Update OWASP CRS rules to v4.27.0
Automated update via update-feed.sh CRS version: v4.27.0 Rules extracted: 279
This commit is contained in:
Andre committed
1 parent
d3acde3d67
commit
93c5d69c53
1 file changed
+64
-63
+64
-63
@@ -1,5 +1,5 @@
|
|||||||
{
|
{
|
||||||
"build_datetime": "2026-04-23T22:04:48Z",
|
"build_datetime": "2026-06-24T23:09:10Z",
|
||||||
"owasp_top_10": {
|
"owasp_top_10": {
|
||||||
"version": "2025",
|
"version": "2025",
|
||||||
"url": "https://owasp.org/Top10/2025/",
|
"url": "https://owasp.org/Top10/2025/",
|
||||||
@@ -107,9 +107,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-protocol-enforcement",
|
"id": "crs-protocol-enforcement",
|
||||||
"name": "CRS Protocol Enforcement",
|
"name": "CRS Protocol Enforcement",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Protocol Enforcement (18 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Protocol Enforcement (18 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 15,
|
"priority": 15,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -117,7 +117,7 @@
|
|||||||
{
|
{
|
||||||
"id": "920100",
|
"id": "920100",
|
||||||
"name": "Invalid HTTP Request Line",
|
"name": "Invalid HTTP Request Line",
|
||||||
"pattern": "(?i)^(?:get /[^#\\?]*(?:\\?[^\\s\\x0b#]*)?(?:#[^\\s\\x0b]*)?|(?:connect (?:(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\.?(?::[0-9]+)?|[\\--9A-Z_a-z]+:[0-9]+)|options \\*|[a-z]{3,10}[\\s\\x0b]+(?:[0-9A-Z_a-z]{3,7}?://[\\--9A-Z_a-z]*(?::[0-9]+)?)?/[^#\\?]*(?:\\?[^\\s\\x0b#]*)?(?:#[^\\s\\x0b]*)?)[\\s\\x0b]+[\\.-9A-Z_a-z]+)$",
|
"pattern": "(?i)^(?:connect (?:(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\.?(?::[0-9]+)?|[\\--9A-Z_a-z]+:[0-9]+)|options \\*|[a-z]{3,10}[\\s\\x0b]+(?:[0-9A-Z_a-z]{3,7}?://[\\--9A-Z_a-z]*(?::[0-9]+)?)?/[^#\\?]*(?:\\?[^\\s\\x0b#]*)?(?:#[^\\s\\x0b]*)?)[\\s\\x0b]+[\\.-9A-Z_a-z]+$",
|
||||||
"targets": [
|
"targets": [
|
||||||
"uri"
|
"uri"
|
||||||
],
|
],
|
||||||
@@ -497,9 +497,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-protocol-attack",
|
"id": "crs-protocol-attack",
|
||||||
"name": "CRS Protocol Attack (HTTP Smuggling)",
|
"name": "CRS Protocol Attack (HTTP Smuggling)",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Protocol Attack (HTTP Smuggling) (14 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Protocol Attack (HTTP Smuggling) (14 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 5,
|
"priority": 5,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -803,9 +803,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-lfi",
|
"id": "crs-lfi",
|
||||||
"name": "CRS Local File Inclusion (LFI)",
|
"name": "CRS Local File Inclusion (LFI)",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Local File Inclusion (LFI) (2 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Local File Inclusion (LFI) (2 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 5,
|
"priority": 5,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -857,9 +857,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-rfi",
|
"id": "crs-rfi",
|
||||||
"name": "CRS Remote File Inclusion (RFI)",
|
"name": "CRS Remote File Inclusion (RFI)",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Remote File Inclusion (RFI) (4 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Remote File Inclusion (RFI) (4 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 5,
|
"priority": 5,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -955,9 +955,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-rce",
|
"id": "crs-rce",
|
||||||
"name": "CRS Remote Code Execution (RCE)",
|
"name": "CRS Remote Code Execution (RCE)",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Remote Code Execution (RCE) (38 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Remote Code Execution (RCE) (38 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 3,
