|
95 | 95 | "SecRule REQUEST_FILENAME \"@endsWith /wp-login.php\" \"id:9002100,phase:2,t:none,nolog,pass,ctl:ruleRemoveTargetById=1;ARGS\"", |
96 | 96 | "SecRule ARGS \"@contains lhebs\" \"id:1,phase:3,t:none,status:202,block,deny,tag:'CRS'\"" |
97 | 97 | ] |
| 98 | + }, |
| 99 | + { |
| 100 | + "enabled":1, |
| 101 | + "version_min":300000, |
| 102 | + "title":"Testing CtlRuleRemoveTargetById (4)", |
| 103 | + "expected":{ |
| 104 | + "http_code": 200 |
| 105 | + }, |
| 106 | + "client":{ |
| 107 | + "ip":"200.249.12.31", |
| 108 | + "port":123 |
| 109 | + }, |
| 110 | + "request":{ |
| 111 | + "headers":{ |
| 112 | + "Host":"localhost", |
| 113 | + "User-Agent":"curl/7.38.0", |
| 114 | + "Accept":"*/*", |
| 115 | + "Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120", |
| 116 | + "Content-Type": "text/xml", |
| 117 | + "Referer": "This is an attack" |
| 118 | + }, |
| 119 | + "uri":"/index.html", |
| 120 | + "method":"GET", |
| 121 | + "body": [ ] |
| 122 | + }, |
| 123 | + "server":{ |
| 124 | + "ip":"200.249.12.31", |
| 125 | + "port":80 |
| 126 | + }, |
| 127 | + "rules":[ |
| 128 | + "SecRuleEngine On", |
| 129 | + "SecRule REQUEST_FILENAME \"@unconditionalMatch\" \"id:1,phase:1,pass,t:none,ctl:ruleRemoveTargetById=2;REQUEST_HEADERS:referer\"", |
| 130 | + "SecRule REQUEST_HEADERS:Referer \"@contains attack\" \"id:2,phase:1,deny,t:none,log\"" |
| 131 | + ] |
| 132 | + }, |
| 133 | + { |
| 134 | + "enabled":1, |
| 135 | + "version_min":300000, |
| 136 | + "title":"Testing CtlRuleRemoveTargetById (5)", |
| 137 | + "expected":{ |
| 138 | + "http_code": 200 |
| 139 | + }, |
| 140 | + "client":{ |
| 141 | + "ip":"200.249.12.31", |
| 142 | + "port":123 |
| 143 | + }, |
| 144 | + "request":{ |
| 145 | + "headers":{ |
| 146 | + "Host":"localhost", |
| 147 | + "User-Agent":"curl/7.38.0", |
| 148 | + "Accept":"*/*", |
| 149 | + "Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120", |
| 150 | + "Content-Type": "text/xml", |
| 151 | + "referer": "This is an attack" |
| 152 | + }, |
| 153 | + "uri":"/index.html", |
| 154 | + "method":"GET", |
| 155 | + "body": [ ] |
| 156 | + }, |
| 157 | + "server":{ |
| 158 | + "ip":"200.249.12.31", |
| 159 | + "port":80 |
| 160 | + }, |
| 161 | + "rules":[ |
| 162 | + "SecRuleEngine On", |
| 163 | + "SecRule REQUEST_FILENAME \"@unconditionalMatch\" \"id:1,phase:1,pass,t:none,ctl:ruleRemoveTargetById=2;REQUEST_HEADERS:referer\"", |
| 164 | + "SecRule REQUEST_HEADERS:Referer \"@contains attack\" \"id:2,phase:1,deny,t:none,log\"" |
| 165 | + ] |
98 | 166 | } |
99 | 167 | ] |
0 commit comments