OK I like this better:
RewriteEngine On
ServerSignature Off
RewriteCond %{QUERY_STRING} ^$
RewriteCond %{REQUEST_METHOD} ^GET$ [NC]
RewriteCond %{REQUEST_URI} ^[a-z0-9\-_\.\/]+\.(jpg|gif|png|jpeg|html|htm|php)$ [NC]
RewriteRule ^(.*)$ - [L]
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR]
RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR]
RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC]
RewriteRule (.*) http://www.godaddy.com/?
Three things have changed since the first version: I ditched the line
RewriteCond %{QUERY_STRING} ^.*\.[A-Za-z0-9].* [NC,OR]
... because I have no idea where he was going: a query string with any amount of any character, followed by a period, followed by A-Z0-9 followed by any character... completely lost me on what kind of restriction that is.
The ditched the UA restrictions because I think that killing a surfer because it's robotic would be the responsibility of the site master rather that at the server level. There are many times I'm plenty happy if a bot is working me.
Lastly, I moved to an optimistic "header" in the sequence, that asks:
If the query string is blank (and)
the request method is cleanly GET (and)
the url contains nothing except A-Z0-9-_/. and is tailed by "." and then either jpg/gif/png etc at the end... then I call it a vanilla URL and stop processing. Why? Because the VAST majority of the time I will have simple requests from normal surfers and rather than imposing all of the RewriteConds on every single request (bear in mind, this is for EVERY file, including graphics) I'll pass the vast majority of requests. This will help in throughput of the vFirewall. This means that all calls for a PDF, flash, POSTS etc will still run through the entire process. Interested in any comments you might have here.
Lastly, rather than keeping the surfer here, I've bounced them to a blackhole site. The problem I found was that in the httpd.conf <Directory> area I can't seem to bounce them to a static file on my box... so instead I redirect away. I could redirect them right back to my own box and a black hole file, but then I'm taking two hits for one bonehead call...
Thoughts?
