101 lines
6.8 KiB
Plaintext
101 lines
6.8 KiB
Plaintext
|
100
|
||
|
|
1 1 User-Agent:\s.*.abc.net 2 0 0 1
|
||
|
|
2 2 (#\d{1,2}){20} 2 0 0 1
|
||
|
|
3 3 (((DestFile|encryptPass)\x3D[^\x26]{50})|((BaseDN|SearchFilter)\x3D[^\x26]{128})) 2 0 0 1
|
||
|
|
4 4 (((c|l)pi\x00.{1}(-\d|0)\x21)|(columns\x00.{1}(-\d|0)\x21)|(page-(right|left|top|bottom)\x00.{1}(-\d|0|([3-9]\d{5}|24\d{4}|236\d{3}|23593\d{1}|23592[2-9])\x21))) 2 0 0 1
|
||
|
|
5 5 (,\d{1,3}){20} 2 0 0 1
|
||
|
|
6 6 (3BFFE033-BF43-11d5-A271-00A024A51325|iNotes6\.iNotes6|E008A543-CEFB-4559-912F-C27C2B89F13B|dwa7\.dwa7) 2 0 0 1
|
||
|
|
7 7 (?P<obj>[A-Z\d_]+)\.DataURL\s*=\s*(\x22[^\x22]{128}|\x27[^\x27]{128}) 2 0 0 1
|
||
|
|
8 8 (Context|Action)\x3D[^\x26\x3b]{1024} 2 0 0 1
|
||
|
|
9 9 (DisableSandboxAndDrop|ConfusedClass|FieldAccessVerifierExpl)\.class 2 0 0 1
|
||
|
|
10 10 (INSERT|UPDATE)\s*[\s\w]*((mysql\.)?func)[^\r\n]+values\s*\([^\)]+\x2c[\x22\x27][^\x22\x27]*\x2f 2 0 0 1
|
||
|
|
11 11 (Image|Doc) 2 0 0 1
|
||
|
|
12 12 (OvAcceptLang|Accept-Language)\s*[\x3D\x3A]\s*[^\n]{69} 2 0 0 1
|
||
|
|
13 13 (OvJavaScript|OvTitleFrame|OvHelpWindow|OvMap|OvSession|OvJavaLocale|OvOSLocale|OvWebSession)\s*\x3D[^\x3B\x2C]{1024} 2 0 0 1
|
||
|
|
14 14 (Set|Check)\x10Properties 2 0 0 1
|
||
|
|
15 15 (USER|PASS)[^\x80-\xff]*[\x80-\xff] 2 0 0 1
|
||
|
|
16 16 ([sp]key|csk)=[^\r\n\x26]+(script|onclick|onload|onmouseover|html|[\x22\x27\x3c\x3e\x28\x29]) 2 0 0 1
|
||
|
|
17 17 (\x22|\x27)daap\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256} 2 0 0 1
|
||
|
|
18 18 (\x22|\x27)itms\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256} 2 0 0 1
|
||
|
|
19 19 (\x22|\x27)itmss\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256} 2 0 0 1
|
||
|
|
20 20 (\x22|\x27)itpc\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256} 2 0 0 1
|
||
|
|
21 21 (\x22|\x27)pcast\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256} 2 0 0 1
|
||
|
|
22 22 (\x25(n|t|d)\x20){85} 2 0 0 1
|
||
|
|
23 23 (\x3F|\x26)[^\x3D]*(\x27|%27)[^\x3D]*(\x3C|%3c)script(\x3E|%3e) 2 0 0 1
|
||
|
|
24 24 (\x40\x09.{19}|\x41\x0b.{23})[\xf0-\xff].{8}\x01\x00[\x00\x01\x02\x04\x08\x10\x18\x20]\x00 2 0 0 1
|
||
|
|
25 25 (^|&)SelectedID=[^&]+?(\x3B|%3B) 2 0 0 1
|
||
|
|
26 26 (^|&)paths(%5b|\x5b)(%5d|\x5d)=[^&]*?(%2e|\x2e){2}(%2f|\x2f) 2 0 0 1
|
||
|
|
27 27 (^|&)selectedLocale=[^&]+?([\x22\x27]|%22|%27) 2 0 0 1
|
||
|
|
28 28 (^|[\x3b\x7b\x7d]|%3b|%7b|%7d)O(%3a|\x3a)(\x2b|%2b)?[0-9]+?(%3a|\x3a)(%22|\x22) 2 0 0 1
|
||
|
|
29 29 (action|setup)=[a-z]{1,4} 2 0 0 1
|
||
|
|
30 30 (arg=[^\x26]*?OVwSelection[^\x26]*?\x26.*?sel=[^\s\x26]{1023}|sel=[^\x26]{1023,}\x26.*?arg=[^\s\x26]*?OVwSelection) 2 0 0 1
