edgeaegis 2026.10.1

package/rules/seclang-bundle.json

@@ -0,0 +1,360 @@
+{
+  "version": 1,
+  "format": "seclang-source-bundle",
+  "source": "Include owasp-crs/setup.conf\nInclude owasp-crs/rules/*.conf\n",
+  "files": {
+    "owasp-crs/LICENSE": "                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright 2026 OWASP CRS project\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n",
+    "owasp-crs/setup.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n\n#\n# -- [[ Introduction ]] --------------------------------------------------------\n#\n# The OWASP CRS is a set of generic attack\n# detection rules that provide a base level of protection for any web\n# application. They are written for the open source, cross-platform\n# ModSecurity Web Application Firewall.\n#\n# See also:\n# https://coreruleset.org/\n# https://github.com/coreruleset/coreruleset\n# https://owasp.org/www-project-modsecurity-core-rule-set/\n#\n\n\n#\n# -- [[ System Requirements ]] -------------------------------------------------\n#\n# We recommend to always use the newest ModSecurity/Coraza version.\n#\n# The configuration directives/settings in this file are used to control\n# CRS. These settings do **NOT** configure the main\n# ModSecurity/Coraza settings, such as SecRuleEngine,\n# SecRequestBodyAccess, SecAuditEngine, SecDebugLog, and XML processing.\n#\n# CRS assumes that the basic ModSecurity/Coraza configuration has already been loaded.\n# If you don't have it, you can get it, and tweak it, starting from:\n# 2.x: https://raw.githubusercontent.com/owasp-modsecurity/ModSecurity/v2/master/modsecurity.conf-recommended\n# 3.x: https://raw.githubusercontent.com/owasp-modsecurity/ModSecurity/v3/master/modsecurity.conf-recommended\n# Coraza: https://github.com/corazawaf/coraza/blob/main/coraza.conf-recommended\n#\n# The order of file inclusion in your webserver configuration should always be:\n# 1. modsecurity.conf or coraza.conf\n# 2. crs-setup.conf (this file)\n# 3. rules/*.conf (the CRS rules files)\n#\n# Please refer to the INSTALL file for detailed installation instructions.\n#\n\n\n#\n# -- [[ Mode of Operation: Anomaly Scoring vs. Self-Contained ]] ---------------\n#\n# The CRS can run in two modes:\n#\n# -- [[ Anomaly Scoring Mode (default) ]] --\n# In CRS3, anomaly mode is the default and recommended mode, since it gives the\n# most accurate log information and offers the most flexibility in setting your\n# blocking policies. It is also called \"collaborative detection mode\".\n# In this mode, each matching rule increases an 'anomaly score'.\n# At the conclusion of the inbound rules, and again at the conclusion of the\n# outbound rules, the anomaly score is checked, and the blocking evaluation\n# rules apply a disruptive action, by default returning an error 403.\n#\n# -- [[ Self-Contained Mode ]] --\n# In this mode, rules apply an action instantly. This was the CRS2 default.\n# It can lower resource usage, at the cost of less flexibility in blocking policy\n# and less informative audit logs (only the first detected threat is logged).\n# Rules inherit the disruptive action that you specify (i.e. deny, drop, etc).\n# The first rule that matches will execute this action. In most cases this will\n# cause evaluation to stop after the first rule has matched, similar to how many\n# IDSs function.\n#\n# -- [[ Alert Logging Control ]] --\n# In the mode configuration, you must also adjust the desired logging options.\n# There are three common options for dealing with logging. By default CRS enables\n# logging to the webserver error log (or Event viewer) plus detailed logging to\n# the ModSecurity audit log (configured under SecAuditLog in modsecurity.conf).\n#\n# - To log to both error log and ModSecurity audit log file, use: \"log,auditlog\"\n# - To log *only* to the ModSecurity audit log file, use: \"nolog,auditlog\"\n# - To log *only* to the error log file, use: \"log,noauditlog\"\n#\n# Examples for the various modes follow.\n# You must leave one of the following options enabled.\n# Note that you must specify the same line for phase:1 and phase:2.\n#\n\n# Default: Anomaly Scoring mode, log to error log, log to ModSecurity audit log\n# - By default, offending requests are blocked with an error 403 response.\n# - To change the disruptive action, see RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example\n#   and review section 'Changing the Disruptive Action for Anomaly Mode'.\n# - In Apache, you can use ErrorDocument to show a friendly error page or\n#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html\n#\nSecDefaultAction \"phase:1,log,auditlog,pass\"\nSecDefaultAction \"phase:2,log,auditlog,pass\"\nSecDefaultAction \"phase:3,log,auditlog,pass\"\nSecDefaultAction \"phase:4,log,auditlog,pass\"\nSecDefaultAction \"phase:5,log,auditlog,pass\"\n\n# Example: Anomaly Scoring mode, log only to ModSecurity audit log\n# - By default, offending requests are blocked with an error 403 response.\n# - To change the disruptive action, see RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example\n#   and review section 'Changing the Disruptive Action for Anomaly Mode'.\n# - In Apache, you can use ErrorDocument to show a friendly error page or\n#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html\n#\n# SecDefaultAction \"phase:1,nolog,auditlog,pass\"\n# SecDefaultAction \"phase:2,nolog,auditlog,pass\"\n# SecDefaultAction \"phase:3,nolog,auditlog,pass\"\n# SecDefaultAction \"phase:4,nolog,auditlog,pass\"\n# SecDefaultAction \"phase:5,nolog,auditlog,pass\"\n\n# Example: Self-contained mode, return error 403 on blocking\n# - In this configuration the default disruptive action becomes 'deny'. After a\n#   rule triggers, it will stop processing the request and return an error 403.\n# - You can also use a different error status, such as 404, 406, et cetera.\n# - In Apache, you can use ErrorDocument to show a friendly error page or\n#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html\n#\n# SecDefaultAction \"phase:1,log,auditlog,deny,status:403\"\n# SecDefaultAction \"phase:2,log,auditlog,deny,status:403\"\n\n# Example: Self-contained mode, redirect back to homepage on blocking\n# - In this configuration the 'tag' action includes the Host header data in the\n#   log. This helps to identify which virtual host triggered the rule (if any).\n# - Note that this might cause redirect loops in some situations; for example\n#   if a Cookie or User-Agent header is blocked, it will also be blocked when\n#   the client subsequently tries to access the homepage. You can also redirect\n#   to another custom URL.\n# SecDefaultAction \"phase:1,log,auditlog,redirect:'http://%{request_headers.host}/',tag:'Host: %{request_headers.host}'\"\n# SecDefaultAction \"phase:2,log,auditlog,redirect:'http://%{request_headers.host}/',tag:'Host: %{request_headers.host}'\"\n\n\n#\n# -- [[ Paranoia Level Initialization ]] ---------------------------------------\n#\n# The Paranoia Level (PL) setting allows you to choose the desired level\n# of rule checks that will add to your anomaly scores.\n#\n# With each paranoia level increase, the CRS enables additional rules\n# giving you a higher level of security. However, higher paranoia levels\n# also increase the possibility of blocking some legitimate traffic due to\n# false alarms (also named false positives or FPs). If you use higher\n# paranoia levels, it is likely that you will need to add some exclusion\n# rules for certain requests and applications receiving complex input.\n#\n# - A paranoia level of 1 is default. In this level, most core rules\n#   are enabled. PL1 is advised for beginners, installations\n#   covering many different sites and applications, and for setups\n#   with standard security requirements.\n#   At PL1 you should face FPs rarely. If you encounter FPs, please\n#   open an issue on the CRS GitHub site and don't forget to attach your\n#   complete Audit Log record for the request with the issue.\n# - Paranoia level 2 includes many extra rules, for instance enabling\n#   many regexp-based SQL and XSS injection protections, and adding\n#   extra keywords checked for code injections. PL2 is advised\n#   for moderate to experienced users desiring more complete coverage\n#   and for installations with elevated security requirements.\n#   PL2 comes with some FPs which you need to handle.\n# - Paranoia level 3 enables more rules and keyword lists, and tweaks\n#   limits on special characters used. PL3 is aimed at users experienced\n#   at the handling of FPs and at installations with a high security\n#   requirement.\n# - Paranoia level 4 further restricts special characters.\n#   The highest level is advised for experienced users protecting\n#   installations with very high security requirements. Running PL4 will\n#   likely produce a very high number of FPs which have to be\n#   treated before the site can go productive.\n#\n# All rules will log their PL to the audit log;\n# example: [tag \"paranoia-level/2\"]. This allows you to deduct from the\n# audit log how the WAF behavior is affected by paranoia level.\n#\n# It is important to also look into the variable\n# tx.enforce_bodyproc_urlencoded (Enforce Body Processor URLENCODED)\n# defined below. Enabling it closes a possible bypass of CRS.\n#\n# Uncomment this rule to change the default:\n#\n#SecAction \\\n#    \"id:900000,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.blocking_paranoia_level=1\"\n\n\n# It is possible to execute rules from a higher paranoia level but not include\n# them in the anomaly scoring. This allows you to take a well-tuned system on\n# paranoia level 1 and add rules from paranoia level 2 without having to fear\n# the new rules would lead to false positives that raise your score above the\n# threshold.\n# This optional feature is enabled by uncommenting the following rule and\n# setting the tx.detection_paranoia_level.\n# Technically, rules up to the level defined in tx.detection_paranoia_level\n# will be executed, but only the rules up to tx.blocking_paranoia_level affect the\n# anomaly scores.\n# By default, tx.detection_paranoia_level is set to tx.blocking_paranoia_level.\n# tx.detection_paranoia_level must not be lower than tx.blocking_paranoia_level.\n#\n# Please notice that setting tx.detection_paranoia_level to a higher paranoia\n# level results in a performance impact that is equally high as setting\n# tx.blocking_paranoia_level to said level.\n#\n#SecAction \\\n#    \"id:900001,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.detection_paranoia_level=1\"\n\n\n#\n# -- [[ Enforce Body Processor URLENCODED ]] -----------------------------------\n#\n# ModSecurity selects the body processor based on the Content-Type request\n# header. But clients are not always setting the Content-Type header for their\n# request body payloads. This will leave ModSecurity with limited vision into\n# the payload.  The variable tx.enforce_bodyproc_urlencoded lets you force the\n# URLENCODED body processor in these situations. This is off by default, as it\n# implies a change of the behaviour of ModSecurity beyond CRS (the body\n# processor applies to all rules, not only CRS) and because it may lead to\n# false positives already on paranoia level 1. However, enabling this variable\n# closes a possible bypass of CRS so it should be considered.\n#\n# Uncomment this rule to change the default:\n#\n#SecAction \\\n#    \"id:900010,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.enforce_bodyproc_urlencoded=1\"\n\n\n#\n# -- [[ Anomaly Scoring Mode Severity Levels ]] --------------------------------\n#\n# Each rule in the CRS has an associated severity level.\n# These are the default scoring points for each severity level.\n# These settings will be used to increment the anomaly score if a rule matches.\n# You may adjust these points to your liking, but this is usually not needed.\n#\n# - CRITICAL severity: Anomaly Score of 5.\n#       Mostly generated by the application attack rules (93x and 94x files).\n# - ERROR severity: Anomaly Score of 4.\n#       Generated mostly from outbound leakage rules (95x files).\n# - WARNING severity: Anomaly Score of 3.\n#       Generated mostly by malicious client rules (91x files).\n# - NOTICE severity: Anomaly Score of 2.\n#       Generated mostly by the protocol rules (92x files).\n#\n# In anomaly mode, these scores are cumulative.\n# So it's possible for a request to hit multiple rules.\n#\n# (Note: In this file, we use 'phase:1' to set CRS configuration variables.\n# In general, 'phase:request' is used. However, we want to make absolutely sure\n# that all configuration variables are set before the CRS rules are processed.)\n#\n#SecAction \\\n#    \"id:900100,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.critical_anomaly_score=5,\\\n#    setvar:tx.error_anomaly_score=4,\\\n#    setvar:tx.warning_anomaly_score=3,\\\n#    setvar:tx.notice_anomaly_score=2\"\n\n\n#\n# -- [[ Anomaly Scoring Mode Blocking Threshold Levels ]] ----------------------\n#\n# Here, you can specify at which cumulative anomaly score an inbound request,\n# or outbound response, gets blocked.\n#\n# Most detected inbound threats will give a critical score of 5.\n# Smaller violations, like violations of protocol/standards, carry lower scores.\n#\n# [ At default value ]\n# If you keep the blocking thresholds at the defaults, the CRS will work\n# similarly to previous CRS versions: a single critical rule match will cause\n# the request to be blocked and logged.\n#\n# [ Using higher values ]\n# If you want to make the CRS less sensitive, you can increase the blocking\n# thresholds, for instance to 7 (which would require multiple rule matches\n# before blocking) or 10 (which would require at least two critical alerts - or\n# a combination of many lesser alerts), or even higher.\n#\n# Please be aware, however, that going beyond our recommendations will progressively\n# neutralize an increasing number of sensitive rules. Beyond a threshold of 5 for\n# requests and 4 for responses, you will disable entire parts of the WAF,\n# such as LFI, RFI, RCE, and data-exfiltration protections.\n#\n# As such, we strongly recommend that the recommended thresholds are only increased temporarily,\n# and solely for false-positive tuning purposes.\n#\n# [ New deployment strategy: Starting high and decreasing ]\n# It is a common practice to start a fresh CRS installation with elevated\n# anomaly scoring thresholds (>100) and then lower the limits as your\n# confidence in the setup grows. You may also look into the Sampling\n# Percentage section below for a different strategy to ease into a new\n# CRS installation.\n#\n# [ Anomaly Threshold / Paranoia Level Quadrant ]\n#\n#     High Anomaly Limit   |   High Anomaly Limit\n#     Low Paranoia Level   |   High Paranoia Level\n#     -> Fresh Site        |   -> Experimental Site\n# ------------------------------------------------------\n#     Low Anomaly Limit    |   Low Anomaly Limit\n#     Low Paranoia Level   |   High Paranoia Level\n#     -> Standard Site     |   -> High Security Site\n#\n# Uncomment this rule to change the defaults:\n#\n#SecAction \\\n#    \"id:900110,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.inbound_anomaly_score_threshold=5,\\\n#    setvar:tx.outbound_anomaly_score_threshold=4\"\n\n\n#\n# -- [[ Application Specific Rule Exclusions ]] --------------------------------\n#\n# CRS 3.x contained exclusion packages to tweak the CRS for use with common\n# web applications, lowering the number of false positives.\n#\n# In CRS 4, these are no longer part of the CRS itself, but they are available\n# as \"CRS plugins\". Some plugins improve support for web applications, and others\n# may bring new functionality. Plugins are not installed by default, but can be\n# downloaded from the plugin registry:\n# https://github.com/coreruleset/plugin-registry\n#\n# For detailed information about using and installing plugins, please see:\n# https://coreruleset.org/docs/concepts/plugins/\n\n\n#\n# -- [[ Anomaly Score Reporting Level ]] ---------------------------------------\n#\n# When a request is blocked due to the anomaly score meeting or exceeding the\n# anomaly threshold then the blocking rule will also report the anomaly score.\n# This applies to the separate inbound and outbound anomaly scores.\n#\n# In phase 5, there are additional rules that can perform additional reporting\n# of anomaly scores with a verbosity that depends on the reporting level defined\n# below.\n#\n# By setting the reporting level you control whether you want additional\n# reporting beyond the blocking rule or not and, if yes, which requests should\n# be covered. The higher the reporting level, the more verbose the reporting is.\n#\n# There are 6 reporting levels:\n#\n# 0 - Reporting disabled\n# 1 - Reporting for requests with a blocking anomaly score >= a threshold\n# 2 - Reporting for requests with a detection anomaly score >= a threshold\n# 3 - Reporting for requests with a blocking anomaly score greater than 0\n# 4 - Reporting for requests with a detection anomaly score greater than 0\n# 5 - Reporting for all requests\n#\n# Note: Reporting levels 1 and 2 make it possible to differentiate between\n# requests that are blocked and requests that are *not* blocked but would have\n# been blocked if the blocking PL was equal to detection PL. This may be useful\n# for certain FP tuning methodologies, for example moving to a higher PL.\n#\n# A value of 5 can be useful on platforms where you are interested in logging\n# non-scoring requests, yet it is not possible to report this information in\n# the request/access log. This applies to Nginx, for example.\n#\n#SecAction \\\n#    \"id:900115,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.reporting_level=4\"\n\n\n#\n# -- [[ Early Anomaly Scoring Mode Blocking ]] ------------------------------\n#\n# The anomaly scores for the request and the responses are generally summed up\n# and evaluated at the end of phase:2 and at the end of phase:4 respectively.\n# However, it is possible to enable an early evaluation of these anomaly scores\n# at the end of phase:1 and at the end of phase:3.\n#\n# If a request (or a response) hits the anomaly threshold in this early\n# evaluation, then blocking happens immediately (if blocking is enabled) and\n# the phase 2 (and phase 4 respectively) will no longer be executed.\n#\n# Enable the rule 900120 that sets the variable tx.early_blocking to 1 in order\n# to enable early blocking. The variable tx.early_blocking is set to 0 by\n# default. Early blocking is thus disabled by default.\n#\n# Please note that early blocking will hide potential alerts from you. This\n# means that a payload that would appear in an alert in phase 2 (or phase 4)\n# does not get evaluated if the request is being blocked early. So when you\n# disabled early blocking again at some point in the future, then new alerts\n# from phase 2 might pop up.\n#SecAction \\\n#    \"id:900120,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.early_blocking=1\"\n\n\n#\n# -- [[ Initialize Default Collections ]] -----------------------------------\n#\n# CRS provides a centralized option to initialize and populate collections\n# meant to be used by plugins (E.g.DoS protection plugin).\n# By default, Global and IP collections (see rule 901320),\n# being not used by core rules, are not initialized.\n#\n# Uncomment this rule to change the default:\n#\n#SecAction \\\n#    \"id:900130,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.enable_default_collections=1\"\n\n\n#\n# -- [[ HTTP Policy Settings ]] ------------------------------------------------\n#\n# This section defines your policies for the HTTP protocol, such as:\n# - allowed HTTP versions, HTTP methods, allowed request Content-Types\n# - forbidden file extensions (e.g. .bak, .sql) and request headers (e.g. Proxy)\n#\n# These variables are used in the following rule files:\n# - REQUEST-911-METHOD-ENFORCEMENT.conf\n# - REQUEST-920-PROTOCOL-ENFORCEMENT.conf\n\n# HTTP methods that a client is allowed to use.\n# Default: GET HEAD POST OPTIONS\n# Example: for RESTful APIs, add the following methods: PUT PATCH DELETE\n# Example: for WebDAV, add the following methods: CHECKOUT COPY DELETE LOCK\n#          MERGE MKACTIVITY MKCOL MOVE PROPFIND PROPPATCH PUT UNLOCK\n# Uncomment this rule to change the default.\n#\n# The HTTP PUT method is normally used to upload data that is saved on the server at a user-supplied URL.\n# If enabled, an attacker may be able to inject arbitrary, and potentially malicious, content into the application or on to the file system of the web server.\n# Depending on the server's configuration, this may lead to compromise of other users (by uploading\n# client-executable scripts), compromise of the server (by uploading server-executable code), or other attacks.\n# For this reason, the PUT method is disabled by default.\n# GET, HEAD, POST and OPTIONS are seen as the minimal set of HTTP methods\n# from a security perspective. For static sites, removing the POST is\n# recommended. Add other HTTP methods as seen fit (see above).\n#\n#SecAction \\\n#    \"id:900200,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'\"\n\n#\n# -- [[ HTTP Method Override Parameter ]] -------------------------------------\n#\n# Many web frameworks (Laravel, Rails, Symfony, CakePHP, Express.js, etc.)\n# support overriding the HTTP method via a _method parameter in the query\n# string or request body. This allows HTML forms to simulate PUT, PATCH,\n# and DELETE requests.\n#\n# While this is legitimate framework behavior, it can be abused for:\n# - WAF bypass (sending POST with _method=DELETE)\n# - CSRF attacks bypassing SameSite=Lax cookie restrictions\n# - Method-based ACL bypass\n#\n# By default, CRS blocks _method parameter usage at PL2+. If your application\n# legitimately uses the _method parameter for method override, you can allow\n# it by uncommenting the rule below.\n#\n# Note: The X-HTTP-Method-Override header is handled separately by rule 920450.\n#\n# Uncomment this rule to ALLOW _method parameter for method override:\n#\n#SecAction \\\n#    \"id:900210,\\\n#    phase:1,\\\n#    pass,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:'tx.allow_method_override_parameter=1'\"\n\n# Content-Types that a client is allowed to send in a request.\n# Default: |application/x-www-form-urlencoded| |multipart/form-data| |text/xml|\n# |application/xml| |application/soap+xml| |application/json|\n#\n# Please note, that the rule where CRS uses this variable (920420) evaluates it with operator\n# `@within`, which is case sensitive, but uses t:lowercase. You must add your whole custom\n# Content-Type with lowercase.\n#\n# Bypass Warning: some applications may not rely on the content-type request header in order\n# to parse the request body. This could make an attacker able to send malicious URLENCODED/JSON/XML\n# payloads without being detected by the WAF. Allowing request content-type that doesn't activate any\n# body processor (for example: \"text/plain\", \"application/x-amf\", \"application/octet-stream\", etc..)\n# could lead to a WAF bypass. For example, a malicious JSON payload submitted with a \"text/plain\"\n# content type may still be interpreted as JSON by a backend application but would not trigger the\n# JSON body parser at the WAF, leading to a bypass. To avoid bypasses, you must enable the appropriate\n# body parser based on the expected data in the request bodies (For example JSON for JSON data, XML for XML data, etc).\n#\n# When additional JSON content types are legitimately used in a deployment,\n# e.g. application/cloudevents+json, it is extremely important to ensure that a\n# rule exists to enable the engine's JSON body processor for these additional\n# JSON content types. Failure to do so can lead to a request body bypass. The\n# default JSON rule in modsecurity.conf-recommended (200001) will only activate\n# the JSON body processor for the specific content type application/json. The\n# optional modsecurity.conf-recommended rule 200006 can be used to enable the\n# JSON body processor for a wide variety of JSON content types.\n#\n# To prevent blocking request with not allowed content-type by default, you can create an exclusion\n# rule that removes rule 920420. It's important that you enable the correct body parser when allowing\n# an additional content type to prevent bypasses. For example, this rule enables the JSON body processor\n# for the text/plain content type:\n#SecRule REQUEST_HEADERS:Content-Type \"@beginsWith text/plain\" \\\n#    \"id:1234,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    chain\"\n#    SecRule REQUEST_URI \"@rx ^/foo/bar\" \\\n#        \"t:none,\\\n#        ctl:ruleRemoveById=920420,\\\n#        ctl:requestBodyProcessor=JSON\"\n#\n# See: https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#ctl\n# See: https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x)#ctl\n#\n# Uncomment this rule to change the default.\n#\n#SecAction \\\n#    \"id:900220,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |text/xml| |application/xml| |application/soap+xml| |application/json|'\"\n\n#\n# -- [[ AWS JSON and \"+json\" Content Types ]] -----------------------------\n#\n# IMPORTANT: in addition to the fixed list above, CRS allows and JSON-parses\n# ANY content type of the form application/*+json by default, unconditionally\n# -- this is a wildcard match (rule 901370 below), not a fixed list. Every\n# content type ending in \"+json\" is included, whether or not it is named\n# below. Examples: application/ld+json, application/problem+json,\n# application/vnd.api+json, and any other \"+json\"-suffixed type your\n# application, a library, or a third party defines. This is safe because\n# the \"+json\" structured syntax suffix (RFC 6839) guarantees the body is\n# JSON syntax regardless of the semantic subtype, and because CRS forces\n# the JSON body processor in the exact same rule that allows the content\n# type, so there is no request body bypass risk from this being on by\n# default.\n#\n# Separately, and not covered by the wildcard above (it doesn't use the\n# \"+json\" suffix), AWS's proprietary JSON-RPC-style content types\n# application/x-amz-json-1.0 and application/x-amz-json-1.1 (Cognito,\n# DynamoDB, SQS, ...) are also allowed and JSON-parsed by default,\n# unconditionally: rule 901360 in REQUEST-901-INITIALIZATION.conf.\n#\n# Neither requires a toggle to enable, since the JSON body processor is\n# forced in the same rule that allows the content type. If you need to\n# disable either, remove the corresponding rule ID (901360 / 901370) via\n# ctl:ruleRemoveById, the same way as any other CRS rule.\n\n# Allowed HTTP versions.\n# Default: HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0\n# Note that some web server versions use 'HTTP/2', some 'HTTP/2.0', so\n# we include both version strings by default.\n# HTTP/0.9 is obsolete per RFC 9110 and no longer supported; rule 920100\n# will block request lines that lack a protocol suffix regardless of this\n# setting.\n# Uncomment this rule to change the default.\n#SecAction \\\n#    \"id:900230,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0'\"\n\n# Forbidden file extensions.\n# Guards against unintended exposure of development/configuration files.\n# Default: .ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/\n# Example: .bak/ .config/ .conf/ .db/ .ini/ .log/ .old/ .pass/ .pdb/ .rdb/ .sql/\n# Note that .axd was removed due to false positives (see PR 1925).\n#\n# To additionally guard against configuration/install archive files from being\n# accidentally exposed, common archive file extensions can be added to the\n# restricted extensions list. An example list of common archive file extensions\n# is presented below:\n# .7z/ .br/ .bz/ .bz2/ .cab/ .cpio/ .gz/ .img/ .iso/ .jar/ .rar/ .tar/ .tbz2/ .tgz/ .txz/ .xz/ .zip/ .zst/\n# (Source: https://en.wikipedia.org/wiki/List_of_archive_formats)\n#\n# Uncomment this rule to change the default.\n#SecAction \\\n#    \"id:900240,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:'tx.restricted_extensions=.ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/'\"\n\n# Restricted request headers.\n# The HTTP request headers that CRS restricts are split into two categories:\n# basic (always forbidden) and extended (may be forbidden). All header names\n# should be lowercase and enclosed by /slashes/ as delimiters.\n#\n# [ Basic ]\n# Includes deprecated headers and headers with known security risks. Always\n# forbidden.\n# Default: /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/\n#\n# /content-encoding/\n#   Used to list any encodings that have been applied to the original payload.\n#   Only used for compression, which isn't supported by CRS by default since CRS\n#   blocks newlines and null bytes inside the request body. Most compression\n#   algorithms require at least null bytes per RFC. Blocking Content-Encoding\n#   shouldn't break anything and increases security since WAF engines, including\n#   ModSecurity, are typically incapable of properly scanning compressed request\n#   bodies.\n#\n# /proxy/\n#   Blocking this prevents the 'httpoxy' vulnerability: https://httpoxy.org\n#\n# /lock-token/\n#\n# /content-range/\n#\n# /if/\n#\n# /x-http-method-override/\n# /x-http-method/\n# /x-method-override/\n#   Blocking these headers prevents method override attacks, as described here:\n#   https://www.sidechannel.blog/en/http-method-override-what-it-is-and-how-a-pentester-can-use-it\n#\n# /x-middleware-subrequest/\n#   CVE-2025-29927 (Next.js)\n#\n# /expect/\n#   Blocking this header prevents Expect-based desync attacks\n#   https://portswigger.net/research/http1-must-die#expect-based-desync-attacks.\n#\n#   The `System.Net.HttpWebRequest` library in .Net uses this header. Use of the header\n#   can be disabled by setting `ServicePointManager.Expect100Continue` to `false`\n#   (see https://learn.microsoft.com/en-us/dotnet/api/system.net.servicepointmanager.expect100continue?view=net-10.0).\n#\n# Uncomment this rule to change the default.\n#SecAction \\\n#    \"id:900250,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:'tx.restricted_headers_basic=/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/'\"\n#\n# [ Extended ]\n# Includes deprecated headers that are still in use (so false positives are\n# possible) and headers with possible security risks. Forbidden at a higher\n# paranoia level.\n# Default: /accept-charset/\n#\n# /accept-charset/\n#   Deprecated header that should not be used by clients and should be ignored\n#   by servers. Can be used for a response WAF bypass by asking for a charset\n#   that the WAF cannot decode. Considered to be a good indicator of suspicious\n#   behavior but produces too many false positives to be forbidden by default.\n#   References:\n#   https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset\n#   https://github.com/coreruleset/coreruleset/issues/3140\n#\n# Uncomment this rule to change the default.\n#SecAction \\\n#    \"id:900255,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:'tx.restricted_headers_extended=/accept-charset/'\"\n\n# Content-Types charsets that a client is allowed to send in a request.\n# The content-types are enclosed by |pipes| as delimiters to guarantee exact matches.\n#\n# You can add additional character sets if something more exotic is required. One caveat: you will also need to edit 'regex-assembly/include/allowed-charsets.ra' and rebuild all the associated regular expressions using `crs-toolchain regex update --all`. See https://coreruleset.org/docs/6-development/6-2-crs-toolchain/.\n#\n# Warning: If the WAF engine is unable to fully and correctly decode a newly added character encoding then this can lead to a full request body or response body bypass. Additional permitted character encodings should be added with caution and tested to ensure inspection is not affected.\n#\n# Default: |utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|\n# Uncomment this rule to change the default.\n#SecAction \\\n#    \"id:900280,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:'tx.allowed_request_content_type_charset=|utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|'\"\n\n#\n# -- [[ HTTP Argument/Upload Limits ]] -----------------------------------------\n#\n# Here you can define optional limits on HTTP get/post parameters and uploads.\n# This can help to prevent application specific DoS attacks.\n#\n# These values are checked in REQUEST-920-PROTOCOL-ENFORCEMENT.conf.\n# Beware of blocking legitimate traffic when enabling these limits.\n#\n\n# Block request if number of arguments is too high\n# Default: unlimited\n# Example: 255\n# Note that a hard limit by the engine may also apply here (SecArgumentsLimit).\n# This would override this soft limit.\n# Uncomment this rule to set a limit.\n#SecAction \\\n#    \"id:900300,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.max_num_args=255\"\n\n# Block request if the length of any argument name is too high\n# Default: unlimited\n# Example: 100\n# Uncomment this rule to set a limit.\n#SecAction \\\n#    \"id:900310,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.arg_name_length=100\"\n\n# Block request if the length of any argument value is too high\n# Default: unlimited\n# Example: 400\n# Uncomment this rule to set a limit.\n#SecAction \\\n#    \"id:900320,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.arg_length=400\"\n\n# Block request if the total length of all combined arguments is too high\n# Default: unlimited\n# Example: 64000\n# Uncomment this rule to set a limit.\n#SecAction \\\n#    \"id:900330,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.total_arg_length=64000\"\n\n# Block request if the file size of any individual uploaded file is too high\n# Default: unlimited\n# Example: 1048576\n# Uncomment this rule to set a limit.\n#SecAction \\\n#    \"id:900340,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.max_file_size=1048576\"\n\n# Block request if the total size of all combined uploaded files is too high\n# Default: unlimited\n# Example: 1048576\n# Uncomment this rule to set a limit.\n#SecAction \\\n#    \"id:900350,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.combined_file_sizes=1048576\"\n\n\n#\n# -- [[ Easing In / Sampling Percentage ]] -------------------------------------\n#\n# Adding the CRS to an existing productive site can lead to false\n# positives, unexpected performance issues and other undesired side effects.\n#\n# It can be beneficial to test the water first by enabling the CRS for a\n# limited number of requests only and then, when you have solved the issues (if\n# any) and you have confidence in the setup, to raise the ratio of requests\n# being sent into the ruleset.\n#\n# Adjust the percentage of requests that are funnelled into the Core Rules by\n# setting TX.sampling_percentage below. The default is 100, meaning that every\n# request gets checked by the CRS.  The selection of requests, which are going\n# to be checked, is based on a pseudo random number generated by ModSecurity.\n#\n# If a request is allowed to pass without being checked by the CRS, there is no\n# entry in the audit log (for performance reasons), but an error log entry is\n# written.  If you want to disable the error log entry, then issue the\n# following directive somewhere after the inclusion of the CRS\n# (E.g., RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf).\n#\n#SecRuleUpdateActionById 901450 \"nolog\"\n#\n# ATTENTION: If this TX.sampling_percentage is below 100, then some of the\n# requests will bypass the Core Rules completely and you lose the ability to\n# protect your service with ModSecurity.\n#\n# Uncomment this rule to enable this feature:\n#\n#SecAction \\\n#    \"id:900400,\\\n#    phase:1,\\\n#    pass,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.sampling_percentage=100\"\n\n\n\n#\n# -- [[ Check UTF-8 encoding ]] ------------------------------------------------\n#\n# CRS validates request parameters (REQUEST_FILENAME, ARGS, ARGS_NAMES)\n# for invalid UTF-8 encoding. Only UTF-8 is checked; other encodings\n# (e.g. UTF-16) are not validated.\n#\n# This check is _enabled_ by default.\n#\n# If your site sends request parameters in a non-UTF-8 encoding, this check\n# can cause false positives. Uncomment this rule to _disable_ the feature:\n#\n#SecAction \\\n#    \"id:900950,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.crs_validate_utf8_encoding=0\"\n\n# -- [[ Skip Checking Responses ]] ------------------------------------------------\n#\n# CRS will perform analysis of the response contents if this is enabled and you have\n# the directive `SecResponseBodyAccess On`.\n#\n# Warning: this feature is _enabled_ by default, but depending on your applications\n# you might be targeted in a Request Filter Denial of Service (RFDoS) attack.\n#\n# References: https://blog.sicuranext.com/response-filter-denial-of-service-a-new-way-to-shutdown-a-website/\n#\n# Uncomment this rule to _skip checking responses_.\n#\n#SecAction \\\n#    \"id:900500,\\\n#    phase:1,\\\n#    pass,\\\n#    t:none,\\\n#    nolog,\\\n#    tag:'OWASP_CRS',\\\n#    ver:'OWASP_CRS/4.30.0',\\\n#    setvar:tx.crs_skip_response_analysis=1\"\n\n#\n# -- [[ End of setup ]] --------------------------------------------------------\n#\n# The CRS checks the tx.crs_setup_version variable to ensure that the setup\n# has been loaded. If you are not planning to use this setup template,\n# you must manually set the tx.crs_setup_version variable before including\n# the CRS rules/* files.\n#\n# The variable is a numerical representation of the CRS version number.\n# E.g., v3.0.0 is represented as 300.\n#\nSecAction \\\n    \"id:900990,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:tx.crs_setup_version=4300\"\n",