|
"priority": 3,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -965,7 +965,7 @@
|
|||||||
{
|
{
|
||||||
"id": "932230",
|
"id": "932230",
|
||||||
"name": "Remote Command Execution: Unix Command Injection (2-3 chars)",
|
"name": "Remote Command Execution: Unix Command Injection (2-3 chars)",
|
||||||
"pattern": "(?i)(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[\\$\\{]|(?:[\\s\\x0b]*\\(|!)[\\s\\x0b]*|[0-9A-Z_a-z]+=(?:[^\\s\\x0b]*|\\$(?:.*|.*)|[<>].*|'[^']*'|\"[^\"]*\")[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[arx][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z|c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[89][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?9|m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|d[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?f|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|q[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n|s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|f[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\Line truncated
|
"pattern": "(?i)(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[\\$\\{]|(?:[\\s\\x0b]*\\(|!)[\\s\\x0b]*|[0-9A-Z_a-z]+=(?:[^\\s\\x0b]*|\\$(?:.*|.*)|[<>].*|'[^']*'|\"[^\"]*\")[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[arx][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z|c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[89][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?9|m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|d[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?f|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|q[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n|s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|f[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\Line truncated
|
||||||
"targets": [
|
"targets": [
|
||||||
"all"
|
"all"
|
||||||
],
|
],
|
||||||
@@ -1112,7 +1112,7 @@
|
|||||||
{
|
{
|
||||||
"id": "932250",
|
"id": "932250",
|
||||||
"name": "Remote Command Execution: Direct Unix Command Execution",
|
"name": "Remote Command Execution: Direct Unix Command Execution",
|
||||||
"pattern": "(?i)(?:^|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[\\$\\{]|(?:[\\s\\x0b]*\\(|!)[\\s\\x0b]*|[0-9A-Z_a-z]+=(?:[^\\s\\x0b]*|\\$(?:.*|.*)|[<>].*|'[^']*'|\"[^\"]*\")[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[arx][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z|c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[89][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?9|m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|d[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?f|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|q[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n|s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|f[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-Line truncated
|
"pattern": "(?i)(?:^|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[\\$\\{]|(?:[\\s\\x0b]*\\(|!)[\\s\\x0b]*|[0-9A-Z_a-z]+=(?:[^\\s\\x0b]*|\\$(?:.*|.*)|[<>].*|'[^']*'|\"[^\"]*\")[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[arx][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z|c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[89][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?9|m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|d[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?f|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|q[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n|s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|f[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-Line truncated
|
||||||
"targets": [
|
"targets": [
|
||||||
"all"
