github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-16 07:56:12 +03:00
Code Issues Packages Projects Releases Wiki Activity
ModSecurity/test/test-cases/regression/auditlog-ctl.json
Felipe Zimmerle 3832042531
actions: Removes Rule parameter from runtime execute 
Generals organization on the Action class
2020-11-26 11:10:25 -03:00

241 lines
7.3 KiB
JSON
Raw Blame History

[
{
"enabled": 1,
"version_min": 300000,
"version_max": 0,
"title": "ctl:auditlogparts : +E",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.modsecurity.org",
"User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language": "en-us,en;q=0.5",
"Accept-Encoding": "gzip,deflate",
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive": "300",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache"
},
"uri": "\/test.pl?param1= test &param2=test2",
"method": "GET",
"http_version": 1.1,
"body": ""
},
"response": {
"headers": {
"Content-Type": "plain\/text\n\r"
},
"body": [
"test"
]
},
"expected": {
"audit_log": "",
"debug_log": "Request was relevant to be saved. Parts: 34",
"error_log": "",
"http_code": 403
},
"rules": [
"SecRuleEngine On",
"SecAuditEngine RelevantOnly",
"SecAuditLogParts A",
"SecAuditLogStorageDir /tmp/test",
"SecAuditLogDirMode 0766",
"SecAuditLogFileMode 0600",
"SecAuditLogType Parallel",
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\"",
"SecRule ARGS \"@contains test\" \"id:1,t:trim,ctl:auditlogparts=+E\"",
"SecRule ARGS \"@contains test\" \"id:2,t:trim,deny,auditlog\""
]
},
{
"enabled": 1,
"version_min": 300000,
"version_max": 0,
"title": "ctl:auditlogparts : +E-E",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.modsecurity.org",
"User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language": "en-us,en;q=0.5",
"Accept-Encoding": "gzip,deflate",
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive": "300",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache"
},
"uri": "\/test.pl?param1= test &param2=test2",
"method": "GET",
"http_version": 1.1,
"body": ""
},
"response": {
"headers": {
"Content-Type": "plain\/text\n\r"
},
"body": [
"test"
]
},
"expected": {
"audit_log": "",
"debug_log": "Request was relevant to be saved. Parts: 2",
"error_log": "",
"http_code": 403
},
"rules": [
"SecRuleEngine On",
"SecAuditEngine RelevantOnly",
"SecAuditLogParts A",
"SecAuditLogStorageDir /tmp/test",
"SecAuditLogDirMode 0766",
"SecAuditLogFileMode 0600",
"SecAuditLogType Parallel",
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\"",
"SecRule ARGS \"@contains test\" \"id:1,t:trim,ctl:auditlogparts=+E\"",
"SecRule ARGS \"@contains test\" \"id:2,t:trim,ctl:auditlogparts=-E\"",
"SecRule ARGS \"@contains test\" \"id:3,t:trim,deny,auditlog\""
]
},
{
"enabled": 1,
"version_min": 300000,
"version_max": 0,
"title": "ctl:auditlogparts : +E-E+E",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.modsecurity.org",
"User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language": "en-us,en;q=0.5",
"Accept-Encoding": "gzip,deflate",
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive": "300",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache"
},
"uri": "\/test.pl?param1= test &param2=test2",
"method": "GET",
"http_version": 1.1,
"body": ""
},
"response": {
"headers": {
"Content-Type": "plain\/text\n\r"
},
"body": [
"test"
]
},
"expected": {
"audit_log": "",
"debug_log": "Request was relevant to be saved. Parts: 34",
"error_log": "",
"http_code": 403
},
"rules": [
"SecRuleEngine On",
"SecAuditEngine RelevantOnly",
"SecAuditLogParts A",
"SecAuditLogStorageDir /tmp/test",
"SecAuditLogDirMode 0766",
"SecAuditLogFileMode 0600",
"SecAuditLogType Parallel",
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\"",
"SecRule ARGS \"@contains test\" \"id:1,t:trim,ctl:auditlogparts=+E\"",
"SecRule ARGS \"@contains test\" \"id:2,t:trim,ctl:auditlogparts=-E\"",
"SecRule ARGS \"@contains test\" \"id:3,t:trim,ctl:auditlogparts=+E\"",
"SecRule ARGS \"@contains test\" \"id:4,t:trim,deny,auditlog\""
]
},
{
"enabled": 1,
"version_min": 300000,
"version_max": 0,
"title": "ctl:auditlogparts : +E-E+E+H",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.modsecurity.org",
"User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language": "en-us,en;q=0.5",
"Accept-Encoding": "gzip,deflate",
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive": "300",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache"
},
"uri": "\/test.pl?param1= test &param2=test2",
"method": "GET",
"http_version": 1.1,
"body": ""
},
"response": {
"headers": {
"Content-Type": "plain\/text\n\r"
},
"body": [
"test"
]
},
"expected": {
"audit_log": "",
"debug_log": "Request was relevant to be saved. Parts: 290",
"error_log": "",
"http_code": 403
},
"rules": [
"SecRuleEngine On",
"SecAuditEngine RelevantOnly",
"SecAuditLogParts A",
"SecAuditLogStorageDir /tmp/test",
"SecAuditLogDirMode 0766",
"SecAuditLogFileMode 0600",
"SecAuditLogType Parallel",
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\"",
"SecRule ARGS \"@contains test\" \"id:1,t:trim,ctl:auditlogparts=+E\"",
"SecRule ARGS \"@contains test\" \"id:2,t:trim,ctl:auditlogparts=-E\"",
"SecRule ARGS \"@contains test\" \"id:3,t:trim,ctl:auditlogparts=+E\"",
"SecRule ARGS \"@contains test\" \"id:4,t:trim,ctl:auditlogparts=+H\"",
"SecRule ARGS \"@contains test\" \"id:5,t:trim,deny,auditlog\""
]
}
]
Reference in New Issue View Git Blame Copy Permalink