1 2use lib 'lib'; 3use Test::Nginx::Socket; 4 5plan tests => repeat_each(2) * blocks(); 6no_root_location(); 7no_long_string(); 8$ENV{TEST_NGINX_SERVROOT} = server_root(); 9run_tests(); 10 11 12__DATA__ 13=== TODO: naxsi does not support utf8, potential bypass. Still too marginal to be worth checking 14--- main_config 15working_directory /tmp/; 16worker_rlimit_core 25M; 17--- main_config 18load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 19--- http_config 20include /tmp/naxsi_ut/naxsi_core.rules; 21--- config 22 location / { 23 #LearningMode; 24 SecRulesEnabled; 25 DeniedUrl "/RequestDenied"; 26 CheckRule "$SQL >= 8" BLOCK; 27 CheckRule "$RFI >= 8" BLOCK; 28 CheckRule "$TRAVERSAL >= 4" BLOCK; 29 CheckRule "$XSS >= 8" BLOCK; 30 root $TEST_NGINX_SERVROOT/html/; 31 index index.html index.htm; 32} 33location /RequestDenied { 34 return 412; 35} 36--- raw_request eval 37"GET /?a=AND+%EF%BC%871%EF%BC%87=%EF%BC%871%EF%BC%87 HTTP/1.0 38 39" 40--- error_code: 200 41 42 43=== TEST 1: hey 2 44--- main_config 45working_directory /tmp/; 46worker_rlimit_core 25M; 47--- main_config 48load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 49--- http_config 50include /tmp/naxsi_ut/naxsi_core.rules; 51--- config 52location / { 53 #LearningMode; 54 SecRulesEnabled; 55 DeniedUrl "/RequestDenied"; 56 CheckRule "$SQL >= 8" BLOCK; 57 CheckRule "$RFI >= 8" BLOCK; 58 CheckRule "$TRAVERSAL >= 4" BLOCK; 59 CheckRule "$XSS >= 8" BLOCK; 60 root $TEST_NGINX_SERVROOT/html/; 61 index index.html index.htm; 62} 63location /RequestDenied { 64 return 412; 65} 66--- raw_request eval 67"GET /?a=AND+%00%271%00%27=%00%271%00%27 HTTP/1.0 68 69" 70--- error_code: 412 71 72 73=== TEST 1: hey 3 74--- main_config 75working_directory /tmp/; 76worker_rlimit_core 25M; 77--- main_config 78load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 79--- http_config 80include /tmp/naxsi_ut/naxsi_core.rules; 81--- config 82location / { 83 #LearningMode; 84 SecRulesEnabled; 85 DeniedUrl "/RequestDenied"; 86 CheckRule "$SQL >= 8" BLOCK; 87 CheckRule "$RFI >= 8" BLOCK; 88 CheckRule "$TRAVERSAL >= 4" BLOCK; 89 CheckRule "$XSS >= 8" BLOCK; 90 root $TEST_NGINX_SERVROOT/html/; 91 index index.html index.htm; 92} 93location /RequestDenied { 94 return 412; 95} 96--- raw_request eval 97"GET /?a=AND+1=1%00 Union select 1 HTTP/1.0 98 99" 100--- error_code: 412 101 102 103=== NOT TODO: base64, not worthing checking 104--- main_config 105working_directory /tmp/; 106worker_rlimit_core 25M; 107--- main_config 108load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 109--- http_config 110include /tmp/naxsi_ut/naxsi_core.rules; 111--- config 112location / { 113 #LearningMode; 114 SecRulesEnabled; 115 DeniedUrl "/RequestDenied"; 116 CheckRule "$SQL >= 8" BLOCK; 117 CheckRule "$RFI >= 8" BLOCK; 118 CheckRule "$TRAVERSAL >= 4" BLOCK; 119 CheckRule "$XSS >= 8" BLOCK; 120 root $TEST_NGINX_SERVROOT/html/; 121 index index.html index.htm; 122} 123location /RequestDenied { 124 return 412; 125} 126--- raw_request eval 127"GET /?a=MScgQU5EIFNMRUVQKDUpIw== HTTP/1.0 