+    "owasp-crs/rules/REQUEST-901-INITIALIZATION.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# This file REQUEST-901-INITIALIZATION.conf initializes the Core Rules\n# and performs preparatory actions. It also fixes errors and omissions\n# of variable definitions in the file crs-setup.conf.\n# The crs-setup.conf can and should be edited by the user, this file\n# is part of the CRS installation and should not be altered.\n#\n\n\n#\n# -=[ Rules Version ]=-\n#\n# Rule version data is added to the \"Producer\" line of Section H of the Audit log:\n#\n# - Producer: ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/); OWASP_CRS/3.1.0.\n#\n# Ref: https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#seccomponentsignature\n#\nSecComponentSignature \"OWASP_CRS/4.30.0\"\n\n#\n# -=[ Default setup values ]=-\n#\n# The CRS checks the tx.crs_setup_version variable to ensure that the setup\n# file is included at the correct time. This detects situations where\n# necessary settings are not defined, for instance if the file\n# inclusion order is incorrect, or if the user has forgotten to\n# include the crs-setup.conf file.\n#\n# If you are upgrading from an earlier version of the CRS and you are\n# getting this error, please make a new copy of the setup template\n# crs-setup.conf.example to crs-setup.conf, and re-apply your policy\n# changes. There have been many changes in settings syntax from CRS2\n# to CRS3, so an old setup file may cause unwanted behavior.\n#\n# If you are not planning to use the crs-setup.conf template, you must\n# manually set the tx.crs_setup_version variable before including\n# the CRS rules/* files.\n#\n# The variable is a numerical representation of the CRS version number.\n# E.g., v3.0.0 is represented as 300.\n#\n\nSecRule &TX:crs_setup_version \"@eq 0\" \\\n    \"id:901001,\\\n    phase:1,\\\n    deny,\\\n    status:500,\\\n    log,\\\n    auditlog,\\\n    msg:'CRS is deployed without configuration! Please copy the crs-setup.conf.example template to crs-setup.conf, and include the crs-setup.conf file in your webserver configuration before including the CRS rules. See the INSTALL file in the CRS directory for detailed instructions',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL'\"\n\n\n#\n# -=[ Default setup values ]=-\n#\n# Some constructs or individual rules will fail if certain parameters\n# are not set in the crs-setup.conf file. The following rules will catch\n# these cases and assign sane default values.\n#\n\n# Default Inbound Anomaly Threshold Level (rule 900110 in crs-setup.conf)\nSecRule &TX:inbound_anomaly_score_threshold \"@eq 0\" \\\n    \"id:901100,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.inbound_anomaly_score_threshold=5'\"\n\n# Default Outbound Anomaly Threshold Level (rule 900110 in crs-setup.conf)\nSecRule &TX:outbound_anomaly_score_threshold \"@eq 0\" \\\n    \"id:901110,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.outbound_anomaly_score_threshold=4'\"\n\n# Default Reporting Level (rule 900115 in crs-setup.conf)\nSecRule &TX:reporting_level \"@eq 0\" \\\n    \"id:901111,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.reporting_level=4'\"\n\n# Default Early Blocking (rule 900120 in crs-setup.conf)\nSecRule &TX:early_blocking \"@eq 0\" \\\n    \"id:901115,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.early_blocking=0'\"\n\n# Default Blocking Paranoia Level (rule 900000 in crs-setup.conf)\nSecRule &TX:blocking_paranoia_level \"@eq 0\" \\\n    \"id:901120,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_paranoia_level=1'\"\n\n# Default Detection Paranoia Level (rule 900001 in crs-setup.conf)\nSecRule &TX:detection_paranoia_level \"@eq 0\" \\\n    \"id:901125,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_paranoia_level=%{TX.blocking_paranoia_level}'\"\n\n# Default Sampling Percentage (rule 900400 in crs-setup.conf)\nSecRule &TX:sampling_percentage \"@eq 0\" \\\n    \"id:901130,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.sampling_percentage=100'\"\n\n# Default Anomaly Scores (rule 900100 in crs-setup.conf)\nSecRule &TX:critical_anomaly_score \"@eq 0\" \\\n    \"id:901140,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.critical_anomaly_score=5'\"\n\nSecRule &TX:error_anomaly_score \"@eq 0\" \\\n    \"id:901141,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.error_anomaly_score=4'\"\n\nSecRule &TX:warning_anomaly_score \"@eq 0\" \\\n    \"id:901142,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.warning_anomaly_score=3'\"\n\nSecRule &TX:notice_anomaly_score \"@eq 0\" \\\n    \"id:901143,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.notice_anomaly_score=2'\"\n\n# Default HTTP policy: allowed_methods (rule 900200 in crs-setup.conf)\nSecRule &TX:allowed_methods \"@eq 0\" \\\n    \"id:901160,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'\"\n\n# Default HTTP policy: allowed_request_content_type (rule 900220 in crs-setup.conf)\nSecRule &TX:allowed_request_content_type \"@eq 0\" \\\n    \"id:901162,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |text/xml| |application/xml| |application/soap+xml| |application/json|'\"\n\n# Default HTTP policy: allowed_request_content_type_charset (rule 900280 in crs-setup.conf)\nSecRule &TX:allowed_request_content_type_charset \"@eq 0\" \\\n    \"id:901168,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.allowed_request_content_type_charset=|utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|'\"\n\n# Default HTTP policy: allowed_http_versions (rule 900230 in crs-setup.conf)\nSecRule &TX:allowed_http_versions \"@eq 0\" \\\n    \"id:901163,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0'\"\n\n# Default HTTP policy: restricted_extensions (rule 900240 in crs-setup.conf)\nSecRule &TX:restricted_extensions \"@eq 0\" \\\n    \"id:901164,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.restricted_extensions=.ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/'\"\n\n# Default HTTP policy: restricted_headers_basic (rule 900250 in crs-setup.conf)\nSecRule &TX:restricted_headers_basic \"@eq 0\" \\\n    \"id:901165,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.restricted_headers_basic=/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/'\"\n\n# Default HTTP policy: restricted_headers_extended (rule 900255 in crs-setup.conf)\nSecRule &TX:restricted_headers_extended \"@eq 0\" \\\n    \"id:901171,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.restricted_headers_extended=/accept-charset/'\"\n\n#\n# -=[ Method Override Parameter Configuration ]=-\n#\n# Initialize the allow_method_override_parameter variable.\n# This controls whether the _method parameter is permitted for HTTP method\n# override (used by frameworks like Laravel, Rails, Symfony).\n#\n# To allow _method parameter, set tx.allow_method_override_parameter=1\n# in crs-setup.conf (see rule 900510).\n#\nSecRule &TX:allow_method_override_parameter \"@eq 0\" \\\n    \"id:901510,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.allow_method_override_parameter=0'\"\n\n# Default enforcing of body processor URLENCODED (rule 900010 in crs-setup.conf)\nSecRule &TX:enforce_bodyproc_urlencoded \"@eq 0\" \\\n    \"id:901167,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.enforce_bodyproc_urlencoded=0'\"\n\n# Default check for UTF8 encoding validation (rule 900950 in crs-setup.conf)\nSecRule &TX:crs_validate_utf8_encoding \"@eq 0\" \\\n    \"id:901169,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.crs_validate_utf8_encoding=1'\"\n\n# Default check for skipping response analysis (rule 900500 in crs-setup.conf)\nSecRule &TX:crs_skip_response_analysis \"@eq 0\" \\\n    \"id:901170,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.crs_skip_response_analysis=0'\"\n\n#\n# -=[ Initialize internal variables ]=-\n#\n\n# Initialize anomaly scoring variables.\n# All _score variables start at 0, and are incremented by the various rules\n# upon detection of a possible attack.\n\nSecAction \\\n    \"id:901200,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=0',\\\n    setvar:'tx.detection_inbound_anomaly_score=0',\\\n    setvar:'tx.inbound_anomaly_score_pl1=0',\\\n    setvar:'tx.inbound_anomaly_score_pl2=0',\\\n    setvar:'tx.inbound_anomaly_score_pl3=0',\\\n    setvar:'tx.inbound_anomaly_score_pl4=0',\\\n    setvar:'tx.sql_injection_score=0',\\\n    setvar:'tx.xss_score=0',\\\n    setvar:'tx.rfi_score=0',\\\n    setvar:'tx.lfi_score=0',\\\n    setvar:'tx.rce_score=0',\\\n    setvar:'tx.php_injection_score=0',\\\n    setvar:'tx.http_violation_score=0',\\\n    setvar:'tx.session_fixation_score=0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=0',\\\n    setvar:'tx.detection_outbound_anomaly_score=0',\\\n    setvar:'tx.outbound_anomaly_score_pl1=0',\\\n    setvar:'tx.outbound_anomaly_score_pl2=0',\\\n    setvar:'tx.outbound_anomaly_score_pl3=0',\\\n    setvar:'tx.outbound_anomaly_score_pl4=0',\\\n    setvar:'tx.anomaly_score=0'\"\n\n\n#\n# -=[ Initialize collections ]=-\n#\n# Create both Global and IP collections for rules to use.\n# Some plugins assume that these two collections have already\n# been initialized.\n# IP collection is initialized with the IP address concatened with the hashed user agent.\n\n# Disable collection initialization by default (see rule 900130 in crs-setup.conf)\n# The creation of the IP and the GLOBAL collection is not being tested as\n# of this writing due to limits in ftw and our testing setup.\n# Proper testing would involve the checking of a variable in the said collections.\nSecRule &TX:ENABLE_DEFAULT_COLLECTIONS \"@eq 1\" \\\n    \"id:901320,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.ua_hash=%{REQUEST_HEADERS.User-Agent}',\\\n    chain\"\n    SecRule TX:ENABLE_DEFAULT_COLLECTIONS \"@eq 1\" \\\n        \"chain\"\n        SecRule TX:ua_hash \"@unconditionalMatch\" \\\n            \"t:none,t:sha1,t:hexEncode,\\\n            initcol:global=global,\\\n            initcol:ip=%{remote_addr}_%{MATCHED_VAR}\"\n\n#\n# -=[ Initialize Correct Body Processing ]=-\n#\n# Force request body variable and optionally request body processor\n#\n\n# Force body variable\nSecRule REQBODY_PROCESSOR \"!@rx (?:URLENCODED|MULTIPART|XML|JSON)\" \\\n    \"id:901340,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    noauditlog,\\\n    msg:'Enabling body inspection',\\\n    tag:'OWASP_CRS',\\\n    ctl:forceRequestBodyVariable=On,\\\n    ver:'OWASP_CRS/4.30.0'\"\n\n# Force body processor URLENCODED\nSecRule TX:enforce_bodyproc_urlencoded \"@eq 1\" \\\n    \"id:901350,\\\n    phase:1,\\\n    pass,\\\n    t:none,t:urlDecodeUni,\\\n    nolog,\\\n    noauditlog,\\\n    msg:'Enabling forced body inspection for ASCII content',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    chain\"\n    SecRule REQBODY_PROCESSOR \"!@rx (?:URLENCODED|MULTIPART|XML|JSON)\" \\\n        \"ctl:requestBodyProcessor=URLENCODED\"\n\n# Allow and force body processor JSON for AWS JSON content types\n# (application/x-amz-json-1.0, application/x-amz-json-1.1). AWS services\n# (Cognito, DynamoDB, SQS, ...) use these proprietary JSON-RPC-style content\n# types; the request bodies are plain JSON, but the type doesn't follow the\n# \"+json\" structured syntax suffix handled by rule 901370 below, so it needs\n# its own literal match. See rule 901370 below for its generic sibling.\nSecRule REQUEST_HEADERS:Content-Type \"@rx ^application/x-amz-json-1\\.[01](?:\\s*;.*)?$\" \\\n    \"id:901360,\\\n    phase:1,\\\n    pass,\\\n    t:none,t:lowercase,\\\n    nolog,\\\n    noauditlog,\\\n    msg:'Enabling JSON body processor for AWS JSON content types',\\\n    tag:'OWASP_CRS',\\\n    ctl:requestBodyProcessor=JSON,\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |application/x-amz-json-1.0| |application/x-amz-json-1.1|'\"\n\n# Allow and force body processor JSON for ANY content type of the form\n# application/*+json -- this is a wildcard match on the \"+json\" structured\n# syntax suffix (RFC 6839), not a fixed list. Every \"+json\"-suffixed content\n# type is included, whether or not it is named here: application/ld+json,\n# application/problem+json, application/vnd.api+json, etc. are examples,\n# not an enumeration. The suffix guarantees the body is JSON syntax\n# regardless of the semantic subtype (RFC 6839 section 3), so this\n# is safe to allow generically instead of enumerating every registered\n# subtype. Mirrors the sample rule 200006 in modsecurity.conf-recommended,\n# but also widens tx.allowed_request_content_type so rule 920420 doesn't\n# block the request in the first place, and is anchored (unlike 200006's\n# unanchored sample) so a non-JSON lookalike content type can't slip in.\n#\n# Do not confuse this with the bare \"application/csp-report\" type (no\n# \"+json\" suffix), which does NOT carry this guarantee and must stay\n# excluded from tx.allowed_request_content_type (see issue #4362).\n#\n# The character class before \"+json\" matches RFC 6838's restricted-name-chars\n# (ALPHA / DIGIT / \"!\" / \"#\" / \"$\" / \"&\" / \"-\" / \"^\" / \"_\" / \".\" / \"+\"), the\n# legal character set for a media type's subtype. \"+\" is included so that\n# subtypes which already contain a \"+\", like application/vc+ld+json, match.\nSecRule REQUEST_HEADERS:Content-Type \"@rx ^(application/[a-z0-9.!#$&_^+-]+\\+json)(?:\\s*;.*)?$\" \\\n    \"id:901370,\\\n    phase:1,\\\n    pass,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    nolog,\\\n    noauditlog,\\\n    msg:'Enabling JSON body processor for +json structured syntax suffix content types',\\\n    tag:'OWASP_CRS',\\\n    ctl:requestBodyProcessor=JSON,\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |%{tx.1}|'\"\n\n\n#\n# -=[ Easing In / Sampling Percentage ]=-\n#\n# This is used to send only a limited percentage of requests into the Core\n# Rule Set. The selection is based on TX.sampling_percentage and a pseudo\n# random number calculated below.\n#\n# Use this to ease into a new Core Rules installation with an existing\n# productive service.\n#\n# See\n# https://www.netnea.com/cms/2016/04/26/easing-in-conditional-modsecurity-rule-execution-based-on-pseudo-random-numbers/\n#\n\n#\n# Generate the pseudo random number\n#\n# ATTENTION: This is no cryptographically secure random number. It's just\n# a cheap way to get some random number suitable for sampling.\n#\n# We take the entropy contained in the UNIQUE_ID. We hash that variable and\n# take the first integer numbers out of it. Theoretically, it is possible\n# but highly improbable that there are no integers in a hexEncoded sha1 hash.\n# In the very rare event that two integers are not matched (due to only being\n# a-f in all, or all but one positions) 901450 will not be triggered.\n# Leading zeros are not removed from the two-digit random number, and are\n# handled gracefullly by 901450\n\nSecRule TX:sampling_percentage \"@eq 100\" \\\n    \"id:901400,\\\n    phase:1,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    skipAfter:END-SAMPLING\"\n\nSecRule UNIQUE_ID \"@rx ^[a-f]*([0-9])[a-f]*([0-9])\" \\\n    \"id:901410,\\\n    phase:1,\\\n    pass,\\\n    capture,\\\n    t:sha1,t:hexEncode,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'TX.sampling_rnd100=%{TX.1}%{TX.2}'\"\n\n#\n# Sampling decision\n#\n# If a request is allowed to pass without being checked by the CRS, there is no\n# entry in the audit log (for performance reasons), but an error log entry is\n# being written.  If you want to disable the error log entry, then issue the\n# following directive somewhere after the inclusion of the CRS\n# (E.g., RESPONSE-999-EXCEPTIONS.conf).\n#\n# SecRuleUpdateActionById 901450 \"nolog\"\n#\n\n#crs-linter:ignore:pass_nolog\nSecRule TX:sampling_rnd100 \"!@lt %{tx.sampling_percentage}\" \\\n    \"id:901450,\\\n    phase:1,\\\n    pass,\\\n    log,\\\n    noauditlog,\\\n    msg:'Sampling: Disable the rule engine based on sampling_percentage %{TX.sampling_percentage} and random number %{TX.sampling_rnd100}',\\\n    tag:'OWASP_CRS',\\\n    ctl:ruleRemoveByTag=OWASP_CRS,\\\n    ver:'OWASP_CRS/4.30.0'\"\n\nSecMarker \"END-SAMPLING\"\n\n\n#\n# Configuration Plausibility Checks\n#\n\n# Make sure detection paranoia level is not lower than paranoia level\nSecRule TX:detection_paranoia_level \"@lt %{tx.blocking_paranoia_level}\" \\\n    \"id:901500,\\\n    phase:1,\\\n    deny,\\\n    status:500,\\\n    t:none,\\\n    log,\\\n    msg:'Detection paranoia level configured is lower than the paranoia level itself. This is illegal. Blocking request. Aborting',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0'\"\n",
+    "owasp-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n\n# This file is used as an exception mechanism to remove common false positives\n# that may be encountered.\n#\n# Exception for Apache SSL pinger\n#\nSecRule REQUEST_LINE \"@streq GET /\" \\\n    \"id:905100,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-apache',\\\n    tag:'attack-generic',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    chain\"\n    SecRule REMOTE_ADDR \"@ipMatch 127.0.0.1,::1\" \\\n        \"t:none,\\\n        ctl:ruleRemoveByTag=OWASP_CRS,\\\n        ctl:auditEngine=Off\"\n\n#\n# Exception for Apache internal dummy connection\n#\nSecRule REMOTE_ADDR \"@ipMatch 127.0.0.1,::1\" \\\n    \"id:905110,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-apache',\\\n    tag:'attack-generic',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    chain\"\n    SecRule REQUEST_HEADERS:User-Agent \"@endsWith (internal dummy connection)\" \\\n        \"t:none,\\\n        chain\"\n        SecRule REQUEST_LINE \"@rx ^(?:GET /|OPTIONS \\*) HTTP/[12]\\.[01]$\" \\\n            \"t:none,\\\n            ctl:ruleRemoveByTag=OWASP_CRS,\\\n            ctl:auditEngine=Off\"\n",
+    "owasp-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:911011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:911012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ Allowed Request Methods ]=-\n#\n# tx.allowed_methods is defined in the crs-setup.conf file\n#\nSecRule REQUEST_METHOD \"!@within %{tx.allowed_methods}\" \\\n    \"id:911100,\\\n    phase:1,\\\n    block,\\\n    msg:'Method is not allowed by policy',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-generic',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/METHOD-ENFORCEMENT',\\\n    tag:'capec/1000/210/272/220/274',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:911013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:911014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:911015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:911016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:911017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:911018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-911-METHOD-ENFORCEMENT\"\n",
+    "owasp-crs/rules/REQUEST-913-SCANNER-DETECTION.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:913011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-913-SCANNER-DETECTION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:913012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-913-SCANNER-DETECTION\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ Security Scanner Checks ]=-\n#\n# This rule inspects the default User-Agent and Header values sent by\n# various commercial and open source scanners, mostly\n# security / vulnerability scanners.\n#\n# It is based on a curated list of known malicious scanners in widespread use.\n# This list is maintained in scanners-user-agents.data.\n#\n# With CRSv4, the project has given up on keeping track of different categories\n# of scanners and scripting agents, mostly because it's very hard to draw\n# a line between benign, mostly benign and malicious. And because dedicated\n# attackers will change the user agent anyways.\n\nSecRule REQUEST_HEADERS:User-Agent \"@pmFromFile scanners-user-agents.data\" \\\n    \"id:913100,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Found User-Agent associated with security scanner',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-reputation-scanner',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/SCANNER-DETECTION',\\\n    tag:'capec/1000/118/224/541/310',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:913013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-913-SCANNER-DETECTION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:913014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-913-SCANNER-DETECTION\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:913015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-913-SCANNER-DETECTION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:913016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-913-SCANNER-DETECTION\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:913017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-913-SCANNER-DETECTION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:913018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-913-SCANNER-DETECTION\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-913-SCANNER-DETECTION\"\n",
+    "owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# Some protocol violations are common in application layer attacks.\n# Validating HTTP requests eliminates a large number of application layer attacks.\n#\n# The purpose of this rules file is to enforce HTTP RFC requirements that state how\n# the client is supposed to interact with the server.\n# https://www.rfc-editor.org/rfc/rfc9110.html\n\n\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:920011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:920012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# Validate request line against the format specified in the HTTP RFC\n#\n# -=[ Rule Logic ]=-\n#\n# Uses rule negation against the regex for positive security. The regex specifies the proper\n# construction of URI request lines such as:\n#\n#   \"http\" \"://\" authority path-abempty [ \"?\" query ]\n#\n#\n# Regular expression generated from regex-assembly/920100.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 920100\n#\n# -=[ References ]=-\n# https://www.rfc-editor.org/rfc/rfc9110.html#section-4.2.1\n# http://capec.mitre.org/data/definitions/272.html\n#\nSecRule REQUEST_LINE \"!@rx (?i)^(?:connect (?:(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\.?(?::[0-9]+)?|[\\--9A-Z_a-z]+:[0-9]+)|options \\*|[a-z]{3,10}[\\s\\x0b]+(?:[0-9A-Z_a-z]{3,7}?://[\\--9A-Z_a-z]*(?::[0-9]+)?)?/[^#\\?]*(?:\\?[^\\s\\x0b#]*)?(?:#[^\\s\\x0b]*)?)[\\s\\x0b]+[\\.-9A-Z_a-z]+$\" \\\n    \"id:920100,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Invalid HTTP Request Line',\\\n    logdata:'%{request_line}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# Identify multipart/form-data name evasion attempts\n#\n# There are possible impedance mismatches between how\n# ModSecurity interprets multipart file names and how\n# a destination app server such as PHP might parse the\n# Content-Disposition data:\n#\n#            filename-parm := \"filename\" \"=\" value\n#\n# -=[ Rule Logic ]=-\n# These rules check for the existence of the ' \" ; = meta-characters in\n# either the \"name\" (FILES) and \"filename\" (FILES_NAMES) variables.\n# HTML entities may lead to false positives, which is why\n# frequently used ones, such as \"&auml;\", are allowed at PL1.\n#\n# -=[ Targets, characters and html entities ]=-\n#\n# 920120: PL1 : FILES_NAMES, FILES\n#    Disallow ['\\\";=\\\\], except for frequently used HTML entities (see 920120.ra).\n#\n# 920121: PL2 : FILES_NAMES, FILES\n#    Disallow ['\\\";=\\\\]\n#\n# -=[ References ]=-\n# http://www.ietf.org/rfc/rfc2183.txt\n#\n# This rule used to use negative look-behind.\n# See https://github.com/coreruleset/coreruleset/wiki/Technical-Decisions-and-Best-Practices#avoiding-negative-look-behind-in-regular-expressions\n# for an explanation of why it now uses `!@rx` instead to avoid look-around.\n#\n# Regular expression generated from regex-assembly/920120.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 920120\n#\nSecRule FILES|FILES_NAMES \"!@rx (?i)^(?:&(?:(?:[acegilnorsuz]acut|[aeiou]grav|[aino]tild)e|[c-elnr-tz]caron|(?:[cgklnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^\\\"';=\\x5c])*$\" \\\n    \"id:920120,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Attempted multipart/form-data bypass',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# Accept only digits in content length\n#\n# -=[ Rule Logic ]=-\n# This rule uses ModSecurity's rule negation against the regex meaning if the Content-Length header\n# is NOT all digits, then it will match.\n#\n# -=[ References ]=-\n# https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6\n#\nSecRule REQUEST_HEADERS:Content-Length \"!@rx ^\\d+$\" \\\n    \"id:920160,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Content-Length HTTP header is not numeric',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# Do not accept GET or HEAD requests with bodies\n# In RCF-9110, \"A client SHOULD NOT generate content in a HEAD/GET request\n# unless it is made directly to an origin server that has previously indicated\"\n#\n# -=[ Rule Logic ]=-\n# The chained rule matches when:\n# 1) If the request method is GET or HEAD\n# AND\n# 2) Header: Content-Length exists and non-zero\n#\n# -=[ References ]=-\n# https://www.rfc-editor.org/rfc/rfc9110.html#section-9.3.1\n# https://www.rfc-editor.org/rfc/rfc9110.html#section-9.3.2\n#\nSecRule REQUEST_METHOD \"@rx ^(?:GET|HEAD)$\" \\\n    \"id:920170,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'GET or HEAD Request with Body Content',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule REQUEST_HEADERS:Content-Length \"!@rx ^0?$\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# This is a sibling of rule 920170\n#\nSecRule REQUEST_METHOD \"@rx ^(?:GET|HEAD)$\" \\\n    \"id:920171,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'GET or HEAD Request with Transfer-Encoding',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule &REQUEST_HEADERS:Transfer-Encoding \"!@eq 0\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# Require Content-Length or Transfer-Encoding to be provided with\n# every POST request if the protocol version is not HTTP/2 or HTTP/3.\n#\n# In case of HTTP/2, see the RFC7540 8.1 p52:\n# HTTP/2 does not use the Transfer-Encoding: chunked anymore, because\n# the underlying transport protocol is already using data frames with\n# known length.\n#\n# In case of HTTP/3, see the RFC9114 4.1:\n# Transfer codings (see Section 7 of [HTTP/1.1]) are not defined for\n# HTTP/3; the Transfer-Encoding header field MUST NOT be used.\n#\n# -=[ Rule Logic ]=-\n# This chained rule checks if the protocol is not HTTP/2 or HTTP/3,\n# then checks request method is POST, if so, it checks that a\n# Content-Length or Transfer-Encoding headers are also present.\n#\nSecRule REQUEST_PROTOCOL \"!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0\" \\\n    \"id:920180,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'POST without Content-Length and Transfer-Encoding headers',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    chain\"\n    SecRule REQUEST_METHOD \"@streq POST\" \\\n        \"chain\"\n        SecRule &REQUEST_HEADERS:Content-Length \"@eq 0\" \\\n            \"chain\"\n            SecRule &REQUEST_HEADERS:Transfer-Encoding \"@eq 0\" \\\n                \"setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'\"\n\n#\n# As per RFC7230 3.3.2: A sender MUST NOT send a Content-Length\n# header field in any message that contains a Transfer-Encoding header\n# field.\n#\n# Related to 920170, 920171 and 920180.\n#\nSecRule &REQUEST_HEADERS:Transfer-Encoding \"!@eq 0\" \\\n    \"id:920181,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Content-Length and Transfer-Encoding headers present',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    chain\"\n    SecRule &REQUEST_HEADERS:Content-Length \"!@eq 0\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# Range Header Check\n#\n# RFC7233 2.1 p6:\n# \"A byte-range-spec is invalid if the last-byte-pos value is present\n# and less than the first-byte-pos.\"\n#\n# -=[ Rule Logic ]=-\n# This rule compares the first and second byte ranges and flags\n# when the first value is greater than the second.\n#\n# -=[ References ]=-\n# https://datatracker.ietf.org/doc/html/rfc7233\n# https://seclists.org/fulldisclosure/2011/Aug/175\n#\nSecRule REQUEST_HEADERS:Range \"@rx (\\d+)-(\\d+)\" \\\n    \"id:920190,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Range: Invalid Last Byte Value',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    chain\"\n    SecRule TX:2 \"@lt %{tx.1}\" \\\n        \"setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'\"\n\n# The `Request-Range` header is a legacy/non-standard HTTP header that dates back to Netscape\n# Navigator 2-3 and MSIE 3 (~1996-1997). It was never part of any HTTP RFC and has no legitimate\n# use in modern web traffic.\n#\n## Background\n#\n### Origin of `Request-Range`\n#\n# The header originated from an early draft of HTTP byte-range requests before standardization:\n#\n# - **Draft standard**: Defined `Request-Range` header with `multipart/x-byteranges` response type\n# - **HTTP/1.1 (RFC 2068/7233/9110)**: Standardized as `Range` header with `multipart/byteranges` response type\n# - **Netscape Navigator 2-3**: Sent **both** `Range` and `Request-Range` headers (with the same value)\n# - **Netscape Communicator 4+**: Dropped the non-standard `Request-Range` header\n#\n# Rationale for Blocking\n#\n# | Factor                    | Assessment                                                    |\n# |---------------------------|---------------------------------------------------------------|\n# | **Legitimate modern use** | None - header is ~25 years obsolete                           |\n# | **Last known clients**    | Netscape Navigator 2-3, MSIE 3 (1996-1997)                    |\n# | **False positive risk**   | Essentially zero                                              |\n# | **Attack surface**        | Servers may still process it; could bypass `Range`-only rules |\n# | **RFC status**            | Never standardized; not in RFC 9110                           |\nSecRule &REQUEST_HEADERS:Request-Range \"@gt 0\" \\\n    \"id:920660,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Obsolete Request-Range header detected',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'\"\n\n#\n# Broken/Malicious clients often have duplicate or conflicting headers\n# Automated programs and bots often do not obey the HTTP RFC\n#\n# -=[ Rule Logic ]=-\n# This rule inspects the Connection header and looks for duplicates of the\n# keep-alive and close options.\n#\n# -=[ References ]=-\n# https://datatracker.ietf.org/doc/html/rfc7233\n#\nSecRule REQUEST_HEADERS:Connection \"@rx \\b(?:keep-alive|close),\\s?(?:keep-alive|close)\\b\" \\\n    \"id:920210,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Multiple/Conflicting Connection Header Data Found',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# Check UTF encoding\n# We only want to apply this check if UTF-8 encoding is actually used by the site, otherwise\n# it will result in false positives.\n#\n# -=[ Rule Logic ]=-\n# This chained rule first checks to see if the admin has set the TX:CRS_VALIDATE_UTF8_ENCODING\n# variable in the crs-setup.conf file.\n#\nSecRule TX:CRS_VALIDATE_UTF8_ENCODING \"@eq 1\" \\\n    \"id:920250,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'UTF8 Encoding Abuse Attack Attempt',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153/267',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    chain\"\n    SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES \"@validateUtf8Encoding\" \\\n        \"setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# Disallow use of full-width unicode as decoding evasions may be possible.\n#\n# -=[ Rule Logic ]=-\n# This rule looks for full-width encoding by looking for %u followed by 2 'f'\n# characters and then 2 hex characters. It is a vulnerability that affected\n# IIS circa 2007.\n# The rule will trigger on %uXXXX formatted chars that are full or half\n# width, as explained above. This %uXXXX format is passed as a raw parameter\n# and is (seemingly only) accepted by IIS (5.0, 6.0, 7.0, and 8.0). Other\n# webservers will only process unicode chars presented as hex UTF-8 bytes.\n#\n# -=[ References ]=-\n# http://www.kb.cert.org/vuls/id/739224\n# https://www.checkpoint.com/defense/advisories/public/2007/cpai-2007-201.html\n# https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/719\n#\n# Regular expression generated from regex-assembly/920260.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 920260\n#\nSecRule REQUEST_URI|REQUEST_BODY \"@rx (?i)%uff[0-9a-f]{2}\" \\\n    \"id:920260,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Unicode Full/Half Width Abuse Attack Attempt',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-iis',\\\n    tag:'platform-windows',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153/267/72',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# Restrict type of characters sent\n#\n# This is a rule with multiple stricter siblings that grows more\n# restrictive in higher paranoia levels.\n#\n# -=[ Rule Logic ]=-\n# This rule uses the @validateByteRange operator to restrict the request\n# payloads.\n#\n# -=[ Targets and ASCII Ranges ]=-\n#\n# 920270: PL1 : REQUEST_URI, REQUEST_HEADERS, ARGS and ARGS_NAMES\n#       ASCII 1-255 : Full ASCII range without null character\n#\n# 920271: PL2 : REQUEST_URI, REQUEST_HEADERS, ARGS and ARGS_NAMES\n#       ASCII 9,10,13,32-126,128-255 : Full visible ASCII range, tab, newline\n#\n# 920272: PL3 : REQUEST_URI, REQUEST_HEADERS, ARGS, ARGS_NAMES and REQUEST_BODY\n#       ASCII 32-36,38-126 : Visible lower ASCII range without percent symbol\n#\n# 920273: PL4 : ARGS, ARGS_NAMES and REQUEST_BODY\n#       ASCII 38,44-46,48-58,61,65-90,95,97-122\n#       A-Z a-z 0-9 = - _ . , : &\n#\n# 920274: PL4 : REQUEST_HEADERS without User-Agent, Referer, Cookie\n#               and Structured Header booleans\n#       ASCII 32,34,38,42-59,61,65-90,95,97-122\n#       A-Z a-z 0-9 = - _ . , : & \" * + / SPACE\n#\n# REQUEST_URI and REQUEST_HEADERS User-Agent, Referer and Cookie are very hard\n# to restrict beyond the limits in 920272. Structured Header booleans are\n# validated separately in 920275.\n#\n# 920274 generally has few positives. However, it would detect rare attacks\n# on Accept request headers and friends.\n\nSecRule REQUEST_URI_RAW|REQUEST_HEADERS|ARGS|ARGS_NAMES \"@validateByteRange 1-255\" \\\n    \"id:920270,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Invalid character in request (null character)',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# Do not accept requests without common headers.\n# All normal web browsers include Host, User-Agent and Accept headers.\n# Implies either an attacker or a legitimate automation client.\n#\n\n#\n# Missing/Empty Host Header\n#\n# -=[ Rule Logic ]=-\n# These rules will first check to see if a Host header is present.\n# The second check is to see if a Host header exists but is empty.\n#\nSecRule &REQUEST_HEADERS:Host \"@eq 0\" \\\n    \"id:920280,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Request Missing a Host Header',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    skipAfter:END-HOST-CHECK\"\n\n\nSecRule REQUEST_HEADERS:Host \"@rx ^$\" \\\n    \"id:920290,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Empty Host Header',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\nSecMarker \"END-HOST-CHECK\"\n\n\n#\n# Empty Accept Header\n#\n# -=[ Rule Logic ]=-\n# This rule checks if an Accept header exists, but has an empty value.\n# This is only allowed in combination with the OPTIONS method.\n# Additionally, there are some clients sending empty Accept headers.\n# They are covered in another chained rule checking the User-Agent.\n# This technique demands a separate rule to detect an empty\n# Accept header if there is no user agent. This is checked via\n# the separate rule 920311.\n#\n# Exclude some common broken clients sending empty Accept header:\n# \"Business/6.6.1.2 CFNetwork/758.5.3 Darwin/15.6.0\" (CRS issue #515)\n# \"Entreprise/6.5.0.177 CFNetwork/758.4.3 Darwin/15.5.0\" (CRS issue #366)\n#\n# -=[ References ]=-\n# https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/366\n#\n\nSecRule REQUEST_HEADERS:Accept \"@rx ^$\" \\\n    \"id:920310,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Request Has an Empty Accept Header',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'NOTICE',\\\n    chain\"\n    SecRule REQUEST_METHOD \"!@rx ^OPTIONS$\" \\\n        \"chain\"\n        SecRule REQUEST_HEADERS:User-Agent \"!@pm AppleWebKit Android Business Enterprise Entreprise\" \\\n            \"t:none,\\\n            setvar:'tx.inbound_anomaly_score_pl1=+%{tx.notice_anomaly_score}'\"\n\n#\n# This rule is a sibling of rule 920310.\n#\nSecRule REQUEST_HEADERS:Accept \"@rx ^$\" \\\n    \"id:920311,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Request Has an Empty Accept Header',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'NOTICE',\\\n    chain\"\n    SecRule REQUEST_METHOD \"!@rx ^OPTIONS$\" \\\n        \"chain\"\n        SecRule &REQUEST_HEADERS:User-Agent \"@eq 0\" \\\n            \"t:none,\\\n            setvar:'tx.inbound_anomaly_score_pl1=+%{tx.notice_anomaly_score}'\"\n\n\n#\n# Empty User-Agent Header\n#\n# -=[ Rule Logic ]=-\n# This rules will check to see if the User-Agent header is empty.\n#\n# Note that there is a second rule, 920320, which will check for\n# the existence of the User-Agent header.\n#\n\nSecRule REQUEST_HEADERS:User-Agent \"@rx ^$\" \\\n    \"id:920330,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Empty User Agent Header',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'NOTICE',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.notice_anomaly_score}'\"\n\n#\n# Missing Content-Type Header with Request Body (Phase 1)\n#\n# -=[ Rule Logic ]=-\n# This rule checks if the Content-Length header value is non-zero (indicating\n# the client declares a body is present), then verifies the existence of the\n# Content-Type header. While RFCs do not mandate a Content-Type header for all\n# requests, its absence in requests with a body is a strong indication of a\n# non-compliant browser or an evasion attempt.\n#\n# Omitting the Content-Type header allows bypassing the Request Body Processor\n# unless you set the optional tx.enforce_bodyproc_urlencoded variable. This can\n# be used to evade detection by preventing proper parsing of XML, JSON, or other\n# body formats.\n#\n# This rule operates in phase:1 (request headers) based on the Content-Length\n# header declaration. A complementary rule (920640) operates in phase:2 based\n# on the actual REQUEST_BODY_LENGTH to catch cases where the body is present\n# but Content-Length was omitted or set to zero.\n#\n# -=[ References ]=-\n# https://httpwg.org/specs/rfc7231.html#header.content-type\n# https://httpwg.org/specs/rfc7230.html#header.content-length\n\nSecRule REQUEST_HEADERS:Content-Length \"!@rx ^0$\" \\\n    \"id:920340,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Content-Type header missing from request with non-zero Content-Length',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule &REQUEST_HEADERS:Content-Type \"@eq 0\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Check that the host header is not an IP address\n# This is not an HTTP RFC violation but it is indicative of automated client access.\n# Many web-based worms propagate by scanning IP address blocks.\n#\n# -=[ Rule Logic ]=-\n# This rule triggers if the Host header contains an IPv4 or IPv6 address, optionally\n# extended with a port number. In the case of IPv6 we covering the address with square\n# brackets and the address without square brackets.\n#\n# The regex consists of three main parts and said optional group:\n#\n# * IPv4 address\n# * IPv6 address with square brackets\n# * IPv6 address without square brackets\n# * optional colon and port number\n#\n# Please note that the regex does not test the validity of the IP addresses.\n# It just tries to detect a potential IP address.\n#\n# -=[ References ]=-\n# https://technet.microsoft.com/en-us/magazine/2005.01.hackerbasher.aspx\n#\n\nSecRule REQUEST_HEADERS:Host \"@rx (?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)\" \\\n    \"id:920350,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Host header is a numeric IP address',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'\"\n\n\n# In most cases, you should expect a certain volume of each a request on your\n# website. For example, a request with 400 arguments, can be suspicious.\n# This file creates limitations on the request.\n#\n# TODO Look at the rules in this file, and define the sizes you'd like to enforce.\n#           Note that most of the rules are commented out by default.\n#           Uncomment the rules you need\n#\n\n\n#\n# Maximum number of arguments in request limited\n#\nSecRule &TX:MAX_NUM_ARGS \"@eq 1\" \\\n    \"id:920380,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Too many arguments in request',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule &ARGS \"@gt %{tx.max_num_args}\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n## -- Arguments limits --\n#\n# Limit argument name length\n#\nSecRule &TX:ARG_NAME_LENGTH \"@eq 1\" \\\n    \"id:920360,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Argument name too long',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule ARGS_NAMES \"@gt %{tx.arg_name_length}\" \\\n        \"t:none,t:length,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Limit argument value length\n#\n# This rule is also triggered by an Apache Struts Remote Code Execution exploit:\n# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ]\n#\nSecRule &TX:ARG_LENGTH \"@eq 1\" \\\n    \"id:920370,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Argument value too long',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule ARGS \"@gt %{tx.arg_length}\" \\\n        \"t:none,t:length,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Limit arguments total length\n#\nSecRule &TX:TOTAL_ARG_LENGTH \"@eq 1\" \\\n    \"id:920390,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Total arguments size exceeded',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule ARGS_COMBINED_SIZE \"@gt %{tx.total_arg_length}\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -- File upload limits --\n#\n# Individual file size is limited\nSecRule &TX:MAX_FILE_SIZE \"@eq 1\" \\\n    \"id:920400,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Uploaded file size too large',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule REQBODY_PROCESSOR \"@streq MULTIPART\" \\\n        \"chain\"\n        SecRule REQUEST_HEADERS:Content-Length \"@gt %{tx.max_file_size}\" \\\n            \"t:none,\\\n            setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Combined file size is limited\n#\nSecRule &TX:COMBINED_FILE_SIZES \"@eq 1\" \\\n    \"id:920410,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Total uploaded files size too large',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule FILES_COMBINED_SIZE \"@gt %{tx.combined_file_sizes}\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n\n#\n# Restrict which content-types we accept.\n#\n\n# Restrict Content-Type header to established patterns.\n#\n# This provides generic allow list protection against vulnerabilities like\n# Apache Struts Content-Type arbitrary command execution (CVE-2017-5638).\n#\n# Examples of allowed patterns:\n# - text/plain\n# - text/plain; charset=\"UTF-8\"\n# - multipart/form-data; boundary=----WebKitFormBoundary12345\n# - application/soap+xml; charset=utf-8; action=\"urn:localhost-hwh#getQuestions\"\n# - application/*+json\n\nSecRule REQUEST_HEADERS:Content-Type \"!@rx ^[\\w/.+*-]+(?:\\s?;\\s*(?:action|boundary|charset|component|start(?:-info)?|type|version)\\s?=\\s?['\\\"\\w.()+,/:=?<>@#*-]+)*$\" \\\n    \"id:920470,\\\n    phase:1,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Illegal Content-Type header',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# In case Content-Type header can be parsed, check the mime-type against\n# the policy defined in the 'allowed_request_content_type' variable.\n# To change your policy, edit crs-setup.conf and activate rule 900220.\nSecRule REQUEST_HEADERS:Content-Type \"@rx ^[^;\\s]+\" \\\n    \"id:920420,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Request content type is not allowed by policy',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.content_type=|%{tx.0}|',\\\n    chain\"\n    SecRule TX:content_type \"!@within %{tx.allowed_request_content_type}\" \\\n        \"t:lowercase,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# Restrict charset parameter within the content-type header\n#\nSecRule REQUEST_HEADERS:Content-Type \"@rx charset\\s*=\\s*[\\\"']?([^;\\\"'\\s]+)\" \\\n    \"id:920480,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'Request content type charset is not allowed by policy',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.content_type_charset=|%{tx.1}|',\\\n    chain\"\n    SecRule TX:content_type_charset \"!@within %{tx.allowed_request_content_type_charset}\" \\\n        \"t:lowercase,\\\n        ctl:forceRequestBodyVariable=On,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Restrict charset parameter inside content type header to occur max once.\n#\nSecRule REQUEST_HEADERS:Content-Type \"@rx charset.*?charset\" \\\n    \"id:920530,\\\n    phase:1,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Multiple charsets detected in content type header',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Missing Content-Type Header with Request Body (Phase 2)\n#\n# -=[ Rule Logic ]=-\n# This rule checks if the actual REQUEST_BODY_LENGTH is greater than zero\n# (indicating a body was received), then verifies the existence of the\n# Content-Type header. This operates in phase:2 (request body) and complements\n# rule 920340 which checks in phase:1 based on the Content-Length header.\n#\n# This rule catches evasion attempts where:\n# - The Content-Length header was omitted entirely\n# - The Content-Length header was set to zero but a body was sent anyway\n# - The request bypassed phase:1 checks but still contains a body\n#\n# Without a Content-Type header, the Request Body Processor cannot properly\n# parse the body content (XML, JSON, multipart, etc.), allowing attackers to\n# hide malicious payloads from inspection unless tx.enforce_bodyproc_urlencoded\n# is configured.\n#\n# -=[ References ]=-\n# https://httpwg.org/specs/rfc7231.html#header.content-type\n# https://httpwg.org/specs/rfc7230.html#message.body\n#\nSecRule REQUEST_BODY_LENGTH \"@gt 0\" \\\n    \"id:920640,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Content-Type header missing from request with body',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule &REQUEST_HEADERS:Content-Type \"@eq 0\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Restrict protocol versions.\n#\nSecRule REQUEST_PROTOCOL \"!@within %{tx.allowed_http_versions}\" \\\n    \"id:920430,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'HTTP protocol version is not allowed by policy',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Restrict file extension\n#\nSecRule REQUEST_BASENAME \"@rx \\.([^.]+)$\" \\\n    \"id:920440,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'URL file extension is restricted by policy',\\\n    logdata:'%{TX.0}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.extension=.%{tx.1}/',\\\n    chain\"\n    SecRule TX:EXTENSION \"@within %{tx.restricted_extensions}\" \\\n        \"t:none,t:lowercase,\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Backup or \"working\" file extension\n# example: index.php~, /index.php~/foo/\n#\nSecRule REQUEST_FILENAME \"@rx \\.[^.~]+~(?:/.*|)$\" \\\n    \"id:920500,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Attempt to access a backup or working file',\\\n    logdata:'%{TX.0}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Restricted HTTP headers\n#\n# -=[ Rule Logic ]=-\n# The use of certain headers is restricted. They are listed in two variables:\n# - TX.restricted_headers_basic: Known security risks, always forbidden (rule\n#                                920450)\n# - TX.restricted_headers_extended: Possible false positives, possible security\n#                                   risks, may be forbidden (rule 920451)\n#\n# The headers are transformed into lowercase before the match. In order to make\n# sure that only complete header names match, the names in the\n# TX.restricted_headers_* variables are wrapped in slashes. This guarantees that\n# the Range header (which becomes /range/) will not match the restricted\n# /content-range/ header, for example.\n#\n# This is a chained rule, where the first rule fills a set of variables of the\n# form TX.header_name_<RULE_ID>_<HEADER_NAME>. The second rule is then executed\n# for all variables of the form TX.header_name_<RULE_ID>_<HEADER_NAME>.