ScanGuard — anti-scan
Bloque les requetes typiques de scanners (WordPress, PHP, fuite .env, scanners CVE) avant tout traitement applicatif. Reponse HTTP 403 avec page explicative.
4
Total bloque (depuis boot)
0
Hits patterns DB
4
Hits regex hardcodee
31
Patterns charges
Etat du ScanGuard ACTIF
Le filtrage anti-scan est actif.
Top 10 patterns par hits
| Pattern | Type | Categorie | Hits | Dernier hit |
|---|---|---|---|---|
| /wp-json/ | prefix | wp | 4328 | 2026-10-28T23:50:50.460772Z |
| <?php | query | injection | 1147 | 2026-10-20T16:37:01.865482Z |
| ${jndi: | query | injection | 362 | 2026-10-23T16:31:50.694528Z |
| /autodiscover/ | prefix | scanner | 96 | 2026-10-28T16:34:05.853216Z |
| <?= | query | injection | 3 | 2026-09-04T09:27:44.967269Z |
| XDEBUG_SESSION_START= | query | injection | 1 | 2026-10-20T17:41:51.584043Z |
Ajouter un pattern
Patterns built-in (regex hardcodee, lecture seule)
Toujours actifs, meme si la DB est indisponible. Pour laisser passer une categorie sur un hostname donne, ajoutez une exception ci-dessous.
| Categorie | Sous-pattern (regex) | Cible | Source | Hits |
|---|---|---|---|---|
| php-extension | (?i).*\.php$ | uri | built-in | 4 |
| asp-extension | (?i).*\.aspx?$ | uri | built-in | 0 |
| script-extension | (?i).*\.(jsp|cgi|env)$ | uri | built-in | 0 |
| wordpress | (?i).*/wp-(login|admin|content|includes)/?.* | uri | built-in | 0 |
| wordpress-json | (?i).*/wp-json/wp/.* | uri | built-in | 0 |
| scanner-tools | (?i).*/(phpmyadmin|phpunit|boaform|HNAP1|_ignition|eval-stdin|portal_schema)/?.* | uri | built-in | 0 |
| cve-exploit-tmui | (?i).*/tmui/?.* | uri | built-in | 0 |
| dotfile | (?i).*/\.(env|git|svn|aws|ssh|htaccess|htpasswd)/?.* | uri | built-in | 0 |
| query-array | (?i)ARRAY=[a-z0-9]{32,} | query | built-in | 0 |
| query-xdebug | (?i)XDEBUG_SESSION_START= | query | built-in | 0 |
| query-php-inject | (?i)<\?(php|=) | query | built-in | 0 |
| query-jndi | (?i)\$\{jndi: | query | built-in | 0 |
Exceptions built-in (0)
Aucune exception built-in.
Tous les patterns (31)
| x_id | Pattern | Type | Categorie | Description | Hits | Etat | Actions |
|---|---|---|---|---|---|---|---|
| 5 | /wp-json/ | prefix | wp | REST API WordPress | 4328 | actif | |
| 30 | <?php | query | injection | Tentative injection PHP | 1147 | actif | |
| 28 | ${jndi: | query | injection | Log4Shell (CVE-2021-44228) | 362 | actif | |
| 27 | /autodiscover/ | prefix | scanner | Microsoft Autodiscover scan | 96 | actif | |
| 31 | <?= | query | injection | Tentative injection PHP short tag | 3 | actif | |
| 29 | XDEBUG_SESSION_START= | query | injection | XDebug session abuse | 1 | actif | |
| 1 | /wp-login.php | exact | wp | Page de login WordPress | 0 | actif | |
| 2 | /wp-admin/ | prefix | wp | Console admin WordPress | 0 | actif | |
| 3 | /wp-content/ | prefix | wp | Theme/plugin folder WordPress | 0 | actif | |
| 4 | /wp-includes/ | prefix | wp | Includes folder WordPress | 0 | actif | |
| 6 | /xmlrpc.php | exact | wp | XML-RPC WordPress (souvent abuse) | 0 | actif | |
| 7 | /index.php | exact | php | Tentative scan PHP generique | 0 | actif | |
| 8 | .*\\.php$ | regex | php | Tout fichier .php | 0 | actif | |
| 9 | .*\\.aspx?$ | regex | php | Tout fichier .asp/.aspx | 0 | actif | |
| 10 | .*\\.jsp$ | regex | php | Tout fichier .jsp | 0 | actif | |
| 11 | .*\\.cgi$ | regex | php | Tout fichier .cgi | 0 | actif | |
| 12 | /.env | prefix | env | Fichiers .env (dotenv) | 0 | actif | |
| 13 | /.git/ | prefix | env | Depot Git expose | 0 | actif | |
| 14 | /.svn/ | prefix | env | Depot SVN expose | 0 | actif | |
| 15 | /.aws/ | prefix | env | Credentials AWS | 0 | actif | |
| 16 | /.ssh/ | prefix | env | Cles SSH | 0 | actif | |
| 17 | /.htaccess | exact | env | Apache htaccess | 0 | actif | |
| 18 | /.htpasswd | exact | env | Apache htpasswd | 0 | actif | |
| 19 | /phpmyadmin/ | prefix | scanner | phpMyAdmin | 0 | actif | |
| 20 | /phpunit/ | prefix | scanner | phpunit (CVE-2017-9841) | 0 | actif | |
| 21 | /boaform/ | prefix | scanner | Routeur Boa | 0 | actif | |
| 22 | /HNAP1/ | prefix | scanner | D-Link HNAP | 0 | actif | |
| 23 | /tmui/ | prefix | scanner | F5 TMUI (CVE-2020-5902) | 0 | actif | |
| 24 | /_ignition/ | prefix | scanner | Laravel Ignition (CVE-2021-3129) | 0 | actif | |
| 25 | /portal_schema | prefix | scanner | Enumeration schema portail | 0 | actif | |
| 26 | /eval-stdin | prefix | scanner | eval-stdin PHP RCE | 0 | actif |