|
"all"
|
||||||
],
|
],
|
||||||
@@ -1260,7 +1260,7 @@
|
|||||||
{
|
{
|
||||||
"id": "932370",
|
"id": "932370",
|
||||||
"name": "Remote Command Execution: Windows Command Injection",
|
"name": "Remote Command Execution: Windows Command Injection",
|
||||||
"pattern": "(?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\"'\\(,@]*(?:[\"'\\.-9A-Z_a-z]+/|(?:[\"'\\x5c\\^]*[0-9A-Z_a-z][\"'\\x5c\\^]*:[^\\x5c]*|[ \"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\"\\^]*(?:a[\"\\^]*(?:c[\"\\^]*c[\"\\^]*c[\"\\^]*h[\"\\^]*e[\"\\^]*c[\"\\^]*k[\"\\^]*c[\"\\^]*o[\"\\^]*n[\"\\^]*s[\"\\^]*o[\"\\^]*l[\"\\^]*e|d[\"\\^]*(?:p[\"\\^]*l[\"\\^]*u[\"\\^]*s|v[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k)|(?:g[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*e[\"\\^]*x[\"\\^]*e[\"\\^]*c[\"\\^]*u[\"\\^]*t[\"\\^]*o|(?:s[\"\\^]*p[\"\\^]*n[\"\\^]*e[\"\\^]*t[\"\\^]*_[\"\\^]*c[\"\\^]*o[\"\\^]*m[\"\\^]*p[\"\\^]*i[\"\\^]*l|t[\"\\^]*b[\"\\^]*r[\"\\^]*o[\"\\^]*k)[\"\\^]*e)[\"\\^]*r|p[\"\\^]*p[\"\\^]*(?:i[\"\\^]*n[\"\\^]*s[\"\\^]*t[\"\\^]*a[\"\\^]*l[\"\\^]*l[\"\\^]*e[\"\\^]*r|v[\"\\^]*l[\"\\^]*p))|b[\"\\^]*(?:a[\"\\^]*s[\"\\^]*h|g[\"\\^]*i[\"\\^]*n[\"\\^]*f[\"\\^]*o|i[\"\\^]*t[\"\\^]*s[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|c[\"\\^]*(?:d[\"\\^]*b|e[\"\\^]*r[\"\\^]*t[\"\\^]*(?:o[\"\\^]*c|r[\"\\^]*e[\"\\^]*q|u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|l[\"\\^]*_[\"\\^]*(?:i[\"\\^]*n[\"\\^]*v[\"\\^]*o[\"\\^]*c[\"\\^]*a[\"\\^]*t[\"\\^]*i[\"\\^]*o[\"\\^]*n|l[\"\\^]*o[\"\\^]*a[\"\\^]*d[\"\\^]*a[\"\\^]*s[\"\\^]*s[\"\\^]*e[\"\\^]*m[\"\\^]*b[\"\\^]*l[\"\\^]*y|m[\"\\^]*u[\"\\^]*t[\"\\^]*e[\"\\^]*x[\"\\^]*v[\"\\^]*e[\"\\^]*r[\"\\^]*i[\"\\^]*f[\"\\^]*i[\"\\^]*e[\"\\^]*r[\"\\^]*s)|m[\"\\^]*(?:d(?:[\"\\^]*(?:k[\"\\^]*e[\"\\^]*y|l[\"\\^]*3[\"\\^]*2))?|s[\"\\^]*t[\"\\^]*p)|o[\"\\^]*(?:m[\"\\^]*s[\"\\^]*v[\"\\^]*c[\"\\^]*s|n[\"\\^]*(?:f[\"\\^]*i[\"\\^]*g[\"\\^]*s[\"\\^]*e[\"\\^]*c[\"\\^]*u[\"\\^]*r[\"\\^]*i[\"\\^]*t[\"\\^]*y[\"\\^]*p[\"\\^]*o[\"\\^]*l[\"\\^]*i[\"\\^]*c[\"\\^]*y|h[\"\\^]*o[\"\\^]*s[\"\\^]*t|t[\"\\^]*r[\"\\^]*o[\"\\^]*l)|r[\"\\^]*e[\"\\^]*g[\"\\^]*e[\"\\^]*n)|r[\"\\^]*e[\"\\^]*a[\"\\^]*t[\"\\^]*e[\"\\^]*d[\"\\^]*u[\"\\^]*m[\"\\^]*p|s[\"\\^]*(?:c(?:[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t)?|i)|u[\"\\^]*s[\"\\^]*t[\"\\^]*o[\"\\^]*m[\"\\^]*s[\"\\^]*h[\"\\^]*e[\"\\^]*l[\"\\^]*l[\"\\^]*h[\"\\^]*o[\"\\^]*s[\"\\^]*t)|d[\"\\^]*(?:a[\"\\^]*t[\"\\^]*a[\"\\^]*s[\"\\^]*v[\"\\^]*c[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|e[\"\\^]*(?:f[\"\\^]*a[\"\\^]*u[\"\\^]*l[\"\\^]*t[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k|s[\"\\^]*k(?:[\"\\^]*t[\"\\^]*o[\"\\^]*p[\"\\^]*i[\"\\^]*m[\"\\^]*g[\"\\^]*d[\"\\^]*o[\"\\^]*w[\"\\^]*n[\"\\^]*l[\"\\^]*d[\"\\^]*r)?|v[\"\\^]*(?:i[\"\\^]*c[\"\\^]*e[\"\\^]*c[\"\\^]*r[\"\\^]*e[\"\\^]*d[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*i[\"\\^]*a[\"\\^]*l[\"\\^]*d[\"\\^]*e[\"\\^]*p[\"\\^]*l[\"\\^]*o[\"\\^]*y[\"\\^]*m[\"\\^]*e[\"\\^]*n[\"\\^]*t|t[\"\\^]*o[\"\\^]*o[\"\\^]*l[\"\\^]*s[\"\\^]*l[\"\\^]*a[\"\\^]*u[\"\\^]*n[\"\\^]*c[\"\\^]*h[\"\\^]*e[\"\\^]*r))|f[\"\\^]*s[\"\\^]*(?:h[\"\\^]*i[\"\\^]*m|v[\"\\^]*c)|i[\"\\^]*(?:a[\"\\^]*n[\"\\^]*t[\"\\^]*z|s[\"\\^]*k[\"\\^]*s[\"\\^]*h[\"\\^]*a[\"\\^]*d[\"\\^]*o[\"\\^]*w)|n[\"\\^]*(?:s[\"\\^]*c[\"\\^]*m[\"\\^]*d|x)|o[\"\\^]*t[\"\\^]*n[\"\\^]*e[\"\\^]*t|u[\"\\^]*m[\"\\^]*p[\"\\^]*6[\"\\^]*4|x[\"\\^]*c[\"\\^]*a[\"\\^]*p)|e[\"\\^]*(?:s[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*u[\"\\^]*t[\"\\^]*l|v[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*v[\"\\^]*w[\"\\^]*r|x[\"\\^]*(?:c[\"\\^]*e[\"\\^]*l|p[\"\\^]*(?:a[\"\\^]*n[\"\\^]*d|l[\"\\^]*o[\"\\^]*r[\"\\^]*e[\"\\^]*r)|t[\"\\^]*(?:e[\"\\^]*x[\"\\^]*p[\"\\^]*o[\"\\^]*r[\"\\^]*t|r[\"\\^]*a[\"\\^]*c[\"\\^]*3[\"\\^]*2)))|f[\"\\^]*(?:i[\"\\^]*n[\"\\^]*(?:d[\"\\^]*s[\"\\^]*t|g[\"\\^]*e)[\"\\^]*r|l[\"\\^]*t[\"\\^]*m[\"\\^]*c|o[\"\\^]*r[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s|s[\"\\^]*(?:i(?:[\"\\^]*a[\"\\^]*n[\"\\^]*y[\"\\^]*c[\"\\^]*p[\"\\^]*u)?