^.*

.*$

Neither of these elements is necessary, and in the long run will add a few picoseconds to processing time.

What in the world is being attempted here? Is there an online resource that can convert this charset to readable Enlgish?

Probably. I made one years ago in javascript that I keep on my HD; this sample says

GET /ubbthreads/ubbthreads.php?ubb=changeprefs&what=style&value=11&curl=https://www.google.by/url?sa=X&q=http://Ys.A@srv5.cineteck.net/phpinfo/?a[]=<a+href=https://PORcu.PineoYs.A@Srv5.Cineteck.net/phpinfo/?a[]=<a+href=http://Haedongacademy.org/phpinfo.php?a[]=<a+href=https://retizen.republika.co.id/posts/159390/cara-membuat-laporan-keuangan-praktis-dengan-software-akuntansi>software+akuntansi+custom</a>>software+akuntansi</a><meta+http-equiv=refresh+content=0;url=http://km10805.Keymachine.de/php.php?a[]=<a+href=https://blog.momitsubo.jp/promotion/comment-page-2014/>software+accounting</a>+/>>Wordpress</a>

(and if any of that is truly sinister, I will get a 403 when I click Submit). Looks like someone in Indonesia is misbehaving.

Thank you, lucy24, for desiphering that gobbledegook. I still have no clue what this person is attempting to do.

I appreciate the comment on the code. I'll remove those.

While I've got your attention, I'm seeing this in the USER_AGENT strings in my logs.

><script >alert(String.fromCharCode(88,83,83))</script>&Number=509953
 1 ><script >alert(String.fromCharCode(88,83,83))</script>&Number=885268
 1 ><script >alert(String.fromCharCode(88,83,83))</script>&Number=912802
 1 ><script >alert(String.fromCharCode(88,83,83))</script>&what=style&value=11&curl=http://\xd0\xbb\xd0\xb5\xd1\x81\xd1\x82\xd0\xbd\xd0\xb8\xd1\x86\xd1\x8b-\xd0\xbf\xd1\x80\xd0\xb0\xd0\xba\xd1\x82\xd0\xb8\xd0\xba.\xd1\x80\xd1\x84/aFbpsept26wwwstoveboltcomtp3

I have tried a number of different combinations in the .htacess file to catch this crap, but everything I try cause Apache to barf. I've tried using *fromCharCode*, *\<script*, and several others, but every one throws errors. Is there a way to blcok this crap that I haven't tried yet?

Is the angle-bracket the very first thing in the UA string? My access-control rules (using a combination of mod_setenvif and mod_auth-I-forget-what-it's-called) include

BrowserMatch ^\W bad_agent=nonword
....
Require env bad_agent

(the latter of course inside a RequireNone envelope), meaning "if the first character in the UA string is a non-word, set the bad_agent user variable". You could do the same thing, mutatis mutandis, in mod_rewrite, though it's a bit more server-intensive, especially in htaccess:

RewriteCond %{HTTP_USER_AGENT} ^\W

Since no legitimate user-agent* contains the string "script" you could also say something like

BrowserMatch script bad_agent=script

(Environmental variables don't have to have a value--they default to 1--but I like to keep a record.)
or

RewriteCond %{HTTP_USER_AGENT} script

meaning if the element "script" occurs anywhere in the UA string, et cetera.

Any time you can do something based on the very first character in the UA, it's going to be more efficient, because the server only has to look at one character instead of scanning the whole string. Whether you use mod_setenvif or a RewriteCond, this would of course have to be separate from the rules that do look at the whole string. In mod_rewrite, you could have two or more Conditions separated by [OR] instead of the default AND.

Edit: Although it does no harm, the [L] in [F,L] isn't needed. Non-300-class responses carry an implied [L].

* And precious few illegitimate ones; I only found a couple involving Google-Apps-Script.

Thank you again, Lucy24. Your explanations are clear and concise and extremely helpful. Bless you.

#script xss insert
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{HTTP_REFERER} (\<|%3C).*script.*(\>|%3E)

then

RewriteCond %{REQUEST_URI} ^.*(,|;|:|<|>|">|"<|\.\.\.).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\*|;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).* [NC]

food for though....

..one has to understand what one's site URIs are, if one not expecting any special characters on one's own site in URIs, do not serve the content, tell web-server of what it can dish out for.

Dashes, Underscores, ampersands - what else is there?

Same goes for GET & POST data, in headers.

(,|;|:|<|>|">|"<|\.\.\.)

Or, if you prefer,

([,;:<>]|\.\.\.)

The ">|"< part is redundant in any case, since < and > by themselves have already been excluded. I also block "   " (three consecutive spaces): some legitimate UAs might accidentally have two "  " but never more.

I found a different way to block all of these.

RewriteCond %{QUERY_STRING} fromCharCode
RewriteRule ^(.*)$ - [F,L]

94.131.112.179 - - [08/Oct/2023:07:59:59 -0400] "GET /ubbthreads/ubbthreads.php?ubb=\"><script%20>alert(String.fromCharCode(88,83,83))</script>&Number=735293 HTTP/1.1" 403 227 "https://www.example.com/ubbthreads/ubbthreads.php?ubb=\"><script >alert(String.fromCharCode(88,83,83))</script>&Number=735293" "Mozilla/5.0 (Windows NT 10.0; WOW64; Rv:50.0) Gecko/20100101 Firefox/50.0"

[edited by: not2easy at 7:04 pm (utc) on Oct 8, 2023]
[edit reason] Reminder: use example.com [/edit]