128 129" 130--- error_code: 200 131 132 133=== TEST 1: hey 5 134--- main_config 135working_directory /tmp/; 136worker_rlimit_core 25M; 137--- main_config 138load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 139--- http_config 140include /tmp/naxsi_ut/naxsi_core.rules; 141--- config 142location / { 143 #LearningMode; 144 SecRulesEnabled; 145 DeniedUrl "/RequestDenied"; 146 CheckRule "$SQL >= 8" BLOCK; 147 CheckRule "$RFI >= 8" BLOCK; 148 CheckRule "$TRAVERSAL >= 4" BLOCK; 149 CheckRule "$XSS >= 8" BLOCK; 150 root $TEST_NGINX_SERVROOT/html/; 151 index index.html index.htm; 152} 153location /RequestDenied { 154 return 412; 155} 156--- raw_request eval 157"GET /?a='A+NOT+BETWEEN+0+AND+B' HTTP/1.0 158 159" 160--- error_code: 412 161 162 163=== TEST 1: hey 6 164--- main_config 165working_directory /tmp/; 166worker_rlimit_core 25M; 167--- main_config 168load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 169--- http_config 170include /tmp/naxsi_ut/naxsi_core.rules; 171--- config 172location / { 173 #LearningMode; 174 SecRulesEnabled; 175 DeniedUrl "/RequestDenied"; 176 CheckRule "$SQL >= 8" BLOCK; 177 CheckRule "$RFI >= 8" BLOCK; 178 CheckRule "$TRAVERSAL >= 4" BLOCK; 179 CheckRule "$XSS >= 8" BLOCK; 180 root $TEST_NGINX_SERVROOT/html/; 181 index index.html index.htm; 182} 183location /RequestDenied { 184 return 412; 185} 186--- raw_request eval 187"GET /?a=%2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545 HTTP/1.0 188 189" 190--- error_code: 412 191 192 193=== TEST 1: hey 7 194--- main_config 195working_directory /tmp/; 196worker_rlimit_core 25M; 197--- main_config 198load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 199--- http_config 200include /tmp/naxsi_ut/naxsi_core.rules; 201--- config 202location / { 203 #LearningMode; 204 SecRulesEnabled; 205 DeniedUrl "/RequestDenied"; 206 CheckRule "$SQL >= 8" BLOCK; 207 CheckRule "$RFI >= 8" BLOCK; 208 CheckRule "$TRAVERSAL >= 4" BLOCK; 209 CheckRule "$XSS >= 8" BLOCK; 210 root $TEST_NGINX_SERVROOT/html/; 211 index index.html index.htm; 212} 213location /RequestDenied { 214 return 412; 215} 216--- raw_request eval 217"GET /?a=%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45 HTTP/1.0 218 219" 220--- error_code: 412 221 222 223=== TEST 1: hey 8 224--- main_config 225working_directory /tmp/; 226worker_rlimit_core 25M; 227--- main_config 228load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 229--- http_config 230include /tmp/naxsi_ut/naxsi_core.rules; 231--- config 232location / { 233 #LearningMode; 234 SecRulesEnabled; 235 DeniedUrl "/RequestDenied"; 236 CheckRule "$SQL >= 8" BLOCK; 237 CheckRule "$RFI >= 8" BLOCK; 238 CheckRule "$TRAVERSAL >= 4" BLOCK; 239 CheckRule "$XSS >= 8" BLOCK; 240 root $TEST_NGINX_SERVROOT/html/; 241 index index.html index.htm; 242} 243location /RequestDenied { 244 return 412; 245} 246--- raw_request eval 247"GET /?a=%u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045' HTTP/1.0 248 249" 250--- error_code: 412 251 252 253=== TEST 1: hey 9 254--- main_config 