|u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|t[\"\\^]*p)|g[\"\\^]*(?:f[\"\\^]*x[\"\\^]*d[\"\\^]*o[\"\\^]*w[\"\\^]*n[\"\\^]*l[\"\\^]*o[\"\\^]*a[\"\\^]*d[\"\\^]*w[\"\\^]*r[\"\\^]*a[\"\\^]*p[\"\\^]*p[\"\\^]*e[\"\\^]*r|p[\"\\^]*s[\"\\^]*c[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t)|h[\"\\^]*h|i[\"\\^]*(?:e[\"\\^]*(?:4[\"\\^]*u[\"\\^]*i[\"\\^]*n[\"\\^]*i[\"\\^]*t|a[\"\\^]*d[\"\\^]*v[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k|e[\"\\^]*x[\"\\^]*e[\"\\^]*c|f[\"\\^]*r[\"\\^]*a[\"\\^]*m[\"\\^]*e)|l[\"\\^]*a[\"\\^]*s[\"\\^]*m|m[\"\\^]*e[\"\\^]*w[\"\\^]*d[\"\\^]*b[\"\\^]*l[\"\\^]*d|n[\"\\^]*(?:f[\"\\^]*d[\"\\^]*e[\"\\^]*f[\"\\^]*a[\"\\^]*u[\"\\^]*l[\"\\^]*t[\"\\^]*i[\"\\^]*n[\"\\^]*s[\"\\^]*t[\"\\^]*a[\"\\^]*l|s[\"\\^]*t[\"\\^]*a[\"\\^]*l[\"\\^]*l[\"\\^]*u[\"\\^]*t[\"\\^]*i)[\"\\^]*l)|j[\"\\^]*s[\"\\^]*c|l[\"\\^]*(?:a[\"\\^]*u[\"\\^]*n[\"\\^]*c[\"\\^]*h[\"\\^]*-[\"\\^]*v[\"\\^]*s[\"\\^]*d[\"\\^]*e[\"\\^]*v[\"\\^]*s[\"\\^]*h[\"\\^]*e[\"\\^]*l[\"\\^]*l|d[\"\\^]*i[\"\\^]*f[\"\\^]*d[\"\\^]*e)|m[\"\\^]*(?:a[\"\\^]*(?:k[\"\\^]*e[\"\\^]*c[\"\\^]*a[\"\\^]*b|n[\"\\^]*a[\"\\^]*g[\"\\^]*e[\"\\^]*-[\"\\^]*b[\"\\^]*d[\"\\^]*e|v[\"\\^]*i[\"\\^]*n[\"\\^]*j[\"\\^]*e[\"\\^]*c[\"\\^]*t)|f[\"\\^]*t[\"\\^]*r[\"\\^]*a[\"\\^]*c[\"\\^]*e|i[\"\\^]*c[\"\\^]*r[\"\\^]*o[\"\\^]*s[\"\\^]*o[\"\\^]*f[\"\\^]*t|m[\"\\^]*c|p[\"\\^]*c[\"\\^]*m[\"\\^]*d[\"\\^]*r[\"\\^]*u[\"\\^]*n|s[\"\\^]*(?:(?:b[\"\\^]*u[\"\\^]*i[\"\\^]*l|o[\"\\^]*h[\"\\^]*t[\"\\^]*m[\"\\^]*e)[\"\\^]*d|c[\"\\^]*o[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*g|d[\"\\^]*(Line truncated
|
"pattern": "(?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\"'\\(,@]*(?:[\"'\\.-9A-Z_a-z]+/|(?:[\"'\\x5c\\^]*[0-9A-Z_a-z][\"'\\x5c\\^]*:[^\\x5c]*|[ \"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\"\\^]*(?:a[\"\\^]*(?:c[\"\\^]*c[\"\\^]*c[\"\\^]*h[\"\\^]*e[\"\\^]*c[\"\\^]*k[\"\\^]*c[\"\\^]*o[\"\\^]*n[\"\\^]*s[\"\\^]*o[\"\\^]*l[\"\\^]*e|d[\"\\^]*(?:p[\"\\^]*l[\"\\^]*u[\"\\^]*s|v[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k)|(?:g[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*e[\"\\^]*x[\"\\^]*e[\"\\^]*c[\"\\^]*u[\"\\^]*t[\"\\^]*o|(?:s[\"\\^]*p[\"\\^]*n[\"\\^]*e[\"\\^]*t[\"\\^]*_[\"\\^]*c[\"\\^]*o[\"\\^]*m[\"\\^]*p[\"\\^]*i[\"\\^]*l|t[\"\\^]*b[\"\\^]*r[\"\\^]*o[\"\\^]*k)[\"\\^]*e)[\"\\^]*r|p[\"\\^]*p[\"\\^]*(?:i[\"\\^]*n[\"\\^]*s[\"\\^]*t[\"\\^]*a[\"\\^]*l[\"\\^]*l[\"\\^]*e[\"\\^]*r|v[\"\\^]*l[\"\\^]*p))|b[\"\\^]*(?:a[\"\\^]*s[\"\\^]*h|g[\"\\^]*i[\"\\^]*n[\"\\^]*f[\"\\^]*o|i[\"\\^]*t[\"\\^]*s[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|c[\"\\^]*(?:d[\"\\^]*b|e[\"\\^]*r[\"\\^]*t[\"\\^]*(?:o[\"\\^]*c|r[\"\\^]*e[\"\\^]*q|u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|l[\"\\^]*_[\"\\^]*(?:i[\"\\^]*n[\"\\^]*v[\"\\^]*o[\"\\^]*c[\"\\^]*a[\"\\^]*t[\"\\^]*i[\"\\^]*o[\"\\^]*n|l[\"\\^]*o[\"\\^]*a[\"\\^]*d[\"\\^]*a[\"\\^]*s[\"\\^]*s[\"\\^]*e[\"\\^]*m[\"\\^]*b[\"\\^]*l[\"\\^]*y|m[\"\\^]*u[\"\\^]*t[\"\\^]*e[\"\\^]*x[\"\\^]*v[\"\\^]*e[\"\\^]*r[\"\\^]*i[\"\\^]*f[\"\\^]*i[\"\\^]*e[\"\\^]*r[\"\\^]*s)|m[\"\\^]*(?:d(?:[\"\\^]*(?:k[\"\\^]*e[\"\\^]*y|l[\"\\^]*3[\"\\^]*2))?|s[\"\\^]*t[\"\\^]*p)|o[\"\\^]*(?:m[\"\\^]*s[\"\\^]*v[\"\\^]*c[\"\\^]*s|n[\"\\^]*(?:f[\"\\^]*i[\"\\^]*g[\"\\^]*s[\"\\^]*e[\"\\^]*c[\"\\^]*u[\"\\^]*r[\"\\^]*i[\"\\^]*t[\"\\^]*y[\"\\^]*p[\"\\^]*o[\"\\^]*l[\"\\^]*i[\"\\^]*c[\"\\^]*y|h[\"\\^]*o[\"\\^]*s[\"\\^]*t|t[\"\\^]*r[\"\\^]*o[\"\\^]*l)|r[\"\\^]*e[\"\\^]*g[\"\\^]*e[\"\\^]*n)|r[\"\\^]*e[\"\\^]*a[\"\\^]*t[\"\\^]*e[\"\\^]*d[\"\\^]*u[\"\\^]*m[\"\\^]*p|s[\"\\^]*(?:c(?:[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t)?