Skip to content

rules.md

Latest commit

 

History

History
51 lines (32 loc) · 1.01 KB

rules.md

File metadata and controls

51 lines (32 loc) · 1.01 KB
Raw

Detection Rules

These rules are intentionally simple so the project stays easy to read and modify while learning Java.

Path traversal probe

Flags request paths containing ../ or encoded %2e%2e segments.

Example:

GET /../../etc/passwd HTTP/1.1

Web shell probe

Flags PHP paths that mention upload, cmd, or shell.

Example:

GET /uploads/cmd.php HTTP/1.1

Admin login probe

Flags request paths containing /admin or /login.

Example:

GET /admin/login.php HTTP/1.1

WordPress probe

Flags common WordPress endpoints such as wp-login.php, xmlrpc.php, and /wp-admin.

Client error sources

Counts 4xx responses by source IP. This is not a detection by itself, but it helps spot clients that are repeatedly probing missing, blocked, or invalid paths during a small lab review.

Server error sources

Counts 5xx responses by source IP. This can point to clients triggering backend errors or to routes that need reliability review during a lab incident walkthrough.