{"action":"created","issue":{"url":"https://api.github.com/repos/mitchellkrogza/apache-ultimate-bad-bot-blocker/issues/92","repository_url":"https://api.github.com/repos/mitchellkrogza/apache-ultimate-bad-bot-blocker","labels_url":"https://api.github.com/repos/mitchellkrogza/apache-ultimate-bad-bot-blocker/issues/92/labels{/name}","comments_url":"https://api.github.com/repos/mitchellkrogza/apache-ultimate-bad-bot-blocker/issues/92/comments","events_url":"https://api.github.com/repos/mitchellkrogza/apache-ultimate-bad-bot-blocker/issues/92/events","html_url":"https://github.com/mitchellkrogza/apache-ultimate-bad-bot-blocker/issues/92","id":348247356,"node_id":"MDU6SXNzdWUzNDgyNDczNTY=","number":92,"title":"Addition to prevent Joomla 0day or similar","user":{"login":"davcpas1234","id":3764587,"node_id":"MDQ6VXNlcjM3NjQ1ODc=","avatar_url":"https://avatars1.githubusercontent.com/u/3764587?v=4","gravatar_id":"","url":"https://api.github.com/users/davcpas1234","html_url":"https://github.com/davcpas1234","followers_url":"https://api.github.com/users/davcpas1234/followers","following_url":"https://api.github.com/users/davcpas1234/following{/other_user}","gists_url":"https://api.github.com/users/davcpas1234/gists{/gist_id}","starred_url":"https://api.github.com/users/davcpas1234/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davcpas1234/subscriptions","organizations_url":"https://api.github.com/users/davcpas1234/orgs","repos_url":"https://api.github.com/users/davcpas1234/repos","events_url":"https://api.github.com/users/davcpas1234/events{/privacy}","received_events_url":"https://api.github.com/users/davcpas1234/received_events","type":"User","site_admin":false},"labels":[{"id":412049721,"node_id":"MDU6TGFiZWw0MTIwNDk3MjE=","url":"https://api.github.com/repos/mitchellkrogza/apache-ultimate-bad-bot-blocker/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":{"login":"mitchellkrogza","id":9961541,"node_id":"MDQ6VXNlcjk5NjE1NDE=","avatar_url":"https://avatars1.githubusercontent.com/u/9961541?v=4","gravatar_id":"","url":"https://api.github.com/users/mitchellkrogza","html_url":"https://github.com/mitchellkrogza","followers_url":"https://api.github.com/users/mitchellkrogza/followers","following_url":"https://api.github.com/users/mitchellkrogza/following{/other_user}","gists_url":"https://api.github.com/users/mitchellkrogza/gists{/gist_id}","starred_url":"https://api.github.com/users/mitchellkrogza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitchellkrogza/subscriptions","organizations_url":"https://api.github.com/users/mitchellkrogza/orgs","repos_url":"https://api.github.com/users/mitchellkrogza/repos","events_url":"https://api.github.com/users/mitchellkrogza/events{/privacy}","received_events_url":"https://api.github.com/users/mitchellkrogza/received_events","type":"User","site_admin":false},"assignees":[{"login":"mitchellkrogza","id":9961541,"node_id":"MDQ6VXNlcjk5NjE1NDE=","avatar_url":"https://avatars1.githubusercontent.com/u/9961541?v=4","gravatar_id":"","url":"https://api.github.com/users/mitchellkrogza","html_url":"https://github.com/mitchellkrogza","followers_url":"https://api.github.com/users/mitchellkrogza/followers","following_url":"https://api.github.com/users/mitchellkrogza/following{/other_user}","gists_url":"https://api.github.com/users/mitchellkrogza/gists{/gist_id}","starred_url":"https://api.github.com/users/mitchellkrogza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitchellkrogza/subscriptions","organizations_url":"https://api.github.com/users/mitchellkrogza/orgs","repos_url":"https://api.github.com/users/mitchellkrogza/repos","events_url":"https://api.github.com/users/mitchellkrogza/events{/privacy}","received_events_url":"https://api.github.com/users/mitchellkrogza/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2018-08-07T09:48:42Z","updated_at":"2018-08-09T14:34:25Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Opening this as an issue, rather that a PR as it's not a bad bot or referrer, rather a user-agent exploit, but could we add a \"bad bot\" to capture similar to this:\r\n\r\n```\r\n}__test|O:21:\\\"JDatabaseDriverMysqli\\\":3:{s:4:\\\"\\\\0\\\\0\\\\0a\\\";O:17:\\\"JSimplepieFactory\\\":0:{}s:21:\\\"\\\\0\\\\0\\\\0disconnectHandlers\\\";a:1:{i:0;a:2:{i:0;O:9:\\\"SimplePie\\\":5:{s:8:\\\"sanitize\\\";O:20:\\\"JDatabaseDriverMysql\\\":0:{}s:5:\\\"cache\\\";b:1;s:19:\\\"cache_name_function\\\";s:6:\\\"assert\\\";s:10:\\\"javascript\\\";i:9999;s:8:\\\"feed_url\\\";s:54:\\\"eval(base64_decode($_POST[111]));JFactory::get();exit;\\\";}i:1;s:4:\\\"init\\\";}}s:13:\\\"\\\\0\\\\0\\\\0connection\\\";i:1;}\\xf0\\x9d\\x8c\\x86\r\n```\r\n\r\nMaybe something like this:\r\n\r\n```\r\nRewriteCond %{HTTP_USER_AGENT} ^\\W [OR]\r\n```"},"comment":{"url":"https://api.github.com/repos/mitchellkrogza/apache-ultimate-bad-bot-blocker/issues/comments/411779381","html_url":"https://github.com/mitchellkrogza/apache-ultimate-bad-bot-blocker/issues/92#issuecomment-411779381","issue_url":"https://api.github.com/repos/mitchellkrogza/apache-ultimate-bad-bot-blocker/issues/92","id":411779381,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMTc3OTM4MQ==","user":{"login":"davcpas1234","id":3764587,"node_id":"MDQ6VXNlcjM3NjQ1ODc=","avatar_url":"https://avatars1.githubusercontent.com/u/3764587?v=4","gravatar_id":"","url":"https://api.github.com/users/davcpas1234","html_url":"https://github.com/davcpas1234","followers_url":"https://api.github.com/users/davcpas1234/followers","following_url":"https://api.github.com/users/davcpas1234/following{/other_user}","gists_url":"https://api.github.com/users/davcpas1234/gists{/gist_id}","starred_url":"https://api.github.com/users/davcpas1234/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davcpas1234/subscriptions","organizations_url":"https://api.github.com/users/davcpas1234/orgs","repos_url":"https://api.github.com/users/davcpas1234/repos","events_url":"https://api.github.com/users/davcpas1234/events{/privacy}","received_events_url":"https://api.github.com/users/davcpas1234/received_events","type":"User","site_admin":false},"created_at":"2018-08-09T14:34:25Z","updated_at":"2018-08-09T14:34:25Z","author_association":"CONTRIBUTOR","body":"Thanks @mitchellkrogza will update as soon as I can."}}
{"actor":{"display_login":"davcpas1234"}}