Ervin Hegedus airween
airween
/ issue-3053.json
Last active
February 9, 2024 21:08
Regression test cases for ModSecurity issue #3053
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ | |
| { | |
| "enabled":1, | |
| "version_min":300000, | |
| "title":"Testing CtlRuleRemoteById (1) - issue 3053", | |
| "expected":{ | |
| "debug_log": "Rule id: 2 was skipped due to a ruleRemoveById action...", | |
| "http_code": 403 | |
| }, | |
| "client":{ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python3 | |
| import argparse | |
| import sys | |
| import msc_pyparser | |
| import json | |
| # use: | |
| # ./crs-data-collector.py -r ~/src/coreruleset/rules/*.conf | jq . | less |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python3 | |
| import requests | |
| import json | |
| def send_request(req): | |
| return requests.post(req['url'], data = req['data']) | |
| URL = { | |
| 'scheme': "https", |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ZA | |
| GY | |
| VA | |
| KO | |
| VE | |
| SO | |
| TO | |
| BA | |
| FE | |
| BP |
airween
/ errorlog1.json
Created
January 7, 2020 13:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ | |
| { | |
| "enabled":1, | |
| "version_min":300000, | |
| "title":"Testing error log output :: example 1", | |
| "client":{ | |
| "ip":"200.249.12.31", | |
| "port":123 | |
| }, | |
| "server":{ |
airween
/ check_variable.py
Last active
October 7, 2019 10:48
Check a unique variable in ModSecurity OWASP CRS rules
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python3 | |
| import yaml | |
| import sys | |
| from msc_pyparser import MSCUtils as u | |
| import os | |
| class Check(object): | |
| def __init__(self, src, data): | |
| self.source = src |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /* | |
| clang++ -Wall rmwsp.cc | |
| g++ -Wall rmwsp.cc | |
| */ | |
| #include <string> | |
| #include <iostream> | |
| #define NBSP 160 |
airween
/ variable-REQUEST_BODY-xml.json
Created
September 18, 2019 12:23
ModSecurity3 resgression test for REQUEST_BODY
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ | |
| { | |
| "enabled":1, | |
| "version_min":300000, | |
| "title":"Testing Variables :: REQUEST_BODY with XML", | |
| "client":{ | |
| "ip":"200.249.12.31", | |
| "port":123 | |
| }, | |
| "server":{ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ | |
| { | |
| "enabled":1, | |
| "version_min":300000, | |
| "title":"issue 2157", | |
| "client":{ | |
| "ip":"200.249.12.31", | |
| "port":123 | |
| }, | |
| "server":{ |
airween
/ rule-941330-2.conf
Created
September 13, 2019 20:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"\'][ ]*(([^a-z0-9~_:\' ])|(in)).*?(((l|(\\u006C))(o|(\\u006F))(c|(\\u0063))(a|(\\u0061))(t|(\\u0074))(i|(\\u0069))(o|(\\u006F))(n|(\\u006E)))|((n|(\\u006E))(a|(\\u0061))(m|(\\u006D))(e|(\\u0065)))|((o|(\\u006F))(n|(\\u006E))(e|(\\u0065))(r|(\\u0072))(r|(\\u0072))(o|(\\u006F))(r|(\\u0072)))|((v|(\\u0076))(a|(\\u0061))(l|(\\u006C))(u|(\\u0075))(e|(\\u0065))(O|(\\u004F))(f|(\\u0066)))).*?=)" \ | |
| "id:941330,\ | |
| phase:2,\ | |
| block,\ | |
| capture,\ | |
| t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,\ | |
| msg:'IE XSS Filters - Attack Detected.',\ | |
| logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ | |
| tag:'application-multi',\ |
NewerOlder