|i)|u[\"\\^]*s[\"\\^]*t[\"\\^]*o[\"\\^]*m[\"\\^]*s[\"\\^]*h[\"\\^]*e[\"\\^]*l[\"\\^]*l[\"\\^]*h[\"\\^]*o[\"\\^]*s[\"\\^]*t)|d[\"\\^]*(?:a[\"\\^]*t[\"\\^]*a[\"\\^]*s[\"\\^]*v[\"\\^]*c[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|e[\"\\^]*(?:f[\"\\^]*a[\"\\^]*u[\"\\^]*l[\"\\^]*t[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k|s[\"\\^]*k(?:[\"\\^]*t[\"\\^]*o[\"\\^]*p[\"\\^]*i[\"\\^]*m[\"\\^]*g[\"\\^]*d[\"\\^]*o[\"\\^]*w[\"\\^]*n[\"\\^]*l[\"\\^]*d[\"\\^]*r)?|v[\"\\^]*(?:i[\"\\^]*c[\"\\^]*e[\"\\^]*c[\"\\^]*r[\"\\^]*e[\"\\^]*d[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*i[\"\\^]*a[\"\\^]*l[\"\\^]*d[\"\\^]*e[\"\\^]*p[\"\\^]*l[\"\\^]*o[\"\\^]*y[\"\\^]*m[\"\\^]*e[\"\\^]*n[\"\\^]*t|t[\"\\^]*o[\"\\^]*o[\"\\^]*l[\"\\^]*s[\"\\^]*l[\"\\^]*a[\"\\^]*u[\"\\^]*n[\"\\^]*c[\"\\^]*h[\"\\^]*e[\"\\^]*r))|f[\"\\^]*s[\"\\^]*(?:h[\"\\^]*i[\"\\^]*m|v[\"\\^]*c)|i[\"\\^]*(?:a[\"\\^]*n[\"\\^]*t[\"\\^]*z|s[\"\\^]*k[\"\\^]*s[\"\\^]*h[\"\\^]*a[\"\\^]*d[\"\\^]*o[\"\\^]*w)|n[\"\\^]*(?:s[\"\\^]*c[\"\\^]*m[\"\\^]*d|x)|o[\"\\^]*t[\"\\^]*n[\"\\^]*e[\"\\^]*t|u[\"\\^]*m[\"\\^]*p[\"\\^]*6[\"\\^]*4|x[\"\\^]*c[\"\\^]*a[\"\\^]*p)|e[\"\\^]*(?:s[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*u[\"\\^]*t[\"\\^]*l|v[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*v[\"\\^]*w[\"\\^]*r|x[\"\\^]*(?:c[\"\\^]*e[\"\\^]*l|p[\"\\^]*(?:a[\"\\^]*n[\"\\^]*d|l[\"\\^]*o[\"\\^]*r[\"\\^]*e[\"\\^]*r)|t[\"\\^]*(?:e[\"\\^]*x[\"\\^]*p[\"\\^]*o[\"\\^]*r[\"\\^]*t|r[\"\\^]*a[\"\\^]*c[\"\\^]*3[\"\\^]*2)))|f[\"\\^]*(?:i[\"\\^]*n[\"\\^]*(?:d[\"\\^]*s[\"\\^]*t|g[\"\\^]*e)[\"\\^]*r|l[\"\\^]*t[\"\\^]*m[\"\\^]*c|o[\"\\^]*r[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s|s[\"\\^]*(?:i(?:[\"\\^]*a[\"\\^]*n[\"\\^]*y[\"\\^]*c[\"\\^]*p[\"\\^]*u)?|u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|t[\"\\^]*p)|g[\"\\^]*(?:f[\"\\^]*x[\"\\^]*d[\"\\^]*o[\"\\^]*w[\"\\^]*n[\"\\^]*l[\"\\^]*o[\"\\^]*a[\"\\^]*d[\"\\^]*w[\"\\^]*r[\"\\^]*a[\"\\^]*p[\"\\^]*p[\"\\^]*e[\"\\^]*r|p[\"\\^]*s[\"\\^]*c[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t)|h[\"\\^]*h|i[\"\\^]*(?:e[\"\\^]*(?:4[\"\\^]*u[\"\\^]*i[\"\\^]*n[\"\\^]*i[\"\\^]*t|a[\"\\^]*d[\"\\^]*v[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k|e[\"\\^]*x[\"\\^]*e[\"\\^]*c|f[\"\\^]*r[\"\\^]*a[\"\\^]*m[\"\\^]*e)|l[\"\\^]*a[\"\\^]*s[\"\\^]*m|m[\"\\^]*e[\"\\^]*w[\"\\^]*d[\"\\^]*b[\"\\^]*l[\"\\^]*d|n[\"\\^]*(?:f[\"\\^]*d[\"\\^]*e[\"\\^]*f[\"\\^]*a[\"\\^]*u[\"\\^]*l[\"\\^]*t[\"\\^]*i[\"\\^]*n[\"\\^]*s[\"\\^]*t[\"\\^]*a[\"\\^]*l|s[\"\\^]*t[\"\\^]*a[\"\\^]*l[\"\\^]*l[\"\\^]*u[\"\\^]*t[\"\\^]*i)[\"\\^]*l)|j[\"\\^]*s[\"\\^]*c|l[\"\\^]*(?:a[\"\\^]*u[\"\\^]*n[\"\\^]*c[\"\\^]*h[\"\\^]*-[\"\\^]*v[\"\\^]*s[\"\\^]*d[\"\\^]*e[\"\\^]*v[\"\\^]*s[\"\\^]*h[\"\\^]*e[\"\\^]*l[\"\\^]*l|d[\"\\^]*i[\"\\^]*f[\"\\^]*d[\"\\^]*e)|m[\"\\^]*(?:a[\"\\^]*(?:k[\"\\^]*e[\"\\^]*c[\"\\^]*a[\"\\^]*b|n[\"\\^]*a[\"\\^]*g[\"\\^]*e[\"\\^]*-[\"\\^]*b[\"\\^]*d[\"\\^]*e|v[\"\\^]*i[\"\\^]*n[\"\\^]*j[\"\\^]*e[\"\\^]*c[\"\\^]*t)|f[\"\\^]*t[\"\\^]*r[\"\\^]*a[\"\\^]*c[\"\\^]*e|i[\"\\^]*c[\"\\^]*r[\"\\^]*o[\"\\^]*s[\"\\^]*o[\"\\^]*f[\"\\^]*t|m[\"\\^]*c|p[\"\\^]*c[\"\\^]*m[\"\\^]*d[\"\\^]*r[\"\\^]*u[\"\\^]*n|s[\"\\^]*(?:(?:b[\"\\^]*u[\"\\^]*i[\"\\^]*l|o[\"\\^]*h[\"\\^]*t[\"\\^]*m[\"\\^]*e)[\"\\^]*d|c[\"\\^]*o[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*g|d[\"\\^]*(Line truncated
|
||||||
"targets": [
|
"targets": [
|
||||||
"all"
|
"all"
|
||||||
],
|
],
|
||||||
@@ -1766,9 +1766,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-php",
|
"id": "crs-php",
|
||||||
"name": "CRS PHP Injection",
|
"name": "CRS PHP Injection",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS PHP Injection (18 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS PHP Injection (18 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 5,
|
