Block Testing Tools Query Parameters, User-Agents and Suspicious Headers

nginx.conf

server {
    listen 80;
    server_name yourdomain.com;

    # Block malicious query parameters
    set $block_query 0;
    if ($query_string ~* "(mdrv|jmeter|gatling|locust|tsung|k6|zaproxy|burp|nikto|sqlmap|metasploit)") {
        set $block_query 1;
    }

    # Block malicious User-Agents
    set $block_user_agent 0;
    if ($http_user_agent ~* "(LoadRunner|JMeter|Gatling|Locust|Tsung|k6|ZAP|Burp|Nikto|sqlmap|Metasploit)") {
        set $block_user_agent 1;
    }

    # Block requests with suspicious headers
    set $block_header 0;
    if ($http_referer ~* "(zaproxy|burp|nikto|sqlmap|metasploit)") {
        set $block_header 1;
    }

    # Apply blocking
    location / {
        if ($block_query = 1) { return 403; }
        if ($block_user_agent = 1) { return 403; }
        if ($block_header = 1) { return 403; }

        # Allow normal traffic
        proxy_pass http://backend_server;
    }

}