%63%72%69%70%74|\\bscr\\x00ipt)\\b[^>]*?(?:>|%3E)/','/(substring\\(|bin\\(|ord\\(|hex\\(|char\\(|system\\(|;return|exec\\()/','/(?i)drop\\s+table\\s*/','/(?i)(?:^|[\\/=])(archive|backups?|db|database|dump|sqldump|master|sql|site|web|www|wwwroot|public_?html|htdocs|wordpress|joomla|magento)\\.(zip|gz|tgz|tar|rar|7z|sql|bak|bz2)\\b/','/(?:ActiveXObject|XMLHttpRequest|xhr\\s*=|r\\s*=\\s*new\\s*XMLHttpRequest)/','/(?i)\\b\\(?[\\"\']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:\\/(?:\\*.*\\*\\/|\\/.*)|#.*|[\\s\\x0b\\"])*[\\"\']*\\)?[\\s\\x0b]*\\(.*\\)/','/(?i)[\\s\\x0b\\(\\)]case[\\s\\x0b]+when.*?then|\\)[\\s\\x0b]*?like[\\s\\x0b]*?\\(|select.*?having[\\s\\x0b]*?[^\\s\\x0b]+[\\s\\x0b]*?[^\\s\\x0b0-9A-Z_a-z]|if[\\s\\x0b]?\\([0-9A-Z_a-z]+[\\s\\x0b]*?[<->~]/','/(?i)(\\{\\{.*?\\}\\}|\\{\\{\\{.*?\\}\\}\\}|#\\{.*?\\}|\\$\\{.*?\\}|<%=\\s*.*?%>|\\{\\{=.*?\\}\\}|\\{\\^.*?\\}.*?\\{\\/.*?\\}|\\[\\[\\$\\{.*?\\}\\]\\])/','bash -c ','update_server_ajax_impact','/(?i)(union[\\s\\/*()]+(all[\\s\\/*()]+)?select|\\binsert\\s+into\\b|\\bdrop\\s+(table|database)\\b|\\bdelete\\s+from\\b|\\b(sleep|benchmark|pg_sleep|extractvalue|updatexml|load_file|group_concat|elt)\\s*\\(|\\bwaitfor\\s+delay\\b|\\bexec(ute)?\\s+(immediate|sp_|xp_)|\\bcreate\\s+user\\b|\\bgrant\\s+(all|select|connect|resource|usage|execute)\\b|\\bdeclare\\s+@\\w+\\s+(n?varchar|n?char|int|table|cursor)|\\bhaving\\s+\\d+\\s*=\\s*\\d+|\\bgroup\\s+by\\s+[\\w.]+\\s+having\\b|\\bprocedure\\s+analyse\\b|information_schema|@@(version|hostname|datadir|basedir|global)|\\bxp_cmdshell\\b|utl_http\\.request|utl_inaddr|into\\s+(outfile|dumpfile))/','/(\\$where\\b|\\$ne\\b|\\$gte?\\b|\\$lte?\\b|\\$nin\\b|\\$regex\\b|\\$elemMatch\\b|\\$mod\\b|\\$or\\b|\\$comment\\b|\\.mapReduce\\s*\\(|db\\.\\w+\\.(insert|find|update|remove|drop|mapReduce)\\s*\\(|this\\.(password|passwordzz))/','/(?i)\\b(etc|proc|sys|usr|var|opt|root|boot|mnt|apache2?|cpanel|inetpub|winnt)\\/[\\w.%\\/-]*?(passwd|shadow|group\\b|environ|cmdline|\\bmaps\\b|\\bstatus\\b|messages\\b|secure\\b|\\bhosts\\b|\\bmotd\\b|httpd|apache|nginx|access[_.-]?log|error[_.-]?log|\\blog\\b|\\blogs\\b|\\.log\\b|security\\b|cpanel\\.config|my\\.cnf|id_[rd]sa|\\.pem\\b|secret|\\.htpasswd|\\.htaccess|\\.ssh\\b|\\.aws\\b|\\.bash|self\\b|wp-config|config\\.php|\\.env\\b)/','/(?i:)\\.(p(h(pt?|t(ml?)?|ar)[0-9]?|l|y)|(j|a)sp|aspx|sh|shtml|html?|cgi|htaccess|user\\.ini)($|\\.)/','/(?i:\\|\\|\\s*utl_http\\.request\\s*\\()/','/(?i)(]{0,200}(\\[|system|public)|]*?