"priority": 5,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -2156,9 +2156,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-generic-attack",
|
"id": "crs-generic-attack",
|
||||||
"name": "CRS Generic Application Attack",
|
"name": "CRS Generic Application Attack",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Generic Application Attack (9 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Generic Application Attack (10 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 5,
|
"priority": 5,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -2272,6 +2272,28 @@
|
|||||||
],
|
],
|
||||||
"paranoia_level": 1
|
"paranoia_level": 1
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"id": "934200",
|
||||||
|
"name": "Server-Side Template Injection (SSTI) Attack",
|
||||||
|
"pattern": "(?:\\{\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?\\}|#\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?)\\}|<%=?[\\s\\x0b]*[^%]*?(?:[\\(\\*]|__)[^%]*?%>",
|
||||||
|
"targets": [
|
||||||
|
"all"
|
||||||
|
],
|
||||||
|
"action": "block",
|
||||||
|
"score": 10,
|
||||||
|
"severity": "critical",
|
||||||
|
"category": "rce",
|
||||||
|
"enabled": true,
|
||||||
|
"tags": [
|
||||||
|
"attack-ssti",
|
||||||
|
"attack-injection-generic",
|
||||||
|
"paranoia-level/1",
|
||||||
|
"OWASP_CRS",
|
||||||
|
"OWASP_CRS/ATTACK-GENERIC",
|
||||||
|
"capec/1000/152/242"
|
||||||
|
],
|
||||||
|
"paranoia_level": 1
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"id": "934101",
|
"id": "934101",
|
||||||
"name": "Node.js Injection Attack 2/2",
|
"name": "Node.js Injection Attack 2/2",
|
||||||
@@ -2364,9 +2386,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-xss",
|
"id": "crs-xss",
|
||||||
"name": "CRS Cross-Site Scripting (XSS)",
|
"name": "CRS Cross-Site Scripting (XSS)",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Cross-Site Scripting (XSS) (30 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Cross-Site Scripting (XSS) (30 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 5,
|
"priority": 5,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -3007,9 +3029,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-sqli",
|
"id": "crs-sqli",
|
||||||
"name": "CRS SQL Injection (SQLi)",
|
"name": "CRS SQL Injection (SQLi)",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS SQL Injection (SQLi) (56 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS SQL Injection (SQLi) (55 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 3,
|
"priority": 3,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -3269,7 +3291,7 @@
|
|||||||
{
|
{
|
||||||
"id": "942290",
|
"id": "942290",
|
||||||
"name": "Finds basic MongoDB SQL injection attempts",
|
"name": "Finds basic MongoDB SQL injection attempts",
|
||||||
"pattern": "(?i)\\[?\\$(?:a(?:bs|c(?:cumulator|osh?)|dd(?:ToSet)?|ll(?:ElementsTrue)?|n(?:d|yElementTrue)|rray(?:ElemA|ToObjec)t|sinh?|tan[2h]?|vg)|b(?:etween|i(?:narySize|t(?:And|Not|(?:O|Xo)r)?)|ottomN?|sonSize|ucket(?:Auto)?)|c(?:eil|mp|o(?:n(?:cat(?:Arrays)?|d|vert)|sh?|unt|variance(?:Po|Sam)p)|urrentDate)|d(?:a(?:te(?:Add|Diff|From(?:Parts|String)|Subtract|T(?:o(?:Parts|String)|runc))|yOf(?:Month|Week|Year))|e(?:greesToRadians|nseRank|rivative)|iv(?:ide)?|ocumentNumber)|e(?:(?:a|lemMat)ch|q|x(?:ists|p(?:MovingAvg|r)?))|f(?:i(?:lter|rstN?)|loor|unction)|g(?:etField|roup|te?)|(?:hou|xo|yea)r|i(?:fNull|n(?:c|dexOf(?:Array|Bytes|CP)|tegral)?|s(?:Array|Number|o(?:DayOfWeek|Week(?:Year)?)))|jsonSchema|l(?:astN?|et|i(?:ke|(?:nearFil|tera)l)|n|o(?:cf|g(?:10)?)|t(?:e|rim)?)|m(?:a(?:p|xN?)|e(?:dian|rgeObjects|ta)|i(?:llisecond|n(?:N|ute)?)|o(?:d|nth)|ul(?:tiply)?)|n(?:atural|e|in|o[rt])|o(?:bjectToArray|r)|p(?:ercentile|o(?:[pw]|sition)|roject|u(?:ll(?:All)?|sh))|r(?:a(?:diansToDegrees|n(?:[dk]|ge))|e(?:(?:duc|nam)e|gex(?:Find(?:All)?|Match)?|place(?:All|One)|verseArray)|ound|trim)|s(?:(?:ampleRat|lic)e|e(?:cond|t(?:Difference|(?:Equal|WindowField)s|Field|I(?:ntersection|sSubset)|OnInsert|Union)?)|(?:hif|pli|qr)t|i(?:nh?|ze)|ort(?:Array)?|t(?:dDev(?:Po|Sam)p|r(?:Len(?:Bytes|CP)|casecmp))|u(?:b(?:str(?:Bytes|CP)?|tract)|m)|witch)|t(?:anh?|ext|o(?:Bool|D(?:(?:at|oubl)e|ecimal)|HashedIndexKey|Int|Lo(?:ng|wer)|ObjectId|String|U(?:UID|pper)|pN?)|r(?:im|unc)|s(?:Increment|Second)|ype)|unset|w(?:eek|here)|zip)\\]?",