\n#\n# As a consequence of the construction of the rule, the alert message and the\n# alert data will not display the original header name Content-Range, but\n# /content-range/ instead.\n#\n# This rule has a stricter sibling, 920451, which matches against the variable\n# TX.restricted_headers_extended. It handles deprecated headers that are still\n# in use (so false positives are possible, hence unsuitable for blocking in a\n# default paranoia level 1 installation) and headers with possible security\n# risks.\n#\n# -=[ References ]=-\n# https://access.redhat.com/security/vulnerabilities/httpoxy (Header Proxy)\n# https://www.sidechannel.blog/en/http-method-override-what-it-is-and-how-a-pentester-can-use-it\n#\nSecRule REQUEST_HEADERS_NAMES \"@rx ^.*$\" \\\n    \"id:920450,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'HTTP header is restricted by policy (%{MATCHED_VAR})',\\\n    logdata:'Restricted header detected: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.header_name_920450_%{tx.0}=/%{tx.0}/',\\\n    chain\"\n    SecRule TX:/^header_name_920450_/ \"@within %{tx.restricted_headers_basic}\" \\\n        \"setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Rule against CVE-2022-21907\n# This rule blocks Accept-Encoding headers longer than 100 characters.\n# The length of 100 is a heuristic based on the length of values from\n# the RFC (https://datatracker.ietf.org/doc/rfc9110/)\n# and the respective values assigned by IANA\n# (https://www.iana.org/assignments/http-parameters/http-parameters.xml#content-coding).\n# Concatenating all valid values for Accept-Encoding (without q=0.5) resulted in a value of 93:\n# aes128gcm, br, compress, deflate, exi, gzip, identity, pack200-gzip, x-compress, x-gzip, zstd\n#\n# This rule has a stricter sibling: 920521\n#\nSecRule REQUEST_HEADERS:Accept-Encoding \"@gt 100\" \\\n    \"id:920520,\\\n    phase:1,\\\n    block,\\\n    t:none,t:lowercase,t:length,\\\n    msg:'Accept-Encoding header exceeded sensible length',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Restrict response charsets that we allow.\n# The following rules make sure that the response will be in an ASCII-compatible charset that\n# phase 4 rules can properly understand and block.\n#\n\n#\n# Some servers rely on the request Accept header to determine what charset to respond with.\n# This rule restricts these to familiar charsets.\n#\n# Regular expression generated from regex-assembly/920600.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 920600\n#\nSecRule REQUEST_HEADERS:Accept \"!@rx ^(?:(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\\\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\\\"?|(?:[^\\s\\x0b-\\\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\\\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\\\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\\\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\\\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\\\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\\\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*(?:[\\s\\x0b]*,[\\s\\x0b]*(?:(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\\\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\\\"?|(?:[^\\s\\x0b-\\\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\\\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\\\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\\\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\\\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\\\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\\\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*)*$\" \\\n    \"id:920600,\\\n    phase:1,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Illegal Accept header: charset parameter',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# This rule disables `920540` if the JSON body processor is not active. This\n# check is split into a different rule to allow for specific targets to be excluded.\nSecRule REQBODY_PROCESSOR \"@streq JSON\" \\\n    \"id:920539,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    ctl:ruleRemoveById=920540,\\\n    ver:'OWASP_CRS/4.30.0'\"\n\n\n#\n# Unicode character bypass check for non JSON requests\n# See reported bypass in issue:\n# https://github.com/coreruleset/coreruleset/issues/2512\n#\nSecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES \"@rx (?i)\\x5cu[0-9a-f]{4}\" \\\n    \"id:920540,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Possible Unicode character bypass detected',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153/267/72',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Disallow any raw URL fragments. The '#' character should be omitted or URL-encoded.\n# CRS rules generally do not check REQUEST_URI_RAW, but some servers accept the fragment as part of the URL path/query.\n# This creates false negative evasions.\n#\nSecRule REQUEST_URI_RAW \"@contains #\" \\\n    \"id:920610,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Raw (unencoded) fragment in request URI',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# The following rule (920620) checks for the presence of 2 or more request Content-Type headers.\n# Content-Type confusion poses a significant security risk to a web application. It occurs when\n# the server and client have different interpretations of the Content-Type header, leading to\n# miscommunication, potential exploitation and WAF bypass.\n#\n# Using Apache, when multiple Content-Type request headers are received, the server combines them\n# into a single header with the values separated by commas. For example, if a client sends multiple\n# Content-Type headers with values \"application/json\" and \"text/plain\", Apache will combine them\n# into a single header like this: \"Content-Type: application/json, text/plain\".\n#\n# On the other hand, Nginx handles multiple Content-Type headers differently. It preserves each\n# header as a separate entity without combining them. So, if a client sends multiple Content-Type\n# headers, Nginx will keep them separate, maintaining the original values.\n#\nSecRule &REQUEST_HEADERS:Content-Type \"@gt 1\" \\\n    \"id:920620,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Multiple Content-Type Request Headers',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:920013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:920014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n#\n# -=[ Rule Logic ]=-\n#\n# Check the number of range fields in the Range request header.\n#\n# An excessive number of Range request headers can be used to DoS a server.\n# The original CVE proposed an arbitrary upper limit of 5 range fields.\n#\n# Several clients are known to request PDF fields with up to 62 range\n# fields. Therefore the standard rule does not cover PDF files. This is\n# performed in two separate (stricter) siblings of this rule.\n#\n# 920200: PL2: Limit of 5 range header fields for all filenames outside of PDFs\n# 920201: PL2: Limit of 62 range header fields for PDFs\n# 920202: PL4: Limit of 5 range header fields for PDFs\n#\n# -=[ References ]=-\n# https://httpd.apache.org/security/CVE-2011-3192.txt\n\n\nSecRule REQUEST_HEADERS:Range \"@rx ^bytes=(?:(?:\\d+)?-(?:\\d+)?\\s*,?\\s*){6}\" \\\n    \"id:920200,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Range: Too many fields (6 or more)',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    chain\"\n    SecRule REQUEST_BASENAME \"!@endsWith .pdf\" \\\n        \"setvar:'tx.inbound_anomaly_score_pl2=+%{tx.warning_anomaly_score}'\"\n\n#\n# This is a sibling of rule 920200\n#\n\nSecRule REQUEST_BASENAME \"@endsWith .pdf\" \\\n    \"id:920201,\\\n    phase:1,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Range: Too many fields for pdf request (63 or more)',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    chain\"\n    SecRule REQUEST_HEADERS:Range \"@rx ^bytes=(?:(?:\\d+)?-(?:\\d+)?\\s*,?\\s*){63}\" \\\n        \"setvar:'tx.inbound_anomaly_score_pl2=+%{tx.warning_anomaly_score}'\"\n\n\nSecRule ARGS \"@rx %[0-9a-fA-F]{2}\" \\\n    \"id:920230,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Multiple URL Encoding Detected',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153/267/120',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# PL2: This is a stricter sibling of 920270.\n#\nSecRule REQUEST_URI_RAW|REQUEST_HEADERS|ARGS|ARGS_NAMES \"@validateByteRange 9,10,13,32-126,128-255\" \\\n    \"id:920271,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Invalid character in request (non printable characters)',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n\n#\n# Missing User-Agent Header\n#\n# -=[ Rule Logic ]=-\n# This rules will check to see if there is a User-Agent header or not.\n#\n\nSecRule &REQUEST_HEADERS:User-Agent \"@eq 0\" \\\n    \"id:920320,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Missing User Agent Header',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'NOTICE',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.notice_anomaly_score}'\"\n\n\n#\n# PL2: This is a stricter sibling of 920120.\n#\nSecRule FILES_NAMES|FILES \"@rx ['\\\";=\\x5c]\" \\\n    \"id:920121,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Attempted multipart/form-data bypass',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# PL2: This is a stricter sibling of 920450.\n#\nSecRule REQUEST_HEADERS_NAMES \"@rx ^.*$\" \\\n    \"id:920451,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'HTTP header is restricted by policy (%{MATCHED_VAR})',\\\n    logdata:'Restricted header detected: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.header_name_920451_%{tx.0}=/%{tx.0}/',\\\n    chain\"\n    SecRule TX:/^header_name_920451_/ \"@within %{tx.restricted_headers_extended}\" \\\n        \"setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# Check URL encodings\n#\n# -=[ References ]=-\n# http://www.ietf.org/rfc/rfc1738.txt\n#\nSecRule REQBODY_PROCESSOR \"@streq URLENCODED\" \\\n    \"id:920240,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'URL Encoding Abuse Attack Attempt',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153/267/72',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    chain\"\n    SecRule REQUEST_BODY \"@rx \\x25\" \\\n        \"chain\"\n        SecRule REQUEST_BODY \"@validateUrlEncoding\" \\\n            \"setvar:'tx.inbound_anomaly_score_pl2=+%{tx.warning_anomaly_score}'\"\n\n#\n# -=[ Rule 920650: HTTP Method Override via _method Parameter ]=-\n#\n# The _method parameter is used by several web frameworks (Laravel, Rails,\n# Symfony, CakePHP, Express.js, Phoenix, etc.) to override the HTTP method.\n# This allows HTML forms to simulate PUT, PATCH, DELETE requests which are\n# not natively supported by browsers.\n#\n# While this is legitimate framework behavior, it can be abused to:\n# - Bypass WAF rules that inspect based on HTTP method\n# - Bypass SameSite=Lax cookie restrictions for CSRF attacks\n# - Circumvent method-based access control lists\n#\n# This rule detects _method parameter in both query string and request body\n# when it specifies a potentially dangerous method (DELETE, PUT, PATCH, etc.).\n#\n# To allow _method parameter for applications that legitimately use it,\n# set tx.allow_method_override_parameter=1 in crs-setup.conf (see rule 900210).\n#\n# References:\n# - https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions\n# - https://blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html\n# - https://www.sidechannel.blog/en/http-method-override-what-it-is-and-how-a-pentester-can-use-it\n# - https://laravel.com/docs/routing#form-method-spoofing\n# - https://guides.rubyonrails.org/form_helpers.html#how-do-forms-with-patch-put-or-delete-methods-work\n#\nSecRule TX:allow_method_override_parameter \"@eq 0\" \\\n    \"id:920650,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'HTTP method override attempt via _method parameter',\\\n    logdata:'Requested method override: %{ARGS._method}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule REQUEST_METHOD \"!@streq %{ARGS._method}\" \\\n        \"t:none,t:lowercase,\\\n        chain\"\n        SecRule ARGS:_method \"@rx ^[a-z]{3,10}$\" \\\n            \"t:none,t:urlDecodeUni,t:lowercase,\\\n            setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:920015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:920016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n#\n# PL 3: This is a stricter sibling of 920270. Ascii range: Printable characters in the low range\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\nSecRule REQUEST_URI_RAW|REQUEST_HEADERS|ARGS|ARGS_NAMES|REQUEST_BODY \"@validateByteRange 32-36,38-126\" \\\n    \"id:920272,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Invalid character in request (outside of printable chars below ascii 127)',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n#\n# Missing Accept Header\n#\n# This rule has been moved to PL3\n#\n# -=[ Rule Logic ]=-\n# This rule generates a notice if the Accept header is missing.\n# RFC 7231 does not enforce the use of the Accept header.\n# It is just typical browser behavior to send and it can indicate a malicious client.\n#\n# Notice: The rule tries to avoid known false positives by ignoring\n# OPTIONS requests, CONNECT requests, and requests coming from known\n# offending User-Agents via two chained rules.\n# As ModSecurity only reports the match of the last matching rule,\n# the alert is misleading.\n#\nSecRule &REQUEST_HEADERS:Accept \"@eq 0\" \\\n    \"id:920300,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Request Missing an Accept Header',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'NOTICE',\\\n    chain\"\n    SecRule REQUEST_METHOD \"!@rx ^(?:OPTIONS|CONNECT)$\" \\\n        \"chain\"\n        SecRule REQUEST_HEADERS:User-Agent \"!@pm AppleWebKit Android\" \\\n            \"t:none,\\\n            setvar:'tx.inbound_anomaly_score_pl3=+%{tx.notice_anomaly_score}'\"\n\n\n#\n# PL3: The little known x-up-devcap-post-charset request header can be used to submit\n# a request with a different encoding as an alternative to the charset parameter in\n# the Content-Type header. This can be used to circumvent charset restrictions on\n# the Content-Type header in ASP.NET.\n# Note that this only works in combination with a User-Agent prefix.\n#\n# This rule is based on a blog post by Soroush Dalili at\n# https://soroush.me/blog/2019/05/x-up-devcap-post-charset-header-in-aspnet-to-bypass-wafs-again/\n#\nSecRule &REQUEST_HEADERS:x-up-devcap-post-charset \"@ge 1\" \\\n    \"id:920490,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Request header x-up-devcap-post-charset detected in combination with prefix \\'UP\\' to User-Agent',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'language-aspnet',\\\n    tag:'platform-windows',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule REQUEST_HEADERS:User-Agent \"@rx ^(?i)up\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# Cache-Control Request Header allow list\n#\n# -=[ Rule Logic ]=-\n# This rule aims to strictly allow list the Cache-Control request header\n# values and to blocks all violations. This should be useful to intercept\n# \"bad bot\" and tools that impersonate a real browser but with wrong request\n# header setup.\n#\n# The regular expression used on this rule tries to match multiple directives\n# in a single value, for example: \"max-stale=1, max-age=2\". This leads us to\n# use a regular expression that accepts a trailing comma to keep compatibility\n# with all regex engines and not PCRE only. For example: \"max-stale=1, max-age=2, \"\n#\n# Moreover, this regular expression allows duplicate directives sequence like:\n# \"max-stale, max-stale=1, no-cache, no-cache\".\n#\n# Standard Cache-Control directives that can be used by the client:\n#   - max-age=<seconds>\n#   - max-stale[=<seconds>]\n#   - min-fresh=<seconds>\n#   - no-cache\n#   - no-store\n#   - no-transform\n#   - only-if-cached\n#\n# References:\n# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control\n# - https://regex101.com/r/CZ0Hxu/22\n#\nSecRule &REQUEST_HEADERS:Cache-Control \"@gt 0\" \\\n    \"id:920510,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'Invalid Cache-Control request header',\\\n    logdata:'Invalid Cache-Control value in request found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'header-allowlist',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule REQUEST_HEADERS:Cache-Control \"!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:\\s*\\,\\s*|$)){1,7}$\" \\\n        \"setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n#\n# This rule checks for valid Accept-Encoding headers\n#\n# This rule has a less strict sibling: 920520\n#\n# Regular expression generated from regex-assembly/920521.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 920521\n#\nSecRule REQUEST_HEADERS:Accept-Encoding \"!@rx br|compress|deflate|(?:pack200-)?gzip|identity|\\*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)\" \\\n    \"id:920521,\\\n    phase:1,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Illegal Accept-Encoding header',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/255/153',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:920017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:920018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n#\n# This is a stricter sibling of rule 920200\n#\n\nSecRule REQUEST_BASENAME \"@endsWith .pdf\" \\\n    \"id:920202,\\\n    phase:1,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Range: Too many fields for pdf request (6 or more)',\\\n    logdata:'%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/4',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    chain\"\n    SecRule REQUEST_HEADERS:Range \"@rx ^bytes=(?:(?:\\d+)?-(?:\\d+)?\\s*,?\\s*){6}\" \\\n        \"setvar:'tx.inbound_anomaly_score_pl4=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# This is a stricter sibling of 920270.\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\nSecRule ARGS|ARGS_NAMES|REQUEST_BODY \"@validateByteRange 38,44-46,48-58,61,65-90,95,97-122\" \\\n    \"id:920273,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Invalid character in request (outside of very strict set)',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/4',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'\"\n\n#\n# This is a stricter sibling of 920270.\n#\nSecRule REQUEST_HEADERS|!REQUEST_HEADERS:User-Agent|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie|!REQUEST_HEADERS:Sec-Fetch-User|!REQUEST_HEADERS:Sec-CH-UA|!REQUEST_HEADERS:Sec-CH-UA-Mobile \"@validateByteRange 32,34,38,42-59,61,65-90,95,97-122\" \\\n    \"id:920274,\\\n    phase:1,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Invalid character in request headers (outside of very strict set)',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/4',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'\"\n\n#\n# This is a stricter sibling of 920270.\n# The headers of this rule are Structured Header booleans, for which only `?0`,\n# and `?1` are inconspicuous.\n# Structured Header boolean: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-header-structure-19#section-3.3.6\n# Sec-Fetch-User: https://www.w3.org/TR/fetch-metadata/#http-headerdef-sec-fetch-user\n# Sec-CH-UA-Mobile: https://wicg.github.io/ua-client-hints/#sec-ch-ua-mobile\n#\nSecRule REQUEST_HEADERS:Sec-Fetch-User|REQUEST_HEADERS:Sec-CH-UA-Mobile \"!@rx ^(?:\\?[01])?$\" \\\n    \"id:920275,\\\n    phase:1,\\\n    block,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Invalid character in request headers (outside of very strict set)',\\\n    logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/4',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/210/272',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'\"\n\n# -=[ Abnormal Character Escapes ]=-\n#\n# [ Rule Logic ]\n# Consider the following payload: arg=cat+/e\\tc/pa\\ssw\\d\n# Here, \\s and \\d were only used to obfuscate the string passwd and a lot of\n# parsers will silently ignore the non-necessary escapes. The case with \\t is\n# a bit different though, as \\t is a natural escape for the TAB character,\n# so we will avoid this (and \\n, \\r, etc.).\n#\n# This rule aims to detect non-necessary, abnormal escapes. You could say it is\n# a nice way to forbid the backslash character where it is not needed.\n#\n# This is a new rule at paranoia level 4. We expect quite a few false positives\n# for this rule and we will later evaluate if the rule makes any sense at all.\n# The rule is redundant with 920273 and 920274 in PL4. But if the rule proofs\n# to be useful and false positives remain at a reasonable level, then it might\n# be shifted to PL3 in a future release, where it would be the only rule\n# covering the backslash escape.\n#\n# We forbid backslashes followed by a list of basic ascii characters - unless\n# the backslash is preceded by another backslash.\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\nSecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES \"@rx (?:^|[^\\x5c])\\x5c[cdeghijklmpqwxyz123456789]\" \\\n    \"id:920460,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:htmlEntityDecode,t:lowercase,\\\n    msg:'Abnormal character escapes in request',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/4',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\\\n    tag:'capec/1000/153/267',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-920-PROTOCOL-ENFORCEMENT\"\n",
+    "owasp-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:921011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:921012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ HTTP Request Smuggling ]=-\n#\n# [ Rule Logic ]\n# This rule looks for a HTTP / WEBDAV method name in combination with the word http/\\d or a CR/LF character.\n# This would point to an attempt to inject a 2nd request into the request, thus bypassing\n# tests carried out on the primary request.\n#\n# [ References ]\n# http://projects.webappsec.org/HTTP-Request-Smuggling\n#\n# Regular expression generated from regex-assembly/921110.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 921110\n#\nSecRule ARGS_NAMES|ARGS|REQUEST_BODY|XML:/*|XML://@* \"@rx (?:get|p(?:(?:os|u)t|atch|rop(?:find|atch))|head|options|co(?:nnect|py)|delete|trac[ek]|m(?:kcol|ove)|(?:un)?lock)[\\s\\x0b]+[^\\s\\x0b]+[\\s\\x0b]+http/[0-9]\" \\\n    \"id:921110,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:htmlEntityDecode,t:lowercase,\\\n    msg:'HTTP Request Smuggling Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/33',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ HTTP Response Splitting ]=-\n#\n# [ Rule Logic ]\n# These rules look for Carriage Return (CR) %0d and Linefeed (LF) %0a characters.\n# These characters may cause problems if the data is returned in a response header and\n# may be interpreted by an intermediary proxy server and treated as two separate\n# responses.\n#\n# [ References ]\n# http://projects.webappsec.org/HTTP-Response-Splitting\n#\n# Regular expression generated from regex-assembly/921120.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 921120\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx [\\n\\r][^0-9A-Z_a-z]*?(?:content-(?:type|length)|set-cookie|location):[\\s\\x0b]*[0-9A-Z_a-z]\" \\\n    \"id:921120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'HTTP Response Splitting Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/34',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?:\\bhttp/\\d|<(?:html|meta)\\b)\" \\\n    \"id:921130,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:htmlEntityDecode,t:lowercase,\\\n    msg:'HTTP Response Splitting Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/34',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ HTTP Header Injection ]=-\n#\n# [ Rule Logic ]\n# These rules look for Carriage Return (CR) %0d and Linefeed (LF) %0a characters,\n# on their own or in combination with header field names.\n# These characters may cause problems if the data is returned in a response header\n# and interpreted by the client.\n# The rules are similar to rules defending against the HTTP Request Splitting and\n# Request Smuggling rules.\n#\n# [ References ]\n# https://en.wikipedia.org/wiki/HTTP_header_injection\n#\nSecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS \"@rx [\\n\\r]\" \\\n    \"id:921140,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'HTTP Header Injection Attack via headers',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/273',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Detect newlines in argument names.\n# Checking for GET arguments has been moved to paranoia level 2 (921151)\n# in order to mitigate possible false positives.\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\nSecRule ARGS_NAMES \"@rx [\\n\\r]\" \\\n    \"id:921150,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'HTTP Header Injection Attack via payload (CR/LF detected)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/33',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Regular expression generated from regex-assembly/921160.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 921160\n#\nSecRule ARGS_GET_NAMES|ARGS_GET \"@rx [\\n\\r]+(?:[\\s\\x0b]|location|re(?:fresh|mote-(?:ip|addr))|(?:set-)?cookie|forwarded-(?:(?:fo|serve)r|host)|host|via|originating-IP|x-(?:forwarded-(?:(?:fo|serve)r|host)|host|via|remote-(?:ip|addr)|originating-IP))[\\s\\x0b]*:\" \\\n    \"id:921160,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'HTTP Header Injection Attack via payload (CR/LF and header-name detected)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/33',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# -=[ HTTP Splitting ]=-\n#\n# This rule detect \\n or \\r in the REQUEST FILENAME\n# Reference: https://wiki.owasp.org/index.php/Testing_for_HTTP_Splitting/Smuggling_(OTG-INPVAL-016)\n# Reference: https://owasp.org/www-project-web-security-testing-guide/assets/archive/OWASP_Testing_Guide_v4.pdf\n#\nSecRule REQUEST_FILENAME \"@rx [\\n\\r]\" \\\n    \"id:921190,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'HTTP Splitting (CR/LF in request filename detected)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/34',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ LDAP Injection ]=-\n#\n# [ Rule Logic ]\n#\n# This is a rule trying to prevent LDAP injection. It is based on a BlackHat presentation by Alonso Parada\n# and regex writing by Denis Kolegov.\n#\n# [ References ]\n# * https://www.blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper/bh-eu-08-alonso-parada-WP.pdf\n# * https://www.sonarsource.com/blog/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/\n# * https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/276#issue-126581660\n\n# Regular expression generated from regex-assembly/921200.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 921200\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx ^[^!&\\(\\):<>\\|~]*\\)[\\s\\x0b]*(?:\\((?:[^!&\\(\\),<->\\|~]+[<>~]?=|[\\s\\x0b]*[!&\\|][\\s\\x0b]*[\\(\\)]?[\\s\\x0b]*)|\\)[\\s\\x0b]*\\([\\s\\x0b]*[!&\\|][\\s\\x0b]*|[!&\\|][\\s\\x0b]*\\([^!&\\(\\),<->\\|~]+[<>~]?=[^!&\\(\\):<>\\|~]*)\" \\\n    \"id:921200,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:htmlEntityDecode,\\\n    msg:'LDAP Injection Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-ldap',\\\n    tag:'platform-multi',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/152/248/136',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ Body Processor Bypass ]=-\n#\n# [ Rule Logic ]\n#\n# This rule intends to detect content types in the Content-Type header outside of the actual content type declaration.\n# This prevents bypasses targeting the Modsecurity recommended rules controlling which body processor is used.\n#\n# Regular expression generated from regex-assembly/921421.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 921421\n#\nSecRule REQUEST_HEADERS:Content-Type \"@rx ^[^\\s\\x0b,;]+[\\s\\x0b,;].*?(?:application/(?:.+\\+)?json|(?:application/(?:soap\\+)?|text/)xml)\" \\\n    \"id:921421,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'Content-Type header: Dangerous content type outside the mime type declaration',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/255/153',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# Rule against CVE-2021-40438:\n# A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.\n# This issue affects Apache HTTP Server 2.4.48 and earlier.\n# GET /?unix:AAAAAAAAAAAAA|http://coreruleset.org/\n#\nSecRule REQUEST_URI_RAW \"@rx unix:[^|]*\\|\" \\\n    \"id:921240,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:lowercase,\\\n    msg:'mod_proxy attack attempt detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-apache',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/33',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Detection for old V1 cookie format from RFC 2109.\n#\n# This has been abused by the cookie sandwich technique, in diverse issues affecting Apache Tomcat, Python, and maybe others.\n# RFC 6265 deprecated and replaced RFCs 2109 and 2965.\n# It completely removed \"$Version\", meaning user agents and servers no longer use this attribute.\n# See:\n# - https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique\n# - https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-%28v2.x%29#seccookieformat\nSecRule REQUEST_COOKIES:/\\x22?\\x24Version/ \"@streq 1\" \\\n    \"id:921250,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'Old Cookies V1 usage attempt detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/33',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:921013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:921014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n# Detect newlines in GET argument values.\n# These may point to a HTTP header injection attack, but can also sometimes\n# occur in benign query parameters.\n#\n# See also: rule 921140, 921150\n#\nSecRule ARGS_GET \"@rx [\\n\\r]\" \\\n    \"id:921151,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'HTTP Header Injection Attack via payload (CR/LF detected)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220/33',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ Body Processor Bypass ]=-\n#\n# [ Rule Logic ]\n#\n# This rule intends to detect content types in the Content-Type header outside of the actual content type declaration.\n#\n# [ References ]\n# * See rule 921422\n#\n# Regular expression generated from regex-assembly/921422.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 921422\n#\nSecRule REQUEST_HEADERS:Content-Type \"@rx ^[^\\s\\x0b,;]+[\\s\\x0b,;].*?\\b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([\\+/]))\\b\" \\\n    \"id:921422,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'Content-Type header: Dangerous content type outside the mime type declaration',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/255/153',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:921015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:921016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n#\n\n# Forbid Request Range Header\n#\n# It is possible abuse the HTTP Request Range Header to leak error pages\n# and other information in very small snippets.\n# The easiest way to fight this is to deny the use of this header.\n# This is a viable option since the header is only used in rare circumstances\n# anymore.\n# If it is necessary to use it in a certain setup, then it is best to\n# create a rule exclusion for a given URI and this rule ID as a workaround.\n#\nSecRule &REQUEST_HEADERS:Range \"@gt 0\" \\\n    \"id:921230,\\\n    phase:1,\\\n    block,\\\n    t:none,\\\n    msg:'HTTP Range Header detected',\\\n    logdata:'Matched Data: Header %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/210/272/220',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n# -=[ HTTP Parameter Pollution ]=-\n#\n# [ Rule Logic ]\n# These rules look for multiple parameters with the same name.\n# 921170 counts the occurrences of the individual parameters.\n# 921180 checks if any counter is > 1.\n#\n# One HPP attack vector is to try evade signature filters by distributing the\n# attack payload across multiple parameters with the same name.\n# This works as many security devices only apply signatures to individual\n# parameter payloads, however the back-end web application may (in the case\n# of ASP.NET) consolidate all of the payloads into one thus making the\n# attack payload active.\n#\n# This rule is not compatible with application endpoints that accept this\n# kind of input: /foo.php?test[]=1&test[]=2\n#\n# [ References ]\n# http://tacticalwebappsec.blogspot.com/2009/05/http-parameter-pollution.html\n# https://capec.mitre.org/data/definitions/460.html\n#\nSecRule ARGS_NAMES \"@rx .\" \\\n    \"id:921170,\\\n    phase:2,\\\n    pass,\\\n    nolog,\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/152/137/15/460',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'TX.paramcounter_%{MATCHED_VAR_NAME}=+1'\"\n\nSecRule TX:/paramcounter_.*/ \"@gt 1\" \\\n    \"id:921180,\\\n    phase:2,\\\n    block,\\\n    msg:'HTTP Parameter Pollution (%{MATCHED_VAR_NAME})',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/152/137/15/460',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n# -=[ HTTP Parameter Pollution ]=-\n#\n# [ Rule Logic ]\n# Parameter pollution rule 921180 PL3 can by bypassed when a weak backend parameter\n# parser is ignoring additional characters in a parameter array name after the\n# closing of the array.\n# Rule 921210 PL3 prevents this by disallowing arbitrary strings after an array has\n# been closed or inbetween the square brackets in multidimensional arrays.\n# Please note that rule 921210 allows for 2-dimensional, but not for higher dimensional\n# arrays. If these are flagged as attacks, a rule exclusion will have to be\n# deployed; ideally for the parameter(s) in question.\n#\n# [ References ]\n# Private bug bounty in Spring 2022, findings Z05OZUCH.\n#\n# [ Payloads ]\n# * foo[1]a=bar&foo[1]b=<evil> - parameter parsers often cut after the closing of\n#   the array. 921180 PL3 takes the full name, though.\n#   This impediance mismatch allows for bypasses.\n# * foo[1]x[1]=bar&foo[1]x[2]=<evil> - extension of 1; this has the advantage that\n#   the parameter name does end with \"]\" just like a valid array notation.\n#\nSecRule ARGS_NAMES \"@rx (][^\\]]+$|][^\\]]+\\[)\" \\\n    \"id:921210,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    log,\\\n    msg:'HTTP Parameter Pollution after detecting bogus char after parameter array',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/152/137/15/460',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:921017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:921018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n# -=[ HTTP Parameter Pollution ]=-\n#\n# [ Rule Logic ]\n# Parameter pollution rule 921180 PL3 and 921210 PL3 can by bypassed if a\n# weak backend parameter parser ignores parameter array alltogether at\n# cuts parameter names at the first occurrence of the \"[\" character.\n# The rule 921220 PL4 prevents this by disallowing parameter array names.\n#\n# If an application needs parameter array names - which is the case for almost\n# all CMS - this rule should be disabled. Otherwise, be prepared to handle\n# a high volume of exclusions to configure, particularly on administration\n# panels.\n#\n# [ References ]\n# Private bug bounty in Spring 2022, finding 5UXE4RK0.\n#\n# [ Payloads ]\n# * foo[1]=bar&foo[2]=<evil>\n# * foo=bar&foo[1]=<evil>\n# * foo[1]=bar&foo[1]acb]=<evil> - this is an edge case that 921210 PL3 is not\n#   able to catch since the parameter name ends with \"]\".\n#\nSecRule ARGS_NAMES \"@rx \\[\" \\\n    \"id:921220,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    log,\\\n    msg:'HTTP Parameter Pollution possible via array notation',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/4',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/PROTOCOL-ATTACK',\\\n    tag:'capec/1000/152/137/15/460',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'\"\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-921-PROTOCOL-ATTACK\"\n",
+    "owasp-crs/rules/REQUEST-922-MULTIPART-ATTACK.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n# This file is to address the 3UWMWA6W vulnerability.\n# It requires ModSecurity version 2.9.6 or 3.0.8 (or an updated version with backports\n# of the security fixes in these versions) or a compatible engine supporting these changes.\n#\n# If you cannot upgrade ModSecurity, this file will cause ModSecurity to fail to start.\n# In that case, you can temporarily delete this file. However, you will be missing\n# protection from these rules. Therefore, we recommend upgrading your engine instead.\n\n# The rules in this file will be part of the 920 / 921 in the future.\n\n# How do these rules work:\n# * rule 922160 sets the multipart charset counter TX variable to 0\n# * rule 922100 collects each _charset_ value into a separate TX variable\n#   (tx.922100_charset_0, tx.922100_charset_1, etc.) and checks all collected\n#   values against the allowed charset list\n# Note: this is in phase:2 because these are headers that come in the body\nSecRule &MULTIPART_PART_HEADERS:_charset_ \"@gt 0\" \\\n    \"id:922160,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'attack-multipart-header',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/MULTIPART-ATTACK',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.multipart_headers_charset_counter=0'\"\n\nSecRule &MULTIPART_PART_HEADERS:_charset_ \"!@eq 0\" \\\n    \"id:922100,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Multipart content type global _charset_ definition is not allowed by policy',\\\n    logdata:'Matched Data: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-multipart-header',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/MULTIPART-ATTACK',\\\n    tag:'capec/1000/255/153',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule ARGS:_charset_ \"@unconditionalMatch\" \\\n        \"setvar:'tx.922100_charset_%{tx.multipart_headers_charset_counter}=|%{MATCHED_VAR}|',\\\n        setvar:'tx.multipart_headers_charset_counter=+1',\\\n        chain\"\n        SecRule TX:/^922100_charset_/ \"!@within %{tx.allowed_request_content_type_charset}\" \\\n            \"t:lowercase,\\\n            setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Only allow specific charsets same as Rule 920600\n# Note: this is in phase:2 because these are headers that come in the body\n#\n# How do these rules work:\n# * rule 922140 sets the multipart counter TX variable to 0\n#   note that this is why does not matter if more parts have the same name - see rule's test\n# * rule 922150 collects all multipart headers' 'Content-Type' value\n#   eg. 'text/plain; charset=utf-8'\n# * rule 922110 checks all the collected headers' content type and charset\n#\nSecRule &MULTIPART_PART_HEADERS \"@gt 0\" \\\n    \"id:922140,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'attack-multipart-header',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/MULTIPART-ATTACK',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.multipart_headers_content_counter=0'\"\n\nSecRule MULTIPART_PART_HEADERS \"@rx ^content-type\\s*:\\s*(.*)$\" \\\n    \"id:922150,\\\n    phase:2,\\\n    pass,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    nolog,\\\n    tag:'attack-multipart-header',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/MULTIPART-ATTACK',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.multipart_headers_content_types_%{tx.multipart_headers_content_counter}=%{tx.1}',\\\n    setvar:'tx.multipart_headers_content_counter=+1'\"\n\n# Regular expression generated from regex-assembly/922110.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 922110\nSecRule TX:/MULTIPART_HEADERS_CONTENT_TYPES_*/ \"!@rx ^(?:(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\\\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\\\"?|(?:[^\\s\\x0b-\\\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\\\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\\\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\\\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\\\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\\\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\\\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*(?:[\\s\\x0b]*,[\\s\\x0b]*(?:(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\\\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\\\"?|(?:[^\\s\\x0b-\\\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\\\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\\\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\\\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\\\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\\\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\\\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*)*$\" \\\n    \"id:922110,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'Illegal MIME Multipart Header content-type: charset parameter',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within Content-Type multipart form',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-multipart-header',\\\n    tag:'attack-protocol',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/MULTIPART-ATTACK',\\\n    tag:'capec/272/220',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Content-Transfer-Encoding was deprecated by rfc7578 in 2015 and should not be used (see: https://www.rfc-editor.org/rfc/rfc7578#section-4.7)\n# Note: this is in phase:2 because these are headers that come in the body\nSecRule MULTIPART_PART_HEADERS \"@rx content-transfer-encoding:(.*)\" \\\n    \"id:922120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'Content-Transfer-Encoding was deprecated by rfc7578 in 2015 and should not be used',\\\n    logdata:'Matched Data: %{TX.0}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-multipart-header',\\\n    tag:'attack-deprecated-header',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/MULTIPART-ATTACK',\\\n    tag:'capec/272/220',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Multipart header names can't contain any characters outside of range 33 and 126,\n# excluding 58 (':') which is the separator.\n# RFC 2045 refers RFC 822 about the header syntax.\n# Note: this is in phase:2 because these are headers that come in the body\nSecRule MULTIPART_PART_HEADERS \"@rx [^\\x21-\\x7E][\\x21-\\x39\\x3B-\\x7E]*:\" \\\n    \"id:922130,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'Multipart header contains characters outside of valid range',\\\n    logdata:'Matched Data: %{TX.0}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-multipart-header',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/MULTIPART-ATTACK',\\\n    tag:'capec/272/220',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n",