(?:"|\')?/','/(?i)(\\b(wso|r57|r99|c99|c100|b374k|alfashell|alfa[-_](team|shell)|indoxploit|hmei7|hax0r|haxor|sh3ll|priv8|r00t|r3vn330|madspot|marijuana|gel4y|foxwso|sidewso|sym403|sym404|bkv74|lock360|leafmailer|filesman|wpbackdoor|0byte|mini[-_]?shell|webshell|backdoor|reverse[-_]?shell|raiz0|sux0r|deathshop|deadcode|indosec)\\b[\\w.-]{0,24}\\.(?:php\\d?|phtml|phar|pht|asp|aspx|jsp|jspx|cgi|pl|py|shtml)|\\/(admin-?upload|file-?upload|uploadify|upload_?file|backdoor|wso|c99|c100|b374k|webshell|r57|r99)[\\w-]{0,12}\\.php|eval-stdin\\.php|\\/(mobiquo|tapatalk)\\/[\\w\\/-]{0,40}\\.php)/','/(?i)\\[?\\$(?:n(?:e|in?|o[rt])|e(?:q|xists|lemMatch)|l(?:te?|ike)|mod|a(?:ll|nd)|(?:s(?:iz|lic)|wher)e|t(?:ype|ext)|x?or|div|between|regex|jsonSchema)\\]?/','/(?i)@@\\w+/','/(?i)\\b(or|and)\\b([\\s(]*[\\x22\\x27]?[\\w.]+[\\x22\\x27]?[\\s)]*((=|<>|!=|<=|>=)[\\s(]*[\\x22\\x27]?[%\\w]+|like[\\s(]*[\\x22\\x27]?%|is\\s+(not\\s+)?null)|\\s+(true|false)\\b|\\s+\\d+\\s*(--|#|\\/\\*)|[\\s(]*[\\x22\\x27]{2}\\s*[-=&^*\\x22\\x27])/','/(?i)(%3c\\s*(%2f)?\\s*script(?![\\w%+]{0,40}application)|&#x?0*(3c|3e|60|62);?|\\\\(?:u003c|x3c)\\s*\\/?\\s*(?:script|img|svg|iframe|object|embed|details|video|audio|marquee|body|form|input|style|base|math|link)|<\\s*\\/?\\s*script|:|(|&newline;|&tab;|fromcharcode|\\.outerhtml)/','/(?i)(?:^|[^A-Za-z0-9])(?:\\.\\.[\\/\\\\]|[\\/\\\\]\\.\\.)(?:[\\w.%\\/\\\\-]{0,80})/','/(?i)union.*?select/','/((__(construct|destruct|call|callStatic|get|set|isset|unset|sleep|wakeup|serialize|unserialize|toString|invoke|set_state|clone|debugInfo)|objectclass)|:"stdClass":[0-9]+:\\{)/','/((?:\\.\\.[\\/\\\\])|(?:\\.\\.(?:%2[fF]|%5[cC]))|(?:(?:%2[eE]){2}(?:[\\/\\\\]|%2[fF]|%5[cC]))|(?:(?:%25(?:2[eE])){2}(?:%25(?:2[fF]|5[cC]))))/','/((@copy|\\$_(files|get|post)|allow_url_(fopen|include)|auto_prepend_file|blexbot|browsersploit|call_user_func_array|(php|web)shell|curl(_exec|test)|disable_functions?|document_root))/','/(?i)(?:\\{\\{=?|\\$\\{|#\\{|<%=?|\\{%|\\[\\[\\$\\{)[^}%>]{0,200}?(?:\\d{1,7}\\s*[-+*\\/%]\\s*\\d{1,7}|process|mainmodule|require|constructor|child_process|popen|subprocess|\\bexec\\b|\\beval\\b|\\bsystem\\b|runtime|getruntime|processbuilder|getclass|forname|\\.class\\b|__\\w{2,20}__|java\\.|javax\\.|lang\\.|\\bos\\.|commands\\.|self\\.env|_self\\.|registerundefined|getfilter|freemarker|scriptengine|nashorn|groovy|lipsum|cycler)[^}%>]{0,200}?(?:%[}>]|\\})/','/(<\\!