255working_directory /tmp/; 256worker_rlimit_core 25M; 257--- main_config 258load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 259--- http_config 260include /tmp/naxsi_ut/naxsi_core.rules; 261--- config 262location / { 263 #LearningMode; 264 SecRulesEnabled; 265 DeniedUrl "/RequestDenied"; 266 CheckRule "$SQL >= 8" BLOCK; 267 CheckRule "$RFI >= 8" BLOCK; 268 CheckRule "$TRAVERSAL >= 4" BLOCK; 269 CheckRule "$XSS >= 8" BLOCK; 270 root $TEST_NGINX_SERVROOT/html/; 271 index index.html index.htm; 272} 273location /RequestDenied { 274 return 412; 275} 276--- raw_request eval 277"GET /?a=SELECT+*+FROM+users+WHERE+id+LIKE+1 HTTP/1.0 278 279" 280--- error_code: 412 281 282 283=== TEST 1: hey 10 284--- main_config 285working_directory /tmp/; 286worker_rlimit_core 25M; 287--- main_config 288load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 289--- http_config 290include /tmp/naxsi_ut/naxsi_core.rules; 291--- config 292 location / { 293 #LearningMode; 294 SecRulesEnabled; 295 DeniedUrl "/RequestDenied"; 296 CheckRule "$SQL >= 8" BLOCK; 297 CheckRule "$RFI >= 8" BLOCK; 298 CheckRule "$TRAVERSAL >= 4" BLOCK; 299 CheckRule "$XSS >= 8" BLOCK; 300 root $TEST_NGINX_SERVROOT/html/; 301 index index.html index.htm; 302} 303location /RequestDenied { 304 return 412; 305} 306--- raw_request eval 307"GET /?a=value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),+NULL,+NULL#/*!0AND+'QDWa'='QDWa HTTP/1.0 308 309" 310--- error_code: 412 311 312 313=== TEST 1: hey 11 314--- main_config 315working_directory /tmp/; 316worker_rlimit_core 25M; 317--- main_config 318load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 319--- http_config 320include /tmp/naxsi_ut/naxsi_core.rules; 321--- config 322location / { 323 #LearningMode; 324 SecRulesEnabled; 325 DeniedUrl "/RequestDenied"; 326 CheckRule "$SQL >= 8" BLOCK; 327 CheckRule "$RFI >= 8" BLOCK; 328 CheckRule "$TRAVERSAL >= 4" BLOCK; 329 CheckRule "$XSS >= 8" BLOCK; 330 root $TEST_NGINX_SERVROOT/html/; 331 index index.html index.htm; 332} 333location /RequestDenied { 334 return 412; 335} 336--- raw_request eval 337"GET /?a=IF(ISNULL(1),+2,+1) HTTP/1.0 338 339" 340--- error_code: 412 341 342 343=== TEST 1: hey 12 344--- main_config 345working_directory /tmp/; 346worker_rlimit_core 25M; 347--- main_config 348load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 349--- http_config 350include /tmp/naxsi_ut/naxsi_core.rules; 351--- config 352location / { 353 #LearningMode; 354 SecRulesEnabled; 355 DeniedUrl "/RequestDenied"; 356 CheckRule "$SQL >= 8" BLOCK; 357 CheckRule "$RFI >= 8" BLOCK; 358 CheckRule "$TRAVERSAL >= 4" BLOCK; 359 CheckRule "$XSS >= 8" BLOCK; 360 root $TEST_NGINX_SERVROOT/html/; 361 index index.html index.htm; 362} 363location /RequestDenied { 364 return 412; 365} 366--- raw_request eval 367"GET /?a=1+/*!30000AND+2>1*/-- HTTP/1.0 368 369" 370--- error_code: 412 371 372 373=== TEST 1: hey 13 374--- main_config 375working_directory /tmp/; 376worker_rlimit_core 25M; 377--- main_config 378load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 