+    "owasp-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:930011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:930012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ Directory Traversal Attacks ]=-\n#\n# Ref: https://github.com/wireghoul/dotdotpwn\n#\n# [ Encoded /../ Payloads ]\n#\n# Regular expression generated from regex-assembly/930100.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 930100\n#\nSecRule REQUEST_URI_RAW|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:/*|XML://@* \"@rx (?i)(?:[/\\x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[56]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:\\.(?:%0[01]|\\?)?|\\?\\.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:\\.|%[256aef]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/\\x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[56]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))\" \\\n    \"id:930100,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Path Traversal Attack (/../) or (/.../)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-lfi',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-LFI',\\\n    tag:'capec/1000/255/153/126',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}'\"\n\n#\n# [ Decoded /../ or /..;/ Payloads ]\n#\n# To prevent '..' from triggering, the regexp is split into two parts:\n# - ../\n# - /..\n# OR\n# - .../\n# - /...\n#\n# Semicolon added to prevent path traversal via reverse proxy mapping '/..;/' (Tomcat)\n#\n# Regular expression generated from regex-assembly/930110.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 930110\n#\nSecRule REQUEST_URI_RAW|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:/*|XML://@* \"@rx (?:^|[/;\\x5c])\\.{2,3}[/;\\x5c]\" \\\n    \"id:930110,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,t:cmdLine,\\\n    msg:'Path Traversal Attack (/../) or (/.../)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-lfi',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-LFI',\\\n    tag:'capec/1000/255/153/126',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    multiMatch,\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ OS File Access ]=-\n#\n# We check for OS file access with the help of a local file with OS files data.\n#\n# Ref: https://github.com/lightos/Panoptic/blob/master/cases.xml\n#\n# If you wonder where support for Google OAuth2 has gone, see:\n# https://github.com/coreruleset/google-oauth2-plugin\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@pmFromFile lfi-os-files.data\" \\\n    \"id:930120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,\\\n    msg:'OS File Access Attempt',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-lfi',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-LFI',\\\n    tag:'capec/1000/255/153/126',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ Restricted File Access ]=-\n#\n# Detects attempts to retrieve application source code, metadata,\n# credentials and version control history possibly reachable in a web root.\n#\nSecRule REQUEST_FILENAME \"@pmFromFile restricted-files.data\" \\\n    \"id:930130,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,\\\n    msg:'Restricted File Access Attempt',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-lfi',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-LFI',\\\n    tag:'capec/1000/255/153/126',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ Restricted AI Artifact Access ]=-\n#\n# Detects attempts to access AI coding assistant configuration directories and\n# proprietary config files. These paths can contain API keys, MCP server definitions,\n# and credentials reachable if in a web root.\n#\n# Ref: https://github.com/coreruleset/coreruleset/issues/4474\n#\nSecRule REQUEST_FILENAME \"@pmFromFile ai-critical-artifacts.data\" \\\n    \"id:930140,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,\\\n    msg:'Restricted File Access Attempt: AI Coding Assistant Artifact',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-lfi',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-LFI',\\\n    tag:'capec/1000/255/153/126',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:930013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:930014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n#\n# -=[ OS File Access ]=-\n#\n# This is a stricter sibling of rule 930120.\n# This stricter sibling checks for OS file data in request headers referer and user-agent.\n# We check for OS file access with the help of a local file with OS files data.\n#\n# Ref: https://github.com/lightos/Panoptic/blob/master/cases.xml\n#\nSecRule REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent \"@pmFromFile lfi-os-files.data\" \\\n    \"id:930121,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,\\\n    msg:'OS File Access Attempt in REQUEST_HEADERS',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-lfi',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-LFI',\\\n    tag:'capec/1000/255/153/126',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:930015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:930016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:930017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:930018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-930-APPLICATION-ATTACK-LFI\"\n",
+    "owasp-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n#\n# RFI Attacks\n#\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:931011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:931012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n# -=[ Rule Logic ]=-\n# These rules look for common types of Remote File Inclusion (RFI) attack methods.\n#\t- URL Contains an IP Address\n#\t- The PHP \"include()\" Function\n#\t- RFI Data Ends with Question Mark(s) (?)\n#\t- RFI Host Doesn't Match Local Host\n#\n# Note: brackets around IPv6 literals are mandatory per RFC 2732,\n# but have been made optional here - just in case - to account for rare\n# non-standard implementations or parsing inconsistencies.\n#\n# -=[ References ]=-\n# http://projects.webappsec.org/Remote-File-Inclusion\n# http://tacticalwebappsec.blogspot.com/2009/06/generic-remote-file-inclusion-attack.html\n# https://datatracker.ietf.org/doc/html/rfc2732\n#\n# Regular expression generated from regex-assembly/931100.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 931100\n#\nSecRule ARGS|XML:/*|XML://@* \"@rx (?i)^(f(?:ile|tps?)|https?|ssh)://(?:\\[?[0-9a-f]+:[0-:a-f]+\\]?|[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})\" \\\n    \"id:931100,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rfi',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RFI',\\\n    tag:'capec/1000/152/175/253',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/931110.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 931110\n#\nSecRule QUERY_STRING|REQUEST_BODY \"@rx (?i)(?:\\binclude[\\s\\x0b]*\\([^\\)]*|mosConfig_absolute_path|(?:_(?:CONF\\[path|SERVER\\[DOCUMENT_ROOT)|path\\[docroot|config\\[root_dir)\\]|GALLERY_BASEDIR|appserv_root)=(?:f(?:ile|tps?)|https?)://\" \\\n    \"id:931110,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rfi',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RFI',\\\n    tag:'capec/1000/152/175/253',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\nSecRule ARGS \"@rx ^(?i:file|ftps?|https?).*?\\?+$\" \\\n    \"id:931120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character (?)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rfi',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RFI',\\\n    tag:'capec/1000/152/175/253',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:931013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:931014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n# url:file:// can be used by Java applications using\n# org.apache.commons.io.IOUtils to access internal files, so this has been added\n#\n# This rule has one (stricter) sibling: 931131.\n# That rule applies the same regular expression to the request filename in phase 1.\n#\n# Regular expression generated from regex-assembly/931130.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 931130\n#\nSecRule ARGS \"@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:\\+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://?(?:[^@]+@)?([^/]*)\" \\\n    \"id:931130,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link',\\\n    logdata:'Matched Data: %{TX.0} found within %{tx.original_target}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rfi',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RFI',\\\n    tag:'capec/1000/152/175/253',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rfi_parameter_%{MATCHED_VAR_NAME}=.%{tx.1}',\\\n    setvar:'tx.original_target=%{MATCHED_VAR_NAME}',\\\n    chain\"\n    SecRule TX:/rfi_parameter_.*/ \"!@endsWith .%{request_headers.host}\" \\\n        \"setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This is a sibling of 931130.\n#\n# Regular expression generated from regex-assembly/931131.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 931131\n#\nSecRule REQUEST_FILENAME \"@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:\\+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)\" \\\n    \"id:931131,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Possible Remote File Inclusion (RFI) Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rfi',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RFI',\\\n    tag:'capec/1000/152/175/253',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:931015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:931016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:931017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:931018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-931-APPLICATION-ATTACK-RFI\"\n",
+    "owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:932011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:932012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n\n# [ Unix command injection ]\n#\n# This rule detects Unix command injections.\n# A command injection takes a form such as:\n#\n#   foo.jpg;uname -a\n#   foo.jpg||uname -a\n#\n# The vulnerability exists when an application executes a shell command\n# without proper input escaping/validation.\n#\n# This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit:\n# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ]\n#\n# To prevent false positives, we look for a 'starting sequence' that\n# precedes a command in shell syntax, such as: ; | & $( ` <( >(\n# Anatomy of the regexp with examples of patterns caught:\n#\n# 1. Starting tokens\n#\n# ;        ;ifconfig\n# \\{       {ifconfig}\n# \\|       |ifconfig\n# \\|\\|     ||ifconfig\n# &        &ifconfig\n# &&       &&ifconfig\n# \\n       ;\\nifconfig\n# \\r       ;\\rifconfig\n# \\$\\(     $(ifconfig)\n# \\$\\(\\(   $((ifconfig))\n# \\$\\[     $[2+2]\n# `        `ifconfig`\n# \\${      ${ifconfig}\n# <\\(      <( ifconfig )\n# >\\(      >( ifconfig )\n# \\(\\s*\\)  a() ( ifconfig; ); a\n#\n# 2. Command prefixes\n#\n# {        { ifconfig }\n# \\s*\\(\\s* ( ifconfig )\n# \\w+=(?:[^\\s]*|\\$.*|\\$.*|<.*|>.*|\\'.*\\'|\\\".*\\\")\\s+   VARNAME=xyz ifconfig\n# !\\s*     ! ifconfig\n# \\$       $ifconfig\n#\n# 3. Quoting\n#\n# '        'ifconfig'\n# \\\"       \"ifconfig\"\n#\n# 4. Paths\n#\n# [\\?\\*\\[\\]\\(\\)\\-\\|+\\w'\\\"\\./\\x5c]+/   /sbin/ifconfig, /s?in/./ifconfig, /s[a-b]in/ifconfig etc.\n#\n# An effort was made to combat evasions by shell quoting (e.g. 'ls',\n# 'l'\"s\", \\l\\s are all valid). ModSecurity has a t:cmdLine\n# transformation built-in to deal with this, but unfortunately, it\n# replaces ';' characters and lowercases the payload, which is less\n# useful for this case. However, emulating the transformation makes\n# the regexp more complex.\n#\n# This is the base Rule to prevent Unix Command Injection\n# for prefix + two and three characters.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932230.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932230\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:(?:7[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[arx][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|(?:b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z|c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[89][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?9|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?f|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|q[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|f[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:g|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b|j[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:j[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s|q)|[kz][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b|k[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?g|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|x[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z)|r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|(?:s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?h|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n)|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:3[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m|c)|x[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:x[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|z)|y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|l[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:4[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?))[\\\"']?[\\s\\x0b&\\),<>\\|].*|a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?-[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?(?:[&\\),<>\\|]{1,10}|(?:[\\-\\.0-9A-Z_a-z][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?){1,10}[\\s\\x0b&\\),<>\\|\\}]{1,10})|r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?j[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*)|g[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?(?:[&\\),<>\\|]{1,10}|(?:[\\-\\.0-9A-Z_a-z][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?){1,10}[\\s\\x0b&\\),<>\\|\\}]{1,10})|(?:d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b|[hr][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?g)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*))\\b\" \\\n    \"id:932230,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix Command Injection (2-3 chars)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix command injection ]\n#\n# This is the base Rule to prevent Unix Command Injection\n# for prefix + more than 4 characters.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932235.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932235\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:dd(?:group|user)|getty|(?:l(?:ias|pine)|tobm|xel)[\\\"']?[\\s\\x0b&\\),<>\\|]|nsible|p(?:parmor_[^\\s\\x0b]{1,10}\\b|t(?:-get|itude[\\\"']?[\\s\\x0b&\\),<>\\|]))|r(?:ch[\\\"']?[\\s\\x0b&\\),<>\\|]|ia2c|j(?:-register|disp))|s(?:cii(?:-xfr|85)|pell)|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:a(?:s(?:e(?:32|64[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\\\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\\\"']?[\\s\\x0b&\\),<>\\|])|tch[\\\"']?[\\s\\x0b&\\),<>\\|])|lkid[\\\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\\\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\\\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\\\"']?[\\s\\x0b&\\),<>\\|])|z(?:c(?:at|mp)[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\\\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|a(?:(?:ncel|psh)[\\\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\\\"']?[\\s\\x0b&\\),<>\\|]))|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\\\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\\\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\\\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|p(?:(?:an|io)[\\\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|r(?:ash[\\\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|tab))|s(?:cli[\\\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:psfilter|rl[\\\"']?[\\s\\x0b&\\),<>\\|]))|d(?:(?:ash|i(?:alog|ff)|vips)[\\\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\\\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\\\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|e(?:2fsck|asy_install|(?:cho|fax|grep|macs|sac|val)[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:d(?:if|sw)[\\\"']?[\\s\\x0b&\\),<>\\|]|v-update)|x(?:(?:ec|p(?:and|(?:ec|or)t|r))[\\\"']?[\\s\\x0b&\\),<>\\|]|iftool))|f(?:acter|d(?:(?:find|isk)[\\\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|(?:etch|grep|lock|unction)[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:le(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|test)|n(?:d(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|con)|ger[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:sh|xfiles)[\\\"']?[\\s\\x0b&\\),<>\\|])|o(?:ld[\\\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\\\"']?[\\s\\x0b&\\),<>\\|])|tp(?:stats|who))|g(?:(?:awk|core|i(?:mp|nsh)|z(?:cat|exe|ip))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:n(?:homedircon|i(?:e[\\\"']?[\\s\\x0b&\\),<>\\|]|soimage))|t(?:cap|enforce|facl[\\\"']?[\\s\\x0b&\\),<>\\|]|sebool))|hc(?:-[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:cat|ep|ubby)[\\\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:ash|i(?:ghlight|story))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\\\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\\\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:conv[\\\"']?[\\s\\x0b&\\),<>\\|]|f(?:config|top[\\\"']?[\\s\\x0b&\\),<>\\|])|n(?:dexcon|stall[\\\"']?[\\s\\x0b&\\),<>\\|])|onice|p(?:6?tables|config|p(?:eveprinter|find|tool))|spell)|j(?:(?:ava|exec)[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:in[\\\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:ill(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\\\"']?[\\s\\x0b&\\),<>\\|]|sshell)|l(?:(?:a(?:st(?:comm|log(?:in)?)|tex)|ynx)[\\\"']?[\\s\\x0b&\\),<>\\|]|dconfig|ess(?:echo|(?:fil|pip)e)|ftp(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ad_policy|cate|ok)[\\\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)[\\\"']?[\\s\\x0b&\\),<>\\|]|b_release)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|at)|c(?:at|mp)[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore)))|m(?:a(?:(?:il[qx]?|ke|wk)[\\\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|k(?:(?:dir|nod)[\\\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\\\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[\\\"']?[\\s\\x0b&\\),<>\\|]|ysql(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:(?:a(?:no|sm|wk)|ice|map|o(?:de|hup)|ping|roff)[\\\"']?[\\s\\x0b&\\),<>\\|]|c(?:\\.(?:openbsd|traditional)|at[\\\"']?[\\s\\x0b&\\),<>\\|])|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan)|wrole[\\\"']?[\\s\\x0b&\\),<>\\|])|s(?:enter|lookup|tat[\\\"']?[\\s\\x0b&\\),<>\\|]))|o(?:ctave[\\\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\\\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:cman|rted|tch)[\\\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\\\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:2mb|3(?:\\.|[\\\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\\\"']?[\\s\\x0b&\\),<>\\|])|er(?:(?:f|ms)[\\\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\\\"']?[\\s\\x0b&\\),<>\\|]|sh))|(?:(?:ft|gre)p|u(?:ppet|shd))[\\\"']?[\\s\\x0b&\\),<>\\|]|hp(?:-cgi|[57][\\\"']?[\\s\\x0b&\\),<>\\|])|i(?:co(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|nv)|dstat|(?:gz|ng6?)[\\\"']?[\\s\\x0b&\\),<>\\|])|k(?:exec|g_?info|ill[\\\"']?[\\s\\x0b&\\),<>\\|])|o(?:licygentool|pd[\\\"']?[\\s\\x0b&\\),<>\\|])|rint(?:env|f[\\\"']?[\\s\\x0b&\\),<>\\|])|s(?:(?:ed|ql)[\\\"']?[\\s\\x0b&\\),<>\\|]|ftp)|tar(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|grep)|y(?:3?versions|thon(?:[23]|[^\\s\\x0b]{1,10}\\b)))|r(?:(?:ak[eu]|bash|nano|oute|vi(?:ew|m))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:a(?:delf|lpath)|(?:(?:boo|dcarpe)t|name)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:eat[\\\"']?[\\s\\x0b&\\),<>\\|]|l(?:ace[\\\"']?[\\s\\x0b&\\),<>\\|]|con))|st(?:ic|orecon(?:_xattr|d)?))|l(?:ogin|wrap)|m(?:dir[\\\"']?[\\s\\x0b&\\),<>\\|]|t-(?:dump|tar)|user)|pm(?:db[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|sync(?:-ssl|[\\\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|_init|c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\\\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:a(?:ndbox|sh)|c(?:hed|r(?:een|ipt))|diff|(?:ft|na)p|l(?:eep|sh)|plit)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\\\"']?[\\s\\x0b&\\),<>\\|])|diff|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|(?:ndmail|rvice)[\\\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus)|t(?:arch|cap|en(?:force|v)|f(?:acl[\\\"']?[\\s\\x0b&\\),<>\\|]|iles)|s(?:ebool|id)))|h(?:\\.distrib|(?:red|u(?:f|tdown))[\\\"']?[\\s\\x0b&\\),<>\\|])|mbclient|o(?:(?:ca|r)t[\\\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|sh(?:-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass)|t(?:a(?:rt-stop-daemon|t[\\\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\\\"']?[\\s\\x0b&\\),<>\\|]))|udo(?:-rs|[\\\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay)|vn(?:a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:ilf?[\\\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|set))|c(?:l?sh[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|elnet|(?:ftp|mux)[\\\"']?[\\s\\x0b&\\),<>\\|]|ime(?:datectl|out[\\\"']?[\\s\\x0b&\\),<>\\|])|o(?:gglesebool|uch[\\\"']?[\\s\\x0b&\\),<>\\|])|r(?:a(?:ceroute6?|p[\\\"']?[\\s\\x0b&\\),<>\\|])|off[\\\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:conv|limit)[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\\\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\\\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\\\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\\\"']?[\\s\\x0b&\\),<>\\|]|std))|p(?:2date[\\\"']?[\\s\\x0b&\\),<>\\|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:(?:[ep]w|gr|rsh)[\\\"']?[\\s\\x0b&\\),<>\\|]|mdiff|sudo(?:-rs)?)|olatility[\\\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:all|get)[\\\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\\\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\\\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:args|pad|term)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:latex|tex[\\\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\\\"']?[\\s\\x0b&\\),<>\\|])|z(?:c(?:at|mp)[\\\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\\\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more))|z(?:athura|(?:c(?:at|mp)|diff|grep|less|run)[\\\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|mo(?:dload|re[\\\"']?[\\s\\x0b&\\),<>\\|])|s(?:oelim|td(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|ypper))\" \\\n    \"id:932235,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix Command Injection (command without evasion)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Windows PowerShell, cmdlets and options ]\n#\n# Detect some common PowerShell commands, cmdlets and options.\n# These commands should be relatively uncommon in normal text, but\n# potentially useful for code injection.\n#\n# If you are not running Windows, it is safe to disable this rule.\n#\n# https://learn.microsoft.com/en-us/previous-versions/technet-magazine/ff714569(v=msdn.10)\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@pmFromFile windows-powershell-commands.data\" \\\n    \"id:932120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,\\\n    msg:'Remote Command Execution: Windows PowerShell Command Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'language-powershell',\\\n    tag:'platform-windows',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Windows Powershell cmdlet aliases ]\n#\n# Attempts to detect aliases of the common PowerShell cmdlets in windows-powershell-commands.data\n# If you are not running Windows, it is safe to disable this rule.\n#\n# There are other aliases which are similar to Unix, but they are properly handled by rule 932105\n#\n# Regular expression generated from regex-assembly/932125.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932125\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\\\"'\\(,@]*(?:[\\\"'\\.-9A-Z_a-z]+/|(?:[\\\"'\\x5c\\^]*[0-9A-Z_a-z][\\\"'\\x5c\\^]*:.*|[ \\\"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\\\"\\^]*(?:(?:a[\\\"\\^]*(?:c|s[\\\"\\^]*n[\\\"\\^]*p)|e[\\\"\\^]*(?:b[\\\"\\^]*p|p[\\\"\\^]*(?:a[\\\"\\^]*l|c[\\\"\\^]*s[\\\"\\^]*v|s[\\\"\\^]*n)|[tx][\\\"\\^]*s[\\\"\\^]*n)|f[\\\"\\^]*(?:[cltw]|o[\\\"\\^]*r[\\\"\\^]*e[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*h)|i[\\\"\\^]*(?:[cr][\\\"\\^]*m|e[\\\"\\^]*x|h[\\\"\\^]*y|i|p[\\\"\\^]*(?:a[\\\"\\^]*l|c[\\\"\\^]*s[\\\"\\^]*v|m[\\\"\\^]*o|s[\\\"\\^]*n)|s[\\\"\\^]*e|w[\\\"\\^]*(?:m[\\\"\\^]*i|r))|m[\\\"\\^]*(?:[dpv]|o[\\\"\\^]*u[\\\"\\^]*n[\\\"\\^]*t)|o[\\\"\\^]*g[\\\"\\^]*v|p[\\\"\\^]*(?:o[\\\"\\^]*p|u[\\\"\\^]*s[\\\"\\^]*h)[\\\"\\^]*d|t[\\\"\\^]*r[\\\"\\^]*c[\\\"\\^]*m|w[\\\"\\^]*j[\\\"\\^]*b)[\\\"\\^]*[\\s\\x0b,\\./;<>].*|c[\\\"\\^]*(?:(?:(?:d|h[\\\"\\^]*d[\\\"\\^]*i[\\\"\\^]*r|v[\\\"\\^]*p[\\\"\\^]*a)[\\\"\\^]*|p[\\\"\\^]*(?:[ip][\\\"\\^]*)?)[\\s\\x0b,\\./;<>].*|l[\\\"\\^]*(?:(?:[cipv]|h[\\\"\\^]*y)[\\\"\\^]*[\\s\\x0b,\\./;<>].*|s)|n[\\\"\\^]*s[\\\"\\^]*n)|d[\\\"\\^]*(?:(?:b[\\\"\\^]*p|e[\\\"\\^]*l|i[\\\"\\^]*(?:f[\\\"\\^]*f|r))[\\\"\\^]*[\\s\\x0b,\\./;<>].*|n[\\\"\\^]*s[\\\"\\^]*n)|g[\\\"\\^]*(?:(?:(?:(?:a[\\\"\\^]*)?l|b[\\\"\\^]*p|d[\\\"\\^]*r|h[\\\"\\^]*y|(?:w[\\\"\\^]*m[\\\"\\^]*)?i|j[\\\"\\^]*b|[uv])[\\\"\\^]*|c[\\\"\\^]*(?:[ims][\\\"\\^]*)?|m[\\\"\\^]*(?:o[\\\"\\^]*)?|s[\\\"\\^]*(?:n[\\\"\\^]*(?:p[\\\"\\^]*)?|v[\\\"\\^]*))[\\s\\x0b,\\./;<>].*|e[\\\"\\^]*r[\\\"\\^]*r|p[\\\"\\^]*(?:(?:s[\\\"\\^]*)?[\\s\\x0b,\\./;<>].*|v))|l[\\\"\\^]*s|n[\\\"\\^]*(?:(?:a[\\\"\\^]*l|d[\\\"\\^]*r|[iv]|m[\\\"\\^]*o|s[\\\"\\^]*n)[\\\"\\^]*[\\s\\x0b,\\./;<>].*|p[\\\"\\^]*s[\\\"\\^]*s[\\\"\\^]*c)|r[\\\"\\^]*(?:(?:(?:(?:b[\\\"\\^]*)?p|e[\\\"\\^]*n|(?:w[\\\"\\^]*m[\\\"\\^]*)?i|j[\\\"\\^]*b|n[\\\"\\^]*[ip])[\\\"\\^]*|d[\\\"\\^]*(?:r[\\\"\\^]*)?|m[\\\"\\^]*(?:(?:d[\\\"\\^]*i[\\\"\\^]*r|o)[\\\"\\^]*)?|s[\\\"\\^]*n[\\\"\\^]*(?:p[\\\"\\^]*)?|v[\\\"\\^]*(?:p[\\\"\\^]*a[\\\"\\^]*)?)[\\s\\x0b,\\./;<>].*|c[\\\"\\^]*(?:j[\\\"\\^]*b[\\\"\\^]*[\\s\\x0b,\\./;<>].*|s[\\\"\\^]*n)|u[\\\"\\^]*j[\\\"\\^]*b)|s[\\\"\\^]*(?:(?:(?:a[\\\"\\^]*(?:j[\\\"\\^]*b|l|p[\\\"\\^]*s|s[\\\"\\^]*v)|b[\\\"\\^]*p|[cv]|w[\\\"\\^]*m[\\\"\\^]*i)[\\\"\\^]*|l[\\\"\\^]*(?:s[\\\"\\^]*)?|p[\\\"\\^]*(?:(?:j[\\\"\\^]*b|p[\\\"\\^]*s|s[\\\"\\^]*v)[\\\"\\^]*)?)[\\s\\x0b,\\./;<>].*|h[\\\"\\^]*c[\\\"\\^]*m|u[\\\"\\^]*j[\\\"\\^]*b))(?:\\.[\\\"\\^]*[0-9A-Z_a-z]+)?\\b\" \\\n    \"id:932125,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Windows Powershell Alias Command Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-windows',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Unix shell expressions ]\n#\n# Detects the following patterns which are common in Unix shell scripts\n# and one-liners:\n#\n# $(foo)    Command substitution\n# ${foo}    Parameter expansion\n# <(foo)    Process substitution\n# >(foo)    Process substitution\n# $((foo))  Arithmetic expansion\n# $[2+2]    Arithmetic expansion\n# /e[t]c    Shell glob expression to bypass wordlists\n#\n# This rule has a stricter sibling: 932131 (PL2) that applies the same regex to User-Agent and Referer\n#\n# This rule is essential to defend against the Log4J / Log4Shell attacks (see also rule 944150)\n#\n# Regular expression generated from regex-assembly/932130.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932130\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\$(?:\\((?:[^\\)]+|\\([^\\)]+\\))\\)|\\{[^\\}]+\\}|\\[[^\\]]*\\])|[<>]\\([^\\)]+\\)|/[0-9A-Z_a-z]*\\[[^\\]]+\\]\" \\\n    \"id:932130,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,\\\n    msg:'Remote Command Execution: Unix Shell Expression Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Windows FOR, IF commands ]\n#\n# This rule detects Windows command shell FOR and IF commands.\n# If you are not running Windows, it is safe to disable this rule.\n#\n# Examples:\n#\n#   FOR              %a IN (set) DO\n#   FOR /D           %a IN (dirs) DO\n#   FOR /F \"options\" %a IN (text|\"text\") DO\n#   FOR /L           %a IN (start,step,end) DO\n#   FOR /R C:\\dir    %A IN (set) DO\n#\n#   IF [/I] [NOT] EXIST filename | DEFINED define | ERRORLEVEL n | CMDEXTVERSION n\n#   IF [/I] [NOT] item1   [==|EQU|NEQ|LSS|LEQ|GTR|GEQ] item2\n#   IF [/I] [NOT] (item1) [==|EQU|NEQ|LSS|LEQ|GTR|GEQ] (item2)\n#\n# http://ss64.com/nt/if.html\n# http://ss64.com/nt/for.html\n#\n# Regular expression generated from regex-assembly/932140.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932140\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\b(?:for(?:/[dflr].*)? %+[^ ]+ in\\(.*\\)[\\s\\x0b]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)\\b|[ \\(].*(?:\\b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))\\b|==)))\" \\\n    \"id:932140,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,\\\n    msg:'Remote Command Execution: Windows FOR/IF Command Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-windows',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Unix shell expressions - Bash Tilde expansion ]\n# This rule has a stricter sibling: 932271\n#\n# Detects the following patterns which are common in Unix shell scripts\n# and one-liners:\n#\n# ~+    $PWD\n# ~-    $OLDPWD\n# ~-2   second directory entry on the stack from the top\n# ~+2   second directory entry on the stack from the bottom\n#\n# Reference - https://linuxsimply.com/bash-scripting-tutorial/expansion/tilde-expansion/\n#\n# Regular expression generated from regex-assembly/932270.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932270\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?:^|[\\s\\x0b\\$&\\(:->`\\|])~[\\+\\-](?:$|[0-9]+)\" \\\n    \"id:932270,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,\\\n    msg:'Remote Command Execution: Unix Shell Expression Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Unix shell expressions - brace expansion ]\n#\n# Detects the following patterns which are common in Unix shell scripts\n# and one-liners:\n#\n# {,ip,a}\n# c{a,oun}t\n# {,ifconfig}\n# {,ifconfig,eth0}\n# {l,-lh}s\n#\n#\n# Regular expression generated from regex-assembly/932280.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932280\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\{[0-9A-Z_a-z]*,[,\\-0-9A-Z_a-z]*\\}\" \\\n    \"id:932280,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Brace Expansion Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Unix direct remote command execution ]\n#\n# Detects Unix commands at the start of a parameter (direct RCE).\n# Example: foo=wget%20www.example.com\n#\n# In this rule we use a different check from command injection (rule 932230), where a\n# command string is appended (injected) to a regular parameter, and then\n# passed to a shell unescaped.\n#\n# Additionaly, we require a trailing space (denoting command parameters) or command\n# separator character after the command.\n#\n# This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit:\n# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ]\n#\n# An effort was made to combat evasions by shell quoting (e.g. 'ls',\n# 'l'\"s\", \\l\\s are all valid). ModSecurity has a t:cmdLine\n# transformation built-in to deal with this, but unfortunately, it\n# replaces ';' characters and lowercases the payload, which is less\n# useful for this case. However, emulating the transformation makes\n# the regexp more complex.\n#\n# This is the base Rule to prevent Direct Unix Command Injection\n# without prefix match.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932250.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932250\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:^(?:json\\.|\\x5c)?|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:(?:7[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[arx][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|(?:b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z|c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[89][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?9|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?f|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|q[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|f[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:g|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b|j[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:j[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s|q)|[kz][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b|k[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?g|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|x[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z)|r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|(?:s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?h|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n)|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:3[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m|c)|x[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:x[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|z)|y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|l[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:4[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?))[\\\"']?[\\s\\x0b&\\),<>\\|].*|a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?-[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?(?:[&\\),<>\\|]{1,10}|(?:[\\-\\.0-9A-Z_a-z][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?){1,10}[\\s\\x0b&\\),<>\\|\\}]{1,10})|r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?j[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*)|g[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?(?:[&\\),<>\\|]{1,10}|(?:[\\-\\.0-9A-Z_a-z][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?){1,10}[\\s\\x0b&\\),<>\\|\\}]{1,10})|(?:d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b|[hr][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?g)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*))\" \\\n    \"id:932250,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Direct Unix Command Execution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix command injection ]\n#\n# This rule complements rule 932250 for commands of 4 characters and up.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932260.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932260\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:^(?:json\\.|\\x5c)?|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:a(?:ddgroup|nsible|pparmor_[^\\s\\x0b]{1,10}\\b|rj(?:-register|disp)|tobm[\\\"']?[\\s\\x0b&\\),<>\\|]|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:ase(?:32|64[\\\"']?[\\s\\x0b&\\),<>\\|]|nc)|(?:lkid|rwap|yobu)[\\\"']?[\\s\\x0b&\\),<>\\|]|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|z(?:c(?:at|mp)[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\\\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|argo-(?:audit|miri|watch)|h(?:(?:attr|c(?:at|on)|mod|o(?:om|wn)|sh)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:module|policy)|f-)|g(?:passwd|rp[\\\"']?[\\s\\x0b&\\),<>\\|])|pass)|l(?:ang\\+\\+|ippy-driver)|o(?:bc(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|run)|mm[\\\"']?[\\s\\x0b&\\),<>\\|]|proc)|(?:p(?:an|io)|scli)[\\\"']?[\\s\\x0b&\\),<>\\|])|d(?:(?:iff|mesg|vips)[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:as[\\\"']?[\\s\\x0b&\\),<>\\|]|cker-)|pkg(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|e(?:2fsck|(?:fax|grep|macs|nd(?:if|sw)|sac|xpr)[\\\"']?[\\s\\x0b&\\),<>\\|])|f(?:d(?:(?:find|isk)[\\\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|grep[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:letest|ndcon|xfiles[\\\"']?[\\s\\x0b&\\),<>\\|])|ping(?:6|[\\\"']?[\\s\\x0b&\\),<>\\|])|tp(?:stats|who))|g(?:(?:core|insh|z(?:cat|exe|ip))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:nhomedircon|t(?:cap|enforce|sebool))|hc(?:-[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:cat|ep|ubby)[\\\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|unzip)|(?:htop|jexec)[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:conv|ftop)[\\\"']?[\\s\\x0b&\\),<>\\|]|ndexcon|pp(?:eveprinter|find|tool))|l(?:ast(?:comm|log(?:in)?)[\\\"']?[\\s\\x0b&\\),<>\\|]|ess(?:echo|(?:fil|pip)e)|ftp(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:ad_policy[\\\"']?[\\s\\x0b&\\),<>\\|]|setup)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)[\\\"']?[\\s\\x0b&\\),<>\\|]|b_release)|wp-download|z(?:4c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|at)|c(?:at|mp)[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore)))|m(?:a(?:(?:ilq|wk)[\\\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|k(?:fifo|nod[\\\"']?[\\s\\x0b&\\),<>\\|]|temp)|locate|ysql(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:(?:a(?:sm|wk)|(?:ma|ohu)p|ping|roff|stat)[\\\"']?[\\s\\x0b&\\),<>\\|]|c(?:\\.(?:openbsd|traditional)|at[\\\"']?[\\s\\x0b&\\),<>\\|])|e(?:t(?:(?:c|st)at|kit-ftp|plan)|wrole[\\\"']?[\\s\\x0b&\\),<>\\|]))|o(?:nintr|pkg[\\\"']?[\\s\\x0b&\\),<>\\|])|p(?:d(?:b(?:2mb|3(?:\\.|[\\\"']?[\\s\\x0b&\\),<>\\|]))|ksh[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:er(?:f|l5?)|(?:ft|gre)p|s(?:ed|ql)|ushd)[\\\"']?[\\s\\x0b&\\),<>\\|]|hp(?:-cgi|[57][\\\"']?[\\s\\x0b&\\),<>\\|])|i(?:conv|(?:gz|ng6)[\\\"']?[\\s\\x0b&\\),<>\\|])|k(?:exec|ill[\\\"']?[\\s\\x0b&\\),<>\\|])|o(?:licygentool|pd[\\\"']?[\\s\\x0b&\\),<>\\|])|rint(?:env|f[\\\"']?[\\s\\x0b&\\),<>\\|])|tar(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|grep)|y(?:3?versions|thon[23]))|r(?:(?:aku|bash|nano|pmdb|vi(?:ew|m))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:alpath|boot[\\\"']?[\\s\\x0b&\\),<>\\|]|plcon|storecon(?:_xattr|d)?)|m(?:dir[\\\"']?[\\s\\x0b&\\),<>\\|]|t-(?:dump|tar)|user)|sync(?:-ssl|[\\\"']?[\\s\\x0b&\\),<>\\|])|u(?:n(?:_init|c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\\\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:diff|ftp|lsh|ocat)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\\\"']?[\\s\\x0b&\\),<>\\|])|diff|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|ndmail[\\\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus)|t(?:cap|en(?:force|v)|files|s(?:ebool|id)))|h(?:\\.distrib|uf[\\\"']?[\\s\\x0b&\\),<>\\|])|sh-(?:a(?:dd|gent)|copy-id)|udo(?:-rs|[\\\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay)|vn(?:a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|ysctl)|t(?:(?:ailf|ftp|imeout|mux)[\\\"']?[\\s\\x0b&\\),<>\\|]|c(?:l?sh[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:ing|traceroute))|elnet|ogglesebool|r(?:a(?:ceroute6?|p[\\\"']?[\\s\\x0b&\\),<>\\|])|off[\\\"']?[\\s\\x0b&\\),<>\\|]))|u(?:conv[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|iq|rar|xz)[\\\"']?[\\s\\x0b&\\),<>\\|]|lz(?:4[\\\"']?[\\s\\x0b&\\),<>\\|]|ma)|pigz|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:(?:gr|pw|rsh)[\\\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|w(?:get[\\\"']?[\\s\\x0b&\\),<>\\|]|ho(?:ami|is[\\\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:args|etex|more|pad|term)[\\\"']?[\\s\\x0b&\\),<>\\|]|z(?:c(?:at|mp)[\\\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\\\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more))|z(?:(?:c(?:at|mp)|diff|grep|less|run)[\\\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|mo(?:dload|re[\\\"']?[\\s\\x0b&\\),<>\\|])|std(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less)))\" \\\n    \"id:932260,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Direct Unix Command Execution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix command injection ]\n#\n# This rule is meant to block the execution of commands with no arguments when it's possible to meaningfully do so.\n# False positive prone commands are not detected at PL-1.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932340.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932340\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:aptitude|d(?:f|mesg)|env|h(?:ostname|top)|(?:(?:io|vm)sta|reboo)t|l(?:ast(?:log(?:in)?)?|s)|mysql(?:[^\\s\\x0b]{1,10}\\b)?|ps(?:ql)?|s(?:et|hutdown|u)|who(?:ami|is)?)[\\\"']?$\" \\\n    \"id:932340,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Direct Unix Command Execution (No Arguments)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix shell history invocation ]\n#\n# Detects Unix shell history invocations in any context.\n#\n# Example:\n#   GET /?rce=example.com\n#   GET /?rce=curl%20\n#   GET /?rce=!-1!-2\n#\n# Will execute `curl example.com`. We should be able to detect the '!-<digit>' sequence with a very low risk of false-positives since the sequence is very specific\n# and does not allow for whitespaces in between.\n#\n# This rule has stricter siblings:\n#   * 932331 (PL3)\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx !-\\d\" \\\n    \"id:932330,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix shell history invocation',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Unix shell snippets ]\n#\n# Detect some common sequences found in shell commands and scripts.\n#\n# Some commands which were restricted in earlier rules due to FP,\n# have been added here with their full path, in order to catch some\n# cases where the full path is sent.\n#\n# Rule relations:\n#\n#  .932160 (base rule, PL1, unix shell commands with full path)\n#  ..932161 (stricter sibling, PL2, unix shell commands with full path in User-Agent and Referer request headers)\n#\n# This rule is also triggered by an Apache Struts Remote Code Execution exploit:\n# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ]\n#\n# This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit:\n# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ]\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@pmFromFile unix-shell.data\" \\\n    \"id:932160,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,t:normalizePath,\\\n    msg:'Remote Command Execution: Unix Shell Code Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Shellshock vulnerability (CVE-2014-6271 and CVE-2014-7169) ]\n#\n# Detect exploitation of \"Shellshock\" GNU Bash RCE vulnerability.\n#\n# Based on ModSecurity rules created by Red Hat.\n# Permission for use was granted by Martin Prpic <secalert@redhat.com>\n#\n# https://access.redhat.com/articles/1212303\n#\nSecRule REQUEST_HEADERS|REQUEST_LINE \"@rx ^\\(\\s*\\)\\s+\\{\" \\\n    \"id:932170,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Remote Command Execution: Shellshock (CVE-2014-6271)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\nSecRule ARGS_NAMES|ARGS|FILES_NAMES \"@rx ^(?:json\\.)?\\([\\s\\x0b]*\\)[\\s\\x0b]+\\{\" \\\n    \"id:932171,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Remote Command Execution: Shellshock (CVE-2014-6271)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Unix shell alias detection ]\n#\n# Detects Unix shell alias invocations in any context.\n#\n# Example:\n#   GET /?rce=alias%20a=b\n#\n# Shell aliasing can be performed to substitute anything in commands, escaping\n#\n# References: https://pubs.opengroup.org/onlinepubs/007904975/basedefs/xbd_chap03.html#tag_03_10 :\n# \"In the shell command language, a word consisting solely of underscores, digits, and alphabetics\n# from the portable character set and any of the following characters: '!', '%', ',', '@'.\"\n#\n# Implementations may allow other characters within alias names as an extension.\n#\n# Regular expression generated from regex-assembly/932175.