|
||
|
|
31 31 (caption,\x22\x5c\x5c\x5c|\x22\x5cn\x5cn\x5cn\x22\x20\x2b\x20str) 2 0 0 1
|
||
|
|
32 32 (data_select1|nameParams|schdParams|text1|schd_select1)=[^\x26]{512} 2 0 0 1
|
||
|
|
33 33 (displayWidth[\x2b\x20]\d[^\x2b\s\n]{128}) 2 0 0 1
|
||
|
|
34 34 (filename|type)=[^\x26]*?\x2E\x2E 2 0 0 1
|
||
|
|
35 35 (ora_osb_bgcookie|rbtool)=[^\x20\x26\x3b]{1} 2 0 0 1
|
||
|
|
36 36 (sIda\/sId|urua\/uru)[abcd]\.classPK 2 0 0 1
|
||
|
|
37 37 .{20}[\x01\x02]\x00\x03\x00.*?\x5c\x00\x5c\x00 2 0 0 1
|
||
|
|
38 38 5FDC81917DE08A41A6AC(E9B8ECA1EE.8|.98ECB1EEA8E) 2 0 0 1
|
||
|
|
39 39 <FILE>(\x2e\x2e\x5c|%2E%2E%5C){2}[^<]+?</FILE> 2 0 0 1
|
||
|
|
40 40 <SelectedID>[^<]+?(\x3B|%3B) 2 0 0 1
|
||
|
|
41 41 <[^>]*?style\s*[>=].{1,1024}margin\s*\x3a\s*[^\x3b\x7d]*?-(\d{4}|1[0-9][1-9]|[2-9]\d\d)[ce][mx].*?[\x7b\x3b] 2 0 0 1
|
||
|
|
42 42 <\?(php)?.{1,256}define\s*\x28\s*str_repeat\s*\x28\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s*\x2c\s*\x24argv 2 0 0 1
|
||
|
|
43 43 <\s*object[^>]*?data\s*\x3A[^,>]*?base64 2 0 0 1
|
||
|
|
44 44 <\s*valitem[^>]*\s(value|name)\s*=\s*([\x22\x27])[^\x22\x27]{104} 2 0 0 1
|
||
|
|
45 45 <\x21DOCTYPE\s+[^>]*?SYSTEM[^>]*?>.*?\x2EparseError 2 0 0 1
|
||
|
|
46 46 <\x21ENTITY[^>]+SYSTEM[^>]+http\x3A\x2F\x2F[^>\s]+http\x3A\x2F\x2F 2 0 0 1
|
||
|
|
47 47 <applet[^>]+(archive|src)\s*?=\s*?(\x22|\x27|)\s*?(\d{5}\.jar|[^>]+\/\d{5}\.jar) 2 0 0 1
|
||
|
|
48 48 <figure[^>]+?dir\s*?=\s*?[\x22\x27]\s*?rtl\s*?[\x22\x27].*?(&#?x?[a-z\d]{2,4}\x3b){100} 2 0 0 1
|
||
|
|
49 49 <iframe[^>]*?height\x3d\s*[\x22\x27]?\s*[0-9]{6} 2 0 0 1
|
||
|
|
50 50 <script[^>]*?for\s*=\s*[\x22\x27]?.*?event\s*=\s*[\x22\x27]?onpropertychange[\x22\x27]?[^>]*?> 2 0 0 1
|
||
|
|
51 51 <script[^>]*src\s*=\s*[\x22\x27][^\x22\x27]*\.json[\x22\x27][^>]*language=vbs 2 0 0 1
|
||
|
|
52 52 <title>CRiMEPACK [\d\.]+</title> 2 0 0 1
|
||
|
|
53 53 <treechildren.*?ordinal=.*?<treechildren 2 0 0 1
|
||
|
|
54 54 <zombis>\s*<JUNIPER-M3>.*?</JUNIPER-M3>\s*</zombis> 2 0 0 1
|
||
|
|
55 55 AdminServlet.*(userid|adminurl)[^\x26\x20\x0a]*<script 2 0 0 1
|
||
|
|
56 56 Authorization\s*\x3A\s*Basic\s*[^\n]{437} 2 0 0 1
|
||
|
|
57 57 Collab\x2EaddStateModel\s*\x28\s*\x7B.*cName\s*\x3A\s*\x22(\x22|\x5Cx00) 2 0 0 1
|
||
|
|
58 58 ComputerName\s*\x3d\s*\x22[^\x22]{256} 2 0 0 1
|
||
|
|
59 59 Content-Type\x3A\s*misc/ultravox.+?(\r?\n){2}\x5A.9\x01 2 0 0 1
|
||
|
|
60 60 CreationDate\x28[^\x3c\x29]{500} 2 0 0 1
|
||
|
|
61 61 DBMS_ASSERT\x2Esimple_sql_name\x28[^\x29\x22]*?\x22 2 0 0 1
|
||
|
|
62 62 EnteredAttrName=[^&]{32} 2 0 0 1
|
||
|
|
63 63 Entry\x20\x2f[^\x2f]*\x2f[^\x2f]{68} 2 0 0 1
|
||
|
|