379--- http_config 380include /tmp/naxsi_ut/naxsi_core.rules; 381--- config 382location / { 383 #LearningMode; 384 SecRulesEnabled; 385 DeniedUrl "/RequestDenied"; 386 CheckRule "$SQL >= 8" BLOCK; 387 CheckRule "$RFI >= 8" BLOCK; 388 CheckRule "$TRAVERSAL >= 4" BLOCK; 389 CheckRule "$XSS >= 8" BLOCK; 390 root $TEST_NGINX_SERVROOT/html/; 391 index index.html index.htm; 392} 393location /RequestDenied { 394 return 412; 395} 396--- raw_request eval 397"GET /?a=1+/*!00000AND+2>1*/-- HTTP/1.0 398 399" 400--- error_code: 412 401 402 403=== TEST 1: hey 14 404--- main_config 405working_directory /tmp/; 406worker_rlimit_core 25M; 407--- main_config 408load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 409--- http_config 410include /tmp/naxsi_ut/naxsi_core.rules; 411--- config 412location / { 413 #LearningMode; 414 SecRulesEnabled; 415 DeniedUrl "/RequestDenied"; 416 CheckRule "$SQL >= 8" BLOCK; 417 CheckRule "$RFI >= 8" BLOCK; 418 CheckRule "$TRAVERSAL >= 4" BLOCK; 419 CheckRule "$XSS >= 8" BLOCK; 420 root $TEST_NGINX_SERVROOT/html/; 421 index index.html index.htm; 422} 423location /RequestDenied { 424 return 412; 425} 426--- raw_request eval 427"GET /?a=+UNION+++SELECT++ HTTP/1.0 428 429" 430--- error_code: 412 431 432 433=== IIS/ASP Encoding 434--- main_config 435working_directory /tmp/; 436worker_rlimit_core 25M; 437--- main_config 438load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 439--- http_config 440include /tmp/naxsi_ut/naxsi_core.rules; 441--- config 442location / { 443 #LearningMode; 444 SecRulesEnabled; 445 DeniedUrl "/RequestDenied"; 446 CheckRule "$SQL >= 8" BLOCK; 447 CheckRule "$RFI >= 8" BLOCK; 448 CheckRule "$TRAVERSAL >= 4" BLOCK; 449 CheckRule "$XSS >= 8" BLOCK; 450 root $TEST_NGINX_SERVROOT/html/; 451 index index.html index.htm; 452} 453location /RequestDenied { 454 return 412; 455} 456--- raw_request eval 457"GET /?a=%S%E%L%E%C%T+%F%I%E%L%D+%F%R%O%M+%T%A%B%L%E HTTP/1.0 458 459" 460--- error_code: 412 461 462 463=== TEST 1: hey 16 464--- main_config 465working_directory /tmp/; 466worker_rlimit_core 25M; 467--- main_config 468load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 469--- http_config 470include /tmp/naxsi_ut/naxsi_core.rules; 471--- config 472location / { 473 #LearningMode; 474 SecRulesEnabled; 475 DeniedUrl "/RequestDenied"; 476 CheckRule "$SQL >= 8" BLOCK; 477 CheckRule "$RFI >= 8" BLOCK; 478 CheckRule "$TRAVERSAL >= 4" BLOCK; 479 CheckRule "$XSS >= 8" BLOCK; 480 root $TEST_NGINX_SERVROOT/html/; 481 index index.html index.htm; 482} 483location /RequestDenied { 484 return 412; 485} 486--- raw_request eval 487"GET /?a=1 UnioN SeLEct 1 HTTP/1.0 488 489" 490--- error_code: 412 491 492 493=== TEST 1: hey 17 494--- main_config 495working_directory /tmp/; 496worker_rlimit_core 25M; 497--- main_config 498load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 499--- http_config 500include /tmp/naxsi_ut/naxsi_core.rules; 501--- config 502location / { 503 #LearningMode; 504 SecRulesEnabled; 505 DeniedUrl "/RequestDenied"; 506 CheckRule "$SQL >= 8" BLOCK; 507 CheckRule "$RFI >= 8" BLOCK; 508 CheckRule "$TRAVERSAL >= 4" BLOCK; 509 CheckRule "$XSS >= 8" BLOCK; 510 root $TEST_NGINX_SERVROOT/html/; 511 index index.html index.htm; 512} 513location /RequestDenied { 514 return 412; 515} 516--- raw_request eval 517"GET /?a=AND+1=1+and+'0having'='0having' HTTP/1.0 518 519" 520--- error_code: 412 521 522 523=== TEST 1: hey 18 524--- main_config 525working_directory /tmp/; 526worker_rlimit_core 25M; 527--- main_config 528load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 529--- http_config 530include /tmp/naxsi_ut/naxsi_core.rules; 531--- config 532location / { 533 #LearningMode; 534 SecRulesEnabled; 535 DeniedUrl "/RequestDenied"; 536 CheckRule "$SQL >= 8" BLOCK; 537 CheckRule "$RFI >= 8" BLOCK; 538 CheckRule "$TRAVERSAL >= 4" BLOCK; 539 CheckRule "$XSS >= 8" BLOCK; 540 root $TEST_NGINX_SERVROOT/html/; 541 index index.html index.htm; 542} 543location /RequestDenied { 544 return 412; 545} 546--- raw_request eval 547"GET /?a=SELECT/**/id/**/FROM/**/users HTTP/1.0 548 549" 550--- error_code: 412 551 552 553=== TEST 1: hey 19 554--- main_config 555working_directory /tmp/; 556worker_rlimit_core 25M; 557--- main_config 558load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 559--- http_config 560include /tmp/naxsi_ut/naxsi_core.rules; 561--- config 562location / { 563 #LearningMode; 564 SecRulesEnabled; 565 DeniedUrl "/RequestDenied"; 566 CheckRule "$SQL >= 8" BLOCK; 567 CheckRule "$RFI >= 8" BLOCK; 568 CheckRule "$TRAVERSAL >= 4" BLOCK; 569 CheckRule "$XSS >= 8" BLOCK; 570 root $TEST_NGINX_SERVROOT/html/; 571 index index.html index.htm; 572} 573location /RequestDenied { 574 return 412; 575} 576--- raw_request eval 577"GET /?a=1--PTTmJopxdWJ%0AAND--cWfcVRPV%0A9227=9227 HTTP/1.0 578 579" 580--- error_code: 412 581 582 583=== TEST 1: hey 20 584--- main_config 585working_directory /tmp/; 586worker_rlimit_core 25M; 587--- main_config 588load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 589--- http_config 590include /tmp/naxsi_ut/naxsi_core.rules; 591--- config 592location / { 593 #LearningMode; 594 SecRulesEnabled; 595 DeniedUrl "/RequestDenied"; 596 CheckRule "$SQL >= 8" BLOCK; 597 CheckRule "$RFI >= 8" BLOCK; 598 CheckRule "$TRAVERSAL >= 4" BLOCK; 599 CheckRule "$XSS >= 8" BLOCK; 600 root $TEST_NGINX_SERVROOT/html/; 601 index index.html index.htm; 602} 603location /RequestDenied { 604 return 412; 605} 606--- raw_request eval 607"GET /?a=1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227 HTTP/1.0 608 609" 610--- error_code: 412 611 612 613=== TEST 1: hey 21 614--- main_config 615working_directory /tmp/; 616worker_rlimit_core 25M; 617--- main_config 618load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 619--- http_config 620include /tmp/naxsi_ut/naxsi_core.rules; 621--- config 622location / { 623 #LearningMode; 624 SecRulesEnabled; 625 DeniedUrl "/RequestDenied"; 626 CheckRule "$SQL >= 8" BLOCK; 627 CheckRule "$RFI >= 8" BLOCK; 628 CheckRule "$TRAVERSAL >= 4" BLOCK; 629 CheckRule "$XSS >= 8" BLOCK; 630 