@abtnode/router-provider 1.16.38-beta-20250116-083413-dbd33222 → 1.16.38-beta-20250118-033334-2da05ae8

package/lib/nginx/includes/security/crs4/rules/unix-shell.data

@@ -0,0 +1,670 @@
+# This list has generic unix shell variables, shells and commands that affect Unix systems.
+# To generate the list, we get the data from all places first. Strip or add the path to commands so it begins with `bin`.
+# Sort the file content ascending, and remove duplicate lines.
+#
+# Data comes from multiple places, listed below.
+# - Binaries:
+#   - GTFOBins. Update list using `curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/GTFOBins/GTFOBins.github.io/contents/_gtfobins | jq '.[].name' | grep '.md' | tr -d '"' | cut -f1 -d.`
+# - Shell lists:
+#   - https://tldp.org/LDP/Linux-Filesystem-Hierarchy/html/etc.html
+#   - https://en.wikipedia.org/wiki/Unix_shell
+#   - https://hyperpolyglot.org/unix-shells
+# - Generic shell variables (Ad-Hoc for now, needs references)
+# - Generic /etc and /dev files (Ad-Hoc, needs references)
+# - Compression and decompression utilities present on Arch Linux (as of 2022-08-02) and Debian 11
+
+${CDPATH}
+${DIRSTACK}
+${HOME}
+${HOSTNAME}
+${IFS}
+${OLDPWD}
+${OSTYPE}
+${PATH}
+${PWD}
+${SHELL}
+$CDPATH
+$DIRSTACK
+$HOME
+$HOSTNAME
+$IFS
+$OLDPWD
+$OSTYPE
+$PATH
+$PWD
+$SHELL
+bin/7z
+bin/7za
+bin/7zr
+bin/7zx
+bin/ab
+bin/addgroup
+bin/adduser
+bin/agetty
+bin/alias
+bin/alpine
+bin/ansible
+bin/apt
+bin/apt-get
+bin/aptitude
+bin/ar
+bin/arch
+bin/aria2c
+bin/arj
+bin/arp
+bin/as
+bin/ascii-xfr
+bin/ascii85
+bin/ash
+bin/aspell
+bin/at
+bin/atobm
+bin/awk
+bin/axel
+bin/aws
+bin/base32
+bin/base64
+bin/basename
+bin/basenc
+bin/bash
+bin/batch
+bin/blkid
+bin/bpftrace
+bin/breaksw
+bin/bridge
+bin/bsdcat
+bin/bsdiff
+bin/bsdtar
+bin/builtin
+bin/bundler
+bin/bunzip2
+bin/busctl
+bin/busybox
+bin/byebug
+bin/byobu
+bin/bzcat
+bin/bzcmp
+bin/bzdiff
+bin/bzegrep
+bin/bzexe
+bin/bzfgrep
+bin/bzgrep
+bin/bzip2
+bin/bzip2recover
+bin/bzless
+bin/bzmore
+bin/bzz
+bin/c89
+bin/c99
+bin/cancel
+bin/capsh
+bin/cat
+bin/cc
+bin/certbot
+bin/chattr
+bin/chdir
+bin/check_by_ssh
+bin/check_cups
+bin/check_log
+bin/check_memory
+bin/check_raid
+bin/check_ssl_cert
+bin/check_statusfile
+bin/chef
+bin/chflags
+bin/chgrp
+bin/chmod
+bin/choom
+bin/chown
+bin/chpass
+bin/chgpasswd
+bin/chroot
+bin/chsh
+bin/clang
+bin/clang++
+bin/cmp
+bin/cobc
+bin/column
+bin/comm
+bin/command
+bin/composer
+bin/compress
+bin/coproc
+bin/core_perl/zipdetails
+bin/cowsay
+bin/cowthink
+bin/cp
+bin/cpan
+bin/cpio
+bin/cpulimit
+bin/crash
+bin/cron
+bin/crontab
+bin/cscli
+bin/csh
+bin/csplit
+bin/csvtool
+bin/cupsfilter
+bin/curl
+bin/cut
+bin/dash
+bin/date
+bin/df
+bin/dd
+bin/dhclient
+bin/dialog
+bin/diff
+bin/dig
+bin/dir
+bin/dmesg
+bin/dmidecode
+bin/dmsetup
+bin/dnf
+bin/doas
+bin/docker
+bin/done
+bin/dosbox
+bin/dpkg
+bin/du
+bin/dvips
