From e24bb4fdfacc9d506a20850a5cdcb7f95b476149 Mon Sep 17 00:00:00 2001 From: Martin Vierula Date: Tue, 20 Sep 2022 11:15:12 -0700 Subject: [PATCH] Minor v3 Ref manual update --- Reference-Manual-(v3.x).mediawiki | 9 --------- 1 file changed, 9 deletions(-) diff --git a/Reference-Manual-(v3.x).mediawiki b/Reference-Manual-(v3.x).mediawiki index a36abd7..6e46020 100644 --- a/Reference-Manual-(v3.x).mediawiki +++ b/Reference-Manual-(v3.x).mediawiki @@ -2490,15 +2490,6 @@ To remove a variable, prefix the name with an exclamation mark: setvar:!TX To increase or decrease variable value, use + and - characters in front of a numerical value: setvar:TX.score=+5 -Example from OWASP CRS: -
-SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bsys\.user_catalog\b" \
-		"phase:2,rev:'2.1.3',capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceComments,t:compressWhiteSpace,ctl:auditLogParts=+E, \
-block,msg:'Blind SQL Injection Attack',id:'959517',tag:'WEB_ATTACK/SQL_INJECTION',tag:'WASCTC/WASC-19',tag:'OWASP_TOP_10/A1',tag:'OWASP_AppSensor/CIE1', \
-tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, \
-setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/SQL_INJECTION-%{matched_var_name}=%{tx.0}"
-
- ; Note : When used in a chain this action will be executed when an individual rule matches and not the entire chain.This means that ``` SecRule REQUEST_FILENAME "@contains /test.php" "chain,id:7,phase:1,t:none,nolog,setvar:tx.auth_attempt=+1"