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932175\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\ba[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s\\b[\\s\\x0b]+(?:[\\+\\-][a-z]+\\+?[\\s\\x0b]+)?[!\\\"%',-\\.0-9@-Z_a-z]+=[^\\s\\x0b]\" \\\n    \"id:932175,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix shell alias invocation',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ Restricted File Upload ]=-\n#\n# Detects attempts to upload a file with a forbidden filename.\n#\n# Many application contain Unrestricted File Upload vulnerabilities.\n# https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload\n#\n# These might be abused to upload configuration files or other files\n# that affect the behavior of the web server, possibly causing remote\n# code execution.\n#\n# Regular expression generated from regex-assembly/932180.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932180\n#\nSecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X-File-Name \"@rx (?i)(?:\\b|^)(?:\\.(?:a(?:ddressbook|iignore|sh(?:_history|rc))|b(?:ashrc|o(?:to|werrc))|c(?:o(?:ndarc|verage)|(?:redential|v)s|sh(?:_history|rc)|ur(?:lrc|sorignore))|d(?:bshell|igrc|ocker(?:env|ignore))|e(?:ditorconfig|nv(?:rc)?|slint(?:ignore|rc))|f(?:bcindex|ish|orward|tpconfig)|g(?:emrc|it(?:(?:attribut|modul)es|config|ignore|keep)|oogle_authenticator)|h(?:gignore|t(?:access|digest|passwd))|i(?:dea|rb_history)|(?:jshint|offlineimap|yarn)rc|k(?:otlinc_history|sh(?:_history|rc))|l(?:esshst|ftprc|history|ighttpdpassword|ynx_cookies)|m(?:(?:bsync|smtp)rc|ys(?:cmserverinfo|ql_history))|n(?:ano(?:_history|rc)|(?:et|pm)rc|ode_repl_history|s(?:config|r))|p(?:ass(?:wd)?|e(?:arrc|rl(?:(?:_repl_)?history|db))|gpass|(?:hp|sql|ython)_history|inerc|lenv|r(?:ettierrc|o(?:c(?:log|mailrc)|file))|wd)|r(?:ediscli_history|h(?:istory|osts)|sync_exclude|ustup)|s(?:3cfg|creenrc|e(?:crets|lected_editor)|(?:h|ql(?:ite|plus))_history|vnignore)|t(?:csh(?:_history|rc)|erraformrc)|v(?:im(?:info|rc)|scode)|w(?:getrc|ww_?acl)|xauthority|z(?:history|sh(?:_history|env|rc)))|(?:Dockerfil|uptim)e|a(?:cpi|sound)|b(?:lock|ootconfig|uddyinfo)|c(?:(?:group|las|onsole)s|mdline|(?:puinf|rypt)o)|d(?:(?:evice|iskstat)s|(?:ock|riv)er|ynamic_debug)|execdomains|fi(?:(?:lesystem|sh_variable)s|rmware)|hypervisor|i(?:n(?:itial_root_password|terrupts)|o(?:mem|ports)|pmi)|k(?:allsyms|core|e(?:rnel|ys)|msg|page(?:c(?:group|ount)|flags))|l(?:atency_stats|o(?:adavg|cks))|m(?:dstat|eminfo|isc|o(?:dules?|unts)|trr)|p(?:a(?:getypeinfo|rtitions)|ower|ressure)|s(?:c(?:hed(?:_debug|stat)|si)|elf|labinfo|(?:oftirq|wap)s|slvpn_websession|tat|ysvipc)|timer_(?:list|stats)|v(?:ersion(?:_signature)?|m(?:allocinfo|stat))|zoneinfo)(?:[^0-9@-Z_a-z]|$)|\\.(?:a(?:(?:(?:cces|w)s|nydesk|tom|zure)/|ptitude/config)|b(?:ash_|(?:in|luemix)/|un(?:(?:dle)?/|fig\\.toml))|c(?:a(?:che/(?:notify-osd\\.log)?|rgo/)|(?:hocolatey|pan(?:el|plus)?|ups)/|o(?:nfig(?:\\.local\\.php|/)|veralls\\.yml))|d(?:(?:atadog-agent|bus|ocker|rush)/|eployment-secrets\\.txt)|(?:eclipse|i(?:bmcloud|(?:dle|rb)rc|pynb_checkpoints)|java|k(?:(?:aggl|ub)e|eras|onan)|v(?:agrant\\.d|i(?:dalia|m)|mware))/|g(?:(?:e(?:m|t(?:dns|mail))|ftp|n(?:ome(?:2|rc)?|upg)|radle|sutil)/|it(?:-credentials|/|lab-ci\\.yml))|h(?:g/|plip/hplip\\.conf)|l(?:(?:ftp|inode-cli|ocal/(?:bin|lib|s(?:har|tat)e))/|ldb-history)|m(?:(?:2|inikube)/|ongo(?:db/|shrc\\.js)|y(?:(?:login)?\\.cnf|py_cache/))|n(?:(?:ano|cftp|pm(?:-global)?|vm)/|ode-gyp)|o(?:ci/|h-my-|p(?:c/|en(?:ssl\\.cnf|vpn/)))|p(?:assword-store|g(?:_service\\.conf|admin/)|hp(?:_cs\\.dist|cs\\.xml(?:\\.dist)?)|(?:ip|(?:k|ulum)i|m2|ryrc|y(?:env|test_cache))/)|r(?:(?:benv|vm)/|e(?:dhat/|mote-sync\\.json)|ubocop\\.yml)|s(?:(?:(?:dkma|ubversio|v)n|ettings|nap|sh)/|ql\\.(?:(?:00|yz)1|[7bgx]?z|a(?:ce|rj)|cpio|l(?:ha|z)|(?:pe?|uh)a|r(?:0[0-9]|ar|ev)|t(?:a[rz]|[bgx]z))|tubby\\.yml)|t(?:(?:conn|hunderbird|o(?:ols|r))/|erraform(?:\\.(?:d/|lock\\.hcl)|/)|mux\\.conf|ravis\\.ya?ml)|u(?:nbound/|ser(?:\\.ini|min/))|w(?:eb\\.config\\.swp|get-hsts|(?:ine|p-cli)/)|yarnrc\\.yml)|/(?:\\.(?:DS_Store|ws_ftp\\.ini)|@(?:fs|id)/|(?:Web\\.confi|(?:debug|errors?)\\.lo)g|(?:auth|package(?:-lock|s)?)\\.json|composer\\.(?:json|lock)|(?:gruntfile|webpack\\.config)\\.js|npm-(?:debug\\.log|shrinkwrap\\.json)|yarn\\.lock)|(?:BlockCypher|yarn-(?:debug|error))\\.log|Desktop\\.ini|(?:META|WEB)-INF/|Thumbs\\.db|(?:aws(?:-key)?\\.ya?|user_secrets\\.y)ml|b(?:o(?:ot\\.ini|wer\\.json)|uild\\.zig\\.zon)|c(?:argo\\.toml|o(?:(?:mpose\\.ya?|verage\\.x)ml|nfig(?:[\\-_](?:dev|prod|sample|test)\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|\\.(?:asp|dev\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|fish|gz|in(?:c\\.php|i)|json|nu|p(?:hp|[ly]|rod\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml))|rb|sample\\.(?:asp|in(?:c\\.php|i)|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|t(?:est\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|oml|xt)|(?:x|ya?)ml)))|redentials\\.json)|d(?:atabase\\.ya?ml|e(?:b(?:ian\\.cnf|ug\\.log)|fault(?:\\.settings|s\\.inc)\\.php))|env\\.php|ftp-sync\\.json|g(?:itlab(?:\\.rb|_config_)|o\\.(?:mod|sum))|key-users|l(?:dap-authentication-report\\.csv|o(?:cal\\.xm|gin\\.sq)l)|(?:my(?:sql(?:dump)?)?\\.cn|thread-sel)f|p(?:arameters\\.(?:php|yml)|hp(?:\\.ini|_errors?\\.log|cs\\.xml(?:\\.dist)?|info\\.php)|m2\\.log|y(?:project\\.toml|test\\.ini))|r(?:outing\\.yml|sync\\.log)|s(?:e(?:c(?:rets\\.(?:json|ya?ml)|urity\\.yml)|ndgrid\\.env|rvices\\.yml|t(?:tings\\.(?:(?:inc|local)\\.)?php|up\\.py))|ftp\\.json|ys(?:rq-trigger|tem\\.ini))|w(?:eblogic\\.xml|g-clients/|in\\.ini|p-config[\\-\\._])\" \\\n    \"id:932180,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:removeWhitespace,\\\n    msg:'Restricted File Upload Attempt',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Windows command injection ]\n#\n# This rule detects Windows shell command injections.\n# If you are not running Windows, it is safe to disable this rule.\n#\n# New in CRSv4: The rules 932110 and 932115 were reorganized and renumbered to 932370 and 932380.\n# The new rules target specific Windows binaries to simplify future updates of the command list.\n#\n# A command injection takes a form such as:\n#\n#   foo.jpg&ver /r\n#   foo.jpg|ver /r\n#\n# The vulnerability exists when an application executes a shell command\n# without proper input escaping/validation.\n#\n# To prevent false positives, we look for a 'starting sequence' that\n# precedes a command in CMD syntax, such as: ; | & `\n#\n# Anatomy of the regexp:\n#\n# 1. Starting tokens\n#\n# ;        ;cmd\n# \\{       {cmd\n# \\|       |cmd\n# \\|\\|     ||cmd\n# &        &cmd\n# &&       &&cmd\n# \\n       \\ncmd\n# \\r       \\rcmd\n# `        `cmd\n#\n# 2. Command prefixes\n#\n# (        (cmd)\n# ,        ,cmd\n# @        @cmd\n# '        'cmd'\n# \"        \"cmd\"\n# \\s       spacing+cmd\n#\n# 3. Paths\n#\n# [\\w'\\\"\\./]+/                          /path/cmd\n# [\\x5c'\\\"\\^]*\\w[\\x5c'\\\"\\^]*:.*\\x5c     C:\\Program Files\\cmd\n# [\\^\\.\\w '\\\"/\\x5c]*\\x5c)?[\\\"\\^]*       \\\\net\\share\\dir\\cmd\n#\n# 4. Quoting\n#\n# \\\"       \"cmd\"\n# \\^       ^cmd\n#\n# 5. Extension/switches\n#\n# \\.[\\\"\\^]*\\w+      cmd.com, cmd.exe, etc.\n# /b                cmd/h\n#\n# An effort is made to combat evasions by CMD syntax; for example,\n# the following strings are valid: c^md, @cmd, \"c\"md. ModSecurity\n# has a t:cmdLine transformation built-in to deal with some of these,\n# but unfortunately, that transformation replaces ';' characters (so\n# we cannot match on the start of a command) and '\\' characters (so we\n# have trouble matching paths). This makes the regexp more complex.\n#\n# This rule is case-insensitive.\n#\n# Regular expression generated from regex-assembly/932370.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932370\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\\\"'\\(,@]*(?:[\\\"'\\.-9A-Z_a-z]+/|(?:[\\\"'\\x5c\\^]*[0-9A-Z_a-z][\\\"'\\x5c\\^]*:[^\\x5c]*|[ \\\"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\\\"\\^]*(?:a[\\\"\\^]*(?:c[\\\"\\^]*c[\\\"\\^]*c[\\\"\\^]*h[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*k[\\\"\\^]*c[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*s[\\\"\\^]*o[\\\"\\^]*l[\\\"\\^]*e|d[\\\"\\^]*(?:p[\\\"\\^]*l[\\\"\\^]*u[\\\"\\^]*s|v[\\\"\\^]*p[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*k)|(?:g[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*e[\\\"\\^]*x[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*o|(?:s[\\\"\\^]*p[\\\"\\^]*n[\\\"\\^]*e[\\\"\\^]*t[\\\"\\^]*_[\\\"\\^]*c[\\\"\\^]*o[\\\"\\^]*m[\\\"\\^]*p[\\\"\\^]*i[\\\"\\^]*l|t[\\\"\\^]*b[\\\"\\^]*r[\\\"\\^]*o[\\\"\\^]*k)[\\\"\\^]*e)[\\\"\\^]*r|p[\\\"\\^]*p[\\\"\\^]*(?:i[\\\"\\^]*n[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*l[\\\"\\^]*l[\\\"\\^]*e[\\\"\\^]*r|v[\\\"\\^]*l[\\\"\\^]*p))|b[\\\"\\^]*(?:a[\\\"\\^]*s[\\\"\\^]*h|g[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*f[\\\"\\^]*o|i[\\\"\\^]*t[\\\"\\^]*s[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*m[\\\"\\^]*i[\\\"\\^]*n)|c[\\\"\\^]*(?:d[\\\"\\^]*b|e[\\\"\\^]*r[\\\"\\^]*t[\\\"\\^]*(?:o[\\\"\\^]*c|r[\\\"\\^]*e[\\\"\\^]*q|u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l)|l[\\\"\\^]*_[\\\"\\^]*(?:i[\\\"\\^]*n[\\\"\\^]*v[\\\"\\^]*o[\\\"\\^]*c[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*o[\\\"\\^]*n|l[\\\"\\^]*o[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*a[\\\"\\^]*s[\\\"\\^]*s[\\\"\\^]*e[\\\"\\^]*m[\\\"\\^]*b[\\\"\\^]*l[\\\"\\^]*y|m[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*e[\\\"\\^]*x[\\\"\\^]*v[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*f[\\\"\\^]*i[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*s)|m[\\\"\\^]*(?:d(?:[\\\"\\^]*(?:k[\\\"\\^]*e[\\\"\\^]*y|l[\\\"\\^]*3[\\\"\\^]*2))?|s[\\\"\\^]*t[\\\"\\^]*p)|o[\\\"\\^]*(?:m[\\\"\\^]*s[\\\"\\^]*v[\\\"\\^]*c[\\\"\\^]*s|n[\\\"\\^]*(?:f[\\\"\\^]*i[\\\"\\^]*g[\\\"\\^]*s[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*u[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*t[\\\"\\^]*y[\\\"\\^]*p[\\\"\\^]*o[\\\"\\^]*l[\\\"\\^]*i[\\\"\\^]*c[\\\"\\^]*y|h[\\\"\\^]*o[\\\"\\^]*s[\\\"\\^]*t|t[\\\"\\^]*r[\\\"\\^]*o[\\\"\\^]*l)|r[\\\"\\^]*e[\\\"\\^]*g[\\\"\\^]*e[\\\"\\^]*n)|r[\\\"\\^]*e[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*e[\\\"\\^]*d[\\\"\\^]*u[\\\"\\^]*m[\\\"\\^]*p|s[\\\"\\^]*(?:c(?:[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*p[\\\"\\^]*t)?|i)|u[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*o[\\\"\\^]*m[\\\"\\^]*s[\\\"\\^]*h[\\\"\\^]*e[\\\"\\^]*l[\\\"\\^]*l[\\\"\\^]*h[\\\"\\^]*o[\\\"\\^]*s[\\\"\\^]*t)|d[\\\"\\^]*(?:a[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*s[\\\"\\^]*v[\\\"\\^]*c[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l|e[\\\"\\^]*(?:f[\\\"\\^]*a[\\\"\\^]*u[\\\"\\^]*l[\\\"\\^]*t[\\\"\\^]*p[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*k|s[\\\"\\^]*k(?:[\\\"\\^]*t[\\\"\\^]*o[\\\"\\^]*p[\\\"\\^]*i[\\\"\\^]*m[\\\"\\^]*g[\\\"\\^]*d[\\\"\\^]*o[\\\"\\^]*w[\\\"\\^]*n[\\\"\\^]*l[\\\"\\^]*d[\\\"\\^]*r)?|v[\\\"\\^]*(?:i[\\\"\\^]*c[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*r[\\\"\\^]*e[\\\"\\^]*d[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*a[\\\"\\^]*l[\\\"\\^]*d[\\\"\\^]*e[\\\"\\^]*p[\\\"\\^]*l[\\\"\\^]*o[\\\"\\^]*y[\\\"\\^]*m[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*t|t[\\\"\\^]*o[\\\"\\^]*o[\\\"\\^]*l[\\\"\\^]*s[\\\"\\^]*l[\\\"\\^]*a[\\\"\\^]*u[\\\"\\^]*n[\\\"\\^]*c[\\\"\\^]*h[\\\"\\^]*e[\\\"\\^]*r))|f[\\\"\\^]*s[\\\"\\^]*(?:h[\\\"\\^]*i[\\\"\\^]*m|v[\\\"\\^]*c)|i[\\\"\\^]*(?:a[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*z|s[\\\"\\^]*k[\\\"\\^]*s[\\\"\\^]*h[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*o[\\\"\\^]*w)|n[\\\"\\^]*(?:s[\\\"\\^]*c[\\\"\\^]*m[\\\"\\^]*d|x)|o[\\\"\\^]*t[\\\"\\^]*n[\\\"\\^]*e[\\\"\\^]*t|u[\\\"\\^]*m[\\\"\\^]*p[\\\"\\^]*6[\\\"\\^]*4|x[\\\"\\^]*c[\\\"\\^]*a[\\\"\\^]*p)|e[\\\"\\^]*(?:s[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*l|v[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*v[\\\"\\^]*w[\\\"\\^]*r|x[\\\"\\^]*(?:c[\\\"\\^]*e[\\\"\\^]*l|p[\\\"\\^]*(?:a[\\\"\\^]*n[\\\"\\^]*d|l[\\\"\\^]*o[\\\"\\^]*r[\\\"\\^]*e[\\\"\\^]*r)|t[\\\"\\^]*(?:e[\\\"\\^]*x[\\\"\\^]*p[\\\"\\^]*o[\\\"\\^]*r[\\\"\\^]*t|r[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*3[\\\"\\^]*2)))|f[\\\"\\^]*(?:i[\\\"\\^]*n[\\\"\\^]*(?:d[\\\"\\^]*s[\\\"\\^]*t|g[\\\"\\^]*e)[\\\"\\^]*r|l[\\\"\\^]*t[\\\"\\^]*m[\\\"\\^]*c|o[\\\"\\^]*r[\\\"\\^]*f[\\\"\\^]*i[\\\"\\^]*l[\\\"\\^]*e[\\\"\\^]*s|s[\\\"\\^]*(?:i(?:[\\\"\\^]*a[\\\"\\^]*n[\\\"\\^]*y[\\\"\\^]*c[\\\"\\^]*p[\\\"\\^]*u)?|u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l)|t[\\\"\\^]*p)|g[\\\"\\^]*(?:f[\\\"\\^]*x[\\\"\\^]*d[\\\"\\^]*o[\\\"\\^]*w[\\\"\\^]*n[\\\"\\^]*l[\\\"\\^]*o[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*w[\\\"\\^]*r[\\\"\\^]*a[\\\"\\^]*p[\\\"\\^]*p[\\\"\\^]*e[\\\"\\^]*r|p[\\\"\\^]*s[\\\"\\^]*c[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*p[\\\"\\^]*t)|h[\\\"\\^]*h|i[\\\"\\^]*(?:e[\\\"\\^]*(?:4[\\\"\\^]*u[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*i[\\\"\\^]*t|a[\\\"\\^]*d[\\\"\\^]*v[\\\"\\^]*p[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*k|e[\\\"\\^]*x[\\\"\\^]*e[\\\"\\^]*c|f[\\\"\\^]*r[\\\"\\^]*a[\\\"\\^]*m[\\\"\\^]*e)|l[\\\"\\^]*a[\\\"\\^]*s[\\\"\\^]*m|m[\\\"\\^]*e[\\\"\\^]*w[\\\"\\^]*d[\\\"\\^]*b[\\\"\\^]*l[\\\"\\^]*d|n[\\\"\\^]*(?:f[\\\"\\^]*d[\\\"\\^]*e[\\\"\\^]*f[\\\"\\^]*a[\\\"\\^]*u[\\\"\\^]*l[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*l|s[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*l[\\\"\\^]*l[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i)[\\\"\\^]*l)|j[\\\"\\^]*s[\\\"\\^]*c|l[\\\"\\^]*(?:a[\\\"\\^]*u[\\\"\\^]*n[\\\"\\^]*c[\\\"\\^]*h[\\\"\\^]*-[\\\"\\^]*v[\\\"\\^]*s[\\\"\\^]*d[\\\"\\^]*e[\\\"\\^]*v[\\\"\\^]*s[\\\"\\^]*h[\\\"\\^]*e[\\\"\\^]*l[\\\"\\^]*l|d[\\\"\\^]*i[\\\"\\^]*f[\\\"\\^]*d[\\\"\\^]*e)|m[\\\"\\^]*(?:a[\\\"\\^]*(?:k[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*a[\\\"\\^]*b|n[\\\"\\^]*a[\\\"\\^]*g[\\\"\\^]*e[\\\"\\^]*-[\\\"\\^]*b[\\\"\\^]*d[\\\"\\^]*e|v[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*j[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*t)|f[\\\"\\^]*t[\\\"\\^]*r[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*e|i[\\\"\\^]*c[\\\"\\^]*r[\\\"\\^]*o[\\\"\\^]*s[\\\"\\^]*o[\\\"\\^]*f[\\\"\\^]*t|m[\\\"\\^]*c|p[\\\"\\^]*c[\\\"\\^]*m[\\\"\\^]*d[\\\"\\^]*r[\\\"\\^]*u[\\\"\\^]*n|s[\\\"\\^]*(?:(?:b[\\\"\\^]*u[\\\"\\^]*i[\\\"\\^]*l|o[\\\"\\^]*h[\\\"\\^]*t[\\\"\\^]*m[\\\"\\^]*e)[\\\"\\^]*d|c[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*f[\\\"\\^]*i[\\\"\\^]*g|d[\\\"\\^]*(?:e[\\\"\\^]*p[\\\"\\^]*l[\\\"\\^]*o[\\\"\\^]*y|t)|h[\\\"\\^]*t[\\\"\\^]*(?:a|m[\\\"\\^]*l)|i[\\\"\\^]*e[\\\"\\^]*x[\\\"\\^]*e[\\\"\\^]*c|p[\\\"\\^]*u[\\\"\\^]*b|x[\\\"\\^]*s[\\\"\\^]*l))|n[\\\"\\^]*(?:e[\\\"\\^]*t[\\\"\\^]*s[\\\"\\^]*h|t[\\\"\\^]*d[\\\"\\^]*s[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l)|o[\\\"\\^]*(?:d[\\\"\\^]*b[\\\"\\^]*c[\\\"\\^]*c[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*f|f[\\\"\\^]*f[\\\"\\^]*l[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*e[\\\"\\^]*s[\\\"\\^]*c[\\\"\\^]*a[\\\"\\^]*n[\\\"\\^]*n[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*s[\\\"\\^]*h[\\\"\\^]*e[\\\"\\^]*l[\\\"\\^]*l|n[\\\"\\^]*e[\\\"\\^]*d[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*v[\\\"\\^]*e[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*n[\\\"\\^]*d[\\\"\\^]*a[\\\"\\^]*l[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*e[\\\"\\^]*u[\\\"\\^]*p[\\\"\\^]*d[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*e[\\\"\\^]*r|p[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*c[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*s[\\\"\\^]*o[\\\"\\^]*l[\\\"\\^]*e)|p[\\\"\\^]*(?:c[\\\"\\^]*(?:a[\\\"\\^]*l[\\\"\\^]*u[\\\"\\^]*a|w[\\\"\\^]*(?:r[\\\"\\^]*u[\\\"\\^]*n|u[\\\"\\^]*t[\\\"\\^]*l))|(?:e[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*e|s)[\\\"\\^]*r|(?:k[\\\"\\^]*t[\\\"\\^]*m[\\\"\\^]*o|u[\\\"\\^]*b[\\\"\\^]*p[\\\"\\^]*r)[\\\"\\^]*n|n[\\\"\\^]*p[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l|o[\\\"\\^]*w[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*p[\\\"\\^]*n[\\\"\\^]*t|r[\\\"\\^]*(?:e[\\\"\\^]*s[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*h[\\\"\\^]*o[\\\"\\^]*s[\\\"\\^]*t|i[\\\"\\^]*n[\\\"\\^]*t(?:[\\\"\\^]*b[\\\"\\^]*r[\\\"\\^]*m)?|o[\\\"\\^]*(?:c[\\\"\\^]*d[\\\"\\^]*u[\\\"\\^]*m[\\\"\\^]*p|t[\\\"\\^]*o[\\\"\\^]*c[\\\"\\^]*o[\\\"\\^]*l[\\\"\\^]*h[\\\"\\^]*a[\\\"\\^]*n[\\\"\\^]*d[\\\"\\^]*l[\\\"\\^]*e[\\\"\\^]*r)))|r[\\\"\\^]*(?:a[\\\"\\^]*s[\\\"\\^]*a[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*o[\\\"\\^]*u|c[\\\"\\^]*s[\\\"\\^]*i|(?:d[\\\"\\^]*r[\\\"\\^]*l[\\\"\\^]*e[\\\"\\^]*a[\\\"\\^]*k[\\\"\\^]*d[\\\"\\^]*i[\\\"\\^]*a|p[\\\"\\^]*c[\\\"\\^]*p[\\\"\\^]*i[\\\"\\^]*n)[\\\"\\^]*g|e[\\\"\\^]*(?:g(?:[\\\"\\^]*(?:a[\\\"\\^]*s[\\\"\\^]*m|e[\\\"\\^]*d[\\\"\\^]*i[\\\"\\^]*t|i[\\\"\\^]*(?:n[\\\"\\^]*i|s[\\\"\\^]*t[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*-[\\\"\\^]*c[\\\"\\^]*i[\\\"\\^]*m[\\\"\\^]*p[\\\"\\^]*r[\\\"\\^]*o[\\\"\\^]*v[\\\"\\^]*i[\\\"\\^]*d[\\\"\\^]*e[\\\"\\^]*r)|s[\\\"\\^]*v[\\\"\\^]*(?:c[\\\"\\^]*s|r[\\\"\\^]*3[\\\"\\^]*2)))?|(?:m[\\\"\\^]*o[\\\"\\^]*t|p[\\\"\\^]*l[\\\"\\^]*a[\\\"\\^]*c)[\\\"\\^]*e)|u[\\\"\\^]*n[\\\"\\^]*(?:d[\\\"\\^]*l[\\\"\\^]*l[\\\"\\^]*3[\\\"\\^]*2|(?:e[\\\"\\^]*x[\\\"\\^]*e|s[\\\"\\^]*c[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*p[\\\"\\^]*t)[\\\"\\^]*h[\\\"\\^]*e[\\\"\\^]*l[\\\"\\^]*p[\\\"\\^]*e[\\\"\\^]*r|o[\\\"\\^]*n[\\\"\\^]*c[\\\"\\^]*e))|s[\\\"\\^]*(?:c[\\\"\\^]*(?:[\\s\\x0b,\\./;<>].*|h[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*s[\\\"\\^]*k[\\\"\\^]*s|r[\\\"\\^]*i[\\\"\\^]*p[\\\"\\^]*t[\\\"\\^]*r[\\\"\\^]*u[\\\"\\^]*n[\\\"\\^]*n[\\\"\\^]*e[\\\"\\^]*r)|e[\\\"\\^]*t[\\\"\\^]*(?:r[\\\"\\^]*e[\\\"\\^]*s|t[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*g[\\\"\\^]*s[\\\"\\^]*y[\\\"\\^]*n[\\\"\\^]*c[\\\"\\^]*h[\\\"\\^]*o[\\\"\\^]*s[\\\"\\^]*t|u[\\\"\\^]*p[\\\"\\^]*a[\\\"\\^]*p[\\\"\\^]*i)|h[\\\"\\^]*(?:d[\\\"\\^]*o[\\\"\\^]*c[\\\"\\^]*v[\\\"\\^]*w|e[\\\"\\^]*l[\\\"\\^]*l[\\\"\\^]*3[\\\"\\^]*2)|q[\\\"\\^]*(?:l[\\\"\\^]*(?:d[\\\"\\^]*u[\\\"\\^]*m[\\\"\\^]*p[\\\"\\^]*e[\\\"\\^]*r|(?:t[\\\"\\^]*o[\\\"\\^]*o[\\\"\\^]*l[\\\"\\^]*s[\\\"\\^]*)?p[\\\"\\^]*s)|u[\\\"\\^]*i[\\\"\\^]*r[\\\"\\^]*r[\\\"\\^]*e[\\\"\\^]*l)|s[\\\"\\^]*h|t[\\\"\\^]*o[\\\"\\^]*r[\\\"\\^]*d[\\\"\\^]*i[\\\"\\^]*a[\\\"\\^]*g|y[\\\"\\^]*(?:n[\\\"\\^]*c[\\\"\\^]*a[\\\"\\^]*p[\\\"\\^]*p[\\\"\\^]*v[\\\"\\^]*p[\\\"\\^]*u[\\\"\\^]*b[\\\"\\^]*l[\\\"\\^]*i[\\\"\\^]*s[\\\"\\^]*h[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*g[\\\"\\^]*s[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*v[\\\"\\^]*e[\\\"\\^]*r|s[\\\"\\^]*s[\\\"\\^]*e[\\\"\\^]*t[\\\"\\^]*u[\\\"\\^]*p))|t[\\\"\\^]*(?:e[\\\"\\^]*[\\s\\x0b,\\./;<>].*|r[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*k[\\\"\\^]*e[\\\"\\^]*r|t[\\\"\\^]*(?:d[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*j[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*t|t[\\\"\\^]*r[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*e[\\\"\\^]*r))|u[\\\"\\^]*(?:n[\\\"\\^]*r[\\\"\\^]*e[\\\"\\^]*g[\\\"\\^]*m[\\\"\\^]*p[\\\"\\^]*2|p[\\\"\\^]*d[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*e|t[\\\"\\^]*i[\\\"\\^]*l[\\\"\\^]*i[\\\"\\^]*t[\\\"\\^]*y[\\\"\\^]*f[\\\"\\^]*u[\\\"\\^]*n[\\\"\\^]*c[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*s)|v[\\\"\\^]*(?:b[\\\"\\^]*c|e[\\\"\\^]*r[\\\"\\^]*c[\\\"\\^]*l[\\\"\\^]*s[\\\"\\^]*i[\\\"\\^]*d|i[\\\"\\^]*s[\\\"\\^]*u[\\\"\\^]*a[\\\"\\^]*l[\\\"\\^]*u[\\\"\\^]*i[\\\"\\^]*a[\\\"\\^]*v[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*f[\\\"\\^]*y[\\\"\\^]*n[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*v[\\\"\\^]*e|s[\\\"\\^]*(?:i[\\\"\\^]*i[\\\"\\^]*s[\\\"\\^]*e[\\\"\\^]*x[\\\"\\^]*e[\\\"\\^]*l[\\\"\\^]*a[\\\"\\^]*u[\\\"\\^]*n[\\\"\\^]*c[\\\"\\^]*h|j[\\\"\\^]*i[\\\"\\^]*t[\\\"\\^]*d[\\\"\\^]*e[\\\"\\^]*b[\\\"\\^]*u[\\\"\\^]*g[\\\"\\^]*g)[\\\"\\^]*e[\\\"\\^]*r)|w[\\\"\\^]*(?:a[\\\"\\^]*b|(?:f|m[\\\"\\^]*i)[\\\"\\^]*c|i[\\\"\\^]*n[\\\"\\^]*(?:g[\\\"\\^]*e[\\\"\\^]*t|r[\\\"\\^]*m|w[\\\"\\^]*o[\\\"\\^]*r[\\\"\\^]*d)|l[\\\"\\^]*r[\\\"\\^]*m[\\\"\\^]*d[\\\"\\^]*r|o[\\\"\\^]*r[\\\"\\^]*k[\\\"\\^]*f[\\\"\\^]*o[\\\"\\^]*l[\\\"\\^]*d[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*s|s[\\\"\\^]*(?:(?:c[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*p|r[\\\"\\^]*e[\\\"\\^]*s[\\\"\\^]*e)[\\\"\\^]*t|l)|t[\\\"\\^]*[\\s\\x0b,\\./;<>].*|u[\\\"\\^]*a[\\\"\\^]*u[\\\"\\^]*c[\\\"\\^]*l[\\\"\\^]*t)|x[\\\"\\^]*w[\\\"\\^]*i[\\\"\\^]*z[\\\"\\^]*a[\\\"\\^]*r[\\\"\\^]*d|z[\\\"\\^]*i[\\\"\\^]*p[\\\"\\^]*f[\\\"\\^]*l[\\\"\\^]*d[\\\"\\^]*r)(?:\\.[\\\"\\^]*[0-9A-Z_a-z]+)?\\b\" \\\n    \"id:932370,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Windows Command Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-windows',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# This rule detects Windows shell command injections.\n# If you are not running Windows, it is safe to disable this rule.\n#\n# New in CRSv4: The rules 932110 and 932115 were reorganized and renumbered to 932370 and 932380.\n# The new rules target specific Windows binaries to simplify future updates of the command list.\n#\n# See rule 932370 above for further explanation.\n#\n# This rule is case-insensitive.\n#\n# Regular expression generated from regex-assembly/932380.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932380\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\\\"'\\(,@]*(?:[\\\"'\\.-9A-Z_a-z]+/|(?:[\\\"'\\x5c\\^]*[0-9A-Z_a-z][\\\"'\\x5c\\^]*:[^\\x5c]*|[ \\\"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\\\"\\^]*(?:a[\\\"\\^]*(?:s[\\\"\\^]*s[\\\"\\^]*o[\\\"\\^]*c|t[\\\"\\^]*(?:m[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*m|t[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*b)|u[\\\"\\^]*(?:d[\\\"\\^]*i[\\\"\\^]*t[\\\"\\^]*p[\\\"\\^]*o[\\\"\\^]*l|t[\\\"\\^]*o[\\\"\\^]*(?:c[\\\"\\^]*(?:h[\\\"\\^]*k|o[\\\"\\^]*n[\\\"\\^]*v)|(?:f[\\\"\\^]*m|m[\\\"\\^]*o[\\\"\\^]*u[\\\"\\^]*n)[\\\"\\^]*t)))|b[\\\"\\^]*(?:c[\\\"\\^]*d[\\\"\\^]*(?:b[\\\"\\^]*o[\\\"\\^]*o|e[\\\"\\^]*d[\\\"\\^]*i)[\\\"\\^]*t|(?:d[\\\"\\^]*e[\\\"\\^]*h[\\\"\\^]*d|o[\\\"\\^]*o[\\\"\\^]*t)[\\\"\\^]*c[\\\"\\^]*f[\\\"\\^]*g|i[\\\"\\^]*t[\\\"\\^]*s[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*m[\\\"\\^]*i[\\\"\\^]*n)|c[\\\"\\^]*(?:a[\\\"\\^]*c[\\\"\\^]*l[\\\"\\^]*s|e[\\\"\\^]*r[\\\"\\^]*t[\\\"\\^]*(?:r[\\\"\\^]*e[\\\"\\^]*q|u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l)|h[\\\"\\^]*(?:c[\\\"\\^]*p|d[\\\"\\^]*i[\\\"\\^]*r|g[\\\"\\^]*(?:l[\\\"\\^]*o[\\\"\\^]*g[\\\"\\^]*o[\\\"\\^]*n|p[\\\"\\^]*o[\\\"\\^]*r[\\\"\\^]*t|u[\\\"\\^]*s[\\\"\\^]*r)|k[\\\"\\^]*(?:d[\\\"\\^]*s[\\\"\\^]*k|n[\\\"\\^]*t[\\\"\\^]*f[\\\"\\^]*s))|l[\\\"\\^]*e[\\\"\\^]*a[\\\"\\^]*n[\\\"\\^]*m[\\\"\\^]*g[\\\"\\^]*r|m[\\\"\\^]*(?:d(?:[\\\"\\^]*k[\\\"\\^]*e[\\\"\\^]*y)?|s[\\\"\\^]*t[\\\"\\^]*p)|s[\\\"\\^]*(?:c[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*p[\\\"\\^]*t|v[\\\"\\^]*d[\\\"\\^]*e))|d[\\\"\\^]*(?:c[\\\"\\^]*(?:d[\\\"\\^]*i[\\\"\\^]*a[\\\"\\^]*g|g[\\\"\\^]*p[\\\"\\^]*o[\\\"\\^]*f[\\\"\\^]*i[\\\"\\^]*x)|e[\\\"\\^]*(?:f[\\\"\\^]*r[\\\"\\^]*a[\\\"\\^]*g|l)|f[\\\"\\^]*s[\\\"\\^]*(?:d[\\\"\\^]*i[\\\"\\^]*a|r[\\\"\\^]*m[\\\"\\^]*i)[\\\"\\^]*g|i[\\\"\\^]*(?:a[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*z|r|s[\\\"\\^]*(?:k[\\\"\\^]*(?:c[\\\"\\^]*o[\\\"\\^]*(?:m[\\\"\\^]*p|p[\\\"\\^]*y)|p[\\\"\\^]*(?:a[\\\"\\^]*r[\\\"\\^]*t|e[\\\"\\^]*r[\\\"\\^]*f)|r[\\\"\\^]*a[\\\"\\^]*i[\\\"\\^]*d|s[\\\"\\^]*h[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*o[\\\"\\^]*w)|p[\\\"\\^]*d[\\\"\\^]*i[\\\"\\^]*a[\\\"\\^]*g))|n[\\\"\\^]*s[\\\"\\^]*c[\\\"\\^]*m[\\\"\\^]*d|(?:o[\\\"\\^]*s[\\\"\\^]*k[\\\"\\^]*e|r[\\\"\\^]*i[\\\"\\^]*v[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*q[\\\"\\^]*u[\\\"\\^]*e[\\\"\\^]*r)[\\\"\\^]*y|s[\\\"\\^]*(?:a[\\\"\\^]*(?:c[\\\"\\^]*l[\\\"\\^]*s|d[\\\"\\^]*d)|g[\\\"\\^]*e[\\\"\\^]*t|m[\\\"\\^]*(?:g[\\\"\\^]*m[\\\"\\^]*t|o[\\\"\\^]*(?:d|v[\\\"\\^]*e))|q[\\\"\\^]*u[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*y|r[\\\"\\^]*m))|e[\\\"\\^]*(?:n[\\\"\\^]*d[\\\"\\^]*l[\\\"\\^]*o[\\\"\\^]*c[\\\"\\^]*a[\\\"\\^]*l|v[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*c[\\\"\\^]*r[\\\"\\^]*e[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*e)|E[\\\"\\^]*v[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*c[\\\"\\^]*m[\\\"\\^]*d|f[\\\"\\^]*(?:c|i[\\\"\\^]*(?:l[\\\"\\^]*e[\\\"\\^]*s[\\\"\\^]*y[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*e[\\\"\\^]*m[\\\"\\^]*s|n[\\\"\\^]*d[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*r)|l[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*t[\\\"\\^]*e[\\\"\\^]*m[\\\"\\^]*p|o[\\\"\\^]*r[\\\"\\^]*f[\\\"\\^]*i[\\\"\\^]*l[\\\"\\^]*e[\\\"\\^]*s|r[\\\"\\^]*e[\\\"\\^]*e[\\\"\\^]*d[\\\"\\^]*i[\\\"\\^]*s[\\\"\\^]*k|s[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l|(?:t[\\\"\\^]*y[\\\"\\^]*p|v[\\\"\\^]*e[\\\"\\^]*u[\\\"\\^]*p[\\\"\\^]*d[\\\"\\^]*a[\\\"\\^]*t)[\\\"\\^]*e)|g[\\\"\\^]*(?:e[\\\"\\^]*t[\\\"\\^]*(?:m[\\\"\\^]*a[\\\"\\^]*c|t[\\\"\\^]*y[\\\"\\^]*p[\\\"\\^]*e)|o[\\\"\\^]*t[\\\"\\^]*o|p[\\\"\\^]*(?:f[\\\"\\^]*i[\\\"\\^]*x[\\\"\\^]*u[\\\"\\^]*p|(?:r[\\\"\\^]*e[\\\"\\^]*s[\\\"\\^]*u[\\\"\\^]*l[\\\"\\^]*)?t|u[\\\"\\^]*p[\\\"\\^]*d[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*e)|r[\\\"\\^]*a[\\\"\\^]*f[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*b[\\\"\\^]*l)|h[\\\"\\^]*(?:e[\\\"\\^]*l[\\\"\\^]*p[\\\"\\^]*c[\\\"\\^]*t[\\\"\\^]*r|o[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*n[\\\"\\^]*a[\\\"\\^]*m[\\\"\\^]*e)|i[\\\"\\^]*(?:c[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*l[\\\"\\^]*s|p[\\\"\\^]*(?:c[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*f[\\\"\\^]*i[\\\"\\^]*g|x[\\\"\\^]*r[\\\"\\^]*o[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*e)|r[\\\"\\^]*f[\\\"\\^]*t[\\\"\\^]*p)|j[\\\"\\^]*e[\\\"\\^]*t[\\\"\\^]*p[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*k|k[\\\"\\^]*(?:l[\\\"\\^]*i[\\\"\\^]*s[\\\"\\^]*t|s[\\\"\\^]*e[\\\"\\^]*t[\\\"\\^]*u[\\\"\\^]*p|t[\\\"\\^]*(?:m[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l|p[\\\"\\^]*a[\\\"\\^]*s[\\\"\\^]*s))|l[\\\"\\^]*(?:d[\\\"\\^]*i[\\\"\\^]*f[\\\"\\^]*d[\\\"\\^]*e|o[\\\"\\^]*(?:d[\\\"\\^]*c[\\\"\\^]*t[\\\"\\^]*r|g[\\\"\\^]*(?:m[\\\"\\^]*a[\\\"\\^]*n|o[\\\"\\^]*f[\\\"\\^]*f))|p[\\\"\\^]*[qr])|m[\\\"\\^]*(?:a[\\\"\\^]*(?:c[\\\"\\^]*f[\\\"\\^]*i[\\\"\\^]*l[\\\"\\^]*e|k[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*a[\\\"\\^]*b|p[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*m[\\\"\\^]*i[\\\"\\^]*n)|k[\\\"\\^]*(?:d[\\\"\\^]*i[\\\"\\^]*r|l[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*k)|m[\\\"\\^]*c|o[\\\"\\^]*u[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*v[\\\"\\^]*o[\\\"\\^]*l|q[\\\"\\^]*(?:b[\\\"\\^]*k[\\\"\\^]*u[\\\"\\^]*p|(?:t[\\\"\\^]*g[\\\"\\^]*)?s[\\\"\\^]*v[\\\"\\^]*c)|s[\\\"\\^]*(?:d[\\\"\\^]*t|i[\\\"\\^]*(?:e[\\\"\\^]*x[\\\"\\^]*e[\\\"\\^]*c|n[\\\"\\^]*f[\\\"\\^]*o[\\\"\\^]*3[\\\"\\^]*2)|t[\\\"\\^]*s[\\\"\\^]*c))|n[\\\"\\^]*(?:b[\\\"\\^]*t[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*t|e[\\\"\\^]*t[\\\"\\^]*(?:c[\\\"\\^]*f[\\\"\\^]*g|d[\\\"\\^]*o[\\\"\\^]*m|s[\\\"\\^]*(?:h|t[\\\"\\^]*a[\\\"\\^]*t))|f[\\\"\\^]*s[\\\"\\^]*(?:a[\\\"\\^]*d[\\\"\\^]*m[\\\"\\^]*i[\\\"\\^]*n|s[\\\"\\^]*(?:h[\\\"\\^]*a[\\\"\\^]*r[\\\"\\^]*e|t[\\\"\\^]*a[\\\"\\^]*t))|l[\\\"\\^]*(?:b[\\\"\\^]*m[\\\"\\^]*g[\\\"\\^]*r|t[\\\"\\^]*e[\\\"\\^]*s[\\\"\\^]*t)|s[\\\"\\^]*l[\\\"\\^]*o[\\\"\\^]*o[\\\"\\^]*k[\\\"\\^]*u[\\\"\\^]*p|t[\\\"\\^]*(?:b[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*k[\\\"\\^]*u[\\\"\\^]*p|c[\\\"\\^]*m[\\\"\\^]*d[\\\"\\^]*p[\\\"\\^]*r[\\\"\\^]*o[\\\"\\^]*m[\\\"\\^]*p[\\\"\\^]*t|(?:d[\\\"\\^]*s[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i|f[\\\"\\^]*r[\\\"\\^]*s[\\\"\\^]*u[\\\"\\^]*t)[\\\"\\^]*l))|o[\\\"\\^]*(?:f[\\\"\\^]*f[\\\"\\^]*l[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*e|p[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*f[\\\"\\^]*i[\\\"\\^]*l[\\\"\\^]*e[\\\"\\^]*s)|p[\\\"\\^]*(?:a[\\\"\\^]*(?:g[\\\"\\^]*e[\\\"\\^]*f[\\\"\\^]*i[\\\"\\^]*l[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*f[\\\"\\^]*i|t[\\\"\\^]*h[\\\"\\^]*p[\\\"\\^]*i[\\\"\\^]*n)[\\\"\\^]*g|(?:b[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*m[\\\"\\^]*i|k[\\\"\\^]*t[\\\"\\^]*m[\\\"\\^]*o)[\\\"\\^]*n|e[\\\"\\^]*(?:n[\\\"\\^]*t[\\\"\\^]*n[\\\"\\^]*t|r[\\\"\\^]*f[\\\"\\^]*m[\\\"\\^]*o[\\\"\\^]*n)|n[\\\"\\^]*p[\\\"\\^]*u[\\\"\\^]*(?:n[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*t[\\\"\\^]*e[\\\"\\^]*n[\\\"\\^]*d|t[\\\"\\^]*i[\\\"\\^]*l)|o[\\\"\\^]*(?:p[\\\"\\^]*d|w[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*s[\\\"\\^]*h[\\\"\\^]*e[\\\"\\^]*l[\\\"\\^]*l)|r[\\\"\\^]*n[\\\"\\^]*(?:c[\\\"\\^]*n[\\\"\\^]*f[\\\"\\^]*g|(?:d[\\\"\\^]*r[\\\"\\^]*v|m[\\\"\\^]*n[\\\"\\^]*g)[\\\"\\^]*r|j[\\\"\\^]*o[\\\"\\^]*b[\\\"\\^]*s|p[\\\"\\^]*o[\\\"\\^]*r[\\\"\\^]*t|q[\\\"\\^]*c[\\\"\\^]*t[\\\"\\^]*l)|u[\\\"\\^]*(?:b[\\\"\\^]*p[\\\"\\^]*r[\\\"\\^]*n|s[\\\"\\^]*h[\\\"\\^]*(?:d|p[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*c[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*n[\\\"\\^]*e[\\\"\\^]*c[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*o[\\\"\\^]*n[\\\"\\^]*s))|w[\\\"\\^]*(?:l[\\\"\\^]*a[\\\"\\^]*u[\\\"\\^]*n[\\\"\\^]*c[\\\"\\^]*h[\\\"\\^]*e[\\\"\\^]*r|s[\\\"\\^]*h))|q[\\\"\\^]*(?:a[\\\"\\^]*p[\\\"\\^]*p[\\\"\\^]*s[\\\"\\^]*r[\\\"\\^]*v|p[\\\"\\^]*r[\\\"\\^]*o[\\\"\\^]*c[\\\"\\^]*e[\\\"\\^]*s[\\\"\\^]*s|u[\\\"\\^]*s[\\\"\\^]*e[\\\"\\^]*r|w[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*a)|r[\\\"\\^]*(?:d(?:[\\\"\\^]*p[\\\"\\^]*s[\\\"\\^]*i[\\\"\\^]*g[\\\"\\^]*n)?|e[\\\"\\^]*(?:f[\\\"\\^]*s[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l|g(?:[\\\"\\^]*(?:i[\\\"\\^]*n[\\\"\\^]*i|s[\\\"\\^]*v[\\\"\\^]*r[\\\"\\^]*3[\\\"\\^]*2))?|l[\\\"\\^]*o[\\\"\\^]*g|(?:(?:p[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*m[\\\"\\^]*i|s[\\\"\\^]*c[\\\"\\^]*a)[\\\"\\^]*)?n|x[\\\"\\^]*e[\\\"\\^]*c)|i[\\\"\\^]*s[\\\"\\^]*e[\\\"\\^]*t[\\\"\\^]*u[\\\"\\^]*p|m[\\\"\\^]*d[\\\"\\^]*i[\\\"\\^]*r|o[\\\"\\^]*b[\\\"\\^]*o[\\\"\\^]*c[\\\"\\^]*o[\\\"\\^]*p[\\\"\\^]*y|p[\\\"\\^]*c[\\\"\\^]*(?:i[\\\"\\^]*n[\\\"\\^]*f[\\\"\\^]*o|p[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*g)|s[\\\"\\^]*h|u[\\\"\\^]*n[\\\"\\^]*d[\\\"\\^]*l[\\\"\\^]*l[\\\"\\^]*3[\\\"\\^]*2|w[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*a)|s[\\\"\\^]*(?:a[\\\"\\^]*n|c[\\\"\\^]*(?:h[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*s[\\\"\\^]*k[\\\"\\^]*s|w[\\\"\\^]*c[\\\"\\^]*m[\\\"\\^]*d)|e[\\\"\\^]*(?:c[\\\"\\^]*e[\\\"\\^]*d[\\\"\\^]*i[\\\"\\^]*t|r[\\\"\\^]*v[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*(?:(?:c[\\\"\\^]*e[\\\"\\^]*i[\\\"\\^]*p|w[\\\"\\^]*e[\\\"\\^]*r)[\\\"\\^]*o[\\\"\\^]*p[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*n|m[\\\"\\^]*a[\\\"\\^]*n[\\\"\\^]*a[\\\"\\^]*g[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*c[\\\"\\^]*m[\\\"\\^]*d)|t[\\\"\\^]*x)|f[\\\"\\^]*c|(?:h[\\\"\\^]*o[\\\"\\^]*w[\\\"\\^]*m[\\\"\\^]*o[\\\"\\^]*u[\\\"\\^]*n|u[\\\"\\^]*b[\\\"\\^]*s)[\\\"\\^]*t|x[\\\"\\^]*s[\\\"\\^]*t[\\\"\\^]*r[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*e|y[\\\"\\^]*s[\\\"\\^]*(?:o[\\\"\\^]*c[\\\"\\^]*m[\\\"\\^]*g[\\\"\\^]*r|t[\\\"\\^]*e[\\\"\\^]*m[\\\"\\^]*i[\\\"\\^]*n[\\\"\\^]*f[\\\"\\^]*o))|t[\\\"\\^]*(?:a[\\\"\\^]*(?:k[\\\"\\^]*e[\\\"\\^]*o[\\\"\\^]*w[\\\"\\^]*n|p[\\\"\\^]*i[\\\"\\^]*c[\\\"\\^]*f[\\\"\\^]*g|s[\\\"\\^]*k[\\\"\\^]*(?:k[\\\"\\^]*i[\\\"\\^]*l[\\\"\\^]*l|l[\\\"\\^]*i[\\\"\\^]*s[\\\"\\^]*t))|(?:c[\\\"\\^]*m[\\\"\\^]*s[\\\"\\^]*e[\\\"\\^]*t[\\\"\\^]*u|f[\\\"\\^]*t)[\\\"\\^]*p|(?:(?:e[\\\"\\^]*l[\\\"\\^]*n[\\\"\\^]*e|i[\\\"\\^]*m[\\\"\\^]*e[\\\"\\^]*o[\\\"\\^]*u)[\\\"\\^]*|r[\\\"\\^]*a[\\\"\\^]*c[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*(?:p[\\\"\\^]*)?)t|l[\\\"\\^]*n[\\\"\\^]*t[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*m[\\\"\\^]*n|p[\\\"\\^]*m[\\\"\\^]*(?:t[\\\"\\^]*o[\\\"\\^]*o[\\\"\\^]*l|v[\\\"\\^]*s[\\\"\\^]*c[\\\"\\^]*m[\\\"\\^]*g[\\\"\\^]*r)|s[\\\"\\^]*(?:(?:d[\\\"\\^]*i[\\\"\\^]*s[\\\"\\^]*)?c[\\\"\\^]*o[\\\"\\^]*n|e[\\\"\\^]*c[\\\"\\^]*i[\\\"\\^]*m[\\\"\\^]*p|k[\\\"\\^]*i[\\\"\\^]*l[\\\"\\^]*l|p[\\\"\\^]*r[\\\"\\^]*o[\\\"\\^]*f)|y[\\\"\\^]*p[\\\"\\^]*e[\\\"\\^]*p[\\\"\\^]*e[\\\"\\^]*r[\\\"\\^]*f|z[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l)|u[\\\"\\^]*n[\\\"\\^]*(?:e[\\\"\\^]*x[\\\"\\^]*p[\\\"\\^]*o[\\\"\\^]*s[\\\"\\^]*e|i[\\\"\\^]*q[\\\"\\^]*u[\\\"\\^]*e[\\\"\\^]*i[\\\"\\^]*d|l[\\\"\\^]*o[\\\"\\^]*d[\\\"\\^]*c[\\\"\\^]*t[\\\"\\^]*r)|v[\\\"\\^]*s[\\\"\\^]*s[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*m[\\\"\\^]*i[\\\"\\^]*n|w[\\\"\\^]*(?:a[\\\"\\^]*i[\\\"\\^]*t[\\\"\\^]*f[\\\"\\^]*o[\\\"\\^]*r|b[\\\"\\^]*a[\\\"\\^]*d[\\\"\\^]*m[\\\"\\^]*i[\\\"\\^]*n|(?:d[\\\"\\^]*s|e[\\\"\\^]*(?:c|v[\\\"\\^]*t))[\\\"\\^]*u[\\\"\\^]*t[\\\"\\^]*i[\\\"\\^]*l|h[\\\"\\^]*o[\\\"\\^]*a[\\\"\\^]*m[\\\"\\^]*i|i[\\\"\\^]*n[\\\"\\^]*(?:n[\\\"\\^]*t(?:[\\\"\\^]*3[\\\"\\^]*2)?|r[\\\"\\^]*s)|m[\\\"\\^]*i[\\\"\\^]*c|s[\\\"\\^]*c[\\\"\\^]*r[\\\"\\^]*i[\\\"\\^]*p[\\\"\\^]*t)|x[\\\"\\^]*c[\\\"\\^]*o[\\\"\\^]*p[\\\"\\^]*y)(?:\\.[\\\"\\^]*[0-9A-Z_a-z]+)?\\b\" \\\n    \"id:932380,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Windows Command Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-windows',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:932013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:932014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n# This rule is a stricter sibling to 932370\n#\n# This rule contains additional commands that are not matched at PL-1 due to being false positive prone or common english words.\n# Regular expression generated from regex-assembly/932371.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932371\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\\\"'\\(,@]*(?:[\\\"'\\.-9A-Z_a-z]+/|(?:[\\\"'\\x5c\\^]*[0-9A-Z_a-z][\\\"'\\x5c\\^]*:[^\\x5c]*|[ \\\"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\\\"\\^]*a[\\\"\\^]*t[\\\"\\^]*[\\s\\x0b,\\./;<>].*(?:\\.[\\\"\\^]*[0-9A-Z_a-z]+)?\\b\" \\\n    \"id:932371,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Windows Command Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-windows',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix command injection ]\n#\n# This rule targets pefix + the source command (dot character) at PL2.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932231.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932231\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?:b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*\\.[\\s\\x0b].*\\b\" \\\n    \"id:932231,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix Command Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This is a stricter sibling of rule 932130.\n#\n# It applies the same regular expression to the\n# User-Agent and Referer HTTP headers.\n#\n# Unlike the sibling rule, this rule runs in phase 1.\n#\n# Regular expression generated from regex-assembly/932131.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932131\n#\nSecRule REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer \"@rx \\$(?:\\((?:[^\\)]+|\\([^\\)]+\\))\\)|\\{[^\\}]+\\}|\\[[^\\]]*\\])|[<>]\\([^\\)]+\\)|/[0-9A-Z_a-z]*\\[[^\\]]+\\]\" \\\n    \"id:932131,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,\\\n    msg:'Remote Command Execution: Unix Shell Expression Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ Rule 932200 ]=-\n#\n# Block RCE Bypass using different techniques:\n# - uninitialized variables (https://www.secjuice.com/web-application-firewall-waf-evasion/)\n# - string concatenations (https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0)\n# - globbing patterns (https://medium.com/secjuice/waf-evasion-techniques-718026d693d8)\n#\n# Examples:\n# - foo;cat$u+/etc$u/passwd\n# - bar;cd+/etc;/bin$u/ca*+passwd\n# - foo;ca\\t+/et\\c/pa\\s\\swd\n# - foo;c'at'+/etc/pa's'swd\n# - foo;c$@at+/et$@c/pas$@swd\n# - foo;c$!at+/et$!c/pas$!swd\n# - foo;c$*at+/et$*c/pas$*swd\n# - foo;c$?at+/et$?c/pas$?swd\n# - foo;c$-at+/et$-c/pas$-swd\n# - foo;c$_at+/et$_c/pas$_swd\n# - foo;c$$at+/et$$c/pas$$swd\n#\n# Regex notes: https://regex101.com/r/V6wrCO/1\n#\n# The two chain rules looking for `/` and `\\s` prevent FPs for strings such as\n# - pa$word\n# - Price: $24.99\n# - rando$mstr.in/g.\n# The regular expression does not include this requirement, but we're looking for a unix command\n# separated by space, followed by an absolute path, e.g., `cat /etc/passwd`.\n#\n# Regular expression generated from regex-assembly/932200.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932200\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx ['\\*\\?\\x5c`][^\\n/]+/|/[^/]+?['\\*\\?\\x5c`]|\\$[!#\\$\\(\\*\\-0-9\\?-\\[_a-\\{]\" \\\n    \"id:932200,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,t:urlDecodeUni,\\\n    msg:'RCE Bypass Technique',\\\n    logdata:'Matched Data: %{TX.0} found within %{TX.932200_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.932200_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule MATCHED_VARS \"@rx /\" \\\n        \"t:none,\\\n        chain\"\n        SecRule MATCHED_VARS \"@rx \\s\" \\\n            \"t:none,\\\n            setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n            setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ Rule 932205 ]=-\n#\n# Sibling of 932200 targeting the Referer header. URLs cause false positives in rule 932200\n# and must be handled with additional checks.\n#\n# Regular expression generated from regex-assembly/932205.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932205 932205-chain1\n#\nSecRule REQUEST_HEADERS:Referer \"@rx ^[^#]+\" \\\n    \"id:932205,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,t:urlDecodeUni,\\\n    msg:'RCE Bypass Technique',\\\n    logdata:'Matched Data: %{TX.2} found within %{TX.932205_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.932205_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule TX:0 \"@rx ^[^\\.]+\\.[^;\\?]+[;\\?](.*(['\\*\\?\\x5c`][^\\n/]+/|/[^/]+?['\\*\\?\\x5c`]|\\$[!#\\$\\(\\*\\-0-9\\?-\\[_a-\\{]))\" \\\n        \"capture,\\\n        t:none,\\\n        chain\"\n        SecRule TX:1 \"@rx /\" \\\n            \"t:none,\\\n            chain\"\n            SecRule TX:1 \"@rx \\s\" \\\n                \"t:none,\\\n                setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n                setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ Rule 932206 ]=-\n#\n# Sibling of 932200 targeting the Referer header. URLs cause false positives in rule 932200\n# and must be handled with additional checks.\n#\n# Regular expression generated from regex-assembly/932206.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932206\n#\nSecRule REQUEST_HEADERS:Referer \"@rx ^[^\\.]*?(?:['\\*\\?\\x5c`][^\\n/]+/|/[^/]+?['\\*\\?\\x5c`]|\\$[!#\\$\\(\\*\\-0-9\\?-\\[_a-\\{])\" \\\n    \"id:932206,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,t:urlDecodeUni,\\\n    msg:'RCE Bypass Technique',\\\n    logdata:'Matched Data: %{TX.0} found within %{TX.932206_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.932206_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule MATCHED_VARS \"@rx /\" \\\n        \"t:none,\\\n        chain\"\n        SecRule MATCHED_VARS \"@rx \\s\" \\\n            \"t:none,\\\n            setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n            setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ Rule 932207 ]=-\n#\n# Sibling of 932200 targeting fragments in the Referer header.\n#\n# The last chain prevents FPs against the \"Scroll to text fragment\" browser feature\n# (https://wicg.github.io/scroll-to-text-fragment/).\n#\n# Regular expression generated from regex-assembly/932207.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932207 932207-chain1\n#\nSecRule REQUEST_HEADERS:Referer \"@rx #.*\" \\\n    \"id:932207,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,t:urlDecodeUni,\\\n    msg:'RCE Bypass Technique',\\\n    logdata:'Matched Data: %{TX.0} found within %{TX.932207_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.932207_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule TX:0 \"@rx ['\\*\\?\\x5c`][^\\n/]+/|/[^/]+?['\\*\\?\\x5c`]|\\$[!#\\$\\(\\*\\-0-9\\?-\\[_a-\\{]\" \\\n        \"capture,\\\n        t:none,\\\n        chain\"\n        SecRule MATCHED_VAR \"@rx /\" \\\n            \"t:none,\\\n            chain\"\n            SecRule MATCHED_VAR \"@rx \\s\" \\\n                \"t:none,\\\n                chain\"\n                SecRule MATCHED_VAR \"!@beginsWith #:~:text=\" \\\n                    \"t:none,\\\n                    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n                    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/932220.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932220\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i).\\|(?:[\\s\\x0b]*|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:(?:7[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[arx][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|(?:G[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?E[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?T|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z|c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[89][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?9|[au][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t|c|(?:m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?p|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)|d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[dfu]|i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[gr])|f[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[cgi]|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p)|h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:d|u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p)|i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[dp]|r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b)|j[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:j[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s|q)|k[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r|v)|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[cl]|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t|(?:p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?m)|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[cr]|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[ex]|i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p)|u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:3[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m|c)|x[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:x[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|z)|y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s|u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m)|z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h))[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:(?:[bdx]|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|q[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?)|l[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:(?:(?:u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?a|[lnps])[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|z[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:4[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?)?