+bin/e2fsck
+bin/easy_install
+bin/eb
+bin/echo
+bin/ed
+bin/efax
+bin/egrep
+bin/emacs
+bin/endif
+bin/endsw
+bin/env
+bin/env-update
+bin/eqn
+bin/es
+bin/esac
+bin/esh
+bin/eval
+bin/ex
+bin/exec
+bin/exiftool
+bin/expand
+bin/expect
+bin/export
+bin/expr
+bin/facter
+bin/fc
+bin/fetch
+bin/fg
+bin/fgrep
+bin/fi
+bin/file
+bin/filetest
+bin/find
+bin/finger
+bin/fish
+bin/flock
+bin/fmt
+bin/fold
+bin/foreach
+bin/fping
+bin/ftp
+bin/ftpstats
+bin/ftpwho
+bin/function
+bin/gawk
+bin/gcc
+bin/gcore
+bin/gdb
+bin/gem
+bin/genie
+bin/genisoimage
+bin/GET
+bin/HEAD
+bin/POST
+bin/getfacl
+bin/ghc
+bin/ghci
+bin/gimp
+bin/ginsh
+bin/git
+bin/go
+bin/gpg
+bin/grc
+bin/grep
+bin/groupmod
+bin/gtester
+bin/gunzip
+bin/gzcat
+bin/gzexe
+bin/gzip
+bin/hash
+bin/hd
+bin/head
+bin/hexdump
+bin/highlight
+bin/history
+bin/hostid
+bin/hostname
+bin/hping3
+bin/htdigest
+bin/htop
+bin/htpasswd
+bin/hup
+bin/iconv
+bin/id
+bin/ifconfig
+bin/iftop
+bin/install
+bin/ionice
+bin/ip
+bin/ip6tables
+bin/ipconfig
+bin/iptables
+bin/irb
+bin/ispell
+bin/java
+bin/jexec
+bin/jjs
+bin/jobs
+bin/join
+bin/journalctl
+bin/jq
+bin/jrunscript
+bin/kill
+bin/killall
+bin/knife
+bin/ksh
+bin/ksshell
+bin/last
+bin/lastcomm
+bin/lastlog
+bin/lastlogin
+bin/latex
+bin/ld
+bin/ldconfig
+bin/ldd
+bin/less
+bin/lessecho
+bin/lessfile
+bin/lesspipe
+bin/lftp
+bin/lftpget
+bin/links
+bin/ln
+bin/local
+bin/locate
+bin/loginctl
+bin/logname
+bin/logsave
+bin/look
+bin/losetup
+bin/lp
+bin/ls
+bin/ls-F
+bin/lsb_release
+bin/lscpu
+bin/lshw
+bin/lsmod
+bin/lsof
+bin/lspci
+bin/lsusb
+bin/ltrace
+bin/lua
+bin/lualatex
+bin/luatex
+bin/lwp-download
+bin/lwp-dump
+bin/lwp-mirror
+bin/lwp-request
+bin/lynx
+bin/lz
+bin/lz4
+bin/lz4c
+bin/lz4cat
+bin/lzcat
+bin/lzcmp
+bin/lzdiff
+bin/lzegrep
+bin/lzfgrep
+bin/lzgrep
+bin/lzless
+bin/lzma
+bin/lzmadec
+bin/lzmainfo
+bin/lzmore
+bin/mail
+bin/mailq
+bin/mailx
+bin/make
+bin/man
+bin/mawk
+bin/mkdir
+bin/mkfifo
+bin/mknod
+bin/mktemp
+bin/mlocate
+bin/more
+bin/mosquitto
+bin/mount
+bin/msgattrib
+bin/msgcat
+bin/msgconv
+bin/msgfilter
+bin/msgmerge
+bin/msguniq
+bin/mtr
+bin/mutt
+bin/mv
+bin/mysql
+bin/mysqladmin
+bin/mysqldump
+bin/mysqldumpslow
+bin/mysqlhotcopy
+bin/mysqlshow
+bin/nano
+bin/nasm
+bin/nawk
+bin/nc
+bin/nc.openbsd
+bin/nc.traditional
+bin/ncat
+bin/neofetch
+bin/net
+bin/netcat
+bin/netkit-ftp
+bin/netplan
+bin/netstat
+bin/nice
+bin/nl
+bin/nm
+bin/nmap
+bin/node
+bin/nohup
+bin/nping
+bin/npm
+bin/nroff
+bin/nsenter
+bin/nslookup
+bin/nstat
+bin/octave
+bin/od
+bin/onintr
+bin/openssl
+bin/openvpn
+bin/openvt
+bin/opkg
+bin/pacman
+bin/parted
+bin/passwd
+bin/paste
+bin/patch
+bin/pax
+bin/pdb
+bin/pdflatex
+bin/pdftex
+bin/pdksh
+bin/perf
+bin/perl
+bin/perl5
+bin/perlsh
+bin/perms
+bin/pf
+bin/pftp
+bin/pg
+bin/pgrep
+bin/php
+bin/php-cgi
+bin/php5
+bin/php7
+bin/pic
+bin/pico
+bin/pidstat
+bin/pigz
+bin/ping
