANITY_PARAM_NAME:

Prevents injection of special encoded characters in parameter values.

SANITY_PARAM_VALUE:

Prevents injection of special encoded characters in header names.

SANITY_HEADER_NAME:

Prevents injection of special encoded characters in header values.

SANITY_HEADER_VALUE:

Prevents injection of special encoded characters in HTTP paths.

SANITY_PATH:

Prevents injection of special encoded characters, such as double URL encoded characters in parameter values.

ENCONV_PARAM_VALUE:

Prevents injection of special encoded characters, such as double URL encoded characters in header values.

ENCONV_HEADER_VALUE:

Prevents HTTP response splitting by blocking injection of an HTML response body or response header.

HRS:

Prevents HTTP parameter pollution by blocking nested parameters in parameter values.

HPP:

The group prevents injections of special payloads not covered by the other Deny Rule groups.

MISC_EXPLOITS:

Prevents automated scanning with standard tools

SCANNING:

Prevents SSRF attacks in Parameter Value.

Included Deny Rules:

Prevents SSRF attacks in Header Value.

Included Deny Rules:

Prevents access from bots, crawlers and scrapers.

Included Deny Rules: