[ { "enabled": 1, "version_min": 300000, "version_max": 0, "title": "actions :: trim,deny", "client": { "ip": "200.249.12.31", "port": 2313 }, "server": { "ip": "200.249.12.31", "port": 80 }, "request": { "headers": { "Host": "net.tutsplus.com", "User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language": "en-us,en;q=0.5", "Accept-Encoding": "gzip,deflate", "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive": "300", "Connection": "keep-alive", "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", "Pragma": "no-cache", "Cache-Control": "no-cache" }, "uri": "\/test.pl?param1= test ¶m2=test2", "method": "GET", "http_version": 1.1, "body": "" }, "response": { "headers": { "Content-Type": "text\/xml; charset=utf-8\n\r", "Content-Length": "length\n\r" }, "body": [ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected": { "audit_log": "", "debug_log": "\\[9\\] T \\(0\\) t:trim: \"test", "error_log": "", "http_code": 403 }, "rules": [ "SecRuleEngine On", "SecResponseBodyAccess On", "SecRule ARGS \"@contains test\" \"id:1,t:trim,deny\"" ] }, { "enabled": 1, "version_min": 300000, "version_max": 0, "title": "actions :: trim,redirect:'http://www.google.com'", "client": { "ip": "200.249.12.31", "port": 2313 }, "server": { "ip": "200.249.12.31", "port": 80 }, "request": { "headers": { "Host": "net.tutsplus.com", "User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language": "en-us,en;q=0.5", "Accept-Encoding": "gzip,deflate", "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive": "300", "Connection": "keep-alive", "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", "Pragma": "no-cache", "Cache-Control": "no-cache" }, "uri": "\/test.pl?param1= test ¶m2=test2", "method": "GET", "http_version": 1.1, "body": "" }, "response": { "headers": { "Content-Type": "text\/xml; charset=utf-8\n\r", "Content-Length": "length\n\r" }, "body": [ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected": { "audit_log": "", "debug_log": "\\[9\\] T \\(0\\) t:trim: \"test", "error_log": "", "http_code": 302, "redirect_url": "http://www.google.com" }, "rules": [ "SecRuleEngine On", "SecRule ARGS \"@contains test\" \"id:1,t:trim,redirect:'http://www.google.com'\"" ] }, { "enabled": 1, "version_min": 300000, "version_max": 0, "title": "actions :: trim,status:500,redirect:http://www.google.com", "client": { "ip": "200.249.12.31", "port": 2313 }, "server": { "ip": "200.249.12.31", "port": 80 }, "request": { "headers": { "Host": "net.tutsplus.com", "User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language": "en-us,en;q=0.5", "Accept-Encoding": "gzip,deflate", "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive": "300", "Connection": "keep-alive", "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", "Pragma": "no-cache", "Cache-Control": "no-cache" }, "uri": "\/test.pl?param1= test ¶m2=test2", "method": "GET", "http_version": 1.1, "body": "" }, "response": { "headers": { "Content-Type": "text\/xml; charset=utf-8\n\r", "Content-Length": "length\n\r" }, "body": [ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected": { "audit_log": "", "debug_log": "\\[9\\] T \\(0\\) t:trim: \"test", "error_log": "", "http_code": 500, "redirect_url": "http://www.google.com" }, "rules": [ "SecRuleEngine On", "SecRule ARGS \"@contains test\" \"id:1,t:trim,status:500,redirect:'http://www.google.com'\"" ] }, { "enabled": 1, "version_min": 300000, "version_max": 0, "title": "actions :: trim,status:500", "client": { "ip": "200.249.12.31", "port": 2313 }, "server": { "ip": "200.249.12.31", "port": 80 }, "request": { "headers": { "Host": "net.tutsplus.com", "User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language": "en-us,en;q=0.5", "Accept-Encoding": "gzip,deflate", "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive": "300", "Connection": "keep-alive", "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", "Pragma": "no-cache", "Cache-Control": "no-cache" }, "uri": "\/test.pl?param1= test ¶m2=test2", "method": "GET", "http_version": 1.1, "body": "" }, "response": { "headers": { "Content-Type": "text\/xml; charset=utf-8\n\r", "Content-Length": "length\n\r" }, "body": [ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected": { "audit_log": "", "debug_log": "\\[9\\] T \\(0\\) t:trim: \"test", "error_log": "", "http_code": 500 }, "rules": [ "SecRuleEngine On", "SecRule ARGS \"@contains test\" \"id:1,t:trim,deny,status:500\"" ] }, { "enabled": 1, "version_min": 300000, "version_max": 0, "title": "actions :: phase:2,trim,status:500,deny", "client": { "ip": "200.249.12.31", "port": 2313 }, "server": { "ip": "200.249.12.31", "port": 80 }, "request": { "headers": { "Host": "net.tutsplus.com", "User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language": "en-us,en;q=0.5", "Accept-Encoding": "gzip,deflate", "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive": "300", "Connection": "keep-alive", "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", "Pragma": "no-cache", "Cache-Control": "no-cache" }, "uri": "\/test.pl?param1= test ¶m2=test2", "method": "GET", "http_version": 1.1, "body": "" }, "response": { "headers": { "Content-Type": "text\/xml; charset=utf-8\n\r", "Content-Length": "length\n\r" }, "body": [ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected": { "audit_log": "", "debug_log": "\\[9\\] T \\(0\\) t:trim: \"test", "error_log": "", "http_code": 500 }, "rules": [ "SecRuleEngine On", "SecRule ARGS \"@contains test\" \"id:1,phase:2,t:trim,status:500,deny\"" ] }, { "enabled": 1, "version_min": 300000, "version_max": 0, "title": "actions :: phase:4,trim,status:500,deny", "client": { "ip": "200.249.12.31", "port": 2313 }, "server": { "ip": "200.249.12.31", "port": 80 }, "request": { "headers": { "Host": "net.tutsplus.com", "User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language": "en-us,en;q=0.5", "Accept-Encoding": "gzip,deflate", "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive": "300", "Connection": "keep-alive", "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", "Pragma": "no-cache", "Cache-Control": "no-cache" }, "uri": "\/test.pl?param1= test ¶m2=test2", "method": "GET", "http_version": 1.1, "body": "" }, "response": { "headers": { "Content-Type": "text\/xml; charset=utf-8\n\r", "Content-Length": "length\n\r" }, "body": [ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected": { "audit_log": "", "debug_log": "\\[9\\] T \\(0\\) t:trim: \"test", "error_log": "", "http_code": 500 }, "rules": [ "SecRuleEngine On", "SecResponseBodyAccess On", "SecRule ARGS \"@contains test\" \"id:1,phase:4,t:trim,status:500,deny\"" ] } ]