Gecko [ explonortespa.com ]

Name	Size	Permission	Date
exclude	[ DIR ]	drwxr-xr-x	2026-02-13 01:21
include	[ DIR ]	drwxr-xr-x	2026-02-13 01:21
920100.ra	804 B	-rw-r--r--	2026-02-11 12:19
920120.ra	723 B	-rw-r--r--	2026-02-11 12:19
920220-chain1.ra	337 B	-rw-r--r--	2026-02-11 12:19
920221.ra	232 B	-rw-r--r--	2026-02-11 12:19
920260.ra	128 B	-rw-r--r--	2026-02-11 12:19
920521.ra	269 B	-rw-r--r--	2026-02-11 12:19
920600.ra	139 B	-rw-r--r--	2026-02-11 12:19
921421.ra	1023 B	-rw-r--r--	2026-02-11 12:19
921422.ra	568 B	-rw-r--r--	2026-02-11 12:19
922110-chain1.ra	139 B	-rw-r--r--	2026-02-11 12:19
930100.ra	2.38 KB	-rw-r--r--	2026-02-11 12:19
931130.ra	424 B	-rw-r--r--	2026-02-11 12:19
931131.ra	424 B	-rw-r--r--	2026-02-11 12:19
932125.ra	3.57 KB	-rw-r--r--	2026-02-11 12:19
932130.ra	124 B	-rw-r--r--	2026-02-11 12:19
932131.ra	211 B	-rw-r--r--	2026-02-11 12:19
932140.ra	286 B	-rw-r--r--	2026-02-11 12:19
932175.ra	404 B	-rw-r--r--	2026-02-11 12:19
932200.ra	518 B	-rw-r--r--	2026-02-11 12:19
932205-chain1.ra	961 B	-rw-r--r--	2026-02-11 12:19
932205.ra	961 B	-rw-r--r--	2026-02-11 12:19
932206.ra	751 B	-rw-r--r--	2026-02-11 12:19
932210.ra	773 B	-rw-r--r--	2026-02-11 12:19
932220.ra	805 B	-rw-r--r--	2026-02-11 12:19
932230.ra	674 B	-rw-r--r--	2026-02-11 12:19
932231.ra	704 B	-rw-r--r--	2026-02-11 12:19
932232.ra	331 B	-rw-r--r--	2026-02-11 12:19
932235.ra	411 B	-rw-r--r--	2026-02-11 12:19
932236.ra	595 B	-rw-r--r--	2026-02-11 12:19
932237.ra	559 B	-rw-r--r--	2026-02-11 12:19
932238.ra	273 B	-rw-r--r--	2026-02-11 12:19
932239.ra	644 B	-rw-r--r--	2026-02-11 12:19
932240.ra	1019 B	-rw-r--r--	2026-02-11 12:19
932250.ra	575 B	-rw-r--r--	2026-02-11 12:19
932260.ra	508 B	-rw-r--r--	2026-02-11 12:19
932300.ra	483 B	-rw-r--r--	2026-02-11 12:19
932301.ra	289 B	-rw-r--r--	2026-02-11 12:19
932310.ra	845 B	-rw-r--r--	2026-02-11 12:19
932311.ra	1.62 KB	-rw-r--r--	2026-02-11 12:19
932320.ra	359 B	-rw-r--r--	2026-02-11 12:19
932321.ra	203 B	-rw-r--r--	2026-02-11 12:19
932370.ra	3.34 KB	-rw-r--r--	2026-02-11 12:19
932380.ra	466 B	-rw-r--r--	2026-02-11 12:19
933131.ra	346 B	-rw-r--r--	2026-02-11 12:19
933160.ra	889 B	-rw-r--r--	2026-02-11 12:19
933161.ra	894 B	-rw-r--r--	2026-02-11 12:19
933200.ra	812 B	-rw-r--r--	2026-02-11 12:19
933210.ra	980 B	-rw-r--r--	2026-02-11 12:19
933211.ra	974 B	-rw-r--r--	2026-02-11 12:19
934100.ra	3.49 KB	-rw-r--r--	2026-02-11 12:19
934101.ra	170 B	-rw-r--r--	2026-02-11 12:19
934120.ra	6.3 KB	-rw-r--r--	2026-02-11 12:19
934140.ra	113 B	-rw-r--r--	2026-02-11 12:19
934150.ra	130 B	-rw-r--r--	2026-02-11 12:19
934160.ra	220 B	-rw-r--r--	2026-02-11 12:19
934170.ra	195 B	-rw-r--r--	2026-02-11 12:19
941130.ra	288 B	-rw-r--r--	2026-02-11 12:19
941160.ra	5.92 KB	-rw-r--r--	2026-02-11 12:19
941210.ra	5.17 KB	-rw-r--r--	2026-02-11 12:19
941220.ra	4.65 KB	-rw-r--r--	2026-02-11 12:19
941390.ra	205 B	-rw-r--r--	2026-02-11 12:19
942120.ra	617 B	-rw-r--r--	2026-02-11 12:19
942130.ra	1.36 KB	-rw-r--r--	2026-02-11 12:19
942131.ra	1.19 KB	-rw-r--r--	2026-02-11 12:19
942140.ra	494 B	-rw-r--r--	2026-02-11 12:19
942150.ra	1.62 KB	-rw-r--r--	2026-02-11 12:19
942151.ra	154 B	-rw-r--r--	2026-02-11 12:19
942152.ra	154 B	-rw-r--r--	2026-02-11 12:19
942170.ra	531 B	-rw-r--r--	2026-02-11 12:19
942180.ra	1.09 KB	-rw-r--r--	2026-02-11 12:19
942190.ra	828 B	-rw-r--r--	2026-02-11 12:19
942200.ra	549 B	-rw-r--r--	2026-02-11 12:19
942210.ra	1.19 KB	-rw-r--r--	2026-02-11 12:19
942230.ra	212 B	-rw-r--r--	2026-02-11 12:19
942240.ra	470 B	-rw-r--r--	2026-02-11 12:19
942260.ra	421 B	-rw-r--r--	2026-02-11 12:19
942280.ra	673 B	-rw-r--r--	2026-02-11 12:19
942290.ra	467 B	-rw-r--r--	2026-02-11 12:19
942300.ra	1.13 KB	-rw-r--r--	2026-02-11 12:19
942310.ra	400 B	-rw-r--r--	2026-02-11 12:19
942320.ra	180 B	-rw-r--r--	2026-02-11 12:19
942321.ra	180 B	-rw-r--r--	2026-02-11 12:19
942330.ra	2.03 KB	-rw-r--r--	2026-02-11 12:19
942340.ra	1.12 KB	-rw-r--r--	2026-02-11 12:19
942350.ra	397 B	-rw-r--r--	2026-02-11 12:19
942360.ra	4.03 KB	-rw-r--r--	2026-02-11 12:19
942362.ra	2.84 KB	-rw-r--r--	2026-02-11 12:19
942370.ra	748 B	-rw-r--r--	2026-02-11 12:19
942380.ra	590 B	-rw-r--r--	2026-02-11 12:19
942390.ra	433 B	-rw-r--r--	2026-02-11 12:19
942400.ra	229 B	-rw-r--r--	2026-02-11 12:19
942410.ra	2.09 KB	-rw-r--r--	2026-02-11 12:19
942440-chain1.ra	629 B	-rw-r--r--	2026-02-11 12:19
942440.ra	155 B	-rw-r--r--	2026-02-11 12:19
942470.ra	752 B	-rw-r--r--	2026-02-11 12:19
942480.ra	879 B	-rw-r--r--	2026-02-11 12:19
942500.ra	248 B	-rw-r--r--	2026-02-11 12:19
942520.ra	428 B	-rw-r--r--	2026-02-11 12:19
942521.ra	304 B	-rw-r--r--	2026-02-11 12:19
942540.ra	241 B	-rw-r--r--	2026-02-11 12:19
942550.ra	1.39 KB	-rw-r--r--	2026-02-11 12:19
942560.ra	132 B	-rw-r--r--	2026-02-11 12:19
944150.ra	1.06 KB	-rw-r--r--	2026-02-11 12:19
944151.ra	1.05 KB	-rw-r--r--	2026-02-11 12:19
944152.ra	741 B	-rw-r--r--	2026-02-11 12:19
951230.ra	706 B	-rw-r--r--	2026-02-11 12:19
951240.ra	483 B	-rw-r--r--	2026-02-11 12:19
toolchain.yaml	1.68 KB	-rw-r--r--	2026-02-11 12:19

Rename

##! Please refer to the documentation at
##! https://coreruleset.org/docs/development/regex_assembly/.