|r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[dv]|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?)|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[dt]|[ghu]|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?))[\\\"']?[\\s\\x0b&\\),<>\\|].*|a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?-[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?(?:[&\\),<>\\|]{1,10}|(?:[\\-\\.0-9A-Z_a-z][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?){1,10}[\\s\\x0b&\\),<>\\|\\}]{1,10})|(?:(?:b|(?:p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?t|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[ks])[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[jp][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?|s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?)[\\\"']?[\\s\\x0b&\\),<>\\|].*)|g[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?(?:[&\\),<>\\|]{1,10}|(?:[\\-\\.0-9A-Z_a-z][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?){1,10}[\\s\\x0b&\\),<>\\|\\}]{1,10})|(?:d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m|[hr][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c|i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t|o|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?g)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*)|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:(?:(?:[at][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b|f|(?:k[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?g|h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|x[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?z)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?|r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?)?)[\\\"']?[\\s\\x0b&\\),<>\\|].*|i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?(?:[\\s\\x0b&\\),<>\\|].*|[&\\),<>\\|]{1,10}|(?:[\\-\\.0-9A-Z_a-z][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?){1,10}[\\s\\x0b&\\),<>\\|\\}]{1,10}))))\" \\\n    \"id:932220,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix Command Injection with pipe',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# -=[ Rule 932240 ]=-\n#\n# Generic RCE Bypass blocking using different techniques: see https://github.com/coreruleset/coreruleset/issues/2632\n#\n# This rule complements rule 932230 with generic evasion detection.\n# Anything that uses a well-known evasion technique should be blocked at this level.\n# The chained rule will exclude false positives due to german thousands separators (e.g., 10'000).\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932240.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932240\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\-0-9_a-z]+(?:[\\s\\x0b]*[\\\"'][^\\s\\x0b\\\"',:]+[\\\"']|(?:[\\\"'][\\\"']+|[\\[-\\]]+|\\$+[!#\\*\\-0-9\\?@\\x5c_a-\\{]+|``|[\\$<>]\\(\\))[\\s\\x0b]*)[\\-0-9_a-z]+\" \\\n    \"id:932240,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix Command Injection evasion attempt detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{TX.932240_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.932240_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule MATCHED_VARS \"!@rx [0-9]\\s*\\'\\s*[0-9]\" \\\n        \"t:none,\\\n        setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Unix shell expressions - Bash Brace expansion ]\n#\n# This rule is a stricter sibling of rule 932280. It matches non-whitespace characters between braces,\n# as an extension of rule 932280, which only detects alphanumeric and underscore characters. This rule detects the following\n# patterns which are used in Unix shell scripts and one-liners:\n#\n# {,echo,#test}\n# {,cd,/etc,}\n# {,$'whoami',}\n# {,$\"whoami\",}\n# {,/?s?/?i?/c?t,/e??/p??s??,}\n#\n#\n# Regular expression generated from regex-assembly/932281.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932281\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\{[^\\s\\x0b,:\\}]*,[^\\s\\x0b]*\\}\" \\\n    \"id:932281,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Brace Expansion Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n\n# [ Sqlite System Command Execution ]\n#\n# This rule prevents execution of SQLite CLI commands like .system and .shell\n#\n# You can find a vulnerable script and a sample payload here:\n# https://github.com/qxxxb/ctf/tree/master/2021/zer0pts_ctf/baby_sqli\n#\n# List of sqlite3 CLI commands:\n# https://sqlite.org/cli.html\n#\n# Regular expression generated from regex-assembly/932210.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932210\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx ;[\\s\\x0b]*\\.[\\s\\x0b]*[\\\"']?(?:a(?:rchive|uth)|b(?:a(?:ckup|il)|inary)|c(?:d|h(?:anges|eck)|lone|onnection)|d(?:atabases|b(?:config|info)|ump)|e(?:cho|qp|x(?:cel|it|p(?:ert|lain)))|f(?:ilectrl|ullschema)|he(?:aders|lp)|i(?:mpo(?:rt|ster)|ndexes|otrace)|l(?:i(?:mi|n)t|o(?:ad|g))|(?:mod|n(?:onc|ullvalu)|unmodul)e|o(?:nce|pen|utput)|p(?:arameter|r(?:int|o(?:gress|mpt)))|quit|re(?:ad|cover|store)|s(?:ave|c(?:anstats|hema)|e(?:lftest|parator|ssion)|h(?:a3sum|ell|ow)?|tats|ystem)|t(?:ables|estc(?:ase|trl)|ime(?:out|r)|race)|vfs(?:info|list|name)|width)\" \\\n    \"id:932210,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:escapeSeqDecode,t:compressWhitespace,\\\n    msg:'Remote Command Execution: SQLite System Command Execution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix shell expressions - Bash Tilde expansion ]\n# This rule is a sibling of rule 932270\n#\n# Detects the following patterns which are common in Unix shell scripts\n# and one-liners:\n#\n# ~4    fourth directory entry on the stack from the top\n#\n# Reference - https://linuxsimply.com/bash-scripting-tutorial/expansion/tilde-expansion/\n#\n# Regular expression generated from regex-assembly/932271.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932271\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx ~[0-9]+\" \\\n    \"id:932271,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,\\\n    msg:'Remote Command Execution: Unix Shell Expression Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n\n# -=[ SMTP/IMAP/POP3 Command Execution ]=-\n#\n# Rationale\n# =========\n#\n# The rules for email command execution are based on the RFCs for each protocol.\n# Some of the commands have optional and/or additional parameters, so we tried to be\n# precise to avoid as many FP in PL2 rules.\n# For those commands that resemble common English words, and may pose a higher risk of false positives,\n# they have been split off to a sibling rule in PL3.\n\n# =[ SMTP Command Execution ]=\n#\n# This rule prevents execution of SMTP related system commands.\n#\n# List of SMTP commands: from rfc 5321 (https://www.rfc-editor.org/rfc/rfc5321)\n#\n# Regular expression generated from regex-assembly/932300.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932300\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\r\\n.*?\\b(?:E(?:HLO[\\s\\x0b][\\-\\.a-z]{1,255}|XPN[\\s\\x0b].{1,64})|HELO[\\s\\x0b][\\-\\.a-z]{1,255}|MAIL[\\s\\x0b]FROM:<.{1,64}@.{1,255}>|R(?:CPT[\\s\\x0b]TO:(?:<.{1,64}@.{1,255}>| )?<.{1,64}>|SET\\b)|VRFY[\\s\\x0b].{1,64}(?:[\\s\\x0b]<.{1,64}@.{1,255}>|@.{1,255})|AUTH[\\s\\x0b][\\-0-9_a-z]{1,20}[\\s\\x0b](?:(?:[\\+/-9A-Z_a-z]{4})*(?:[\\+/-9A-Z_a-z]{2}=|[\\+/-9A-Z_a-z]{3}))?=|STARTTLS\\b|NOOP\\b(?:[\\s\\x0b].{1,255})?)\" \\\n    \"id:932300,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:escapeSeqDecode,\\\n    msg:'Remote Command Execution: SMTP Command Execution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/137/134',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# =[ IMAP Command Execution ]=\n#\n# This rule prevents execution of IMAP4 related system commands.\n#\n# List of IMAP4 commands: from rfc 3501 (https://datatracker.ietf.org/doc/html/rfc3501#section-9)\n#\n# Note: Mailbox International Naming Convention uses UTF-7, so it was left out explicitly.\n#\n# Regular expression generated from regex-assembly/932310.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932310\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?is)\\r\\n[0-9A-Z_a-z]{1,50}\\b (?:A(?:PPEND (?:[\\\"#%&\\*\\--9A-Z\\x5c_a-z]+)?(?: \\([ \\x5ca-z]+\\))?(?: \\\"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [\\+\\-][0-9]{4}\\\"?)? \\{[0-9]{1,20}\\+?\\}|UTHENTICATE [\\-0-9_a-z]{1,20}\\r\\n)|L(?:SUB (?:[\\\"#\\*\\.-9A-Z_a-z~]+)? (?:[\\\"%&\\*\\.-9A-Z\\x5c_a-z]+)?|ISTRIGHTS (?:[\\\"%&\\*\\--9A-Z\\x5c_a-z]+)?)|S(?:TATUS (?:[\\\"%&\\*\\--9A-Z\\x5c_a-z]+)? \\((?:U(?:NSEEN|IDNEXT)|MESSAGES|UIDVALIDITY|RECENT| )+\\)|ETACL (?:[\\\"%&\\*\\--9A-Z\\x5c_a-z]+)? [\\+\\-][ac-eiklpr-twx]+?)|UID (?:COPY|FETCH|STORE) (?:[\\*,0-:]+)?|(?:(?:DELETE|GET)ACL|MYRIGHTS) (?:[\\\"%&\\*\\--9A-Z\\x5c_a-z]+)?)\" \\\n    \"id:932310,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:escapeSeqDecode,\\\n    msg:'Remote Command Execution: IMAP Command Execution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/137/134',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# =[ POP3 Command Execution ]=\n#\n# This rule prevents execution of POP3 related system commands.\n#\n# List of POP3 commands:\n# - from rfc 1939 (https://www.rfc-editor.org/rfc/rfc1939#appendix-B)\n# - extensions from rfc 2449 (https://www.rfc-editor.org/rfc/rfc2449)\n#\n# These commands all have some kind of parameter that makes them a good PL2 target.\n#\n# Regular expression generated from regex-assembly/932320.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932320\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?is)\\r\\n.*?\\b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [\\-0-9_a-z]{1,20} (?:(?:[\\+/-9A-Z_a-z]{4})*(?:[\\+/-9A-Z_a-z]{2}=|[\\+/-9A-Z_a-z]{3}))?=))\" \\\n    \"id:932320,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:escapeSeqDecode,\\\n    msg:'Remote Command Execution: POP3 Command Execution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/137/134',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Unix command injection ]\n#\n# This is a stricter sibling of rules 932230, 932235, 932250, 932260.\n# This stricter sibling detects Unix RCE with and without prefix and words of any length.\n# It uses the same regex.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932236.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932236\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:^(?:json\\.|\\x5c)?|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\\\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\\\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:z(?:(?:z|c(?:at|mp))[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\\\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\\\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\\\"']?[\\s\\x0b&\\),<>\\|])|tch[\\\"']?[\\s\\x0b&\\),<>\\|])|lkid[\\\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\\\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\\\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\\\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\\\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\\\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\\\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\\\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:(?:t|rl)[\\\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\\\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\\\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\\\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\\\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\\\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\\\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\\\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\\\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\\\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:sh|xfiles)?[\\\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|test)|n(?:d(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|con)|ger[\\\"']?[\\s\\x0b&\\),<>\\|]))|tp(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\\\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\\\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\\\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:homedircon|i(?:e[\\\"']?[\\s\\x0b&\\),<>\\|]|soimage))|t(?:cap|enforce|facl[\\\"']?[\\s\\x0b&\\),<>\\|]|sebool))|hc(?:-?[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep|ubby)[\\\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\\\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\\\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\\\"']?[\\s\\x0b&\\),<>\\|])|n(?:dexcon|stall[\\\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\\\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\\\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\\\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|inks|ynx)?[\\\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\\\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\\\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ad_policy|ca(?:l|te)|ok)[\\\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|il[qx]?|ke|wk)[\\\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|(?:tr|v|utt)[\\\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\\\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\\\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\\\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch|wrole[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\\\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\\\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\\\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\\\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|rted|tch)[\\\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\\\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\\\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|wd|xz|u(?:ppet|shd))[\\\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\\\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\\\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\\\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\\\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\\\"']?[\\s\\x0b&\\),<>\\|]))|t(?:x[\\\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\\\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\\\"']?[\\s\\x0b&\\),<>\\|]|sh))|o(?:licygentool|pd[\\\"']?[\\s\\x0b&\\),<>\\|])|s(?:(?:ed|ql)[\\\"']?[\\s\\x0b&\\),<>\\|]|ftp)|y(?:3?versions|thon(?:[23]|[^\\s\\x0b]{1,10}\\b)))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name)[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|p(?:eat[\\\"']?[\\s\\x0b&\\),<>\\|]|l(?:ace[\\\"']?[\\s\\x0b&\\),<>\\|]|con))|st(?:ic|orecon(?:_xattr|d)?))|m(?:(?:dir)?[\\\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\\\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|_init|c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\\\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|a(?:ndbox|sh)|diff|(?:ft|na)p|l(?:eep|sh)|plit)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:d(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|iff)|t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|en(?:force|v)|f(?:acl[\\\"']?[\\s\\x0b&\\),<>\\|]|iles)|s(?:ebool|id))|a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\\\"']?[\\s\\x0b&\\),<>\\|])|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|(?:ndmail|rvice)[\\\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus))|h(?:(?:red|u(?:f|tdown))?[\\\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\\\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\\\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\\\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\\\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\\\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|ftp|mux)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\\\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\\\"']?[\\s\\x0b&\\),<>\\|]|me(?:datectl|out[\\\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:p|uch)[\\\"']?[\\s\\x0b&\\),<>\\|]|gglesebool)|c(?:l?sh[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\\\"']?[\\s\\x0b&\\),<>\\|])|off[\\\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\\\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\\\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\\\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\\\"']?[\\s\\x0b&\\),<>\\|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|diff)|(?:[ep]w|gr|rsh)[\\\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|algrind|olatility[\\\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:3m|c|a(?:ll|tch)|get)[\\\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\\\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\\\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\\\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\\\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\\\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\\\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\\\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\\\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\\\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\\\"']?[\\s\\x0b&\\),<>\\|])|ypper))\" \\\n    \"id:932236,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix Command Injection (command without evasion)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix command injection ]\n#\n# This is a sibling of rule 932236.\n# This sibling detects Unix RCE in request headers Referer and User-Agent.\n# It uses the same regex but excludes known user-agents to avoid false positives.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n#\n# Regular expression generated from regex-assembly/932239.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932239\n#\nSecRule REQUEST_FILENAME|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer \"@rx (?i)(?:^(?:json\\.|\\x5c)?|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\\\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\\\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:z(?:(?:z|c(?:at|mp))[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\\\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\\\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\\\"']?[\\s\\x0b&\\),<>\\|])|tch[\\\"']?[\\s\\x0b&\\),<>\\|])|lkid[\\\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\\\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\\\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\\\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\\\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\\\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\\\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\\\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\\\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\\\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\\\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\\\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\\\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\\\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\\\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\\\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\\\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\\\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:sh|xfiles)?[\\\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|test)|n(?:d(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|con)|ger[\\\"']?[\\s\\x0b&\\),<>\\|]))|tp(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\\\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\\\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\\\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:homedircon|i(?:e[\\\"']?[\\s\\x0b&\\),<>\\|]|soimage))|t(?:cap|enforce|facl[\\\"']?[\\s\\x0b&\\),<>\\|]|sebool))|hc(?:-?[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep|ubby)[\\\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\\\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\\\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\\\"']?[\\s\\x0b&\\),<>\\|])|n(?:dexcon|stall[\\\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\\\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\\\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\\\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\\\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\\\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\\\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ad_policy|ca(?:l|te)|ok)[\\\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|il[qx]?|ke|wk)[\\\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|(?:tr|v|utt)[\\\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\\\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\\\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\\\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch|wrole[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\\\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\\\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\\\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\\\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|rted|tch)[\\\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\\\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\\\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|wd|xz|u(?:ppet|shd))[\\\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\\\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\\\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\\\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\\\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\\\"']?[\\s\\x0b&\\),<>\\|]))|t(?:x[\\\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\\\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\\\"']?[\\s\\x0b&\\),<>\\|]|sh))|o(?:licygentool|pd[\\\"']?[\\s\\x0b&\\),<>\\|])|s(?:(?:ed|ql)[\\\"']?[\\s\\x0b&\\),<>\\|]|ftp)|y(?:3?versions|thon[23]))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name)[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|p(?:eat[\\\"']?[\\s\\x0b&\\),<>\\|]|l(?:ace[\\\"']?[\\s\\x0b&\\),<>\\|]|con))|st(?:ic|orecon(?:_xattr|d)?))|m(?:(?:dir)?[\\\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\\\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|_init|c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\\\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|a(?:ndbox|sh)|diff|ftp|l(?:eep|sh)|plit)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:d(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|iff)|t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|en(?:force|v)|f(?:acl[\\\"']?[\\s\\x0b&\\),<>\\|]|iles)|s(?:ebool|id))|a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\\\"']?[\\s\\x0b&\\),<>\\|])|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|(?:ndmail|rvice)[\\\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus))|h(?:(?:red|u(?:f|tdown))?[\\\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\\\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\\\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\\\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\\\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\\\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|ftp|mux)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\\\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\\\"']?[\\s\\x0b&\\),<>\\|]|me(?:datectl|out[\\\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:p|uch)[\\\"']?[\\s\\x0b&\\),<>\\|]|gglesebool)|c(?:l?sh[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\\\"']?[\\s\\x0b&\\),<>\\|])|off[\\\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\\\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\\\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\\\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\\\"']?[\\s\\x0b&\\),<>\\|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|diff)|(?:[ep]w|gr|rsh)[\\\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|algrind|olatility[\\\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:c|a(?:ll|tch))[\\\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\\\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\\\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\\\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\\\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\\\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\\\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\\\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\\\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\\\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\\\"']?[\\s\\x0b&\\),<>\\|])|ypper))\" \\\n    \"id:932239,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix Command Injection found in user-agent or referer header',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Unix shell snippets ]\n#\n# Detect some common sequences found in shell commands and scripts.\n#\n# Some commands which were restricted in earlier rules due to FP,\n# have been added here with their full path, in order to catch some\n# cases where the full path is sent.\n#\n# Rule relations:\n#\n#  .932160 (base rule, PL1, unix shell commands with full path)\n#  ..932161 (stricter sibling, PL2, unix shell commands with full path in User-Agent and Referer request headers)\n#\nSecRule REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer \"@pmFromFile unix-shell.data\" \\\n    \"id:932161,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,t:normalizePath,\\\n    msg:'Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# [ Shell fork bomb detection ]\n#\n# This rule detects shell fork bomb patterns, where a function is defined\n# whose body recursively calls itself via pipe and / or background process,\n# causing exponential process creation that exhausts system resources.\n#\n# Examples:\n#   :(){ :|:& };:\n#   f(){ f|f& };f\n#   test() { test | test & }; test\n#\n# The detection targets the structural pattern:\n#   <name>() { <name call> <| or &> <name call> <optional &> }; <name call>\n# where <name> can be any identifier including bash builtins like : or .\n#\n# Regular expression generated from regex-assembly/932390.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932390\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx [\\.0-:A-Z_a-z]+[\\s\\x0b]*\\([\\s\\x0b]*\\)[\\s\\x0b]*\\{[^\\}]+[&\\|][^\\}]+\\}\" \\\n    \"id:932390,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Remote Command Execution: Shell Fork Bomb',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:932015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:932016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n# [ Unix command injection ]\n#\n# This rule targets pefix + commans that are prone to false positive detection at PL3.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932232.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932232\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?:b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:(?:(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?2[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n|s)|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?f|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o|[\\\"']?[\\s\\x0b&\\),<>\\|].*))\\b\" \\\n    \"id:932232,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix Command Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix command injection ]\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932237.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932237\n#\nSecRule REQUEST_FILENAME|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer \"@rx (?i)\\b(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|t(?:obm)?|w[ks]|l(?:ias|pine)|xel)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:(?:itude)?[\\\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\\\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h?[\\\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:z(?:(?:z|c(?:at|mp))[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\\\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\\\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\\\"']?[\\s\\x0b&\\),<>\\|])|tch[\\\"']?[\\s\\x0b&\\),<>\\|])|lkid[\\\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\\\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\\\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\\\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\\\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\\\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\\\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\\\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\\\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\\\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\\\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\\\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\\\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\\\"']?[\\s\\x0b&\\),<>\\|]|nf(?:[\\\"']?[\\s\\x0b&\\),<>\\|])?|hclient|m(?:esg[\\\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\\\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\\\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\\\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:sh|xfiles)?[\\\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|test)|n(?:d(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|con)|ger[\\\"']?[\\s\\x0b&\\),<>\\|]))|tp(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\\\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\\\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\\\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:homedircon|i(?:e[\\\"']?[\\s\\x0b&\\),<>\\|]|soimage))|t(?:cap|enforce|facl[\\\"']?[\\s\\x0b&\\),<>\\|]|sebool))|hc(?:-?[\\\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\\\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep|ubby)[\\\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\\\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\\\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv)[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\\\"']?[\\s\\x0b&\\),<>\\|])|n(?:dexcon|stall[\\\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\\\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\\\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\\\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\\\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\\\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\\\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ad_policy|ca(?:l|te)|ok)[\\\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|il[qx]?|ke|wk)[\\\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|(?:tr|v|utt)[\\\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\\\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:(?:re|unt)[\\\"']?[\\s\\x0b&\\),<>\\|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\\\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch|wrole[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\\\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\\\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\\\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\\\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|cman|rted|tch)[\\\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\\\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\\\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\\\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|wd|xz|u(?:ppet|shd))[\\\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\\\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\\\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\\\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\\\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\\\"']?[\\s\\x0b&\\),<>\\|]))|s(?:(?:ed|ql)?[\\\"']?[\\s\\x0b&\\),<>\\|]|ftp)|t(?:x[\\\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\\\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\\\"']?[\\s\\x0b&\\),<>\\|]|sh))|o(?:licygentool|pd[\\\"']?[\\s\\x0b&\\),<>\\|])|y(?:3?versions|thon[23]))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name)[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|p(?:eat[\\\"']?[\\s\\x0b&\\),<>\\|]|l(?:ace[\\\"']?[\\s\\x0b&\\),<>\\|]|con))|st(?:ic|orecon(?:_xattr|d)?))|m(?:(?:dir)?[\\\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\\\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|_init|c(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\\\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|a(?:ndbox|sh)|diff|ftp|l(?:eep|sh)|plit)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:d(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|iff)|t(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|en(?:force|v)|f(?:acl[\\\"']?[\\s\\x0b&\\),<>\\|]|iles)|s(?:ebool|id))|a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\\\"']?[\\s\\x0b&\\),<>\\|])|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|(?:ndmail|rvice)[\\\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus))|h(?:(?:red|u(?:f|tdown))?[\\\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\\\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\\\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\\\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\\\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\\\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|ftp|mux)[\\\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\\\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\\\"']?[\\s\\x0b&\\),<>\\|]|me(?:(?:out)?[\\\"']?[\\s\\x0b&\\),<>\\|]|datectl))|o(?:(?:p|uch)[\\\"']?[\\s\\x0b&\\),<>\\|]|gglesebool)|c(?:l?sh[\\\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\\\"']?[\\s\\x0b&\\),<>\\|])|off[\\\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\\\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\\\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\\\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\\\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\\\"']?[\\s\\x0b&\\),<>\\|]|std))|p(?:2date[\\\"']?[\\s\\x0b&\\),<>\\|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:[ep]w|gr|rsh)?[\\\"']?[\\s\\x0b&\\),<>\\|]|m(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|diff)|sudo(?:-rs)?)|algrind|olatility[\\\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:c|a(?:ll|tch))?[\\\"']?[\\s\\x0b&\\),<>\\|]|h(?:o(?:(?:is)?[\\\"']?[\\s\\x0b&\\),<>\\|]|ami)?|iptail[\\\"']?[\\s\\x0b&\\),<>\\|])|i(?:reshark|sh[\\\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\\\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\\\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\\\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\\\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\\\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\\\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\\\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\\\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\\\"']?[\\s\\x0b&\\),<>\\|])|ypper))(?:\\b|[^0-9A-Z_a-z])\" \\\n    \"id:932237,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,t:normalizePath,\\\n    msg:'Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix command injection ]\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932238.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932238\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@*|REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent \"@rx (?i)(?:^(?:json\\.|\\x5c)?|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:(?:(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?2[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|p[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n|s)|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|d[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?f|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o|[\\\"']?[\\s\\x0b&\\),<>\\|].*))\" \\\n    \"id:932238,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:cmdLine,t:normalizePath,\\\n    msg:'Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n# This rule detects command evasion via quotes(single/double).\n# For e.g.,\n#\n# 'i'fconfig\n# \"e\"cho whatever\n# 'i'p a\n#\n# Regular expression generated from regex-assembly/932290.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932290\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* \"@rx (?:'[0-9A-Z_a-z]+'|\\\"[0-9A-Z_a-z]+\\\")[0-9A-Z_a-z]+\\b|[0-9A-Z_a-z]+(?:'[0-9A-Z_a-z]+'|\\\"[0-9A-Z_a-z]+\\\")\" \\\n    \"id:932290,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Quote evasion Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ Bypass Rule 930120 (wildcard) ]=-\n#\n# When Paranoia Level is set to 1 and 2, a Remote Command Execution\n# could be exploited bypassing rule 930120 (OS File Access Attempt)\n# by using wildcard characters.\n#\n# In some other cases, it could be bypassed even if the Paranoia Level is set to 3.\n# Please, keep in mind that this rule could lead to many false positives.\n#\n# The following two blog posts explain the evasions this rule is designed to detect:\n# - https://medium.com/secjuice/waf-evasion-techniques-718026d693d8\n# - https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0\n\n# Regular expression generated from regex-assembly/932190.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932190\n#\nSecRule ARGS \"@rx (?i)/(?:[\\*\\?]+[/-9A-Z_a-z]|[/-9A-Z_a-z]+[\\*\\?])\" \\\n    \"id:932190,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:normalizePath,t:cmdLine,\\\n    msg:'Remote Command Execution: Wildcard bypass technique attempt',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n# [ Unix command injection ]\n#\n# This rule is meant to block the execution of commands with no arguments when it's possible to meaningfully do so.\n#\n# Rule relations:\n#\n#  .932230 (base rule, PL1, targets prefix + two and three character commands)\n#  ..932231 (stricter sibling, PL2, targets prefix + the source shortcut command)\n#  ..932232 (stricter sibling, PL3, targets prefix + additional command words)\n#  .932235 (base rule, PL1, targets prefix + known command word of length > 3 without evasion)\n#\n#  .932250 (base rule, PL1, targets two and three character commands)\n#  .932260 (base rule, PL1, targets known command word of length > 3 without evasion)\n#  .932340 (PL-1, matches commands with no arguments)\n#  .932350 (PL-3, matches commands with no arguments)\n#\n#  .932240 (generic detection, PL2, targets generic evasion attempts)\n#  .932236 (stricter sibling of 932230, 932235, 932250, 932260, PL2,\n#       - with and without prefix\n#       - words of any length)\n#  ..932239 (sibling of 932236, PL2,\n#       - with and without prefix\n#       - words of any length\n#       - targets request headers user-agent and referer only\n#       - excluded words: known user-agents)\n#  ..932238 (stricter sibling of 932236, PL3,\n#       - no excluded words)\n#  .932237 (stricter sibling of 932230, 932235, 932250, 932260, PL3,\n#       - targets request headers user-agent and referer only\n#       - without prefix\n#       - with word boundaries\n#       - words of any length\n#       - excluded words: known user-agents)\n#\n#\n# Regular expression generated from regex-assembly/932350.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932350\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:^(?:json\\.|\\x5c)?|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\\\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\\\"']?[\\s\\x0b&\\),<>\\|].*|o[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\\\"']*(?:[\\\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\\\"'\\x5c]*(?:(?:aptitud|unam)e|d(?:f|ir|mesg)|env|h(?:istory|ostname|top)|i(?:d|ostat)|l(?:ast(?:log(?:in)?)?|s)|mysql(?:[^\\s\\x0b]{1,10}\\b)?|p(?:s(?:ql)?|wd)|(?:reboo|vmsta)t|s(?:(?:cree|hutdow)n|et|u)|top|w(?:ho(?:ami|is)?)?)[\\\"']?$\" \\\n    \"id:932350,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Direct Unix Command Execution (No Arguments)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n# -=[ SMTP commands ]=-\n#\n# This rule prevents execution of SMTP related system commands.\n#\n# These commands may have a higher risk of false positives.\n# For explanation of this rule, see above rule 932300.\n#\n# Rule 932301 is a stricter sibling of rule 932300.\n#\n# Regular expression generated from regex-assembly/932301.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932301\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\r\\n.*?\\b(?:DATA|QUIT|HELP(?: .{1,255})?)\" \\\n    \"id:932301,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:escapeSeqDecode,\\\n    msg:'Remote Command Execution: SMTP Command Execution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/137/134',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n# =[ IMAP4 Command Execution ]=\n#\n# This rule prevents execution of IMAP4 related system commands.\n#\n# These commands may have a higher risk of false positives.\n# For explanation of this rule, see above rule 932310.\n#\n# Rule 932311 is a stricter sibling of rule 932310.\n#\n# Regular expression generated from regex-assembly/932311.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932311\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?is)\\r\\n[0-9A-Z_a-z]{1,50}\\b (?:C(?:(?:REATE|OPY [\\*,0-:]+) [\\\"#%&\\*\\--9A-Z\\x5c_a-z]+|APABILITY|HECK|LOSE)|DELETE [\\\"#%&\\*\\-\\.0-9A-Z\\x5c_a-z]+|EX(?:AMINE [\\\"#%&\\*\\-\\.0-9A-Z\\x5c_a-z]+|PUNGE)|FETCH [\\*,0-:]+|L(?:IST [\\\"#\\*\\--9A-Z\\x5c_a-z~]+? [\\\"#%&\\*\\--9A-Z\\x5c_a-z]+|OG(?:IN [\\-\\.0-9@_a-z]{1,40} .*?|OUT))|RENAME [\\\"#%&\\*\\--9A-Z\\x5c_a-z]+? [\\\"#%&\\*\\--9A-Z\\x5c_a-z]+|S(?:E(?:LECT [\\\"#%&\\*\\--9A-Z\\x5c_a-z]+|ARCH(?: CHARSET [\\-\\.0-9A-Z_a-z]{1,40})? (?:(KEYWORD \\x5c)?(?:A(?:LL|NSWERED)|BCC|D(?:ELETED|RAFT)|(?:FLAGGE|OL)D|RECENT|SEEN|UN(?:(?:ANSWER|FLAGG)ED|D(?:ELETED|RAFT)|SEEN)|NEW)|(?:BODY|CC|FROM|HEADER .{1,100}|NOT|OR .{1,255}|T(?:EXT|O)) .{1,255}|LARGER [0-9]{1,20}|[\\*,0-:]+|(?:BEFORE|ON|S(?:ENT(?:(?:BEFOR|SINC)E|ON)|INCE)) \\\"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}\\\"?|S(?:MALLER [0-9]{1,20}|UBJECT .{1,255})|U(?:ID [\\*,0-:]+?|NKEYWORD \\x5c(Seen|(?:Answer|Flagg)ed|D(?:eleted|raft)|Recent))))|T(?:ORE [\\*,0-:]+? [\\+\\-]?FLAGS(?:\\.SILENT)? (?:\\(\\x5c[a-z]{1,20}\\))?|ARTTLS)|UBSCRIBE [\\\"#%&\\*\\--9A-Z\\x5c_a-z]+)|UN(?:SUBSCRIBE [\\\"#%&\\*\\--9A-Z\\x5c_a-z]+|AUTHENTICATE)|NOOP)\" \\\n    \"id:932311,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:escapeSeqDecode,\\\n    msg:'Remote Command Execution: IMAP Command Execution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/137/134',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n# =[ POP3 Command Execution ]=\n#\n# This rule prevents execution of POP3 related system commands.\n#\n# These commands may have a higher risk of false positives.\n# For explanation of this rule, see above rule 932320.\n#\n# Rule 932321 is a stricter sibling of rule 932320.\n#\n# Regular expression generated from regex-assembly/932321.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 932321\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\r\\n.*?\\b(?:(?:QUI|STA|RSE)T|NOOP|CAPA)\" \\\n    \"id:932321,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:escapeSeqDecode,\\\n    msg:'Remote Command Execution: POP3 Command Execution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/137/134',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n# =[ Unix shell history invocation ]=\n#\n# This rule is a stricter sibling of 932330.\n# Shell history can also be invoked by providing an absolute position: '!1' or by repeating the last command '!!'.\n# The latter might seem harmless as you would expect that it already requires a successful exploitation, but it is a threat in disguise.\n#\n# Imagine the following requests:\n#   GET /?rce=c\n#   GET /?rce=!!!!\n# The last request will invoke /usr/bin/cc, which is otherwise blocked by 932250.\n#\n# Neither !1 nor !! is necessarily valid speech, but blocking either of them is much more likely to cause false-positives than 932330.\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx !(?:\\d|!)\" \\\n    \"id:932331,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Remote Command Execution: Unix shell history invocation',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-shell',\\\n    tag:'platform-unix',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-RCE',\\\n    tag:'capec/1000/152/248/88',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:932017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:932018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-932-APPLICATION-ATTACK-RCE\"\n",