root $TEST_NGINX_SERVROOT/html/; 631 index index.html index.htm; 632} 633location /RequestDenied { 634 return 412; 635} 636--- raw_request eval 637"GET /?a=1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227 HTTP/1.0 638 639" 640--- error_code: 412 641 642 643=== TEST 1: hey 22 644--- main_config 645working_directory /tmp/; 646worker_rlimit_core 25M; 647--- main_config 648load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 649--- http_config 650include /tmp/naxsi_ut/naxsi_core.rules; 651--- config 652location / { 653 #LearningMode; 654 SecRulesEnabled; 655 DeniedUrl "/RequestDenied"; 656 CheckRule "$SQL >= 8" BLOCK; 657 CheckRule "$RFI >= 8" BLOCK; 658 CheckRule "$TRAVERSAL >= 4" BLOCK; 659 CheckRule "$XSS >= 8" BLOCK; 660 root $TEST_NGINX_SERVROOT/html/; 661 index index.html index.htm; 662} 663location /RequestDenied { 664 return 412; 665} 666--- raw_request eval 667"GET /?a=SELECT%08id%02FROM%0Fusers HTTP/1.0 668 669" 670--- error_code: 412 671 672 673=== TEST 1: hey 23 674--- main_config 675working_directory /tmp/; 676worker_rlimit_core 25M; 677--- main_config 678load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 679--- http_config 680include /tmp/naxsi_ut/naxsi_core.rules; 681--- config 682location / { 683 #LearningMode; 684 SecRulesEnabled; 685 DeniedUrl "/RequestDenied"; 686 CheckRule "$SQL >= 8" BLOCK; 687 CheckRule "$RFI >= 8" BLOCK; 688 CheckRule "$TRAVERSAL >= 4" BLOCK; 689 CheckRule "$XSS >= 8" BLOCK; 690 root $TEST_NGINX_SERVROOT/html/; 691 index index.html index.htm; 692} 693location /RequestDenied { 694 return 412; 695} 696--- raw_request eval 697"GET /?a=1%23%0A9227=922%237 HTTP/1.0 698 699" 700--- error_code: 412 701 702 703=== TEST 1: hey 24 704--- main_config 705working_directory /tmp/; 706worker_rlimit_core 25M; 707--- main_config 708load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 709--- http_config 710include /tmp/naxsi_ut/naxsi_core.rules; 711--- config 712location / { 713 #LearningMode; 714 SecRulesEnabled; 715 DeniedUrl "/RequestDenied"; 716 CheckRule "$SQL >= 8" BLOCK; 717 CheckRule "$RFI >= 8" BLOCK; 718 CheckRule "$TRAVERSAL >= 4" BLOCK; 719 CheckRule "$XSS >= 8" BLOCK; 720 root $TEST_NGINX_SERVROOT/html/; 721 index index.html index.htm; 722} 723location /RequestDenied { 724 return 412; 725} 726--- raw_request eval 727"GET /?a=SELECT%0Bid%0BFROM%A0users HTTP/1.0 728 729" 730--- error_code: 412 731 732 733=== TEST 1: hey 25 734--- main_config 735working_directory /tmp/; 736worker_rlimit_core 25M; 737--- main_config 738load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 739--- http_config 740include /tmp/naxsi_ut/naxsi_core.rules; 741--- config 742location / { 743 #LearningMode; 744 SecRulesEnabled; 745 DeniedUrl "/RequestDenied"; 746 CheckRule "$SQL >= 8" BLOCK; 747 CheckRule "$RFI >= 8" BLOCK; 748 CheckRule "$TRAVERSAL >= 4" BLOCK; 749 CheckRule "$XSS >= 8" BLOCK; 750 root $TEST_NGINX_SERVROOT/html/; 751 index index.html index.htm; 752} 753location /RequestDenied { 754 return 412; 755} 756--- raw_request eval 757"GET /?a=1--%0AAND--%0A9227=9227 HTTP/1.0 758 759" 760--- error_code: 412 761 762 763=== TEST 1: hey 26 764--- main_config 765working_directory /tmp/; 766worker_rlimit_core 25M; 767--- main_config 768load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 769--- http_config 770include /tmp/naxsi_ut/naxsi_core.rules; 771--- config 772location / { 773 #LearningMode; 774 SecRulesEnabled; 775 DeniedUrl "/RequestDenied"; 776 CheckRule "$SQL >= 8" BLOCK; 777 CheckRule "$RFI >= 8" BLOCK; 778 CheckRule "$TRAVERSAL >= 4" BLOCK; 779 CheckRule "$XSS >= 8" BLOCK; 780 root $TEST_NGINX_SERVROOT/html/; 781 index index.html index.htm; 782} 783location /RequestDenied { 784 return 412; 785} 786--- raw_request eval 787"GET /?a=SELECT+id+FROM+users HTTP/1.0 788 789" 790--- error_code: 412 791 792 793 794=== TEST 1: hey 28 795--- main_config 796working_directory /tmp/; 797worker_rlimit_core 25M; 798--- main_config 799load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 800--- http_config 801include /tmp/naxsi_ut/naxsi_core.rules; 802--- config 803location / { 804 #LearningMode; 805 SecRulesEnabled; 806 DeniedUrl "/RequestDenied"; 807 CheckRule "$SQL >= 8" BLOCK; 808 CheckRule "$RFI >= 8" BLOCK; 809 CheckRule "$TRAVERSAL >= 4" BLOCK; 810 CheckRule "$XSS >= 8" BLOCK; 811 root $TEST_NGINX_SERVROOT/html/; 812 index index.html index.htm; 813} 814location /RequestDenied { 815 return 412; 816} 817--- raw_request eval 818"GET /?a=1%bf%27+AND+1=1--%20 HTTP/1.0 819 820" 821--- error_code: 412 822 823 824=== TEST 1: hey 29 825--- main_config 826working_directory /tmp/; 827worker_rlimit_core 25M; 828--- main_config 829load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 830--- http_config 831include /tmp/naxsi_ut/naxsi_core.rules; 832--- config 833location / { 834 #LearningMode; 835 SecRulesEnabled; 836 DeniedUrl "/RequestDenied"; 837 CheckRule "$SQL >= 8" BLOCK; 838 CheckRule "$RFI >= 8" BLOCK; 839 CheckRule "$TRAVERSAL >= 4" BLOCK; 840 CheckRule "$XSS >= 8" BLOCK; 841 root $TEST_NGINX_SERVROOT/html/; 842 index index.html index.htm; 843} 844location /RequestDenied { 845 return 412; 846} 847--- raw_request eval 848"GET /?a=1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,+CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))# HTTP/1.0 849 850" 851--- error_code: 412 852 853 854=== TEST 1: hey 30 855--- main_config 856working_directory /tmp/; 857worker_rlimit_core 25M; 858--- main_config 859load_module /tmp/naxsi_ut/modules/ngx_http_naxsi_module.so; 860--- http_config 861include /tmp/naxsi_ut/naxsi_core.rules; 862--- config 863location / { 864 #LearningMode; 865 SecRulesEnabled; 866 DeniedUrl "/RequestDenied"; 867 CheckRule "$SQL >= 8" BLOCK; 868 CheckRule "$RFI >= 8" BLOCK; 869 CheckRule "$TRAVERSAL >= 4" BLOCK; 870 CheckRule "$XSS >= 8" BLOCK; 871 root $TEST_NGINX_SERVROOT/html/; 872 index index.html index.htm; 873} 874location /RequestDenied { 875 return 412; 876} 877--- raw_request eval 878"GET /?a=1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))# HTTP/1.0 879 880" 881--- error_code: 412 882 883 884