##! Bypasses and techniques here come from:
##! - https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery
##! - https://github.com/cujanovic/SSRF-Testing

##!+ i

##! add capture group
##!^ (
##!$ )

##! This regex starts with a list of all the schemes that can be used to make a request
##!> assemble
  ##!> include url-schemes
  ##!=>
  ://
  ##!=>

##! http://425.510.425.510/ Dotted decimal with overflow (already covered by RFI rule 931100)
  ##! http://2852039166/ Dotless decimal
  ##! http://7147006462/ Dotless decimal with overflow
  \d{10}

##! http://0xA9.0xFE.0xA9.0xFE/ Dotted hexadecimal
  (?:0x[a-f0-9]{2}\.){3}0x[a-f0-9]{2}

##! http://0xA9FEA9FE/ Dotless hexadecimal
  0x[a-f0-9]{8}

##! http://0x41414141A9FEA9FE/ Dotless hexadecimal with overflow
  0x[a-f0-9]{16}

##! http://0251.0376.0251.0376/ Dotted octal
  ##! http://0251.00376.000251.0000376/ Dotted octal with padding
  (?:0{1,4}\d{1,3}\.){3}0{1,4}\d{1,3}

##! http://169.254.43518/
  \d{1,3}\.\d{1,3}\.\d{5}

##! http://169.16689662/
  \d{1,3}\.\d{8}

##! glibc Name Service Switch abuse
  ##! http://\\l\\o\\c\\a\\l\\h\\o\\s\\t (while underscore is not valid RFC syntax, it is allowed and might be used)
  (?:\x5c\x5c[a-z\d-]\.?_?)+

##! http://[::ffff:a9fe:a9fe] IPV6 Compressed - IPv6 (base regex from https://ihateregex.io/expr/ipv6/, with [0-9] converted to \d and with non-capturing groups (below))
  ##! http://[0:0:0:0:0:ffff:a9fe:a9fe] IPV6 Expanded
  ##! http://[fe80::%zone1] link-local unicast with zone ID
  ##! http://[0:0:0:0:0:ffff:169.254.169.254] IPV6/IPV4
  ##! http://[::] the unspecified address

##! Something that looks like IPv6 in a URL.
  ##! Matches full and compressed IPv6, link-local IPv6 with
  ##! zone ID, and embedded IPv4.
  ##! We could match the IPv6 specification here but that would
  ##! decrease performance of the regular expression and would
  ##! actually increase the possibility for bypasses.
  \[[a-f\d:]+(?:[\d.]+|%\w+)?\]

##! These come from https://github.com/cujanovic/SSRF-Testing
  ##! These bypasses work by confusing URL parsers in different languages (e.g., PHP, Python, Ruby, Perl)
  ##! and libraries (e.g. cURL). The bypasses are parser specific but will often be combined to break
  ##! multiple parsers with one try. The goal is often to get the application to call another library
  ##! with the malicious URL, e.g. libcurl or glibc (name resolution via gethostbyname(), see also
  ##! Name Service Switch abuse above).

##! http://127.88.23.245:22/+&@google.com:80#+@google.com:80/ (already covered by RFI rule 931100)

##! http://127.88.23.245:22/?@google.com:80/ (already covered by RFI rule 931100)

##! http://127.88.23.245:22/#@www.google.com:80/ (already covered by RFI rule 931100)

##! http://google.com:80\\@127.88.23.245:22/ (already covered by RFI rule 931100)

##! http://google.com:80+&@127.88.23.245:22/#+@google.com:80/
  ##! http://google.com:80+&@google.com:80#+@127.88.23.245:22/

##! create ip-or-domain for later use
  ##!> assemble
    (?:\d{1,3}\.){3,3}\d{1,3}
    [a-z][\w\-\.]{1,255}
    ##!=>
    :\d{1,5}
    ##!=< ip-or-domain
  ##!<