+    "owasp-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:933011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:933012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ PHP Injection Attacks ]=-\n#\n# [ References ]\n# https://rips-scanner.sourceforge.net/\n# https://wiki.owasp.org/index.php/PHP_Top_5#P1:_Remote_Code_Executionh\n#\n\n#\n# [ PHP Open Tag Found ]\n#\n# Detects PHP open tags \"<?\" and \"<?php\".\n# http://www.php.net/manual/en/language.basic-syntax.phptags.php\n#\n# Care is taken to avoid false positives in XML declarations \"<?xml...\"\n#\n# Also detects \"[php]\", \"[/php]\" and \"[\\php]\" tags used by some applications\n# to indicate PHP dynamic content, and Smarty template engine \"{php}\" and\n# \"{/php}\" tags (deprecated since Smarty 3.1.0, removed in later versions).\n#\n# Previously, this rule also checked for the PHP close tag '?>', but\n# this resulted in false positives which were difficult to prevent.\n# Therefore, that pattern is now checked by rule 933190 in paranoia levels\n# 3 or higher.\n#\n# Regular expression generated from regex-assembly/933100.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933100\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)<\\?(?:php[\\s\\x0b]|[\\s\\x0b=]|xml(?:[\\s\\x0b]+[^a-z]|:)|$)|\\[[/\\x5c]?php\\]|\\{/?php\\}\" \\\n    \"id:933100,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: PHP Open Tag Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# [ PHP Script Uploads ]\n#\n# Block file uploads with filenames ending in PHP related extensions\n# (.php, .phps, .phtml, .php5 etc).\n#\n# Many application contain Unrestricted File Upload vulnerabilities.\n# https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload\n#\n# Attackers may use such a vulnerability to achieve remote code execution\n# by uploading a .php file. If the upload storage location is predictable\n# and not adequately protected, the attacker may then request the uploaded\n# .php file and have the code within it executed on the server.\n#\n# Also block files with just dot (.) or slash (/) characters after the\n# extension (ref V29-260924):\n# https://www.rapid7.com/blog/post/2013/08/15/time-to-patch-joomla/\n#\n# Some AJAX uploaders use the nonstandard request headers X-Filename,\n# X_Filename, or X-File-Name to transmit the file name to the server;\n# scan these request headers as well as multipart/form-data file names.\n#\nSecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name \"@rx .*\\.ph(?:p\\d*|tml|ar|ps|t|pt)[./]*$\" \\\n    \"id:933110,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,t:removeWhitespace,\\\n    msg:'PHP Injection Attack: PHP Script File Upload Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Configuration Directives ]\n#\n# Regular expression generated from regex-assembly/933120.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933120\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:a(?:llow_url_(?:fopen|include)|pc.(?:coredump_unmap|en(?:able(?:_cli|d)|tries_hint)|(?:gc_)?ttl|mmap_file_mask|preload_path|s(?:erializer|hm_s(?:egments|ize)|lam_defense)|use_request_time)|rg_separator.(?:in|out)put|ssert.(?:active|(?:bai|quiet_eva)l|callback|exception|warning)|uto_(?:(?:ap|pre)pend_file|detect_line_endings|globals_jit))|b(?:cmath.scale|rowscap)|c(?:gi.(?:check_shebang_line|(?:discard_pat|np)h|f(?:ix_pathinfo|orce_redirect)|r(?:edirect_status_env|fc2616_headers))|hild_terminate|li(?:_server.color|.p(?:ager|rompt))|om.(?:a(?:llow_dcom|utoregister_(?:(?:casesensitiv|verbos)e|typelib))|(?:code_pag|typelib_fil)e|dotnet_version)|url.cainfo)|d(?:ate.(?:(?:default_l(?:at|ong)itud|timezon)e|sun(?:rise|set)_zenith)|ba.default_handler|efault_(?:(?:charse|socket_timeou)t|mimetype)|is(?:able_(?:classe|function)|play_(?:startup_)?error)s|oc(?:_roo|ref_(?:ex|roo))t)|e(?:n(?:able_(?:dl|post_data_reading)|gine)|rror_(?:(?:(?:ap|pre)pend_str|report)in|lo)g|x(?:i(?:f.(?:decode_(?:jis|unicode)_(?:intel|motorola)|encode_(?:jis|unicode))|t_on_timeout)|tension(?:_dir)?|p(?:ect.(?:log(?:file|user)|match_max|timeout)|ose_php)))|f(?:astcgi.(?:impersonate|logging)|fi.(?:enable|preload)|il(?:e_uploads|ter.default(?:_flags)?))|g(?:d.jpeg_ignore_warning|eoip.custom_directory)|h(?:ard_timeout|ighlight.(?:(?:commen|defaul)t|html|keyword|string)|tml_errors)|i(?:b(?:ase.(?:(?:allow_persisten|time(?:stamp)?forma)t|d(?:ateformat|efault_(?:charset|db|password|user))|max_(?:links|persistent))|m_db2.(?:binmode|i(?:5_(?:all(?:_pconnec|ow_commi)t|dbcs_alloc|ignore_userid)|nstance_name)))|conv.(?:in(?:put|ternal)|output)_encoding|g(?:binary.compact_strings|nore_(?:repeated_(?:errors|source)|user_abort))|m(?:a(?:gick.(?:locale_fix|progress_monitor|skip_version_check)|p.enable_insecure_rsh)|plicit_flush)|n(?:clude_path|put_encoding|t(?:ernal_encoding|l.(?:default_locale|error_level|use_exceptions))))|l(?:dap.max_links|og_errors(?:_max_len)?)|m(?:a(?:gic_quotes_(?:gpc|runtime)|il(?:.(?:add_x_header|force_extra_parameters|log)|parse.def_charset)|x_(?:execution_time|file_uploads|input_(?:nesting_level|time|vars)))|bstring.(?:detect_order|encoding_translation|func_overload|http_(?:input|output(?:_conv_mimetypes)?)|internal_encoding|language|regex_(?:retry|stack)_limit|s(?:trict_detection|ubstitute_character))|crypt.(?:algorithm|mode)s_dir|em(?:cache(?:.(?:allow_failover|c(?:hunk_size|ompress_threshold)|(?:default_por|lock_timeou)t|hash_(?:function|strategy)|max_failover_attempts|protocol|(?:session_)?redundancy)|d.(?:compression_(?:factor|t(?:hreshold|ype))|default_(?:binary_protocol|con(?:nect_timeout|sistent_hash))|s(?:e(?:rializer|ss_(?:binary(?:_protocol)?|con(?:nect_timeout|sistent_hash(?:_type)?)|lock(?:_(?:expire|retries|wait(?:_m(?:ax|in))?)|ing)|number_of_replicas|p(?:ersistent|refix)|r(?:andomize_replica_read|emove_failed(?:_servers)?)|s(?:asl_(?:password|username)|erver_failure_limit)))|tore_retry_count)|use_sasl))|ory_limit)|ysql(?:.(?:allow_(?:local_infile|persistent)|connect_timeout|default_(?:(?:hos|socke)t|p(?:assword|ort)|user)|max_(?:links|persistent)|trace_mode)|i.(?:allow_(?:local_infile|persistent)|default_(?:(?:hos|socke)t|p(?:ort|w)|user)|local_infile_directory|max_(?:links|persistent)|r(?:econnect|ollback_on_cached_plink))|nd.(?:collect_(?:memory_)?statistics|debug|(?:fetch_data_cop|sha256_server_public_ke)y|log_mask|mempool_default_size|net_(?:cmd_buffer_size|read_(?:buffer_size|timeout))|trace_alloc)))|o(?:ci8.(?:(?:connection_clas|event|old_oci_close_semantic)s|default_prefetch|max_persistent|p(?:ersistent_timeout|ing_interval|r(?:efetch_lob_size|ivileged_connect))|statement_cache_size)|dbc.(?:(?:allow|check)_persistent|default(?:_(?:cursortype|db|pw|user)|binmode|lrl)|max_(?:links|persistent))|p(?:cache.(?:blacklist_filename|c(?:ache_id|onsistency_checks)|dups_fix|e(?:nable(?:_(?:cli|file_override))?|rror_log)|f(?:ast_shutdown|ile_(?:cache(?:_(?:consistency_checks|fallback|only))?|update_protection)|orce_restart_timeout)|(?:huge_code_page|save_comment)s|in(?:herited_hack|terned_strings_buffer)|jit(?:_(?:b(?:isect_limit|(?:lacklist_(?:root|side)_trac|uffer_siz)e)|debug|hot_(?:func|loop|return|side_exit)|max_(?:exit_counter|(?:loop_unro|polymorphic_ca)ll|r(?:ecursive_(?:call|return)|oot_trace)|side_trace)s|prof_threshold))?|lo(?:ckfile_path|g_verbosity_level)|m(?:ax_(?:accelerated_files|(?:file_siz|wasted_percentag)e)|emory_consumption|map_base)|opt(?:_debug|imization)_level|pr(?:e(?:ferred_memory_model|load(?:_user)?)|otect_memory)|re(?:cord_warnings|strict_api|validate_(?:freq|path))|use_cwd|validate_(?:permission|root|timestamps))|en(?:_basedir|ssl.ca(?:file|path)))|utput_(?:(?:buffer|encod)ing|handler))|p(?:cre.(?:(?:backtrack|recursion)_lim|j)it|do(?:_odbc.(?:connection_pooling|db2_instance_name)|.dsn)|gsql.(?:a(?:llow|uto_reset)_persistent|(?:ignore|log)_notice|max_(?:links|persistent))|h(?:ar.(?:cache_list|re(?:adonly|quire_hash))|pdbg.(?:eol|path))|recision|ost_max_size)|r(?:e(?:alpath_cache_(?:size|ttl)|gister_argc_argv|port_(?:memleaks|zend_debug)|quest_order)|unkit.(?:internal_override|superglobal))|s(?:e(?:aslog.(?:appender(?:_retry)?|buffer_(?:disabled_in_cli|size)|d(?:efault_(?:basepath|datetime_format|logger|template)|isting_(?:(?:by_hou|folde)r|type))|ignore_warning|level|re(?:call_depth|mote_(?:hos|por|timeou)t)|t(?:hrow_exception|r(?:ace_(?:e(?:rror|xception)|notice|warning)|im_wrap))|use_buffer)|ndmail_(?:from|path)|rialize_precision|ssion.(?:auto_start|c(?:ache_(?:expire|limiter)|ookie_(?:domain|httponly|(?:lifetim|s(?:amesit|ecur))e|path))|entropy_(?:file|length)|gc_(?:divisor|maxlifetime|probability)|hash_(?:bits_per_character|function)|(?:lazy_writ|nam)e|referer_check|s(?:ave_(?:handler|path)|erialize_handler|id_(?:bits_per_character|length))|trans_sid_(?:host|tag)s|u(?:pload_progress.(?:cleanup|enabled|(?:min_)?freq|name|prefix)|se_(?:(?:only_)?cookies|strict_mode|trans_sid))))|hort_open_tag|mtp(?:_port)?|oap.wsdl_cache(?:_(?:dir|enabled|limit|ttl))?|ql(?:.safe_mode|ite3.(?:defensive|extension_dir))|tomp.default_(?:broker|(?:connection|read)_timeout_u?sec)|woole.(?:aio_thread_num|display_errors|enable_(?:coroutine|library|preemptive_scheduler)|(?:fast_serializ|u(?:nixsock_buffer_siz|se_(?:namespac|shortnam)))e)|ys(?:_temp_dir|log.(?:f(?:acility|ilter)|ident)|vshm.init_mem))|t(?:aint.e(?:nable|rror_level)|idy.(?:clean_output|default_config)|ra(?:ck_errors|der.real_(?:precision|round_mode)))|u(?:nserialize_(?:callback_func|max_depth)|opz.(?:disable|exit|overloads)|pload(?:_(?:max_filesize|tmp_dir)|progress.file.filename_template)|rl_rewriter.(?:host|tag)s|ser_(?:agent|dir|ini.(?:cache_ttl|filename)))|v(?:8js.(?:flag|max_disposed_context)s|ariables_order|ld.(?:(?:activ|execut)e|skip_(?:ap|pre)pend))|w(?:in(?:cache.(?:chkinterval|enablecli|f(?:c(?:achesize|enabled(?:filter)?|ndetect)|ile(?:count|mapdir))|(?:ignorelis|namesal)t|maxfilesize|oc(?:achesize|enabled(?:filter)?)|reroute(?:_enabled|ini)|s(?:cachesize|rwlocks)|ttlmax|uc(?:achesize|enabled))|dows.show_crt_warning)|khtmltox.graphics)|x(?:bithack|hprof.output_dir|mlrpc_error(?:_number|s))|ya(?:c(?:.(?:compress_threshold|debug|enable(?:_cli)?|(?:key|value)s_memory_size|serializer)|onf.(?:check_dela|director)y)|f.(?:action_prefer|cache_config|environ|forward_limit|l(?:ibrary|owcase_path)|name_s(?:eparator|uffix)|use_(?:namespace|spl_autoload))|ml.(?:decode_(?:binary|(?:ph|timestam)p)|output_(?:canonical|indent|width))|r.(?:(?:connect_)?timeout|debug|expose_info|packager)|z.(?:keepalive|log_mask))|z(?:end(?:_extension|.(?:assertions|(?:detect_unicod|multibyt)e|e(?:nable_gc|xception_(?:ignore_args|string_param_max_len))|s(?:cript_encoding|ignal_check)))|lib.output_(?:compression(?:_level)?|handler)|ookeeper.(?:recv_timeout|sess(?:_lock_wait|ion_lock))))[\\s\\x0b]*=[^=]\" \\\n    \"id:933120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:normalizePath,\\\n    msg:'PHP Injection Attack: Configuration Directive Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Variables ]\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@pmFromFile php-variables.data\" \\\n    \"id:933130,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:normalizePath,t:urlDecodeUni,\\\n    msg:'PHP Injection Attack: Variables Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Variables ]\n#\n# Prevent accessing PHP variables using these methods:\n# ${'VARIABLE_NAME'}\n# $ {\"VARIABLE_NAME\"}\n# $ {'_VAR'.'IABLE_NAME'}\n# $     {   $var}\n# $     {   CONSTANT   }\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\$\\s*\\{\\s*\\S[^\\{\\}]*\\}\" \\\n    \"id:933135,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Variable Access Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP I/O Streams ]\n#\n# The \"php://\" syntax can be used to refer to various objects, such as local files (for LFI),\n# remote urls (for RFI), or standard input/request body. Its occurrence indicates a possible attempt\n# to either inject PHP code or exploit a file inclusion vulnerability in a PHP web app.\n#\n# Examples:\n# php://filter/resource=./../../../wp-config.php\n# php://filter/resource=http://www.example.com\n# php://stdin\n# php://input\n#\n# http://php.net/manual/en/wrappers.php.php\n#\n# Regular expression generated from regex-assembly/933140.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933140\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|f(?:d|ilter)|memory|temp)\" \\\n    \"id:933140,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: I/O Stream Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Wrappers ]\n#\n# PHP comes with many built-in wrappers for various URL-style protocols for use with the filesystem\n# functions such as fopen(), copy(), file_exists() and filesize(). Abusing of PHP wrappers like phar://\n# could lead to RCE as describled by Sam Thomas at BlackHat USA 2018 (https://bit.ly/2yaKV5X), even\n# wrappers like zlib://, glob://, rar://, zip://, etc... could lead to LFI and expect:// to RCE.\n#\n# Valid PHP wrappers can be found in the PHP documentation here:\n# https://www.php.net/manual/en/wrappers.php\n#\n# Regular expression generated from regex-assembly/933200.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933200\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://\" \\\n    \"id:933200,\\\n    phase:2,\\\n    block,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,t:cmdLine,\\\n    msg:'PHP Injection Attack: Wrapper scheme detected',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Functions ]\n#\n# Detecting PHP function names is useful to block PHP code injection attacks.\n# There are many PHP functions. We have to strike a balance between robust detection\n# of PHP code in content, and the risk of false positives.\n#\n# The list of PHP functions is divided into four groups of varying attack/false positive risk.\n# Four separate rules are used to detect these groups of functions:\n#\n# - Rule 933150: ~234 words highly common to PHP injection payloads and extremely rare in\n#\t\tnatural language or other contexts.\n#\t\tExamples: 'base64_decode', 'file_get_contents'.\n#\t\tThese words are detected as a match directly using @pmFromFile.\n#\t\tFunction names are defined in php-function-names-933150.data\n#\n# - Rule 933160: ~39 words which are common in PHP code, but have a higher chance to cause\n#\t\tfalse positives in natural language or other contexts.\n#\t\tExamples: 'chr', 'eval'.\n#\t\tTo mitigate false positives, a regexp looks for PHP function syntax, e.g. 'eval()'.\n#\t\tRegexp is generated from function names in /regexp-assemble/data/933160.ra\n#\n# - Rule 933151: ~2200 words of lesser importance. This includes most PHP functions and keywords.\n#\t\tExamples: 'addslashes', 'array_diff'.\n#\t\tFor performance reasons, the @pmFromFile operator is used, and many functions from lesser\n#\t\tused PHP extensions are removed.\n#\t\tTo mitigate false positives, we only match when the '(' character is also found.\n#\t\tThis rule only runs in paranoia level 2 or higher.\n#\t\tFunction names are defined in php-function-names-933151.data\n#\n# - Rule 933161: ~95 words with short or trivial names, possibly leading to false positives.\n#\t\tExamples: 'abs', 'cos'.\n#\t\tTo mitigate false positives, a regexp matches on function syntax, e.g. 'abs()'.\n#\t\tThis rule only runs in paranoia level 3 or higher.\n#\t\tRegexp is generated from function names in /regexp-assemble/data/933161.ra\n#\n\n\n#\n# [ PHP Functions: High-Risk PHP Function Names ]\n#\n# Rule 933150 contains a small list of function names which are highly indicative of a PHP\n# injection attack, for example 'base64_decode'.\n# The rule uses a chained rule to require parentheses after function names.\n# This prevents false positives from substring matches (e.g., \"intval\" in \"PaintValdosta\").\n# Functions that commonly appear as English words/substrings are handled by rule 933160\n# with stricter regex-based function call syntax validation.\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@pmFromFile php-function-names-933150.data\" \\\n    \"id:933150,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: High-Risk PHP Function Name Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule MATCHED_VARS \"@pm ( )\" \\\n        \"t:none,\\\n        setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Functions: High-Risk PHP Function Calls ]\n#\n# Some PHP function names have a certain risk of false positives, due to short\n# names, full or partial overlap with common natural language terms, uses in\n# other contexts, et cetera. Some examples are 'eval', 'exec', 'system'.\n#\n# For these function names, we apply a regexp to look for PHP function syntax.\n# The regexp looks for a word boundary and adjoining parentheses.\n# For instance, we want to block 'eval()', but we want to allow 'medieval()'.\n#\n# We have to be careful of possible bypasses using comment syntax. Examples:\n#\n#   system(...)\n#   system (...)\n#   system\\t(...)\n#   system /*comment*/ (...)\n#   system /*multiline \\n comment*/ (...)\n#   system //comment \\n (...)\n#   system #comment \\n (...)\n#\n# This rule is triggered by the following exploits as well, as they include the string 'exec(...)':\n# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ]\n# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45260 ]\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Regular expression generated from regex-assembly/933160.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933160\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b\\(?[\\\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|f(?:ile(?:group)?|open|puts)|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a|ntval)|m(?:d5|kdir)|o(?:pendir|rd)|p(?:assthru|hpinfo|open|r(?:intf|ev))|r(?:eadfile|trim)|s(?:t(?:rip_tags|at)|ubstr|ystem)|tmpfile|u(?:n(?:(?:pac|lin)k|serialize)|sort))(?:/\\*[^\\*]*\\*+(?:[^\\*/][^\\*]*\\*+)*/|(?:#|//)[^\\n\\r]*[\\n\\r]|[\\s\\x0b\\\"])*[\\\"']*\\)?[\\s\\x0b]*\\([^\\)]*\\)\" \\\n    \"id:933160,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: High-Risk PHP Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Object Injection ]\n#\n# PHP Object Injection is an application level vulnerability that could allow\n# an attacker to perform different kinds of malicious attacks, such as\n# Code Injection, SQL Injection, Path Traversal and Application Denial of Service,\n# depending on the context.\n#\n# The vulnerability occurs when user-supplied input is not properly sanitized\n# before being passed to the unserialize() PHP function. Since PHP allows object\n# serialization, attackers could pass ad-hoc serialized strings to a vulnerable\n# unserialize() call, resulting in an arbitrary PHP object(s) injection into the\n# application scope.\n#\n# https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection\n#\n# In serialized form, PHP objects have the following format:\n#\n#    O:8:\"stdClass\":1:{s:1:\"a\";i:2;}\n#    O:3:\"Foo\":0:{}\n#\n# Also detected are PHP objects with a custom unserializer:\n# https://www.phpinternalsbook.com/php5/classes_objects/serialization.html\n# These have the following format:\n#\n#    C:11:\"ArrayObject\":37:{x:i:0;a:1:{s:1:\"a\";s:1:\"b\";};m:a:0:{}}\n#    C:3:\"Foo\":23:{s:15:\"My private data\";}\n#\n# HTTP headers are inspected, since PHP object injection vulnerabilities have been\n# found in applications parsing them:\n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8562 (User-Agent header)\n# https://www.exploit-db.com/exploits/39033/ (X-Forwarded-For header)\n# http://karmainsecurity.com/KIS-2015-10 (Host header)\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx [oOcC]:\\d+:\\\".+?\\\":\\d+:\\{.*}\" \\\n    \"id:933170,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Serialized Object Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n\n#\n# [ PHP Functions: Variable Function Calls ]\n#\n# PHP 'variable functions' provide an alternate syntax for calling PHP functions.\n# http://php.net/manual/en/functions.variable-functions.php\n#\n# An attacker may use variable function syntax to evade detection of function\n# names during exploitation of a remote code execution vulnerability.\n# An example to use the 'file_get_contents' function while evading rule 933150:\n#\n#   $fn = 'file_' . 'get_' . 'contents';\n#   echo $fn('wp-co' . 'nfig.php');\n#\n# Some examples from obfuscated malware:\n#\n#   $OOO0000O0(...)\n#   @$b374k(...)\n#   $_[@-_]($_[@!+_] )\n#\n# A breakdown of the regular expression:\n#\n#   \\$+\n#       The variable's '$' char, or multiple '$' for 'variable variables':\n#       http://php.net/manual/en/language.variables.variable.php\n#   (?:[a-zA-Z_\\x7f-\\xff][a-zA-Z0-9_\\x7f-\\xff]*|\\s*{.+})\n#       One of the following:\n#       - A variable name; regexp from http://php.net/language.variables.basics\n#       - A nonempty expression for variable variables: ${'fn'} or $ {'fn'}\n#   (?:\\s|\\[.+\\]|{.+}|/\\*.*\\*/|//.*|#.*)*\n#       Optional whitespace, array access, or comments\n#   \\(.*\\)\n#       Parentheses optionally containing function parameters\n#\n# Regular expression generated from regex-assembly/933180.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933180\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\$+(?:[A-Z_a-z\\x7f-\\x{ff}][0-9A-Z_a-z\\x7f-\\x{ff}]*|[\\s\\x0b]*\\{[^\\}]+\\})(?:[\\s\\x0b]|\\[(?:[^\\[\\]]|\\[[^\\]]+\\])+\\]|\\{[^\\}]+\\}|/(?:\\*[^\\*]*\\*+(?:[^\\*/][^\\*]*\\*+)*/|/[^\\n\\r]*[\\n\\r])|#[^\\n\\r]*[\\n\\r])*\\(.*\\)\" \\\n    \"id:933180,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Variable Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# [ PHP Functions: Variable Function Prevent Bypass ]\n#\n# Referring to https://www.secjuice.com/php-rce-bypass-filters-sanitization-waf/\n# Regex test on https://regex101.com/r/x1tfXG/1\n# the rule 933180 could be bypassed by using the following payloads:\n#\n# - (system)('uname');\n# - (sy.(st).em)('uname');\n# - (string)\"system\"('uname');\n# - define('x', 'sys' . 'tem');(x)/* comment */('uname');\n# - $y = 'sys'.'tem';($y)('uname');\n# - define('z', [['sys' .'tem']]);(z)[0][0]('uname');\n# - (system)(ls);\n# - (/**/system)(ls/**/);\n# - (['system'])[0]('uname');\n# - (++[++system++][++0++])++{/*dsasd*/0}++(++ls++);\n#\n# This rule blocks all payloads above and avoids to block values like:\n#\n# - [ACME] this is a test (just a test)\n# - Test (with two) rounded (brackets)\n#\n# Regular expression generated from regex-assembly/933210.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933210\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?:\\((?:.+\\)(?:[\\\"'][\\-0-9A-Z_a-z]+[\\\"'])?\\(.+|[^\\)]*string[^\\)]*\\)[\\s\\x0b\\\"'\\-\\.0-9A-\\[\\]_a-\\{\\}]+\\([^\\)]*)|(?:\\[[0-9]+\\]|\\{[0-9]+\\}|\\$[^\\(\\),\\./;\\x5c]+|[\\\"'][\\-0-9A-Z\\x5c_a-z]+[\\\"'])\\(.+)\\);\" \\\n    \"id:933210,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:replaceComments,t:removeWhitespace,\\\n    msg:'PHP Injection Attack: Variable Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Session File Upload Protection ]\n#\n# Detects attempts to upload files matching PHP session naming patterns.\n# PHP session files typically follow the pattern: sess_<session_id>\n# where session_id is typically 20-256 characters (varies by PHP version).\n# Example sizes:\n# 32 chars — MD5 hash (legacy default)\n# 40 chars — SHA-1 hash\n# 26 chars — MD5 with 5 bits/character encoding\n#\n# Modern PHP (7.1+)\n# PHP 7.1+ uses session.sid_length (default 32, range 22–256) and session.sid_bits_per_character:\n#\n# | Bits/char | Character set | Regex                 |\n# | 4         | 0-9a-f        | [0-9a-f]{22,256}      |\n# | 5         | 0-9a-v        | [0-9a-v]{22,256}      |\n# | 6         | 0-9a-zA-Z,-   | [0-9a-zA-Z,-]{22,256} |\n#\n# Attackers can upload malicious serialized PHP objects with session filenames,\n# then trigger deserialization by presenting a matching PHPSESSID cookie, leading\n# to Remote Code Execution through PHP object injection.\n#\n# References:\n# - CVE-2025-54236 (Magento - Session Reaper)\n# - https://slcyber.io/assetnote-security-research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/\n#\n# This rule blocks:\n# - sess_abcdef1234567890opqrstxyz (standard session file)\n# - /tmp/sess_d8ew88tqmabdcokhumchy8htqm (with path)\n# - C:\\temp\\sess_maliciousfilename1234567890 (Windows path)\n#\n# Some AJAX uploaders use the nonstandard request headers X-Filename,\n# X_Filename, or X-File-Name to transmit the file name to the server;\n# scan these request headers as well as multipart/form-data file names.\n#\n# Regular expression generated from regex-assembly/933220.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933220\n#\nSecRule FILES|FILES_NAMES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name \"@rx (?:^|[/\\x5c])sess_[,\\-0-9a-z]{20,256}$\" \\\n    \"id:933220,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'PHP Injection Attack: PHP Session File Upload Attempt',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:933013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:933014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n#\n# [ PHP Functions: Medium-Risk PHP Function Names ]\n#\n# In paranoia level 2, we add additional checks for most PHP functions.\n#\n# The size of the PHP function list is considerable.\n# Even after excluding the more obscure PHP extensions, 1300+ functions remain.\n# For performance reasons, this rule now uses a singular regex, without any capturing.\n# Due to regex size limitations in Modsecurity 2 with httpd, this is currently split\n# out into 3 seperate regex assembly includes: php-function-names-933151,\n# php-function-names-933152, and php-function-names-933153, which correspond\n# to 933151, 933152, and 933153 respectively.\n#\n# This approach carries some risk for false positives. Therefore, the function list\n# has been curated to remove words closely matching natural language and terms often\n# used in other contexts.\n#\n# This rule is a stricter sibling of rule 933150.\n#\n# Regular expression generated from regex-assembly/933151.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933151\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:a(?:c(?:cel_chdir|osh?)|ddc?slashes|pache_(?:child_terminate|get(?:_(?:modules|version)|env)|lookup_uri|note |re(?:quest|sponse)_headers|setenv)|r(?:ray_(?:c(?:h(?:ange_key_case|unk)|o(?:lumn|mbine|unt_values))|diff(?:_(?:assoc|key|u(?:assoc|key)))?|f(?:ill(?:_keys)?|lip)|i(?:ntersect(?:_(?:assoc|key|u(?:assoc|key)))?|s_list)|key(?:_(?:fir|la)st|s)|m(?:ap|erge(?:_recursive)?|ultisort)|p(?:ad|op|roduct)|r(?:and|e(?:(?:duc|vers)e|place(?:_recursive)?))|s(?:earch|p?lice|um)|u(?:(?:diff|intersect)(?:_u?assoc)?|n(?:ique|shift))|walk(?:_recursive)?)|sort)|s(?:inh|ort|sert_options)|tan[2h]?)|b(?:ase(?:64_(?:de|en)code|_convert)|c(?:add|comp|div|m(?:od|ul)|pow(?:mod)?|s(?:cale|qrt|ub))|in(?:2hex|d(?:_textdomain_codeset|ec|textdomain))|oolval|z(?:(?:de)?compress|err(?:no|(?:o|st)r)|open|read))|c(?:al(?:_(?:days_in_month|(?:from|to)_jd|info)|l_user_func_array)|eil|h(?:(?:di)?r|grp|mod|own|unk_split)|l(?:ass_(?:alia|(?:implem|par)ent|use)s|earstatcache|ose(?:dir|log))|o(?:llator_(?:asort|c(?:ompar|reat)e|get_(?:(?:attribut|error_(?:cod|messag)|local)e|s(?:ort_key|trength))|s(?:et_(?:attribute|strength)|ort(?:_with_sort_keys)?))|m_(?:create_guid|event_sink|get_active_object|load_typelib|message_pump|print_typeinfo)|n(?:fig_get_hash|nection_(?:aborted|status)|vert_uu(?:de|en)code)|unt_chars)|rc32|type_(?:al(?:num|pha)|cntrl|(?:x?digi|p(?:rin|unc))t|graph|(?:low|upp)er|space)|url_(?:(?:c(?:los|opy_handl)|file_creat|paus)e|e(?:rr(?:no|or)|scape|xec)|getinfo|(?:ini|rese)t|multi_(?:(?:(?:add|remove)_handl|clos)e|e(?:rrno|xec)|getcontent|in(?:fo_read|it)|s(?:e(?:lec|top)t|trerror))|s(?:etopt(?:_array)?|hare_(?:close|errno|init|s(?:etopt|trerror))|trerror)|u(?:nescape|pkeep)|version))|d(?:ate(?:_(?:add|create(?:_(?:from_format|immutable(?:_from_format)?))?|d(?:(?:ate_s|efault_timezone_[gs])et|iff)|(?:forma|(?:offset_g|time(?:_s|(?:stamp|zone)_[gs]))e)t|get_last_errors|i(?:nterval_(?:create_from_date_string|format)|sodate_set)|modify|parse(?:_from_format)?|su(?:b|n(?:_info|rise|set)))|fmt_(?:(?:creat|localtim|pars)e|format(?:_object)?|get_(?:calendar(?:_object)?|(?:datetyp|error_(?:cod|messag)|local)e|pattern|time(?:type|zone(?:_id)?))|is_lenient|set_(?:calendar|lenient|pattern|timezone)))|ba_(?:(?:clos|delet|replac)e|(?:exist|handler)s|f(?:etch|irstkey)|(?:inser|key_spli|lis)t|nextkey|op(?:en|timize)|popen|sync)|(?:cn?)?gettext|e(?:bug_(?:(?:print_)?backtrace|zval_dump)|c(?:bin|hex)|flate_(?:add|init)|g2rad)|isk_(?:free|total)_space|l_test_test[12]|n(?:gettext|s_(?:check_record|get_(?:mx|record)))|om_import_simplexml)|e(?:aster_da(?:te|ys)|n(?:chant_(?:broker_(?:d(?:escribe|ict_exists)|free(?:_dict)?|get_(?:dict_path|error)|(?:ini|request_(?:pwl_)?dic)t|list_dicts|set_(?:dict_path|ordering))|dict_(?:add(?:_to_session)?|(?:quick_)?check|describe|get_error|is_added|s(?:tore_replacemen|ugges)t))|um_exists)|rror_(?:(?:clear|get)_last|(?:lo|reportin)g)|scapeshell(?:arg|cmd)|x(?:if_(?:imagetype|read_data|t(?:agname|humbnail))|pm1|tension_loaded))|f(?:astcgi_finish_request|d(?:atasync|iv)|eof|f(?:i_trampoline|lush)|get(?:c(?:sv)?|s)|i(?:l(?:e_put_contents|ter_(?:has_var|i(?:d|nput(?:_array)?)|list|var(?:_array)?))|nfo_(?:buffer|(?:clos|fil)e|open|set_flags))|loatval|(?:mo|re(?:a|nchtoj))d|nmatch|orward_static_call(?:_array)?|p(?:assthru|m_get_status|rintf|utcsv)|s(?:canf|eek|ockopen|tat|ync)|t(?:ell|ok|p_(?:a(?:lloc|ppend)|c(?:dup|h(?:dir|mod)|lose|onnect)|delete|exec|f(?:ge|pu)t|get(?:_option)?|login|m(?:dtm|kdir|lsd)|n(?:b_(?:continue|(?:f(?:ge|pu)|ge|pu)t)|list)|p(?:asv|ut|wd)|r(?:aw(?:list)?|ename|mdir)|s(?:et_option|(?:i[tz]|ystyp)e|sl_connect))|runcate)|unc_(?:get_args?|num_args)|write)|g(?:c_(?:(?:(?:collect_cycl|mem_cach)e|statu)s|disable|enabled?)|d_info|et(?:_(?:browser|c(?:(?:alled_clas|lass_(?:method|var))s|(?:fg_va|urrent_use)r)|de(?:bug_type|(?:clared_(?:(?:class|interfac)e|trait)|fined_(?:constant|function|var))s)|(?:extension_func|loaded_extension|m(?:angled_object_var|eta_tag)|parent_clas)s|h(?:eaders|tml_translation_table)|include(?:_path|d_files)|o(?:bject_vars|pen_basedir)|resource(?:_(?:id|type)|s))|(?:cw|lastmo)d|(?:dat|rusag)e|env|host(?:by(?:addr|namel?)|name)|imagesize(?:fromstring)?|my(?:[gpu]id|inode)|opt|protobyn(?:ame|umber)|servby(?:name|port)|t(?:ext|imeofday|ype))|m(?:(?:dat|(?:mk|strf)tim)e|p_(?:a(?:bs|[dn]d)|binomial|c(?:lrbit|mp|om)|div(?:_(?:qr?|r)|exact)|(?:expor|fac|hamdis|testbi)t|gcd(?:ext)?|i(?:mport|n(?:(?:i|ver)t|tval))|jacobi|(?:kronecke|x?o)r|l(?:cm|egendre)|m(?:od|ul)|ne(?:g|xtprime)|p(?:erfect_(?:power|square)|o(?:pcount|wm?)|rob_prime)|r(?:andom_(?:bits|range|seed)|oot(?:rem)?)|s(?:can[01]|etbit|ign|qrt(?:rem)?|trval|ub)))|r(?:apheme_(?:extract|s(?:tr(?:i(?:pos|str)|len|(?:ri?)?pos|str)|ubstr))|egoriantojd)|z(?:(?:un)?compress|(?:de(?:cod|flat)|encod|fil|inflat)e|open))|h(?:ash_(?:(?:algo|equal)s|copy|fi(?:le|nal)|h(?:kdf|mac(?:_(?:algos|file))?)|init|pbkdf2|update(?:_(?:file|stream))?)|e(?:ader(?:_re(?:gister_callback|move)|s_(?:lis|sen)t)|brev|x(?:2bin|dec))|ighlight_(?:file|string)|rtime|t(?:ml(?:(?:_entity|specialchars)_decode|entities)|tp_(?:build_query|response_code))|ypot)|i(?:conv(?:_(?:get_encoding|mime_(?:decode(?:_headers)?|encode)|s(?:et_encoding|tr(?:len|r?pos)|ubstr)))?|dn_to_(?:ascii|utf8)|gnore_user_abort|ma(?:ge(?:_type_to_(?:extension|mime_type)|a(?:ffine(?:matrix(?:conca|ge)t)?|lphablending|ntialias|rc|vif)|(?:bm|w(?:bm|eb))p|c(?:har(?:up)?|o(?:lor(?:a(?:llocate(?:alpha)?|t)|closest(?:alpha|hwb)?|deallocate|(?:exact|resolve)(?:alpha)?|match|s(?:et|forindex|total)|transparent)|nvolution|py(?:merge(?:gray)?|res(?:ampl|iz)ed)?)|r(?:eate(?:from(?:avif|(?:bm|w(?:bm|eb))p|g(?:d(?:2(?:part)?)?|if)|(?:jpe|(?:p|stri)n)g|tga|x[bp]m)|truecolor)?|op(?:auto)?))|d(?:ashedline|estroy)|ellipse|f(?:il(?:l(?:ed(?:arc|(?:ellips|rectangl)e|polygon)|toborder)?|ter)|lip|ont(?:height|width)|t(?:bbox|text))|g(?:ammacorrect|d2?|et(?:clip|interpolation)|if|rab(?:screen|window))|i(?:nterlace|struecolor)|jpeg|l(?:(?:ayereffec|oadfon)t|ine)|openpolygon|p(?:alette(?:copy|totruecolor)|ng|olygon)|r(?:e(?:ctangle|solution)|otate)|s(?:avealpha|cale|et(?:brush|clip|interpolation|pixel|style|t(?:hickness|ile))|tring(?:up)?|[xy])|t(?:ruecolortopalette|ypes)|xbm)|p_(?:(?:8bi|qprin)t|a(?:lerts|ppend)|b(?:ase64|inary|ody(?:struct)?)|c(?:heck|l(?:earflag_full|ose)|reatemailbox)|delete(?:mailbox)?|e(?:rrors|xpunge)|fetch(?:_overview|body|header|(?:mim|structur)e)|g(?:c|et(?:_quota(?:root)?|acl|mailboxes|subscribed))|header(?:info|s)|(?:is_)?open|l(?:ast_error|ist(?:scan)?|sub)|m(?:ail(?:_(?:co(?:mpose|py)|move)|boxmsginfo)?|ime_header_decode|sgno|utf7_to_utf8)|num_(?:msg|recent)|ping|r(?:e(?:namemailbox|open)|fc822_(?:parse_(?:adrlist|headers)|write_address))|s(?:avebody|e(?:arch|t(?:_quota|(?:ac|flag_ful)l))|ort|tatus|ubscribe)|t(?:hread|imeout)|u(?:id|n(?:delet|subscrib)e|tf(?:7_(?:de|en)code|8(?:_to_mutf7)?))))|n(?:_array|et_(?:ntop|pton)|flate_(?:add|get_(?:read_len|status)|init)|i_(?:get(?:_all)?|parse_quantity|restore|set)|t(?:div|erface_exists|l(?:_(?:error_nam|get_error_(?:cod|messag)|is_failur)e|cal_(?:a(?:dd|fter)|(?:befor|f(?:ield_differenc|rom_date_tim)|to_date_tim)e|c(?:lear|reate_instance)|equals|get(?:_(?:a(?:ctual_m(?:ax|in)imum|vailable_locales)|(?:day_of_week_typ|error_(?:cod|messag)|keyword_values_for_local)e|first_day_of_week|greatest_minimum|l(?:east_maximum|ocale)|m(?:aximum|inim(?:al_days_in_first_week|um))|now|(?:(?:repeat|skipp)ed_wall_time_op|weekend_transi)tion|t(?:ime(?:_zone)?|ype)))?|i(?:n_daylight_time|s_(?:equivalent_to|(?:lenien|se)t|weekend))|roll|set(?:_(?:(?:first_day_of|minimal_days_in_first)_week|lenient|(?:repeat|skipp)ed_wall_time_option|time(?:_zone)?))?)|gregcal_(?:(?:create_instanc|[gs]et_gregorian_chang)e|is_leap_year)|tz_(?:c(?:ount_equivalent_ids|reate_(?:default|enumeration|time_zone(?:_id_enumeration)?))|(?:(?:from|to)_date_time_zon|use_daylight_tim)e|get_(?:(?:canonical|windows)_id|d(?:isplay_name|st_savings)|e(?:quivalent_id|rror_(?:cod|messag)e)|(?:gm|offse)t|id(?:_for_windows_id)?|r(?:aw_offset|egion)|(?:tz_data_versio|unknow)n)|has_same_rules))))|p(?:2long|tc(?:embed|parse))|s_(?:bool|(?:(?:(?:c(?:all|ount)|(?:execu|wri)t)ab|uploaded_fi)l|i(?:nfinit|terabl)|re(?:adabl|sourc))e|f(?:i(?:l|nit)e|loat)|link|nan|s(?:calar|oap_fault|tring|ubclass_of))|terator_(?:(?:appl|to_arra)y|count))|j(?:d(?:dayofweek|monthname|to(?:french|gregorian|j(?:ewish|ulian)|unix))|(?:ewish|ulian)tojd|son_(?:last_error(?:_msg)?|validate)))[\\s\\x0b]*\\(\" \\\n    \"id:933151,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Medium-Risk PHP Function Name Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This rule is a sibling of rule 933151.\n#\n# Regular expression generated from regex-assembly/933152.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933152\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:kr?sort|l(?:c(?:first|g_value|h(?:grp|own))|dap_(?:8859_to_t61|(?:ad|bin)d(?:_ext)?|co(?:mpare|nnect(?:_wallet)?|unt_(?:entri|referenc)es)|d(?:elete(?:_ext)?|n2ufn)|e(?:rr(?:(?:2st|o)r|no)|scape|x(?:op(?:_(?:passwd|refresh|sync|whoami))?|plode_dn))|f(?:irst_(?:(?:attribut|referenc)e|entry)|ree_result)|get_(?:(?:attribut|entri)es|(?:d|optio|values_le)n)|list|mod(?:_(?:add|del|replace)(?:_ext)?|ify_batch)|next_(?:(?:attribut|referenc)e|entry)|parse_(?:exop|re(?:ference|sult))|re(?:ad|name(?:_ext)?)|s(?:asl_bind|e(?:arch|t_(?:option|rebind_proc))|tart_tls)|t61_to_8859|unbind)|evenshtein|i(?:bxml_(?:(?:clear|use_internal)_errors|disable_entity_loader|get_(?:e(?:rrors|xternal_entity_loader)|last_error)|set_(?:external_entity_loader|streams_context))|nkinfo|tespeed_(?:finish_request|re(?:quest|sponse)_headers))|o(?:cal(?:e(?:_(?:(?:accept_from_htt|looku)p|(?:c(?:anonicaliz|ompos)|pars)e|filter_matches|get_(?:(?:all_variant|keyword)s|d(?:efault|isplay_(?:(?:languag|nam)e|region|(?:scrip|varian)t))|primary_language|region|script)|set_default)|conv)|time)|g1[0p]|ng2ip)|stat|trim)|m(?:b_(?:c(?:h(?:eck_encoding|r)|onvert_(?:case|encoding|kana|variables))|de(?:code_(?:mimeheader|numericentity)|tect_(?:encoding|order))|e(?:ncod(?:e_(?:mimeheader|numericentity)|ing_aliases)|reg(?:_(?:match|replace(?:_callback)?|search(?:_(?:(?:get(?:po|reg)|(?:set)?po|reg)s|init))?)|i(?:_replace)?)?)|get_info|http_(?:in|out)put|internal_encoding|l(?:anguage|ist_encodings)|o(?:rd|utput_handler)|p(?:arse_str|referred_mime_name)|regex_(?:encoding|set_options)|s(?:crub|end_mail|plit|tr(?:_(?:pad|split)|cut|i(?:mwidth|pos|str)|len|pos|r(?:chr|i(?:chr|pos)|pos)|(?:st|to(?:low|upp)e)r|width)|ubst(?:itute_character|r(?:_count)?)))|(?:(?:d5|ove_uploaded)_fil|e(?:mory_(?:get_(?:peak_)?|reset_peak_)usag|taphon)|i(?:crotim|me_content_typ))e|hash(?:_(?:count|get_(?:block_siz|hash_nam)e|keygen_s2k))?|k(?:dir|time)|sg(?:_(?:(?:get_queu|re(?:ceiv|move_queu))e|queue_exists|s(?:e(?:nd|t_queue)|tat_queue))|fmt_(?:create|(?:format|parse)(?:_message)?|get_(?:(?:error_(?:cod|messag)|local)e|pattern)|set_pattern))|t_(?:getrandmax|s?rand)|ysqli_(?:a(?:ffected_rows|utocommit)|begin_transaction|c(?:ha(?:nge_user|racter_set_name)|lose|o(?:mmit|nnect(?:_err(?:no|or))?))|d(?:ata_seek|ebug|ump_debug_info)|e(?:rr(?:no|or(?:_list)?)|xecute_query)|f(?:etch_(?:a(?:ll|rray|ssoc)|column|field(?:_direct|s)?|lengths|object|row)|ield_(?:count|seek|tell)|ree_result)|get_(?:c(?:harset|lient_(?:info|stats|version)|onnection_stats)|(?:host|proto)_info|(?:links_stat|warning)s|server_(?:info|version))|in(?:fo|it|sert_id)|kill|m(?:ore_results|ulti_query)|n(?:ext_result|um_(?:field|row)s)|options|p(?:ing|oll|repare)|query|r(?:e(?:a(?:l_(?:connect|escape_string|query)|p_async_query)|fresh|(?:lease_savepoin|por)t)|ollback)|s(?:(?:avepoin|sl_se)t|e(?:lect_db|t_charset)|qlstate|t(?:(?:a|ore_resul)t|mt_(?:a(?:ffected_rows|ttr_[gs]et)|bind_(?:param|result)|close|data_seek|e(?:rr(?:no|or(?:_list)?)|xecute)|f(?:etch|(?:ield_coun|ree_resul)t)|get_(?:result|warnings)|in(?:it|sert_id)|more_results|n(?:ext_result|um_rows)|p(?:aram_count|repare)|res(?:et|ult_metadata)|s(?:end_long_data|qlstate|tore_result))))|thread_(?:id|safe)|(?:use_resul|warning_coun)t))|n(?:(?:at(?:case)?sor|gettex)t|et_get_interfaces|l(?:2br|_langinfo)|ormalizer_(?:get_raw_decomposition|is_normalized|normalize)|umfmt_(?:create|(?:format|parse)(?:_currency)?|get_(?:(?:(?:text_)?attribut|error_(?:cod|messag)|local)e|pattern|symbol)|set_(?:(?:text_)?attribute|pattern|symbol)))|o(?:b_(?:clean|end_(?:clean|flush)|(?:implicit_)?flush|g(?:et_(?:c(?:lean|ontents)|flush|le(?:ngth|vel)|status)|zhandler)|list_handlers)|c(?:i(?:_(?:(?:bind_(?:array_)?|define_)by_name|c(?:ancel|l(?:ient_version|ose)|o(?:llection_(?:a(?:ppend|ssign)|element_(?:assign|get)|max|size|trim)|(?:mmi|nnec)t))|e(?:rror|xecute)|f(?:etch(?:_(?:a(?:ll|rray|ssoc)|object|row))?|ield_(?:is_null|(?:nam|s(?:cal|iz))e|precision|type(?:_raw)?)|ree_(?:collection|descriptor|statement))|get_implicit_resultset|lob_(?:(?:appen|loa|re(?:a|win))d|copy|e(?:of|rase|xport)|flush|i(?:mport|s_equal)|s(?:(?:av|iz)e|eek)|t(?:ell|runcate)|write)|n(?:ew_(?:c(?:o(?:llection|nnect)|ursor)|descriptor)|um_(?:field|row)s)|p(?:a(?:rs|ssword_chang)e|connect)|r(?:e(?:gister_taf_callback|sult)|ollback)|s(?:e(?:rver_version|t_(?:(?:ac|db_opera|edi)tion|c(?:all_timeout|lient_i(?:dentifier|nfo))|module_name|prefetch(?:_lob)?))|tatement_type)|unregister_taf_callback)|fetchinto|[gs]etbufferinglob)|tdec)|dbc_(?:autocommit|(?:binmod|data_sourc)e|c(?:lose(?:_all)?|o(?:lumn(?:privilege)?s|mmit|nnect(?:ion_string_(?:is_quoted|(?:should_)?quote))?)|ursor)|e(?:rror(?:msg)?|xec(?:ute)?)|f(?:etch_(?:array|into|object|row)|ield_(?:len|n(?:ame|um)|(?:scal|typ)e)|oreignkeys|ree_result)|gettypeinfo|longreadlen|n(?:ext_result|um_(?:field|row)s)|p(?:connect|r(?:epare|(?:imarykey|ocedure(?:column)?)s))|r(?:esult(?:_all)?|ollback)|s(?:etoption|(?:pecialcolumn|tatistic)s)|table(?:privilege)?s)|p(?:cache_(?:compile_file|get_(?:configuration|status)|i(?:nvalidate|s_script_cached)|reset)|en(?:dir|log|ssl_(?:c(?:ipher_(?:iv|key)_length|ms_(?:(?:de|en)crypt|read|sign|verify)|sr_(?:export(?:_to_file)?|get_(?:public_key|subject)|new|sign))|d(?:(?:ecryp|iges)t|h_compute_key)|e(?:ncrypt|rror_string)|(?:get_(?:c(?:ert_location|ipher_method|urve_name)|md_method)|random_pseudo_byte)s|open|p(?:bkdf2|k(?:cs(?:12_(?:export(?:_to_file)?|read)|7_(?:(?:de|en)crypt|read|sign|verify))|ey_(?:(?:deriv|fre)e|export(?:_to_file)?|get_(?:details|p(?:rivate|ublic))|new))|(?:rivate|ublic)_(?:de|en)crypt)|s(?:eal|ign|pki_(?:export(?:_challenge)?|new|verify))|verify|x509_(?:check(?:_private_key|purpose)|export(?:_to_file)?|f(?:ingerprint|ree)|parse|read|verify))))|utput_(?:add_rewrite_var|reset_rewrite_vars))|p(?:a(?:rse_(?:ini_(?:file|string)|str)|ss(?:thru|word_(?:algos|get_info|(?:needs_re)?hash|verify))|thinfo)|c(?:lose|ntl_(?:a(?:larm|sync_signals)|exec|forkx?|get(?:_last_error|priority)|rfork|s(?:etpriority|ig(?:nal(?:_(?:dispatch|get_handler))?|procmask|timedwait|waitinfo)|trerror)|unshare|w(?:ait(?:pid)?|exitstatus|if(?:continu|exit|s(?:ignal|topp))ed|(?:stop|term)sig)))|do_drivers|fsockopen|g_(?:(?:affected_row|num_(?:field|row)|option)s|c(?:ancel_query|l(?:ient_encoding|ose)|o(?:n(?:nect(?:_poll|ion_(?:busy|reset|status))?|(?:sume_inpu|ver)t)|py_(?:from|to)))|d(?:bnam|elet)e|e(?:n(?:d_copy|ter_pipeline_mode)|scape_(?:bytea|identifier|literal|string)|x(?:ecut|it_pipeline_mod)e)|f(?:etch_(?:a(?:ll(?:_columns)?|rray|ssoc)|object|r(?:esult|ow))|ield(?:_(?:is_null|n(?:ame|um)|prtlen|size|t(?:able|ype(?:_oid)?))|isnull|prtlen)|lush|ree_result)|get_(?:notify|pid|result)|(?:hos|inser)t|l(?:ast_(?:error|notice|oid)|o_(?:(?:c(?:los|reat)|writ)e|(?:ex|im)port|open|read(?:_all)?|(?:see|unlin)k|t(?:ell|runcate)))|meta_data|p(?:arameter_status|(?:connec|or)t|i(?:ng|peline_s(?:tatus|ync))|(?:repar|ut_lin)e)|query(?:_params)?|result_(?:error(?:_field)?|s(?:eek|tatus))|s(?:e(?:lect|nd_(?:(?:execut|prepar)e|query(?:_params)?)