+bin/pip
+bin/pkexec
+bin/pkg
+bin/pkg_info
+bin/pkginfo
+bin/pkill
+bin/popd
+bin/pr
+bin/printenv
+bin/printf
+bin/pry
+bin/ps
+bin/psed
+bin/psftp
+bin/psql
+bin/ptar
+bin/ptardiff
+bin/ptargrep
+bin/ptx
+bin/puppet
+bin/pushd
+bin/pwd
+bin/pxz
+bin/python
+bin/python2
+bin/python3
+bin/pyversions
+bin/py3versions
+bin/rake
+bin/raku
+bin/rar
+bin/rbash
+bin/rc
+bin/rcp
+bin/readelf
+bin/realpath
+bin/red
+bin/redcarpet
+bin/rename
+bin/repeat
+bin/replace
+bin/restic
+bin/rev
+bin/rlogin
+bin/rlwrap
+bin/rm
+bin/rmdir
+bin/rmuser
+bin/rnano
+bin/route
+bin/rpm
+bin/rpmdb
+bin/rpmquery
+bin/rpmverify
+bin/rsync
+bin/ruby
+bin/run-mailcap
+bin/run-parts
+bin/rview
+bin/rvim
+bin/sash
+bin/sched
+bin/scp
+bin/screen
+bin/script
+bin/sdiff
+bin/sed
+bin/sendmail
+bin/service
+bin/set
+bin/setarch
+bin/setenv
+bin/setfacl
+bin/setsid
+bin/sftp
+bin/sg
+bin/sh
+bin/sh.distrib
+bin/shuf
+bin/shutdown
+bin/sleep
+bin/slsh
+bin/smbclient
+bin/snap
+bin/socat
+bin/soelim
+bin/sort
+bin/source
+bin/split
+bin/sqlite3
+bin/ss
+bin/ssh
+bin/ssh-keygen
+bin/ssh-keyscan
+bin/sshpass
+bin/start-stop-daemon
+bin/stdbuf
+bin/strace
+bin/strings
+bin/su
+bin/sudo
+bin/svn
+bin/sysctl
+bin/systemctl
+bin/systemd-resolve
+bin/tac
+bin/tail
+bin/tailf
+bin/tar
+bin/task
+bin/taskset
+bin/tbl
+bin/tclsh
+bin/tcpdump
+bin/tcping
+bin/tcptraceroute
+bin/tcsh
+bin/tee
+bin/telnet
+bin/tex
+bin/tftp
+bin/tic
+bin/time
+bin/timedatectl
+bin/timeout
+bin/tmux
+bin/top
+bin/touch
+bin/traceroute
+bin/traceroute6
+bin/troff
+bin/tshark
+bin/ul
+bin/ulimit
+bin/uname
+bin/uncompress
+bin/unexpand
+bin/uniq
+bin/unlink
+bin/unlz4
+bin/unlzma
+bin/unpigz
+bin/unrar
+bin/unset
+bin/unshare
+bin/unxz
+bin/unzip
+bin/unzstd
+bin/up2date
+bin/update-alternatives
+bin/useradd
+bin/userdel
+bin/usermod
+bin/uudecode
+bin/uuencode
+bin/valgrind
+bin/vi
+bin/view
+bin/vigr
+bin/vim
+bin/vimdiff
+bin/vipw
+bin/virsh
+bin/visudo
+bin/volatility
+bin/w
+bin/w3m
+bin/wall
+bin/watch
+bin/wc
+bin/wget
+bin/whiptail
+bin/who
+bin/whoami
+bin/whois
+bin/wireshark
+bin/wish
+bin/xargs
+bin/xelatex
+bin/xetex
+bin/xmodmap
+bin/xmore
+bin/xpad
+bin/xterm
+bin/xxd
+bin/xz
+bin/xzcat
+bin/xzcmp
+bin/xzdec
+bin/xzdiff
+bin/xzegrep
+bin/xzfgrep
+bin/xzgrep
+bin/xzless
+bin/xzmore
+bin/yarn
+bin/yelp
+bin/yes
+bin/yum
+bin/zathura
+bin/zcat
+bin/zcmp
+bin/zdiff
+bin/zegrep
+bin/zfgrep
+bin/zgrep
+bin/zip
+bin/zipcloak
+bin/zipcmp
+bin/zipdetails
+bin/zipgrep
+bin/zipinfo
+bin/zipmerge
+bin/zipnote
+bin/zipsplit
+bin/ziptool
+bin/zless
+bin/zmore
+bin/zrun
+bin/zsh
+bin/zsoelim
+bin/zstd
+bin/zstdcat
+bin/zstdgrep
+bin/zstdless
+bin/zstdmt
+bin/zypper
+dev/fd
+dev/null
+dev/stderr
+dev/stdin
+dev/stdout
+dev/tcp
+dev/udp
+dev/zero
+etc/group
+etc/master.passwd
+etc/passwd
+etc/pwd.db
+etc/shadow
+etc/shells
+etc/spwd.db
+proc/self
+sbin/capsh
+sbin/logsave
+sbin/service
+sbin/start-stop-daemon