\\[CDATA\\[\\s*(?:<|>)*\\s*(?:SCRIPT|script)\\s*(?:>|\\]\\]>)|(?:alert\\(|javascript:))/',array('uip-framed-page','javascript:date'),'/(?i:load_file\\s*\\(\\s*char\\s*\\()/','oembed/','w, https://','/[?&](url|goto)=https?:/','/((s)?(ftp|http|inurl|php)(s)?(:(\\/|%2f|%u2215)(\\/|%2f|%u2215)))/','/((?]{0,80}application\\/(ld\\+json|json))|<\\s*\\/\\s*script\\s*>|javascript\\s*:|vbscript\\s*:|data\\s*:\\s*text\\/html|document\\.cookie|document\\.write|String\\.fromCharCode|\\bon(error|load|mouseover|mouseout|mouseenter|mouseleave|mousedown|mouseup|click|dblclick|focus|focusin|blur|submit|toggle|animationstart|animationend|beforescriptexecute|readystatechange|pointerover|pointerdown|wheel|keydown|keypress|keyup|contextmenu|hashchange|popstate|loadstart)\\s*=)/',array('instance-data/latest/','169.254.169.254/latest/','2852039166/latest/','025177524776/latest/','0251.0376.0251.0376/latest/','0xA9.0xFE.0xA9.0xFE/latest/','0xA9FEA9FE/latest/','0251.254.169.254/latest/','[::ffff:a9fe:a9fe]/latest/','[0:0:0:0:0:ffff:a9fe:a9fe]/latest/','[0:0:0:0:0:ffff:169.254.169.254]/latest/','169.254.169.254.nip.io/latest/','nicob.net/redir-http-169.254.169.254:80-','2130706433/','3232235521/','3232235777/','2852039166/','[::]:','localtest.me','127.0.0.1.nip.io','127.127.127.127','127.0.1.3','127.0.0.0','127.0.0.1','0.0.0.0','localhost','0177.0.0.1/','[::1]','[0000::1]','[::ffff:127.0.0.1]','[0:0:0:0:0:ffff:127.0.0.1]','://0/','://0:','127.1','127.0.1','169.254.170.2/v2','169.254.169.254/computeMetadata/v1/','metadata.google.internal/computeMetadata/v1/','metadata/computeMetadata/v1/','2852039166/computeMetadata/v1/','025177524776/computeMetadata/v1/','0251.0376.0251.0376/computeMetadata/v1/','[::ffff:a9fe:a9fe]/computeMetadata/v1/','[0:0:0:0:0:ffff:a9fe:a9fe]/computeMetadata/v1/','[0:0:0:0:0:ffff:169.254.169.254]/computeMetadata/v1/','169.254.169.254.nip.io/computeMetadata/v1/','0xA9.0xFE.0xA9.0xFE/computeMetadata/v1/','0xA9FEA9FE/computeMetadata/v1/','0251.254.169.254/computeMetadata/v1/','gopher://metadata.google.internal','metadata.google.internal/computeMetadata/v1/instance/disks/?recursive=true','metadata.google.internal/computeMetadata/v1beta1/','169.254.169.254/metadata/v1.json','https://metadata.packet.net/userdata','169.254.169.254/metadata/v1/','169.254.169.254/metadata/instance?api-version=2017-04-02','169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text','2852039166/metadata/v1/','025177524776/metadata/v1/','0251.0376.0251.0376/metadata/v1/','[::ffff:a9fe:a9fe]/metadata/v1/','[0:0:0:0:0:ffff:a9fe:a9fe]/metadata/v1/','[0:0:0:0:0:ffff:169.254.169.254]/metadata/v1/','169.254.169.254.nip.io/metadata/v1/','0xA9.0xFE.0xA9.0xFE/metadata/v1/','0xA9FEA9FE/metadata/v1/','0251.254.169.254/metadata/v1/','169.254.169.254/openstack','169.254.169.254/2009-04-04/meta-data/','192.0.0.192/latest/','100.100.100.200/latest/meta-data/','rancher-metadata/','127.0.0.1:2375','2130706433:2375/','[::]:2375/','[0000::1]:2375/','[0:0:0:0:0:ffff:127.0.0.1]:2375/','017700000001:2375/','0x7f000001:2375/','0xc0a80014:2375/','127.0.0.1:2379','169。254。169。254','169。254。169。254','⑯⑨。②⑤④。⑯⑨。②⑤④','⓪ⓧⓐ⑨。⓪ⓧⓕⓔ。⓪ⓧⓐ⑨。⓪ⓧⓕⓔ','⓪ⓧⓐ⑨ⓕⓔⓐ⑨ⓕⓔ','②⑧⑤②⓪③⑨①⑥⑥','④②⑤。⑤①⓪。④②⑤。⑤①⓪','⓪②⑤①。⓪③⑦⑥。⓪②⑤①。⓪③⑦⑥','⓪⓪②⑤①。⓪⓪⓪③⑦⑥。⓪⓪⓪⓪②⑤①。⓪⓪⓪⓪⓪③⑦⑥','[::①⑥⑨。②⑤④。⑯⑨。②⑤④]','[::ⓕⓕⓕⓕ:①⑥⑨。②⑤④。⑯⑨。②⑤④]','⓪ⓧⓐ⑨。⓪③⑦⑥。④③⑤①⑧','⓪ⓧⓐ⑨。⑯⑥⑧⑨⑥⑥②','⓪⓪②⑤①。⑯⑥⑧⑨⑥⑥②','⓪⓪②⑤①。⓪ⓧⓕⓔ。④③⑤①⑧','jar:127.0.0.1!/','jar:https://127.0.0.1!/','jar:ftp://127.0.0.1!/','gopher://127.0.0.1','gopher://localhost','localhost:9001/2018-06-01/runtime/'),'/(?i)([\\x22\\x27`]\\s*(--\\s|--$|#\\s|#$)|[\\w)][\\x22\\x27`]\\s*\\/\\*|\\/\\*![0-9]*|;\\s*(select|insert|update|delete|drop|exec|declare|union|alter|create|truncate)\\b|\\bselect\\b[\\s\\S]{0,60}?\\bfrom\\b|[\\s,(=]0x[0-9a-f]{8,}(?!\\))|\\border\\s+by\\s+\\d+\\s*(--|#)|\\bsql(vuln|map|attempt))/','/(?i)onerror\\s*=\\s*alert\\s*\\(/','/<%!--|<!--|--%3E|-->/','/(?i)(\\/etc\\/(passwd|shadow|hosts|group|gshadow|issue|motd|fstab)|(boot|win|php)\\.ini|\\/proc\\/self\\/(environ|cmdline|status|stat|fd|maps)|\\/windows\\/(win|system)\\.ini|win(nt|dows)?[\\/\\\\]system32|inetpub|global\\.asa|web\\.config|desktop\\.ini|httpd\\.conf|(?:^|[\\/\\\\])\\.(htaccess|htpasswd|bash_history|bashrc|bash_profile)\\b|[\\/\\\\]\\.(ssh|aws|git|env)\\b|\\bid_rsa\\b|\\/(access|error)[_.-]?log\\b|php:\\/\\/(filter|input)|phar:\\/\\/|expect:\\/\\/|data:\\/\\/|file:\\/\\/\\/|zip:\\/\\/|\\/wp-config\\.php)/','/(?i)create[\\s\\x0b]+function[\\s\\x0b].+[\\s\\x0b]returns|;[\\s\\x0b]*?(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)\\b[\\s\\x0b]*?[\\(\\[]?[0-9A-Z_a-z]{2,}/','/(?i)(<\\s*\\/?\\s*(object|embed|applet|base|frameset|isindex|keygen)[\\s\\/>]|\\b(alert|prompt|confirm|eval|expression|execScript|fromCharCode)\\s*\\(|srcdoc\\s*=|formaction\\s*=)/','/(?i)(?:\\/\\/|%2f%2f|@|%40|[=&?])(localhost|127(\\.\\d{1,3}){3}|0\\.0\\.0\\.0|\\[?::1\\]?|169\\.254\\.169\\.254|metadata\\.(google|aws|azure)\\b|2130706433)(?::\\d{1,5})?(?:$|[\\/?\\#&;\\x22\\x27]|%2f)/','/]*?(?:src\\s*=\\s*(?:"|\')?(?:javascript|http|%3C|%22|\\b404\\b)[^>]*?(?:>|%3E|>))/','