Htaccess File

cerpac/hobbyLink/master/public/uploads/.htaccess

GET, HTTP_HOST, HTTP_REFERER, POST, QUERY_STRING, REMOTE_ADDR, REQUEST_FILENAME, REQUEST_URI
# Don't list directory contents

IndexIgnore *

# Disable script execution

AddHandler cgi-script .php .php2 .php3 .php4 .php5 .php6 .php7 .php8 .pl .py .js .jsp .asp .htm .html .shtml .sh .cgi

Options -ExecCGI -Indexes

 

# Only allow access to this directory if they are coming from your domain; excluding you, your server, Google and any other IPs

RewriteEngine On

RewriteCond %{REMOTE_ADDR} !^(xxx.xxx.xxx.xxx|xxx.xxxxxx.xxx|66.249.)

RewriteCond %{HTTP_HOST} !^(127.0.0.0|localhost) [NC]

RewriteCond %{HTTP_REFERER} !^https?://(.+.)?kodewebsites.com/ [NC]

RewriteRule .* http://kodewebsites.com/ [L]

 

# Secure php.ini and .htaccess

RewriteRule ^(php.ini|.htaccess) - [NC,F]

 

# Block shell uploaders, htshells, and other baddies

RewriteCond %{REQUEST_URI} ((php|my|bypass)?shell|remview.*|phpremoteview.*|sshphp.*|pcom|nstview.*|c99|c100|r57|webadmin.*|phpget.*|phpwriter.*|fileditor.*|locus7.*|storm7.*).(p?s?x?htm?l?|txt|aspx?|cfml?|cgi|pl|php[3-9]{0,1}|jsp?|sql|xml) [NC,OR]

RewriteCond %{REQUEST_URI} (.exe|.php?act=|.tar|_vti|afilter=|algeria.php|chbd|chmod|cmd|command|db_query|download_file|echo|edit_file|eval|evil_root|exploit|find_text|fopen|fsbuff|fwrite|friends_links.|ftp|gofile|grab|grep|htshell| -dump|logname|lynx|mail_file|md5|mkdir|mkfile|mkmode|MSOffice|muieblackcat|mysql|owssvr.dll|passthru|popen|proc_open|processes|pwd|rmdir|root|safe0ver|search_text|selfremove|setup.php|shell|ShellAdresi.TXT|spicon|sql|ssh|system|telnet|trojan|typo3|uname|unzip|w00tw00t|whoami|xampp) [NC,OR]

RewriteCond %{QUERY_STRING} (.exe|.tar|act=|afilter=|alter|benchmark|chbd|chmod|cmd|command|cast|char|concat|convert|create|db_query|declare|delete|download_file|drop|edit_file|encode|environ|eval|exec|exploit|find_text|fsbuff|ftp|friends_links.|globals|gofile|grab|insert|localhost|logname|loopback|mail_file|md5|meta|mkdir|mkfile|mkmode|mosconfig|muieblackcat|mysql|order|passthru|popen|proc_open|processes|pwd|request|rmdir|root|scanner|script|search_text|select|selfremove|set|shell|sql|sp_executesql|spicon|ssh|system|telnet|trojan|truncate|uname|union|unzip|whoami) [NC]

RewriteRule .* - [F]

 

# Disable hotlinking of images

RewriteCond %{HTTP_REFERER} !^$

RewriteCond %{REQUEST_FILENAME} -f

RewriteCond %{REQUEST_FILENAME} .(jpe?g?|png|gif|ico|pdf|flv|swf|gz)$ [NC]

RewriteCond %{HTTP_REFERER} !^https?://([^.]+.)?kodewebsites. [NC]

RewriteRule .(jpe?g?|png|gif|ico|pdf|flv|swf|gz)$ - [NC,F]

 

# Only the following file extensions are allowed

Order Allow,Deny

Deny from all

<FilesMatch ".([Jj][Pp][Ee]?[Gg]?|[Pp][Nn][Gg]|[Gg][Ii][Ff]|[Gg][Zz]|[Pp][Dd][Ff])$">

Allow from all

</FilesMatch>

 

# Block double extensions from being uploaded or accessed, including htshells

<FilesMatch ".*.([^.]+).([^.]+)$">

Order Deny,Allow

Deny from all

</FilesMatch>

 

# Only allow GET and POST HTTP methods

<LimitExcept GET POST>

Deny from all

</LimitExcept>
Exit mobile version