[ { "enabled":1, "version_min":300000, "version_max":0, "title":"Testing collection :: TX (with macro) (1/4)", "client":{ "ip":"200.249.12.31", "port":2313 }, "server":{ "ip":"200.249.12.31", "port":80 }, "request":{ "headers":{ "User-Agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language":"en-us,en;q=0.5", "Accept-Encoding":"gzip,deflate", "Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive":"300", "Connection":"keep-alive", "Cookie":"PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120", "Pragma":"no-cache", "Cache-Control":"no-cache" }, "uri":"\/test.pl?param1= test ¶m2=test2", "method":"GET", "http_version":1.1, "body":"" }, "response":{ "headers":{ "Content-Type":"text\/xml; charset=utf-8\n\r", "Content-Length":"length\n\r" }, "body":[ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected":{ "audit_log":"", "debug_log":"Target value: \"PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120\" \\(Variable: TX:something\\)", "error_log":"" }, "rules":[ "SecRuleEngine On", "SecRule REQUEST_HEADERS \"@contains PHPSESSID\" \"id:1,t:lowercase,t:none,setvar:TX.something=%{REQUEST_HEADERS:Cookie}%\"", "SecRule TX \"@contains to_test\" \"id:2,t:lowercase,t:none\"" ] }, { "enabled":1, "version_min":300000, "version_max":0, "title":"Testing collection :: TX (with macro) (2/4)", "client":{ "ip":"200.249.12.31", "port":2313 }, "server":{ "ip":"200.249.12.31", "port":80 }, "request":{ "headers":{ "User-Agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language":"en-us,en;q=0.5", "Accept-Encoding":"gzip,deflate", "Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive":"300", "Connection":"keep-alive", "Cookie":"PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120", "Pragma":"no-cache", "Cache-Control":"no-cache" }, "uri":"\/test.pl?param1= test ¶m2=test2", "method":"GET", "http_version":1.1, "body":"" }, "response":{ "headers":{ "Content-Type":"text\/xml; charset=utf-8\n\r", "Content-Length":"length\n\r" }, "body":[ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected":{ "audit_log":"", "debug_log":"Target value: \"1\" \\(Variable: TX:somethingPHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120\\)", "error_log":"" }, "rules":[ "SecRuleEngine On", "SecRule REQUEST_HEADERS \"@contains PHPSESSID\" \"id:1,t:lowercase,t:none,setvar:TX.something%{REQUEST_HEADERS:Cookie}%\"", "SecRule TX \"@contains to_test\" \"id:2,t:lowercase,t:none\"" ] }, { "enabled":1, "version_min":300000, "version_max":0, "title":"Testing collection :: TX (with macro) (3/4)", "client":{ "ip":"200.249.12.31", "port":2313 }, "server":{ "ip":"200.249.12.31", "port":80 }, "request":{ "headers":{ "User-Agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language":"en-us,en;q=0.5", "Accept-Encoding":"gzip,deflate", "Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive":"300", "Connection":"keep-alive", "Cookie":"PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120", "Pragma":"no-cache", "Cache-Control":"no-cache" }, "uri":"\/test.pl?param1= test ¶m2=test2", "method":"GET", "http_version":1.1, "body":"" }, "response":{ "headers":{ "Content-Type":"text\/xml; charset=utf-8\n\r", "Content-Length":"length\n\r" }, "body":[ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected":{ "audit_log":"", "debug_log":"Target value: \"310\" \\(Variable: TX:something\\)", "error_log":"" }, "rules":[ "SecRuleEngine On", "SecRule REQUEST_HEADERS \"@contains PHPSESSID\" \"id:1,t:lowercase,t:none,setvar:TX.something=%{REQUEST_HEADERS:Keep-Alive}%\"", "SecRule REQUEST_HEADERS \"@contains PHPSESSID\" \"id:2,t:lowercase,t:none,setvar:TX.something=+10\"", "SecRule TX \"@contains to_test\" \"id:3,t:lowercase,t:none\"" ] }, { "enabled":1, "version_min":300000, "version_max":0, "title":"Testing collection :: TX (with macro) (4/4)", "client":{ "ip":"200.249.12.31", "port":2313 }, "server":{ "ip":"200.249.12.31", "port":80 }, "request":{ "headers":{ "User-Agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)", "Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language":"en-us,en;q=0.5", "Accept-Encoding":"gzip,deflate", "Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive":"300", "Connection":"keep-alive", "Cookie":"PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120", "Pragma":"no-cache", "Cache-Control":"no-cache" }, "uri":"\/test.pl?param1= test ¶m2=test2", "method":"GET", "http_version":1.1, "body":"" }, "response":{ "headers":{ "Content-Type":"text\/xml; charset=utf-8\n\r", "Content-Length":"length\n\r" }, "body":[ "\n\r", "\n\r", " \n\r", " \n\r", " string<\/EnlightenResult>\n\r", " <\/EnlightenResponse>\n\r", " <\/soap:Body>\n\r", "<\/soap:Envelope>\n\r" ] }, "expected":{ "audit_log":"", "debug_log":"Target value: \"5\" \\(Variable: TX:something_else\\)", "error_log":"" }, "rules":[ "SecRuleEngine On", "SecRule REQUEST_HEADERS \"@contains PHPSESSID\" \"id:1,t:lowercase,t:none,setvar:TX.something=+10\"", "SecRule REQUEST_HEADERS \"@contains PHPSESSID\" \"id:2,t:lowercase,t:none,setvar:TX.something_else=%{tx.something}%\"", "SecRule REQUEST_HEADERS \"@contains PHPSESSID\" \"id:3,t:lowercase,t:none,setvar:TX.something_else=-5\"", "SecRule TX:something_else \"@contains to_test\" \"id:4,t:lowercase,t:none\"" ] } ]