1[ 2 { 3 "enabled": 1, 4 "version_min": 209000, 5 "version_max": -1, 6 "title": "Invalid actions break CRS 3.1 on rule 912160 - 1", 7 "url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830", 8 "client": { 9 "ip": "200.249.12.31", 10 "port": 2313 11 }, 12 "server": { 13 "ip": "200.249.12.31", 14 "port": 80 15 }, 16 "request": { 17 "headers": { 18 "Host": "net.tutsplus.com", 19 "User-Agent": "", 20 "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", 21 "Accept-Language": "en-us,en;q=0.5", 22 "Accept-Encoding": "gzip,deflate", 23 "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", 24 "Keep-Alive": "300", 25 "Connection": "keep-alive", 26 "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", 27 "Pragma": "no-cache", 28 "Cache-Control": "no-cache" 29 }, 30 "uri": "\/test.pl?foo=£&bar=%C2%A3", 31 "method": "GET", 32 "http_version": 1.1, 33 "body": "" 34 }, 35 "response": { 36 "headers": { 37 "Content-Type": "text\/xml; charset=utf-8\n\r", 38 "Content-Length": "length\n\r" 39 } 40 }, 41 "expected": { 42 "debug_log": "\\\\xc2\\\\xa3" 43 }, 44 "rules": [ 45 "SecRuleEngine On", 46 "SecRule ARGS:foo \"^$\" \"id:1,expirevar:'ip.dos_burst_counter=%{tx.dos_burst_time_slice}'" 47 ] 48 }, 49 { 50 "enabled": 1, 51 "version_min": 209000, 52 "version_max": -1, 53 "title": "Invalid actions break CRS 3.1 on rule 912160 - 2", 54 "url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830", 55 "client": { 56 "ip": "200.249.12.31", 57 "port": 2313 58 }, 59 "server": { 60 "ip": "200.249.12.31", 61 "port": 80 62 }, 63 "request": { 64 "headers": { 65 "Host": "net.tutsplus.com", 66 "User-Agent": "", 67 "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", 68 "Accept-Language": "en-us,en;q=0.5", 69 "Accept-Encoding": "gzip,deflate", 70 "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", 71 "Keep-Alive": "300", 72 "Connection": "keep-alive", 73 "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", 74 "Pragma": "no-cache", 75 "Cache-Control": "no-cache" 76 }, 77 "uri": "\/test.pl?foo=£&bar=%C2%A3", 78 "method": "GET", 79 "http_version": 1.1, 80 "body": "" 81 }, 82 "response": { 83 "headers": { 84 "Content-Type": "text\/xml; charset=utf-8\n\r", 85 "Content-Length": "length\n\r" 86 } 87 }, 88 "expected": { 89 "http_code": 200 90 }, 91 "rules": [ 92 "SecRuleEngine On", 93 "SecRule ARGS:foo \".\" \"id:1,setvar:'ip.dos_counter=1',log", 94 "SecRule ip.dos_counter \".\" \"id:4,log", 95 "SecRule ARGS:foo \".\" \"id:2,setvar:'!ip.dos_counter',log", 96 "SecRule ip.dos_counter \".\" \"id:3,log,status:123,block,deny" 97 ] 98 }, 99 { 100 "enabled": 1, 101 "version_min": 209000, 102 "version_max": -1, 103 "title": "Invalid actions break CRS 3.1 on rule 912160 - 3", 104 "url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830", 105 "client": { 106 "ip": "200.249.12.31", 107 "port": 2313 108 }, 109 "server": { 110 "ip": "200.249.12.31", 111 "port": 80 112 }, 113 "request": { 114 "headers": { 115 "Host": "net.tutsplus.com", 116 "User-Agent": "", 117 "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", 118 "Accept-Language": "en-us,en;q=0.5", 119 "Accept-Encoding": "gzip,deflate", 120 "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", 121 "Keep-Alive": "300", 122 "Connection": "keep-alive", 123 "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", 124 "Pragma": "no-cache", 125 "Cache-Control": "no-cache" 126 }, 127 "uri": "\/test.pl?foo=£&bar=%C2%A3", 128 "method": "GET", 129 "http_version": 1.1, 130 "body": "" 131 }, 132 "response": { 133 "headers": { 134 "Content-Type": "text\/xml; charset=utf-8\n\r", 135 "Content-Length": "length\n\r" 136 } 137 }, 138 "expected": { 139 "http_code": 200, 140 "debug_log": "Target value: \"1\"" 141 }, 142 "rules": [ 143 "SecRuleEngine On", 144 "SecRule ARGS:foo \".\" \"id:1,setvar:'global.alerted_970018_iisDefLoc'\"", 145 "SecRule GLOBAL:alerted_970018_iisDefLoc \".\" \"id:4,log\"" 146 ] 147 }, 148 { 149 "enabled": 1, 150 "version_min": 209000, 151 "version_max": -1, 152 "title": "Invalid actions break CRS 3.1 on rule 912160 - 4", 153 "url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830", 154 "client": { 155 "ip": "200.249.12.31", 156 "port": 2313 157 }, 158 "server": { 159 "ip": "200.249.12.31", 160 "port": 80 161 }, 162 "request": { 163 "headers": { 164 "Host": "net.tutsplus.com", 165 "User-Agent": "", 166 "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", 167 "Accept-Language": "en-us,en;q=0.5", 168 "Accept-Encoding": "gzip,deflate", 169 "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", 170 "Keep-Alive": "300", 171 "Connection": "keep-alive", 172 "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", 173 "Pragma": "no-cache", 174 "Cache-Control": "no-cache" 175 }, 176 "uri": "\/test.pl?foo=£&bar=%C2%A3", 177 "method": "GET", 178 "http_version": 1.1, 179 "body": "" 180 }, 181 "response": { 182 "headers": { 183 "Content-Type": "text\/xml; charset=utf-8\n\r", 184 "Content-Length": "length\n\r" 185 } 186 }, 187 "expected": { 188 "http_code": 200, 189 "debug_log": "GLOBAL:alerted_970018_iisDefLoc with value: 1" 190 }, 191 "rules": [ 192 "SecRuleEngine On", 193 "SecRule ARGS \"@rx .\" \"id:954100,phase:1,block,capture,t:none,t:lowercase,msg:'Disclosure of IIS install location',logdata:'Matched Data',tag:'application-multi',tag:'language-multi',tag:'platform-iis',tag:'platform-windows',tag:'attack-disclosure',ctl:auditLogParts=+E,rev:3,ver:'OWASP_CRS/3.0.0',severity:'ERROR',chain\"", 194 "SecRule ARGS \"@eq 0\" \"setvar:'global.alerted_970018_iisDefLoc',setvar:'tx.msg=%{rule.msg}',setvar:'tx.outbound_anomaly_score=+%{tx.error_anomaly_score}',setvar:'tx.anomaly_score=+%{tx.error_anomaly_score}'\"" 195 ] 196 } 197] 198 199 200 201