|
"pattern": "(?i)\\[?\\$(?:a(?:bs|c(?:cumulator|osh?)|dd(?:ToSet)?|ll(?:ElementsTrue)?|n(?:d|yElementTrue)|rray(?:ElemA|ToObjec)t|sinh?|tan[2h]?|vg)|b(?:etween|i(?:narySize|t(?:And|Not|(?:O|Xo)r)?)|ottomN?|sonSize|ucket(?:Auto)?)|c(?:eil|mp|o(?:n(?:cat(?:Arrays)?|d|vert)|sh?|unt|variance(?:Po|Sam)p)|urrentDate)|d(?:a(?:te(?:Add|Diff|From(?:Parts|String)|Subtract|T(?:o(?:Parts|String)|runc))|yOf(?:Month|Week|Year))|e(?:greesToRadians|nseRank|rivative)|iv(?:ide)?|ocumentNumber)|e(?:(?:a|lemMat)ch|q|x(?:ists|p(?:MovingAvg|r)?))|f(?:i(?:lter|rstN?)|loor|unction)|g(?:etField|roup|te?)|(?:hou|xo|yea)r|i(?:fNull|n(?:c|dexOf(?:Array|Bytes|CP)|tegral)?|s(?:Array|Number|o(?:DayOfWeek|Week(?:Year)?)))|jsonSchema|l(?:astN?|et|i(?:ke|(?:nearFil|tera)l)|n|o(?:cf|g(?:10)?)|t(?:e|rim)?)|m(?:a(?:p|xN?)|e(?:dian|rgeObjects|ta)|i(?:llisecond|n(?:N|ute)?)|o(?:d|nth)|ul(?:tiply)?)|n(?:atural|e|in|o[rt])|o(?:bjectToArray|r)|p(?:ercentile|o(?:[pw]|sition)|roject|u(?:ll(?:All)?|sh))|r(?:a(?:diansToDegrees|n(?:[dk]|ge))|e(?:(?:duc|nam)e|gex(?:Find(?:All)?|Match)?|place(?:All|One)|verseArray)|ound|trim)|s(?:(?:ampleRat|lic)e|e(?:cond|t(?:Difference|(?:Equal|WindowField)s|Field|I(?:ntersection|sSubset)|OnInsert|Union)?)|(?:hif|pli|qr)t|i(?:nh?|ze)|ort(?:Array)?|t(?:dDev(?:Po|Sam)p|r(?:Len(?:Bytes|CP)|casecmp))|u(?:b(?:str(?:Bytes|CP)?|tract)|m)|witch)|t(?:anh?|ext|o(?:Bool|D(?:(?:at|oubl)e|ecimal)|HashedIndexKey|Int|Lo(?:ng|wer)|ObjectId|String|U(?:UID|pper)|pN?)|r(?:im|unc)|s(?:Increment|Second)|ype)|unset|w(?:eek|here)|zip)\\b\\]?",
|
||||||
"targets": [
|
"targets": [
|
||||||
"all"
|
"all"
|
||||||
],
|
],
|
||||||
@@ -3497,27 +3519,6 @@
|
|||||||
],
|
],
|
||||||
"paranoia_level": 2
|
"paranoia_level": 2
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "942200",
|
|
||||||
"name": "Detects MySQL comment-/space-obfuscated injections and backtick termination",
|
|
||||||
"pattern": "(?i)(?:,[^\\)]*?(?:[0-9a-f]+|\\([0-9a-f]+\\))|\\([^,]+(?:,[\\s\\x0b]*[0-9a-f]+)+\\))(?:$|[\"'`](?:$|[^\"'`]+[\"'`])|(?:\\r?\\n)?\\z)|,[^\\)]*?[\"'`][^\"'`]+[\"'`]|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[\\s\\x0b]*?\\([\\s\\x0b]*?space[\\s\\x0b]*?\\(",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "score",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "sqli",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-sqli",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-SQLI",
|
|
||||||
"capec/1000/152/248/66"
|
|
||||||
],
|
|
||||||
"paranoia_level": 2
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "942210",
|
"id": "942210",
|
||||||
"name": "Detects chained SQL injection attempts 1/2",
|
"name": "Detects chained SQL injection attempts 1/2",
|
||||||
@@ -4199,9 +4200,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-session-fixation",
|
"id": "crs-session-fixation",
|
||||||
"name": "CRS Session Fixation",
|
"name": "CRS Session Fixation",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Session Fixation (1 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Session Fixation (1 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 10,
|
"priority": 10,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -4232,9 +4233,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-java-attack",
|
"id": "crs-java-attack",
|
||||||