##!> assemble
    ##! domain + port
    [a-z][\w\-\.]{1,255}:\d{1,5}
    ##!=>

##! at least one of the evasion techniques
    ##!> assemble
      ##! technique 1
      ##!> assemble
        ##! possible white spaces to fool safety checks in URL parsers
        \s*
        ##!=>

##! &@ to confuse URL parsers (& can indicate query parameter, @ indicates user info)
        &?@
        ##!=>

##! IPv4 + port or domain + port
        ##!=> ip-or-domain

##! optional forward slash
        \/?
        ##!=>
      ##!<

##! technique 2
      ##!> assemble
        ##! fragment to confuse URL parsers
        #
        ##!=>

##! possible white spaces to fool safety checks in URL parsers
        \s*
        ##!=>

##! &@ to confuse URL parsers (& can indicate query parameter, @ indicates user info)
        &?@
        ##!=>

##! IPv4 + port or domain + port
        ##!=> ip-or-domain

##! optional forward slash
        /?
        ##!=>
      ##!<
    ##!<
    ##!=>
    +
    ##!=>
  ##!<

##! Enclosed alphanumerics are used for evasion (https://en.wikipedia.org/wiki/Enclosed_Alphanumerics).
  ##! See also https://github.com/cujanovic/SSRF-Testing.
  ##! These will normally sound many alarms, but having them flagged as ssrf attempt makes sense

##!> assemble
    ##! ⓪,①,②,③,④,⑤,⑥,⑦,⑧,⑨,⑩,⑪,⑫,⑬,⑭,⑮,⑯,⑰,⑱,⑲,⑳
    \xe2\x91[\xaa\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3]
    ##! ⑴,⑵,⑶,⑷,⑸,⑹,⑺,⑻,⑼,⑽,⑾,⑿
    \xe2\x91[\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf]
    ##! ⒀,⒁,⒂,⒃,⒄,⒅,⒆,⒇
    \xe2\x92[\x80\x81\x82\x83\x84\x85\x86\x87]
    ##! ⒈,⒉,⒊,⒋,⒌,⒍,⒎,⒏,⒐,⒑,⒒,⒓,⒔,⒕,⒖,⒗,⒘,⒙,⒚,⒛
    \xe2\x92[\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b]
    ##! ⒜,⒝,⒞,⒟,⒠,⒡,⒢,⒣,⒤,⒥,⒦,⒧,⒨,⒩,⒪,⒫,⒬,⒭,⒮,⒯,⒰,⒱,⒲,⒳,⒴,⒵
    \xe2\x92[\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5]
    ##! Ⓐ,Ⓑ,Ⓒ,Ⓓ,Ⓔ,Ⓕ,Ⓖ,Ⓗ,Ⓘ,Ⓙ
    \xe2\x92[\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf]
    ##! Ⓚ,Ⓛ,Ⓜ,Ⓝ,Ⓞ,Ⓟ,Ⓠ,Ⓡ,Ⓢ,Ⓣ,Ⓤ,Ⓥ,Ⓦ,Ⓧ,Ⓨ,Ⓩ
    \xe2\x93[\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f]
    ##! ⓐ,ⓑ,ⓒ,ⓓ,ⓔ,ⓕ,ⓖ,ⓗ,ⓘ,ⓙ,ⓚ,ⓛ
    \xe2\x93[\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b]
    ##! ⓜ,ⓝ,ⓞ,ⓟ,ⓠ,ⓡ,ⓢ,ⓣ,ⓤ,ⓥ,ⓦ,ⓧ,ⓨ,ⓩ
    \xe2\x93[\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9]
    ##! ⓫,⓬,⓭,⓮,⓯,⓰,⓱,⓲,⓳,⓴
    \xe2\x93[\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4]
    ##! ⓿,⓵,⓶,⓷,⓸,⓹,⓺,⓻,⓼,⓽,⓾
    \xe2\x93[\xbf\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe]
    ##! ideographic full stop: 。
    \xe3\x80\x82
    ##!=< enclosed-alnums
  ##!<

##! an IP could start with digits and dots
  ##!> assemble
    [\d.]{0,11}
    ##!=>
    ##!> assemble
      ##!=> enclosed-alnums
    ##!<
    ##!=>
    ##! match all for capture
    +
    ##!=>
  ##!<
##!<