| Server IP : 20.75.53.88 / Your IP : 216.73.217.72 [ Web Server : Apache System : Linux VMRALP-3 4.4.0-256-generic #290~14.04.1-Ubuntu SMP Thu Jun 20 09:24:50 UTC 2024 x86_64 User : www-data ( 33) PHP Version : 5.5.9-1ubuntu4.29+esm15 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority, Domains : 3 Domains MySQL : ON | cURL : OFF | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /proc/self/root/usr/share/modsecurity-crs/lua/ |
Upload File : |
#!/usr/bin/lua
require("io");
function main()
local anomaly_score = m.getvar("TX.ANOMALY_SCORE", "none");
m.log(4, "Anomaly Score is: " .. anomaly_score .. ".");
local remote_addr = m.getvar("ARGS.REMOTE_ADDR", "none");
m.log(4, "Remote IP is: " .. remote_addr .. ".");
local ip_hostname = m.getvar("IP.HOSTNAME", "none");
if ((anomaly_score ~= nil) and (ip_hostname == nil)) then
local hostname = "NONE";
local abuse_contact = "NONE";
n = os.tmpname ()
os.execute ("nslookup '" .. remote_addr .. "' > " .. n)
os.execute ("whois '" .. remote_addr .. "' >> " .. n)
for line in io.lines (n) do
if string.match(line, "name = ") then
hostname = line
end
if string.match(line, "abuse") then
abuse_contact = line
end
end
m.log(4, "Hostname is: " .. hostname .. ".");
m.setvar("tx.hostname", hostname);
m.log(4, "Abuse Contact is: " .. abuse_contact .. ".");
m.setvar("tx.abuse_contact", abuse_contact);
os.remove (n)
return("Nslookup: " .. hostname .. " and WHOIS Abuse Info: " .. abuse_contact .. "");
end
return nil;
end