Protokoll #32864

{
    "event": "PreToolUse",
    "tool_name": "Bash",
    "tool_input": {
        "command": "ssh root@prod.karlkratz.com \"cat \/var\/www\/prod.karlkratz.de\/src\/Config\/bot-management.json\" 2>\/dev\/null | head -150",
        "description": "Check JSON config for reference values"
    }
}

{
    "tool_response": {
        "stdout": "{\n  \"description\": \"Bot-Management Konfiguration für karlkratz.de\",\n  \"version\": \"1.0\",\n  \"updated\": \"2025-06-02\",\n  \n  \"settings\": {\n    \"enabled\": true,\n    \"log_blocked_bots\": true,\n    \"auto_ufw_blocking\": true,\n    \"block_duration_minutes\": 1440,\n    \"max_requests_per_minute\": 10\n  },\n  \n  \"whitelist\": {\n    \"description\": \"Erlaubte Bots und Crawler (diese werden NICHT blockiert)\",\n    \"user_agents\": [\n      \"Googlebot\",\n      \"karlsCORE\",\n      \"Bingbot\", \n      \"Slurp\",\n      \"DuckDuckBot\",\n      \"Applebot\",\n      \"facebookexternalhit\",\n      \"Twitterbot\",\n      \"LinkedInBot\",\n      \"WhatsApp\",\n      \"Telegram\",\n      \"Mozilla\/5.0\",\n      \"Chrome\",\n      \"Firefox\",\n      \"Safari\",\n      \"Edge\"\n    ],\n    \"user_agent_patterns\": [\n      \"Google.*Bot\",\n      \"Bing.*Bot\",\n      \"Yahoo.*Slurp\",\n      \"search\\\\.msn\\\\.com\",\n      \"crawl.*google\",\n      \"bot.*facebook\",\n      \"crawler.*bing\"\n    ],\n    \"ips\": [\n      \"66.249.64.0\/19\",\n      \"207.46.0.0\/16\",\n      \"208.65.144.0\/20\",\n      \"185.201.147.27\",\n      \"185.102.95.236\",\n      \"127.0.0.1\"\n    ],\n    \"domains\": [\n      \"googlebot.com\",\n      \"search.msn.com\",\n      \"crawl.yahoo.net\"\n    ]\n  },\n  \n  \"blacklist\": {\n    \"description\": \"Unerwünschte Bots und Crawler (diese werden blockiert)\",\n    \"user_agents\": [\n      \"AhrefsBot\",\n      \"SemrushBot\",\n      \"MJ12bot\",\n      \"DotBot\",\n      \"SiteAuditBot\",\n      \"SEOkicks\",\n      \"BLEXBot\",\n      \"YandexBot\",\n      \"PetalBot\",\n      \"Sogou\",\n      \"Baiduspider\",\n      \"360Spider\",\n      \"CCBot\",\n      \"DataForSeoBot\",\n      \"MegaIndex\",\n      \"AspiegelBot\",\n      \"Awario\",\n      \"SEObility\",\n      \"SurdotlyBot\",\n      \"ZoominfoBot\",\n      \"CensysInspect\",\n      \"Nuclei\",\n      \"gobuster\",\n      \"sqlmap\",\n      \"nmap\",\n      \"masscan\",\n      \"ZGrab\",\n      \"Shodan\",\n      \"censys\",\n      \"BinaryEdge\",\n      \"Reeder\",\n      \"WPMU DEV Broken Link Checker\",\n      \"Broken Link Checker\"\n    ],\n    \"user_agent_patterns\": [\n      \"karlsCORE\",\n      \".*[Bb]ot.*\",\n      \".*[Cc]rawl.*\",\n      \".*[Ss]crape.*\",\n      \".*[Ss]pider.*\",\n      \".*[Ss]can.*\",\n      \".*penetration.*\",\n      \".*test.*\",\n      \"curl.*\",\n      \"wget.*\",\n      \"python.*requests.*\",\n      \"Go-http-client.*\",\n      \"Java.*\",\n      \".*vulnerability.*\",\n      \".*security.*scan.*\",\n      \".*hack.*\",\n      \".*exploit.*\"\n    ],\n    \"ips\": [\n      \"185.220.101.0\/24\",\n      \"185.220.102.0\/24\",\n      \"198.98.51.0\/24\"\n    ],\n    \"exact_user_agents\": [\n      \"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; karlsCORE) AppleWebKit\/537.36\",\n      \"curl\/7.68.0\",\n      \"wget\/1.20.3\",\n      \"Python-urllib\/3.8\"\n    ]\n  },\n  \n  \"rate_limiting\": {\n    \"enabled\": true,\n    \"primary\": {\n      \"requests_per_minute\": 45,\n      \"burst_requests\": 12,\n      \"burst_window_seconds\": 5\n    },\n    \"levels\": {\n      \"gentle\": {\n        \"requests\": 30,\n        \"window_seconds\": 60,\n        \"action\": \"log_warning\",\n        \"penalty_duration\": 0\n      },\n      \"moderate\": {\n        \"requests\": 60,\n        \"window_seconds\": 60,\n        \"action\": \"temporary_delay\",\n        \"penalty_duration\": 30\n      },\n      \"aggressive\": {\n        \"requests\": 90,\n        \"window_seconds\": 60,\n        \"action\": \"temporary_block\",",
        "stderr": "",
        "interrupted": false,
        "isImage": false,
        "noOutputExpected": false
    }
}