// 示例：Node.js中记录可疑请求的中间件
app.use((req, res, next) => {
  const suspiciousPatterns = [
    /\.\.\//, // 目录遍历
    /select.*from/i, // SQL注入
    /<script>/i, // XSS
    /\/wp-admin\/|\/phpmyadmin\// // 常见后台路径
  ];
  
  if (suspiciousPatterns.some(pattern => pattern.test(req.url))) {
    console.warn(`可疑请求: ${req.method} ${req.url} from ${req.ip}`);
    // 可以选择记录到数据库或安全日志系统
  }
  
  next();
});

# 阻止常见攻击模式
location ~* "(\.\./|\.\.\\|%2e%2e|%2e%2e/|\\.\\.\\\\)" {
    return 403;
}

# 阻止特定User-Agent
if ($http_user_agent ~* (nmap|sqlmap|wget|curl|scan|bot|spider|crawler)) {
    return 403;
}

# 限制请求速率
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;

// 检查并过滤可疑GET参数
foreach ($_GET as $key => $value) {
    if (preg_match('/[\/\\\\\'"<>%]/', $value)) {
        // 记录可疑请求
        error_log("可疑输入: $key=$value from ".$_SERVER['REMOTE_ADDR']);
        // 可以选择返回错误或过滤值
        $_GET[$key] = preg_replace('/[\/\\\\\'"<>%]/', '', $value);
    }
}