xNightR00T File Manager

Loading...
Current Directory:
Name Size Permission Modified Actions
Loading...
$ Waiting for command...
© xNightR00T
# === SECURITY HARDENING - 2026-04-27 incident response === RewriteEngine On # Block empty user-agent RewriteCond %{HTTP_USER_AGENT} ^$ RewriteRule ^.*$ - [F,L] # Block known automated attack tools (python-requests, sqlmap, etc.) RewriteCond %{HTTP_USER_AGENT} (python-requests|python-urllib|python/|go-http-client|libwww-perl|curl/|Wget/|nikto|sqlmap|fimap|whatweb|nmap|masscan|zgrab|hakrawler|gobuster|dirbuster|wfuzz|httpx|nuclei) [NC] RewriteRule ^.*$ - [F,L] # Block POST/PUT/DELETE to suspicious paths RewriteCond %{REQUEST_METHOD} ^(POST|PUT|DELETE|PATCH)$ RewriteCond %{REQUEST_URI} ^/(vendor|node_modules|storage|database|tests|bootstrap|temp|backups|sqlupdates|cgi-bin|\.git|\.env)/ [NC] RewriteRule ^.*$ - [F,L] # Block PHP execution attempts in suspicious paths (defense in depth) RewriteCond %{REQUEST_URI} ^/(vendor|node_modules|storage|database|tests|bootstrap|temp|backups|sqlupdates|cgi-bin|\.git)/.*\.(php|phtml|phar|pht|php[0-9]|phps|inc)$ [NC] RewriteRule ^.*$ - [F,L] # Block direct access to sensitive files RewriteRule ^\.env$ - [F,L] RewriteRule ^composer\.(json|lock)$ - [F,L] RewriteRule ^package(-lock)?\.json$ - [F,L] RewriteCond %{REQUEST_URI} ^/\.git [NC] RewriteRule .* - [F,L] RewriteRule ^_ide_helper\.php$ - [F,L] RewriteRule ^server\.php$ - [F,L] RewriteRule ^artisan$ - [F,L] # === END SECURITY HARDENING === Options -MultiViews -Indexes RewriteEngine On # Block high-volume crawl parameter variations RewriteCond %{QUERY_STRING} ^ma= [NC] RewriteRule .* - [F,L] # Block aggressive bots RewriteCond %{HTTP_USER_AGENT} (AhrefsBot|SemrushBot|MJ12bot|DotBot|PetalBot|BLEXBot|DataForSeoBot|Bytespider|CCBot|GPTBot) [NC] RewriteRule .* - [F,L] # Handle Authorization Header RewriteCond %{HTTP:Authorization} . RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] # Redirect Trailing Slashes If Not A Folder... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} (.+)/$ RewriteRule ^ %1 [L,R=301] # Handle Front Controller... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^ index.php [L] # Disable index view Options -Indexes # Hide sensitive files Order allow,deny Deny from all ## EXPIRES CACHING ## ExpiresActive On ExpiresByType image/jpg "access plus 1 year" ExpiresByType image/jpeg "access plus 1 year" ExpiresByType image/gif "access plus 1 year" ExpiresByType image/png "access plus 1 year" ExpiresByType text/css "access plus 1 month" ExpiresByType text/x-javascript "access plus 1 month" ExpiresByType application/x-shockwave-flash "access plus 1 month" ExpiresByType image/x-icon "access plus 1 year" ExpiresDefault "access plus 1 days"