64 64 ExecWB\s*\x28\s*[^\x2c\x29]*(7|IDM_PRINTPREVIEW)[^\x29]+http\x3a\x2f\x2f 2 0 0 1
|
||
|
|
65 65 FILECODE=[^&]{96} 2 0 0 1
|
||
|
|
66 66 HEADER[\x20\r]*\n[\x20]*9[\x20\r]*\n\x24[^\n]{92} 2 0 0 1
|
||
|
|
67 67 HTTP\/1.[01]\r\nUser\x2dAgent\x3a\x20[ -~]+\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.info\r\n 2 0 0 1
|
||
|
|
68 68 HostList=([^\r\n\x3B]{,296}\x3B)*[^\r\n\x3B]{297} 2 0 0 1
|
||
|
|
69 69 Host\x3A\s*[^\x0D\x0A]{121} 2 0 0 1
|
||
|
|
70 70 Hostname\x3D[^\x26\x3F\x3B\x0D\x0A\s]{300} 2 0 0 1
|
||
|
|
71 71 ICount\x3D\x2D[^\x26\x3F\x3B\x0D\x0A\s]{300} 2 0 0 1
|
||
|
|
72 72 IP=(https?|ftps?) 2 0 0 1
|
||
|
|
73 73 InformixServerList=([^\r\n\x3B]{,293}\x3B)*[^\r\n\x3B]{294} 2 0 0 1
|
||
|
|
74 74 Libs\/Starter(CmdExec|NetUtils|Rec|ScreenShots|Settings)\.py 2 0 0 1
|
||
|
|
75 75 Math\x2efloor([^\x7d]{1,3})?\x7dcatch\x28 2 0 0 1
|
||
|
|
76 76 Math\x2eround([^\x7d]{1,3})?\x7dcatch\x28 2 0 0 1
|
||
|
|
77 77 MaxAge\x3D[^\x26\x3F\x3B\x0D\x0A]{300} 2 0 0 1
|
||
|
|
78 78 Oid\x3D[^\x0D\x0A]{1000} 2 0 0 1
|
||
|
|
79 79 OvAcceptLang\s*\x3d\s*[^\x3b\n]{300} 2 0 0 1
|
||
|
|
80 80 OvOSLocale\s*\x3d\s*[^\x3b\s]{249} 2 0 0 1
|
||
|
|
81 81 Referer\x3a[^\x0d\x0a]*\/world\/ 2 0 0 1
|
||
|
|
82 82 Referer\x3a\s*?http\x3a\x2f{2}[a-z0-9\x2e\x2d]+\x2fs\x2f\x3fk\x3d 2 0 0 1
|
||
|
|
83 83 RegExp?\x23.{0,5}\x28\x3f[^\x29]{0,4}i.*?\x28\x3f\x2d[^\x29]{0,4}i.{0,50}\x7c\x7c 2 0 0 1
|
||
|
|
84 84 SET_(SENDFROM|MAILHOST)\x28\x27[^\x27]{256} 2 0 0 1
|
||
|
|
85 85 SOAPAction\x3A\s*?\x22[^\x22\x23]+?\x23([^\x22]{2048}|[^\x22]+$) 2 0 0 1
|
||
|
|
86 86 SYS\.LT\.FINDRICSET\([^,\)]*\'\'\|\| 2 0 0 1
|
||
|
|
87 87 SYS\x2eDBMS\x5fAQADM\x5fSYS\x2eGRANT\x5fTYPE\x5fACCESS\s*\x28\s*\x27[^\x2c\x20\x27]*[\x2c\x20] 2 0 0 1
|
||
|
|
88 88 SelectedSubTabId=[^>]*?([\x22\x27]|%22|%27)\s*?>\s*?<[^>]*?script 2 0 0 1
|
||
|
|
89 89 SignUrl=[^\x26\s]*[\x22\x27\x28\x29\x3C\x3E] 2 0 0 1
|
||
|
|
90 90 SoftwareRegistration\.do.*?updateRegn=[^\x26\r\n]+(script|onclick|onload|onmouseover|html) 2 0 0 1
|
||
|
|
91 91 TMlogonEncrypted=(\!|\%21)CRYPT(\!|\%21)[A-Z0-9]{512} 2 0 0 1
|
||
|
|
92 92 Template\x3D[^\x0D\x0A]{1000} 2 0 0 1
|
||
|
|
93 93 TimerMethod\x3D[^\x26]*[\x3C\x28\x22\x27] 2 0 0 1
|
||
|
|
94 94 USER\s*[^\x0d]+\x25\x27 2 0 0 1
|
||
|
|
95 95 User-Agent\:[^\x0a\x0d]+?Havij 2 0 0 1
|
||
|
|
96 96 User-Agent\x3A\s+?mus[\x0d\x0a] 2 0 0 1
|
||
|
|
97 97 User-Agent\x3a[^\x0d\x0a]*Java\/1\. 2 0 0 1
|
||
|
|
98 98 User-Agent\x3a\x20Agent\d{5,9} 2 0 0 1
|
||
|
|
99 99 User-Agent\x3a\x20[^\n]*?WinHttp\x2eWinHttpRequest.*?\n 2 0 0 1
|
||
|
|
100 100 Visio \x28TM\x29 Drawing\r\n\x00{4}([^\x00]|\x00[^\x00]|\x00\x00[^\x01-\x06\x0b]|\x00\x00[\x01-\x06\x0b][^\x00]) 2 0 0 1
|