1[
2  {
3    "enabled": 1,
4    "version_min": 209000,
5    "version_max": -1,
6    "title": "Invalid actions break CRS 3.1 on rule 912160 - 1",
7    "url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
8    "client": {
9      "ip": "200.249.12.31",
10      "port": 2313
11    },
12    "server": {
13      "ip": "200.249.12.31",
14      "port": 80
15    },
16    "request": {
17      "headers": {
18        "Host": "net.tutsplus.com",
19        "User-Agent": "",
20        "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
21        "Accept-Language": "en-us,en;q=0.5",
22        "Accept-Encoding": "gzip,deflate",
23        "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
24        "Keep-Alive": "300",
25        "Connection": "keep-alive",
26        "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
27        "Pragma": "no-cache",
28        "Cache-Control": "no-cache"
29      },
30      "uri": "\/test.pl?foo=£&bar=%C2%A3",
31      "method": "GET",
32      "http_version": 1.1,
33      "body": ""
34    },
35    "response": {
36      "headers": {
37        "Content-Type": "text\/xml; charset=utf-8\n\r",
38        "Content-Length": "length\n\r"
39      }
40    },
41    "expected": {
42      "debug_log": "\\\\xc2\\\\xa3"
43    },
44    "rules": [
45      "SecRuleEngine On",
46      "SecRule ARGS:foo \"^$\" \"id:1,expirevar:'ip.dos_burst_counter=%{tx.dos_burst_time_slice}'"
47    ]
48  },
49  {
50    "enabled": 1,
51    "version_min": 209000,
52    "version_max": -1,
53    "title": "Invalid actions break CRS 3.1 on rule 912160 - 2",
54    "url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
55    "client": {
56      "ip": "200.249.12.31",
57      "port": 2313
58    },
59    "server": {
60      "ip": "200.249.12.31",
61      "port": 80
62    },
63    "request": {
64      "headers": {
65        "Host": "net.tutsplus.com",
66        "User-Agent": "",
67        "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
68        "Accept-Language": "en-us,en;q=0.5",
69        "Accept-Encoding": "gzip,deflate",
70        "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
71        "Keep-Alive": "300",
72        "Connection": "keep-alive",
73        "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
74        "Pragma": "no-cache",
75        "Cache-Control": "no-cache"
76      },
77      "uri": "\/test.pl?foo=£&bar=%C2%A3",
78      "method": "GET",
79      "http_version": 1.1,
80      "body": ""
81    },
82    "response": {
83      "headers": {
84        "Content-Type": "text\/xml; charset=utf-8\n\r",
85        "Content-Length": "length\n\r"
86      }
87    },
88    "expected": {
89      "http_code": 200
90    },
91    "rules": [
92      "SecRuleEngine On",
93      "SecRule ARGS:foo \".\" \"id:1,setvar:'ip.dos_counter=1',log",
94      "SecRule ip.dos_counter \".\" \"id:4,log",
95      "SecRule ARGS:foo \".\" \"id:2,setvar:'!ip.dos_counter',log",
96      "SecRule ip.dos_counter \".\" \"id:3,log,status:123,block,deny"
97    ]
98  },
99  {
100    "enabled": 1,
101    "version_min": 209000,
102    "version_max": -1,
103    "title": "Invalid actions break CRS 3.1 on rule 912160 - 3",
104    "url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
105    "client": {
106      "ip": "200.249.12.31",
107      "port": 2313
108    },
109    "server": {
110      "ip": "200.249.12.31",
111      "port": 80
112    },
113    "request": {
114      "headers": {
115        "Host": "net.tutsplus.com",
116        "User-Agent": "",
117        "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
118        "Accept-Language": "en-us,en;q=0.5",
119        "Accept-Encoding": "gzip,deflate",
120        "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
121        "Keep-Alive": "300",
122        "Connection": "keep-alive",
123        "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
124        "Pragma": "no-cache",
125        "Cache-Control": "no-cache"
126      },
127      "uri": "\/test.pl?foo=£&bar=%C2%A3",
128      "method": "GET",
129      "http_version": 1.1,
130      "body": ""
131    },
132    "response": {
133      "headers": {
134        "Content-Type": "text\/xml; charset=utf-8\n\r",
135        "Content-Length": "length\n\r"
136      }
137    },
138    "expected": {
139      "http_code": 200,
140      "debug_log": "Target value: \"1\""
141    },
142    "rules": [
143      "SecRuleEngine On",
144      "SecRule ARGS:foo \".\" \"id:1,setvar:'global.alerted_970018_iisDefLoc'\"",
145      "SecRule GLOBAL:alerted_970018_iisDefLoc \".\" \"id:4,log\""
146    ]
147  },
148  {
149    "enabled": 1,
150    "version_min": 209000,
151    "version_max": -1,
152    "title": "Invalid actions break CRS 3.1 on rule 912160 - 4",
153    "url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
154    "client": {
155      "ip": "200.249.12.31",
156      "port": 2313
157    },
158    "server": {
159      "ip": "200.249.12.31",
160      "port": 80
161    },
162    "request": {
163      "headers": {
164        "Host": "net.tutsplus.com",
165        "User-Agent": "",
166        "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
167        "Accept-Language": "en-us,en;q=0.5",
168        "Accept-Encoding": "gzip,deflate",
169        "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
170        "Keep-Alive": "300",
171        "Connection": "keep-alive",
172        "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
173        "Pragma": "no-cache",
174        "Cache-Control": "no-cache"
175      },
176      "uri": "\/test.pl?foo=£&bar=%C2%A3",
177      "method": "GET",
178      "http_version": 1.1,
179      "body": ""
180    },
181    "response": {
182      "headers": {
183        "Content-Type": "text\/xml; charset=utf-8\n\r",
184        "Content-Length": "length\n\r"
185      }
186    },
187    "expected": {
188      "http_code": 200,
189      "debug_log": "GLOBAL:alerted_970018_iisDefLoc with value: 1"
190    },
191    "rules": [
192      "SecRuleEngine On",
193      "SecRule ARGS \"@rx .\" \"id:954100,phase:1,block,capture,t:none,t:lowercase,msg:'Disclosure of IIS install location',logdata:'Matched Data',tag:'application-multi',tag:'language-multi',tag:'platform-iis',tag:'platform-windows',tag:'attack-disclosure',ctl:auditLogParts=+E,rev:3,ver:'OWASP_CRS/3.0.0',severity:'ERROR',chain\"",
194      "SecRule ARGS \"@eq 0\" \"setvar:'global.alerted_970018_iisDefLoc',setvar:'tx.msg=%{rule.msg}',setvar:'tx.outbound_anomaly_score=+%{tx.error_anomaly_score}',setvar:'tx.anomaly_score=+%{tx.error_anomaly_score}'\""
195    ]
196  }
197]
198
199
200
201