"name": "CRS Java / Deserialization Attack",
|
"name": "CRS Java / Deserialization Attack",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Java / Deserialization Attack (11 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Java / Deserialization Attack (11 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 3,
|
"priority": 3,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -4475,9 +4476,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-data-leakage",
|
"id": "crs-data-leakage",
|
||||||
"name": "CRS Data Leakage Detection",
|
"name": "CRS Data Leakage Detection",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Data Leakage Detection (3 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Data Leakage Detection (3 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 15,
|
"priority": 15,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -4550,9 +4551,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-data-leakage-sql",
|
"id": "crs-data-leakage-sql",
|
||||||
"name": "CRS SQL Data Leakage",
|
"name": "CRS SQL Data Leakage",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS SQL Data Leakage (16 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS SQL Data Leakage (16 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 15,
|
"priority": 15,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -4898,9 +4899,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-data-leakage-java",
|
"id": "crs-data-leakage-java",
|
||||||
"name": "CRS Java Data Leakage",
|
"name": "CRS Java Data Leakage",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Java Data Leakage (1 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Java Data Leakage (1 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 15,
|
"priority": 15,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -4931,9 +4932,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-data-leakage-php",
|
"id": "crs-data-leakage-php",
|
||||||
"name": "CRS PHP Data Leakage",
|
"name": "CRS PHP Data Leakage",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS PHP Data Leakage (3 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS PHP Data Leakage (3 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 15,
|
"priority": 15,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -5006,9 +5007,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-data-leakage-iis",
|
"id": "crs-data-leakage-iis",
|
||||||
"name": "CRS IIS Data Leakage",
|
"name": "CRS IIS Data Leakage",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS IIS Data Leakage (3 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS IIS Data Leakage (3 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 15,
|
"priority": 15,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -5081,9 +5082,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-web-shells",
|
"id": "crs-web-shells",
|
||||||
"name": "CRS Web Shell Detection",
|
"name": "CRS Web Shell Detection",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Web Shell Detection (23 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Web Shell Detection (23 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 3,
|
"priority": 3,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -5576,9 +5577,9 @@
|
|||||||
{
|
{
|
||||||
"id": "crs-data-leakage-ruby",
|
"id": "crs-data-leakage-ruby",
|
||||||
"name": "CRS Ruby Data Leakage",
|
"name": "CRS Ruby Data Leakage",
|
||||||
"version": "4.25.0",
|
"version": "4.27.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.25.0 — CRS Ruby Data Leakage (1 rules)",
|
"description": "OWASP CRS v4.27.0 — CRS Ruby Data Leakage (1 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 15,
|
"priority": 15,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
|
|||||||
Reference in new issue
Block a user