|t_(?:client_encoding|error_(?:context_visibil|verbos)ity))|ocket)|t(?:ra(?:ce|nsaction_status)|ty)|u(?:n(?:escape_bytea|trace)|pdate)|version)|hp(?:_(?:ini_(?:loaded_file|scanned_files)|(?:s(?:api_nam|trip_whitespac)|unam)e)|credits|dbg_(?:break_(?:f(?:ile|unction)|method|next)|c(?:lea|olo)r|e(?:nd_oplog|xec)|get_executable|prompt|start_oplog)|info|version)|osix_(?:e?access|ctermid|f?pathconf|get(?:_last_error|(?:cw|(?:e[gu]|[su])i)d|g(?:id|r(?:gid|nam|oups))|login|p(?:g(?:id|rp)|p?id|w(?:nam|uid))|rlimit)|i(?:nitgroups|satty)|kill|mk(?:fifo|nod)|s(?:et(?:(?:e[gu]|p?g|[su])id|rlimit)|trerror|ysconf)|t(?:imes|tyname)|uname)|r(?:eg_(?:filter|grep|last_error(?:_msg)?|match_all|quote|replace_callback(?:_array)?|split)|o(?:c_(?:(?:clos|nic|terminat)e|get_status|open)|perty_exists))|spell_(?:add_to_(?:personal|session)|c(?:heck|lear_session|onfig_(?:(?:creat|ignor|mod)e|d(?:ata|ict)_dir|(?:persona|save_rep)l|r(?:epl|untogether)))|new(?:_(?:config|personal))?|s(?:(?:ave_wordli|ugge)s|tore_replacemen)t)|utenv)|quote(?:d_printable_(?:de|en)code|meta))[\\s\\x0b]*\\(\" \\\n    \"id:933152,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Medium-Risk PHP Function Name Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This rule is a sibling of rule 933151.\n#\n# Regular expression generated from regex-assembly/933153.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933153\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:r(?:a(?:d2deg|ndom_(?:bytes|int)|wurl(?:de|en)code)|e(?:a(?:d(?:dir|(?:gz)?file|lin(?:e(?:_(?:(?:(?:add|list|write)_histor|re(?:ad_histor|displa))y|c(?:allback_(?:handler_(?:install|remove)|read_char)|lear_history|ompletion_function)|info|on_new_line))?|k))|lpath(?:_cache_(?:get|size))?)|gister_(?:shutdown|tick)_function|s(?:ourcebundle_(?:c(?:ount|reate)|get(?:_error_(?:cod|messag)e)?|locales)|tore_e(?:rror|xception)_handler)|wind(?:dir)?)|mdir|sort)|s(?:api_windows_(?:cp_(?:conv|[gs]et|is_utf8)|(?:generate_ctrl_even|vt100_suppor)t|set_ctrl_handler)|candir|e(?:m_(?:(?:acquir|re(?:leas|mov))e|get)|ssion_(?:(?:abor|unse)t|c(?:ache_(?:expire|limiter)|reate_id)|de(?:code|stroy)|(?:encod|(?:module_)?nam|write_clos)e|g(?:c|et_cookie_params)|id|re(?:g(?:enerate_id|ister_shutdown)|set)|s(?:ave_path|et_(?:cookie_params|save_handler)|ta(?:rt|tus)))|t(?:_(?:e(?:rror|xception)_handler|include_path|time_limit)|(?:(?:raw)?cooki|local)e))|h(?:a1(?:_file)?|ell_exec|m(?:_(?:(?:at|de)tach|(?:(?:ge|pu)t|has)_var|remove(?:_var)?)|op_(?:(?:clos|(?:dele|wri)t|siz)e|open|read)))|i(?:m(?:ilar_text|plexml_(?:import_dom|load_(?:file|string)))|nh)|nmp(?:[23]_(?:get(?:next)?|(?:real_)?walk|set)|_(?:get_(?:quick_print|valueretrieval)|read_mib|set_(?:(?:(?:enum|quick)_prin|oid_output_forma)t|valueretrieval))|get(?:next)?|(?:real)?walk|set)|o(?:cket_(?:a(?:ccept|ddrinfo_(?:bind|connect|explain|lookup)|tmark)|bind|c(?:l(?:ear_error|ose)|msg_space|onnect|reate(?:_(?:listen|pair))?)|(?:ex|im)port_stream|get(?:_option|(?:peer|sock)name)|l(?:ast_error|isten)|re(?:ad|cv(?:from|msg)?)|s(?:e(?:lect|nd(?:msg|to)?|t_(?:(?:non)?block|option))|hutdown|trerror)|w(?:rite|saprotocol_info_(?:(?:ex|im)port|release)))|dium_(?:(?:ad|(?:un)?pa)d|b(?:ase642bin|in2(?:base64|hex))|c(?:ompare|rypto_(?:a(?:ead_(?:aes256gcm_(?:(?:de|en)crypt|is_available|keygen)|chacha20poly1305_(?:(?:de|en)crypt|ietf_(?:(?:de|en)crypt|keygen)|keygen)|xchacha20poly1305_ietf_(?:(?:de|en)crypt|keygen))|uth(?:_(?:keygen|verify))?)|box(?:_(?:keypair(?:_from_secretkey_and_publickey)?|open|publickey(?:_from_secretkey)?|se(?:al(?:_open)?|cretkey|ed_keypair)))?|core_ristretto255_(?:add|from_hash|is_valid_point|random|s(?:calar_(?:add|(?:complemen|inver)t|mul|negate|r(?:andom|educe)|sub)|ub))|generichash(?:_(?:final|init|keygen|update))?|k(?:df_(?:derive_from_key|keygen)|x_(?:client_session_keys|keypair|publickey|se(?:cretkey|ed_keypair|rver_session_keys)))|pwhash(?:_s(?:cryptsalsa208sha256(?:_str(?:_verify)?)?|tr(?:_(?:needs_rehash|verify))?))?|s(?:calarmult(?:_ristretto255(?:_base)?)?|ecret(?:box(?:_(?:keyg|op)en)?|stream_xchacha20poly1305_(?:(?:init_)?pu(?:ll|sh)|keygen|rekey))|horthash(?:_keygen)?|ign(?:_(?:(?:verify_)?detached|ed25519_[ps]k_to_curve25519|keypair(?:_from_secretkey_and_publickey)?|open|publickey(?:_from_secretkey)?|se(?:cretkey|ed_keypair)))?|tream(?:_(?:keygen|x(?:chacha20(?:_(?:keygen|xor(?:_ic)?))?|or)))?)))|hex2bin|increment|mem(?:cmp|zero))|undex)|p(?:l_(?:autoload(?:_(?:call|(?:extens|funct)ions|(?:un)?register))?|classes|object_(?:hash|id))|rintf)|qrt|scanf|tr(?:_(?:contains|(?:decreme|word_cou)nt|ends_with|getcsv|i(?:ncrement|replace)|pad|r(?:epeat|ot13)|s(?:huffle|plit|tarts_with))|c(?:(?:asec)?mp|oll|spn)|eam_(?:bucket_(?:(?:ap|pre)pend|make_writeable|new)|co(?:ntext_(?:create|get_(?:default|(?:option|param)s)|set_(?:default|options?|params))|py_to_stream)|filter_(?:(?:ap|pre)pend|re(?:gister|move))|get_(?:(?:(?:conten|transpor)t|(?:filt|wrapp)er)s|line|meta_data)|is(?:_local|atty)|resolve_include_path|s(?:e(?:lect|t_(?:blocking|chunk_size|(?:read|write)_buffer|timeout))|ocket_(?:(?:accep|clien)t|enable_crypto|get_name|pair|recvfrom|s(?:e(?:ndto|rver)|hutdown))|upports_lock)|wrapper_(?:re(?:gister|store)|unregister))|ftime|i(?:p(?:c?slashe|o)s|str)|n(?:at)?c(?:asec)?mp|p(?:brk|time)|r(?:chr|ev|i?pos)|s(?:pn|tr)|t(?:ok|r)|val)|ubstr_(?:co(?:mpare|unt)|replace)|ys_get(?:_temp_dir|loadavg))|t(?:anh|e(?:mpnam|st[12]|xtdomain)|i(?:dy_(?:(?:access|error|warning)_count|c(?:lean_repair|onfig_count)|diagnose|get(?:_(?:body|config|error_buffer|h(?:ead|tml(?:_ver)?)|o(?:pt_doc|utput)|r(?:elease|oot)|status)|opt)|is_x(?:ht)?ml|(?:parse|repair)_(?:file|string))|me(?:_(?:nanosleep|sleep_until)|zone_(?:(?:(?:abbreviation|identifier)s_lis|(?:(?:locat|vers)ion|transitions)_ge)t|name_(?:from_abbr|get)|o(?:ffset_get|pen))))|mpfile|oken_(?:get_all|name)|r(?:a(?:it_exists|nsliterator_(?:create(?:_(?:from_rules|inverse))?|(?:get_error_(?:cod|messag)|transliterat)e|list_ids))|igger_error))|u(?:[ak]sort|cwords|mask|n(?:i(?:qi|xtoj)d|register_tick_function)|(?:rlde|tf8_(?:de|en))code|s(?:e_soap_error_handler|leep|ort))|v(?:ar(?:_(?:dump|export)|iant_(?:a(?:bs|[dn]d)|c(?:as?t|mp)|d(?:ate_(?:from|to)_timestamp|iv)|eqv|fix|get_type|i(?:div|mp|nt)|m(?:od|ul)|n(?:eg|ot)|x?or|pow|round|s(?:et(?:_type)?|ub)))|ersion_compare|[fs]?printf)|wordwrap|xml(?:_(?:error_string|get_(?:current_(?:byte_index|(?:column|line)_number)|error_code)|parse(?:_into_struct|r_(?:create(?:_ns)?|free|[gs]et_option))?|set_(?:(?:character_data|default|e(?:lement|nd_namespace_decl|xternal_entity_ref)|(?:notation|start_namespace|unparsed_entity)_decl|processing_instruction)_handler|object))|writer_(?:end_(?:attribute|c(?:data|omment)|d(?:ocument|td(?:_(?:attlist|e(?:lement|ntity)))?)|element|pi)|f(?:lush|ull_end_element)|o(?:pen_(?:memory|uri)|utput_memory)|s(?:et_indent(?:_string)?|tart_(?:(?:attribute|element)(?:_ns)?|c(?:data|omment)|d(?:ocument|td(?:_(?:attlist|e(?:lement|ntity)))?)|pi))|text|write_(?:(?:attribute|element)(?:_ns)?|c(?:data|omment)|dtd(?:_(?:attlist|e(?:lement|ntity)))?|pi|raw)))|z(?:end_(?:c(?:all_method|reate_unterminated_string)|get_(?:current_func_name|map_ptr_last|unit_enum)|iterable(?:_legacy)?|leak_(?:bytes|variable)|(?:number_or_string|string_or_(?:object|stdclass))(?:_or_null)?|t(?:e(?:rminate_string|st_(?:(?:(?:nullable_)?array|void)_return|c(?:ompile_string|r(?:ash|eate_throwing_resource))|deprecated|f(?:ill_packed_array|unc)|is_string_marked_as_valid_utf8|(?:override_libxml_global_sta|parameter_with_attribu)te|zend_(?:call_stack_(?:get|use_all)|ini_(?:parse_u?quantity|str))))|hread_id)|version|weakmap_(?:attach|dump|remove))|ip_(?:close|entry_(?:c(?:lose|ompress(?:edsize|ionmethod))|(?:filesiz|nam)e|open|read)|open|read)|lib_(?:(?:de|en)cod|get_coding_typ)e)|ZendTestNS2_(?:ZendSubNS_)?namespaced_(?:deprecated_)?func)[\\s\\x0b]*\\(\" \\\n    \"id:933153,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Medium-Risk PHP Function Name Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:933015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:933016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n#\n# [ PHP Variables: Common Variable Indexes ]\n#\n# In paranoia level 3, we add additional checks for parameters to many PHP variables.\n#\n#\n# One of the more common variables used within attacks on PHP is $_SERVER. Because\n# of how many different ways PHP has for executing variables (variable variables,\n# etc) often just looking for $_SERVER will be less effective than looking for the\n# various indexes within $_SERVER. This rule checks for these indexes.\n# This rule is located in PL 3 because often developers will use these names as\n# parameter names or values and this will lead to false positives.\n# Because this list is not expected to change and it is limited in size we use a\n# regex in this case to look for these values whereas in its sibling rule we use\n# @pmFromFile for flexibility and performance.\n#\n# Regular expression generated from regex-assembly/933131.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933131\n#\n# This rule is a stricter sibling of rule 933130.\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI\" \\\n    \"id:933131,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:normalizePath,t:urlDecodeUni,\\\n    msg:'PHP Injection Attack: Variables Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Functions: Low-Value PHP Function Calls ]\n#\n# In paranoia level 3, we add additional checks for the remaining PHP functions.\n#\n# Most of these function names are likely to cause false positives in natural text\n# or common parameter values, such as 'abs', 'copy', 'date', 'key', 'max', 'min'.\n# Therefore, these function names are not scanned in lower paranoia levels.\n#\n# To mitigate the risk of false positives somewhat, a regexp is used to look for\n# PHP function syntax. (See rule 933160 for a description.)\n#\n# This rule is a stricter sibling of rule 933160.\n#\n# This rule is also triggered by the following exploit(s):\n# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45262 ]\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Regular expression generated from regex-assembly/933161.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933161\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:a(?:bs|s(?:in|sert(?:_options)?))|basename|c(?:h(?:eckdate|r(?:oot)?)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|r(?:eate_function|ypt)|urrent)|d(?:ate|e(?:coct|fined?)|ir)|e(?:nd|val|x(?:ec|p(?:lode)?|tract))|f(?:ile(?:(?:[acm]tim|inod|siz|typ)e|group|owner|perms)?|l(?:o(?:ck|or)|ush))|glob|h(?:ash|eader)|i(?:date|m(?:age(?:gif|(?:jpe|pn)g|wbmp|xbm)|plode)|s_a)|key|l(?:ink|og)|m(?:a(?:il|x)|d5|in)|n(?:ame|ext)|o(?:pendir|rd)|p(?:a(?:ck|ss(?:thru)?)|i|o(?:pen|w)|rev)|r(?:an(?:d|ge)|e(?:(?:adfil|nam)e|set)|ound)|s(?:(?:erializ|huffl)e|in|leep|(?:or|ta)t|ubstr|y(?:mlink|s(?:log|tem)))|t(?:an|(?:im|mpfil)e|ouch|rim)|u(?:cfirst|n(?:lin|pac)k)|virtual)(?:[\\s\\x0b]|/\\*[^\\*]*\\*+(?:[^\\*/][^\\*]*\\*+)*/|(?:#|//)[^\\n\\r]*[\\n\\r])*\\(.*\\)\" \\\n    \"id:933161,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Low-Value PHP Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ PHP Script Uploads: Superfluous extension ]\n#\n# Block file uploads with PHP related extensions (.php, .phps, .phtml,\n# .php5 etc) anywhere in the name, followed by a dot.\n#\n# Example: index.php.tmp\n#\n# Uploading of such files can lead to remote code execution if\n# Apache is configured with AddType and MultiViews, as Apache will\n# automatically do a filename match when the extension is unknown.\n# This configuration is fortunately not common in modern installs.\n#\n# Blocking these file names might lead to more false positives.\n#\n# Some AJAX uploaders use the nonstandard request headers X-Filename,\n# X_Filename, or X-File-Name to transmit the file name to the server;\n# scan these request headers as well as multipart/form-data file names.\n#\n# This rule is a stricter sibling of rule 933110.\n#\nSecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name \"@rx .*\\.ph(?:p\\d*|tml|ar|ps|t|pt)\\..*$\" \\\n    \"id:933111,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,t:removeWhitespace,\\\n    msg:'PHP Injection Attack: PHP Script File Upload Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n# [ PHP Closing Tag Found ]\n#\n# http://www.php.net/manual/en/language.basic-syntax.phptags.php\n#\n# This check was extracted from 933100 (paranoia level 1), since the\n# checked sequence '?>' commonly causes false positives.\n# See issue #654 for discussion.\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@pm ?>\" \\\n    \"id:933190,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'PHP Injection Attack: PHP Closing Tag Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\n# [ PHP Functions: Variable Function Prevent Bypass ]\n#\n# This rule is a stricter sibling of 933210.\n# Unlike 933210, this rule will also match \"this is a 'dog' (not a cat)\", because the semi-colon at the end of the string is optional.\n# This is useful for PHP evals where the semi-colon is already hardcoded:\n# <?php eval(\"($input);\") ?>\n#\n# Any potential function calls not at the end of a string will require a semi-colon to form valid PHP, which is automatically covered by 933210.\n#\n# Regular expression generated from regex-assembly/933211.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 933211\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?:\\((?:.+\\)(?:[\\\"'][\\-0-9A-Z_a-z]+[\\\"'])?\\(.+|[^\\)]*string[^\\)]*\\)[\\s\\x0b\\\"'\\-\\.0-9A-\\[\\]_a-\\{\\}]+\\([^\\)]*)|(?:\\[[0-9]+\\]|\\{[0-9]+\\}|\\$[^\\(\\),\\./;\\x5c]+|[\\\"'][\\-0-9A-Z\\x5c_a-z]+[\\\"'])\\(.+)\\)(?:;|$)?\" \\\n    \"id:933211,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:replaceComments,t:removeWhitespace,\\\n    msg:'PHP Injection Attack: Variable Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-PHP',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:933017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:933018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-933-APPLICATION-ATTACK-PHP\"\n",
+    "owasp-crs/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:934011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:934012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n\n# [ NodeJS Insecure unserialization / generic RCE signatures ]\n#\n# Libraries performing insecure unserialization:\n# - node-serialize: _$$ND_FUNC$$_ (CVE-2017-5941)\n# - funcster: __js_function\n#\n# See:\n# https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/\n# https://www.acunetix.com/blog/web-security-zone/deserialization-vulnerabilities-attacking-deserialization-in-js/\n#\n# Some generic snippets used:\n# - function() {\n# - new Function(\n# - eval(\n# - String.fromCharCode(\n#\n# Last two are used by nodejsshell.py,\n# https://github.com/ajinabraham/Node.Js-Security-Course/blob/master/nodejsshell.py\n#\n# As base64 is sometimes (but not always) used to encode serialized values,\n# use multiMatch and t:base64decode.\n#\n# Regular expression generated from regex-assembly/934100.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934100\n#\n# Stricter sibling: 934101\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx _(?:\\$\\$ND_FUNC\\$\\$_|_js_function)|(?:\\beval|new[\\s\\x0b]+Function[\\s\\x0b]*)\\(|(?:String\\.fromCharCod|Module:prototyp)e|function\\(\\)\\{|this\\.constructor|module\\.exports=|\\([\\s\\x0b]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][\\s\\x0b]*\\)|cons(?:tructor:constructor|ole(?:\\.(?:(?:debu|lo)g|error|info|trace|warn)(?:\\.call)?\\(|\\[[\\\"'`](?:(?:debu|lo)g|error|info|trace|warn)[\\\"'`]\\]))|process(?:\\.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:\\.call)?\\(|binding|constructor|env|global|main(?:Module)?|process|require)|\\[[\\\"'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)[\\\"'`]\\])|(?:binding|constructor|env|global|main(?:Module)?|process|require)\\[|require(?:\\.(?:resolve(?:\\.call)?\\(|main|extensions|cache)|\\[[\\\"'`](?:(?:resolv|cach)e|main|extensions)[\\\"'`]\\])\" \\\n    \"id:934100,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:jsDecode,t:removeWhitespace,t:base64Decode,t:urlDecodeUni,t:jsDecode,t:removeWhitespace,\\\n    msg:'Node.js Injection Attack 1/2',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-javascript',\\\n    tag:'platform-multi',\\\n    tag:'platform-nodejs',\\\n    tag:'attack-rce',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    multiMatch,\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# -=[ SSRF Attacks ]=-\n#\n# We provide only partial protection to SSRF. DNS Rebinding attacks needs\n# to be handled at application level, and even those might be difficult to catch.\n#\n# PL1 rules are based on common attacks on cloud providers, based on well-known URLs.\n#\n# -=[ References ]=-\n# https://highon.coffee/blog/ssrf-cheat-sheet/\n# https://cwe.mitre.org/data/definitions/918.html\n# https://capec.mitre.org/data/definitions/664.html)\n#\n# Preventing: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@pmFromFile ssrf.data\" \\\n    \"id:934110,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Possible Server Side Request Forgery (SSRF) Attack: Cloud provider metadata URL in Parameter',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-ssrf',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/225/664',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# This rule detects SSRF attempts using hostnames without schemes.\n# Some frameworks and libraries add implicit 'http://' or 'https://' schemes\n# when processing URLs, making scheme-less hostnames effective attack vectors.\n#\n# Examples:\n# - localhost/\n# - host.docker.internal/\n# - kubernetes.default.svc.cluster.local/\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@pmFromFile ssrf-no-scheme.data\" \\\n    \"id:934190,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Possible Server Side Request Forgery (SSRF) Attack: Scheme-less localhost or internal hostname detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-ssrf',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/225/664',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# JavaScript prototype pollution injection attempts\n#\n# Example from https://hackerone.com/reports/869574 critical\n# vulnerability in the TypeORM library:\n# {\"text\":\"a\",\"title\":{\"__proto__\":{\"where\":{\"name\":\"sqlinjection\",\"where\":null}}}}\n#\n# Test cases are based on this list of payloads:\n# https://github.com/BlackFan/client-side-prototype-pollution/blob/master/README.md\n#\n# See also: https://cwe.mitre.org/data/definitions/1321.html\n#\n# Note: only server-based (not DOM-based) attacks are covered here.\n\n# Regular expression generated from regex-assembly/934130.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934130\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx __proto__|constructor[\\s\\x0b]*(?:\\.|\\]?\\[)[\\s\\x0b]*prototype\" \\\n    \"id:934130,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:jsDecode,\\\n    msg:'JavaScript Prototype Pollution',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-javascript',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1/180/77',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    multiMatch,\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# [ Ruby generic RCE signatures ]\n#\n# Detects Ruby-based injection attacks.\n# Example: Process.spawn(\"id\")\n#\n# Regular expression generated from regex-assembly/934150.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934150\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx Process[\\s\\x0b]*\\.[\\s\\x0b]*spawn[\\s\\x0b]*\\(\" \\\n    \"id:934150,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Ruby Injection Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-ruby',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# [ NodeJS DoS signatures ]\n#\n# NodeJS runs in a single thread, so any evaluated payloads that block execution can cause an easy DoS.\n# This rule attempts to block e.g. while(true).\n#\n# Regular expression generated from regex-assembly/934160.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934160\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx while[\\s\\x0b]*\\([\\s\\x0b\\(]*(?:!+(?:false|null|undefined|NaN|[\\+\\-]?0|\\\"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[\\+\\-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)\\b|\\{[^\\}]*\\}|\\[[^\\]]*\\]|\\\"[^\\\"]+\\\"|'[^']+'|`[^`]+`)).*\\)\" \\\n    \"id:934160,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:jsDecode,t:base64Decode,t:urlDecodeUni,t:jsDecode,t:replaceComments,\\\n    msg:'Node.js DoS attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-javascript',\\\n    tag:'platform-nodejs',\\\n    tag:'attack-rce',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    multiMatch,\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# [ PHP data: scheme ]\n#\n# PHP supports the `data:` scheme without using `//` before the content-type.\n#\n# Regular expression generated from regex-assembly/934170.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934170\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx ^(?:json\\.)?data:(?:(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\\\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\\\"?|(?:[^\\s\\x0b-\\\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\\\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\\\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\\\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\\\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\\\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\\\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*(?:[\\s\\x0b]*,[\\s\\x0b]*(?:(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\\\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\\\"?|(?:[^\\s\\x0b-\\\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\\\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\\\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\\\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\\\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\\\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\\\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\\\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*)*\" \\\n    \"id:934170,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'PHP data scheme attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-ssrf',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Detects SSTI (Server-Side Template Injection) attacks at PL1.\n# Requires code execution indicators (arithmetic, dunder access, function calls)\n# inside template syntax to reduce false positives.\n# Examples: {{7*7}}, #{system('id')}, <%= 7*7 %>\n#\n# Regular expression generated from regex-assembly/934200.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934200\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\{\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?\\}\\}|#(?:\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?\\}|[0-9A-Z_a-z]+[\\s\\x0b]*\\([\\s\\x0b]*\\$[^\\)]*?(?:[\\(\\*]|__)[^\\)]*?\\))|<(?:%=?[\\s\\x0b]*[^%]*?(?:[\\(\\*]|__)[^%]*?%|[#@][0-9A-Z_a-z]+[^>]*?(?:[\\(\\*]|__)[^>]*?)>\" \\\n    \"id:934200,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Server-Side Template Injection (SSTI) Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-ssti',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:934013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:934014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n# This rule is a stricter sibling of 934100.\n# Regular expression generated from regex-assembly/934101.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934101\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[\\s\\x0b]*\\(\" \\\n    \"id:934101,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:jsDecode,t:base64Decode,t:urlDecodeUni,t:jsDecode,\\\n    msg:'Node.js Injection Attack 2/2',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-javascript',\\\n    tag:'platform-nodejs',\\\n    tag:'attack-rce',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    multiMatch,\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# -=[ SSRF Attacks ]=-\n#\n# PL2 rules adds SSRF capture for common evasion techniques.\n#\n# We add captures for these evasion techniques: (see source in util/regexp-assemble/data/regexp-934120.data)\n# http://425.510.425.510/ Dotted decimal with overflow (already covered by RFI rule 931100)\n# http://2852039166/ Dotless decimal - \\d{10}\n# http://7147006462/ Dotless decimal with overflow - \\d{10}\n# http://0xA9.0xFE.0xA9.0xFE/ Dotted hexadecimal - (?:0x[a-f0-9]{2}\\.){3}0x[a-f0-9]{2}\n# http://0xA9FEA9FE/ Dotless hexadecimal - 0x[a-f0-9]{8}\n# http://0x41414141A9FEA9FE/ Dotless hexadecimal with overflow - 0x[a-f0-9]{16}\n# http://0251.0376.0251.0376/ Dotted octal - Covered by the same below\n# http://0251.00376.000251.0000376/ Dotted octal with padding - (?:0{1,4}\\d{3}\\.){3}0{1,4}\\d{3})\n# http://169.254.43518/ - (?:\\d{1,3}\\.){2}\\.\\d{5}\n# http://169.16689662/ - \\d{1,3}\\.\\d{8}\n# http://[::ffff:a9fe:a9fe] IPV6 Compressed - IPv6 regex from https://ihateregex.io/expr/ipv6/, with [0-9] converted to \\d and with non-capturing groups (below)\n# http://[0:0:0:0:0:ffff:a9fe:a9fe] IPV6 Expanded -  (?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}\\d){0,1}\\d)\\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}\\d){0,1}\\d)|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(2[0-4]|1{0,1}\\d){0,1}\\d)\\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}\\d){0,1}\\d))\n# http://[0:0:0:0:0:ffff:169.254.169.254] IPV6/IPV4 - ((?:[0-9a-fA-F]{1,4}:){6}(?:(25[0-5]|(?:2[0-4]|1{0,1}\\d){0,1}\\d)\\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}\\d){0,1}\\d))\n# http://[::]\n# http://127.88.23.245:22/+&@google.com:80#+@google.com:80/ (already covered by RFI rule 931100)\n# http://127.88.23.245:22/?@google.com:80/ (already covered by RFI rule 931100)\n# http://127.88.23.245:22/#@www.google.com:80/ (already covered by RFI rule 931100)\n# http://google.com:80\\\\@127.88.23.245:22/ (already covered by RFI rule 931100)\n# http://google.com:80+&@127.88.23.245:22/#+@google.com:80/\n# http://google.com:80+&@google.com:80#+@127.88.23.245:22/\n#\n# Regular expression generated from regex-assembly/934120.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934120\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:\\+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip):/?/?(?:[0-9]{7,10}|(?:0x[0-9a-f]{2}\\.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}\\.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}\\.(?:[0-9]{1,3}\\.[0-9]{5}|[0-9]{8})|(?:\\x5c\\x5c[\\-0-9a-z]\\.?_?)+|\\[[0-:a-f]+(?:[\\.0-9]+|%[0-9A-Z_a-z]+)?\\]|[a-z][\\-\\.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[\\s\\x0b]*&?@(?:(?:[0-9]{1,3}\\.){3}[0-9]{1,3}|[a-z][\\-\\.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[\\.0-9]{0,11}(?:\\x{e2}(?:\\x91[\\xa0-\\x{bf}]|\\x92[\\x80-\\x{bf}]|\\x93[\\x80-\\x{a9}\\x{ab}-\\x{bf}])|\\x{e3}\\x80\\x82)+)\" \\\n    \"id:934120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Possible Server Side Request Forgery (SSRF) Attack: URL Parameter using IP Address',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-ssrf',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/225/664',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Perl generic RCE signatures ]\n#\n# Detects Perl-based injection attacks.\n# Example: @{[system whoami]}\n#\n# Regular expression generated from regex-assembly/934140.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934140\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx @+\\{[\\s\\x0b]*\\[\" \\\n    \"id:934140,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Perl Injection Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-perl',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# [ Generic RCE signatures ]\n#\n# Detects General SSTI attacks.\n# Example: <%= File.open('/etc/passwd').read %>\n# Note: there is another rule 941380 that checks for {{.*}} regex.\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?:\\{%[^%}]*%}|<%=?[^%>]*%>)\" \\\n    \"id:934180,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'SSTI Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-ssti',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# [ ORM Lookup Operator Injection - nested traversal ]\n#\n# Stricter sibling of 934210. Detects an ORM lookup operator suffix that\n# follows nested relationship traversal (two or more `__` separators), e.g.\n# `created_by__departments__employees__user__username__startswith`. Deep\n# traversal exposed to clients is rarely legitimate, so this higher-confidence\n# form sits at PL2. A single `field__operator` (normal django-filter usage)\n# is left to 934210 at PL3.\n#\n# Regular expression generated from regex-assembly/934220.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934220\n#\nSecRule ARGS_NAMES|REQUEST_BODY \"@rx __[^\\\"&=]*__(?:i?(?:startswith|e(?:ndswith|xact)|contains|regex)|i(?:snull|n)|range|[gl]te?|has_(?:keys?|any_keys)|contained_by)(?:$|\\\"[\\s\\x0b]*:)\" \\\n    \"id:934220,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'ORM Lookup Operator Injection via Nested Traversal',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/248/66/109',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:934015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:934016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n# [ ORM Lookup Operator Injection ]\n#\n# Django ORM and similar frameworks use `__` as a lookup separator in\n# filter keys. An application that passes unsanitized request keys into a\n# query builder (e.g. `Model.objects.filter(**data)`) can be coerced into\n# operator injection and relationship traversal, leading to data leakage\n# or authentication-filter bypass.\n#\n# This rule targets request parameter names ending in an ORM lookup\n# operator. JSON body keys are parsed into ARGS by the JSON body processor,\n# so ARGS_NAMES covers both JSON body keys and query string filter params.\n#\n# These patterns are also legitimate django-filter / DRF query syntax, so\n# this rule lives at PL3 and may need tuning on apps exposing ORM filters.\n#\n# Regular expression generated from regex-assembly/934210.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 934210\n#\nSecRule ARGS_NAMES|REQUEST_BODY \"@rx __(?:i?(?:startswith|e(?:ndswith|xact)|contains|regex)|i(?:snull|n)|range|[gl]te?|has_(?:keys?|any_keys)|contained_by)(?:$|\\\"[\\s\\x0b]*:)\" \\\n    \"id:934210,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'ORM Lookup Operator Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-generic',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-GENERIC',\\\n    tag:'capec/1000/152/248/66/109',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:934017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:934018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-934-APPLICATION-ATTACK-GENERIC\"\n",
+    "owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:941011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:941012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n\n# In CRS v4.0, we have added REQUEST_FILENAME to the list of variables to\n# be checked for XSS to catch path-based XSS exploits such as:\n# /index.php/%3Csvg/onload=alert()\n#\n# However, the REQUEST_FILENAME is always populated (while ARGS etc. are\n# only set on some requests) and we found that always checking the\n# REQUEST_FILENAME has a significant performance impact.\n# Therefore, we are disabling the REQUEST_FILENAME XSS checks when the\n# REQUEST_FILENAME is clearly not containing special characters necessary\n# for a successful XSS.\n#\n# Some bona-fide REQUEST_FILENAMEs will still contain special characters\n# and will be checked by the rules, but it will be a much lower amount,\n# and that is a trade-off we are willing to make.\n#\n# So, we check for XSS in REQUEST_FILENAME only if it contains\n# other characters than alphanumeric characters, hyphens, underscores etc.\n# typically found in filenames and paths:\n#\n# - ascii 20 (whitespace)\n# - ascii 45-47 (- . /)\n# - ascii 48-57 (0-9)\n# - ascii 65-90 (A-Z)\n# - ascii 95 (underscore)\n# - ascii 97-122 (a-z)\n#\n# If just these characters are present, we make use of a special tag to remove\n# REQUEST_FILENAME from the target list of all the 941xxx rules starting 941100.\n#\n# Please note that it would be preferable to start without REQUEST_FILENAME in the\n# target list and to add it on a case to case base, but the rule language does not\n# support this feature at runtime.\n#\nSecRule REQUEST_FILENAME \"!@validateByteRange 20,45-47,48-57,65-90,95,97-122\" \\\n    \"id:941010,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    ctl:ruleRemoveTargetByTag=xss-perf-disable;REQUEST_FILENAME,\\\n    ver:'OWASP_CRS/4.30.0'\"\n\n\n#\n# -=[ Libinjection - XSS Detection ]=-\n#\n# Ref: https://github.com/client9/libinjection\n# Ref: https://speakerdeck.com/ngalbreath/libinjection-from-sqli-to-xss\n#\n# -=[ Targets ]=-\n#\n# 941100: PL1 : REQUEST_COOKIES|\n#               REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|\n#               ARGS_NAMES|ARGS|XML:/*|XML://@*\n#\n# 941101: PL2 : REQUEST_FILENAME|REQUEST_HEADERS:Referer\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@detectXSS\" \\\n    \"id:941100,\\\n    phase:2,\\\n    block,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'XSS Attack Detected via libinjection',\\\n    logdata:'Matched Data: XSS data found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ XSS Filters - Category 1 ]=-\n# http://xssplayground.net23.net/xssfilter.html\n# script tag based XSS vectors, e.g., <script> alert(1)</script>\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)<script[^>]*>[\\s\\S]*?\" \\\n    \"id:941110,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'XSS Filter - Category 1: Script Tag Vector',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ XSS Filters - Category 2 ]=-\n# XSS vectors making use of event handlers like onerror, onload etc, e.g., <body onload=\"alert(1)\">\n#\n# We are not listing all the known event handlers like rule 941160, but we\n# limit the alerts to keywords of 3-50 characters after the prefix (\"on\").\n#\n# The shortest known event is \"onget\". The longest known event is \"onwebkitplaybacktargetavailabilitychanged\"\n# with 39 chars after the prefix. 50 chars adds a little bit of safety.\n#\n# The regex requires the equals sign to be followed by a non-equals character (=[^=])\n# to prevent false positives with base64-encoded strings (which often end in = or ==).\n# This improvement allows the rule to be placed at PL1 despite having previously been\n# moved to PL2 in v3.4 due to base64-related false positives with the older regex.\n#\n# Regular expression generated from regex-assembly/941120.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941120\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)[\\t-\\r \\\"'\\(,/-9;=`]on[a-z]{3,50}[\\t-\\r \\(,;]*?=[^=]\" \\\n    \"id:941120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'XSS Filter - Category 2: Event Handler Vector',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ XSS Filters - Category 3 ]=-\n#\n# Regular expression generated from regex-assembly/941130.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941130\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i).(?:\\b(?:(?:x(?:link:href|html|mlns)|data:text/html|formaction)\\b|pattern[\\s\\x0b]*=)|(?:!ENTITY[\\s\\x0b]+(?:%[\\s\\x0b]+)?[^\\s\\x0b]+[\\s\\x0b]+(?:SYSTEM|PUBLIC)|@import|;base64)\\b)\" \\\n    \"id:941130,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'XSS Filter - Category 3: Attribute Vector',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ XSS Filters - Category 4 ]=-\n# XSS vectors making use of javascript uri and tags, e.g., <p style=\"background:url(javascript:alert(1))\">\n# https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#css-expressions-ie7\n# https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#behaviors-for-older-modes-of-ie\n# examples: https://regex101.com/r/FFEpsh/1\n#\n# Regular expression generated from regex-assembly/941140.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941140\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)[a-z]+=(?:[^:=]+:[^;]+;)*?[^:=]+:url\\(javascript\" \\\n    \"id:941140,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,t:removeWhitespace,\\\n    msg:'XSS Filter - Category 4: Javascript URI Vector',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ NoScript XSS Filters ]=-\n# Ref: http://noscript.net/\n#\n# [NoScript InjectionChecker] HTML injection\n#\n# Regular expression generated from regex-assembly/941160.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941160\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)<[^0-9<>A-Z_a-z]*(?:[^\\s\\x0b\\\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0-9>A-Z_a-z])|f[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?m|d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?g|m[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?q[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?e|e[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?a[^0-9>A-Z_a-z])|(?:l[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?k|o[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?j[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?c[^0-9A-Z_a-z]*?t|e[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?d|a[^0-9A-Z_a-z]*?(?:p[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?t|u[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?o|n[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?e)|p[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m|i?[^0-9A-Z_a-z]*?f[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?e|b[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?s[^0-9A-Z_a-z]*?e|o[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?y|i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?s)|i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a?[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?e?|v[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?o)[^0-9>A-Z_a-z])|(?:<[0-9A-Z_a-z][^\\s\\x0b/]*[\\s\\x0b/]|[\\\"'](?:[^\\s\\x0b/]*[\\s\\x0b/])?)(?:background|formaction|lowsrc|on(?:a(?:bort|ctivate|d(?:apteradded|dtrack)|fter(?:print|(?:scriptexecu|upda)te)|lerting|n(?:imation(?:cancel|end|iteration|start)|tennastatechange)|ppcommand|u(?:dio(?:end|process|start)|xclick))|b(?:e(?:fore(?:(?:(?:(?:de)?activa|scriptexecu)t|toggl)e|c(?:opy|ut)|editfocus|input|p(?:aste|rint)|u(?:nload|pdate))|gin(?:Event)?)|l(?:ocked|ur)|oun(?:ce|dary)|roadcast|usy)|c(?:a(?:(?:ch|llschang)ed|nplay(?:through)?|rdstatechange)|(?:ell|fstate)change|h(?:a(?:rging(?:time)?cha)?nge|ecking)|l(?:ick|ose)|o(?:m(?:mand(?:update)?|p(?:lete|osition(?:end|start|update)))|n(?:nect(?:ed|ing)|t(?:extmenu|rolselect))|py)|u(?:echange|t))|d(?:ata(?:(?:availabl|chang)e|error|setc(?:hanged|omplete))|blclick|e(?:activate|livery(?:error|success)|vice(?:found|light|(?:mo|orienta)tion|proximity))|i(?:aling|s(?:abled|c(?:hargingtimechange|onnect(?:ed|ing))))|o(?:m(?:a(?:ctivate|ttrmodified)|(?:characterdata|subtree)modified|focus(?:in|out)|mousescroll|node(?:inserted(?:intodocument)?|removed(?:fromdocument)?))|wnloading)|r(?:ag(?:drop|e(?:n(?:d|ter)|xit)|(?:gestur|leav)e|over|start)|op)|urationchange)|e(?:mptied|n(?:abled|d(?:ed|Event)?|ter)|rror(?:update)?|xit)|f(?:ailed|i(?:lterchange|nish)|o(?:cus(?:in|out)?|rm(?:change|input))|ullscreenchange)|g(?:amepad(?:axismove|button(?:down|up)|(?:dis)?connected)|et)|h(?:ashchange|e(?:adphoneschange|l[dp])|olding)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|put|valid))|key(?:down|press|up)|l(?:evelchange|o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|y)|m(?:ark|essage|o(?:use(?:down|enter|(?:lea|mo)ve|o(?:ut|ver)|up|wheel)|ve(?:end|start)?|z(?:a(?:fterpaint|udioavailable)|(?:beforeresiz|orientationchang|t(?:apgestur|imechang))e|(?:edgeui(?:c(?:ancel|omplet)|start)e|network(?:down|up)loa)d|fullscreen(?:change|error)|m(?:agnifygesture(?:start|update)?|ouse(?:hittest|pixelscroll))|p(?:ointerlock(?:change|error)|resstapgesture)|rotategesture(?:start|update)?|s(?:crolledareachanged|wipegesture(?:end|start|update)?))))|no(?:match|update)|o(?:(?:bsolet|(?:ff|n)lin)e|pen|verflow(?:changed)?)|p(?:a(?:ge(?:hide|show)|int|(?:st|us)e)|lay(?:ing)?|o(?:inter(?:down|enter|(?:(?:lea|mo)v|rawupdat)e|o(?:ut|ver)|up)|p(?:state|up(?:hid(?:den|ing)|show(?:ing|n))))|ro(?:gress|pertychange))|r(?:atechange|e(?:adystatechange|ceived|movetrack|peat(?:Event)?|quest|s(?:et|ize|u(?:lt|m(?:e|ing)))|trieving)|ow(?:e(?:nter|xit)|s(?:delete|inserted)))|s(?:croll(?:end)?|e(?:arch|ek(?:complete|ed|ing)|lect(?:ionchange|start)?|n(?:ding|t)|t)|how|(?:ound|peech)(?:end|start)|t(?:a(?:lled|rt|t(?:echange|uschanged))|k(?:comma|sessione)nd|op)|u(?:bmit|ccess|spend)|vg(?:abort|error|(?:un)?load|resize|scroll|zoom))|t(?:ext|ime(?:out|update)|o(?:ggle|uch(?:cancel|en(?:d|ter)|(?:lea|mo)ve|start))|ransition(?:cancel|end|run|start))|u(?:n(?:derflow|handledrejection|load)|p(?:dateready|gradeneeded)|s(?:erproximity|sdreceived))|v(?:ersion|o(?:ic|lum)e)change|w(?:a(?:it|rn)ing|ebkit(?:animation(?:end|iteration|start)|(?:playbacktargetavailabilitychange|transitionen)d)|heel)|zoom)|ping|s(?:rc|tyle))[\\x08-\\n\\f\\r ]*?=\" \\\n    \"id:941160,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'NoScript XSS InjectionChecker: HTML Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [NoScript InjectionChecker] Attributes injection\n#\n# Regular expression generated from regex-assembly/941170.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941170\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)(?:[^0-9A-Z_a-z]|^)(?:javascript:(?:.+[\\(\\.<=\\[\\x5c]|.*?(?:\\bname\\b|\\x5c[ux][0-9]))|data:(?:(?:[a-z][0-9A-Z_a-z]+/[0-9A-Z_a-z][\\+\\-0-9A-Z_a-z]+[0-9A-Z_a-z])?[,;]|.*?(?:;.*?\\b(?:base64|charset=)|,.*?<.*?[0-9A-Z_a-z].*?>)))|@[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?(?:/\\*.*?)?(?:[\\\"']|[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?l.*?\\()|-[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?z[^0-9A-Z_a-z]*?-[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^:]*?:[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?l.*?\\(\" \\\n    \"id:941170,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'NoScript XSS InjectionChecker: Attribute Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [Deny List Keywords from Node-Validator]\n# https://github.com/validatorjs/validator.js/\n# This rule has a stricter sibling 941181 (PL2) that covers the additional payload \"-->\"\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@pm document.cookie document.domain document.querySelector document.body.appendChild document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[\" \\\n    \"id:941180,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'Node-Validator Deny List Keywords',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-nodejs',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ XSS Filters from IE ]=-\n# Ref: http://blogs.technet.com/srd/archive/2008/08/18/ie-8-xss-filter-architecture-implementation.aspx\n# Ref: http://xss.cx/examples/ie/internet-exploror-ie9-xss-filter-rules-example-regexp-mshtmldll.txt\n#\n# Regular expression generated from regex-assembly/941190.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941190\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)<style.*?>.*?(?:@[\\x5ci]|(?:[:=]|&#x?0*(?:58|3[AD]|61);?).*?(?:[\\(\\x5c]|&#x?0*(?:40|28|92|5C);?))\" \\\n    \"id:941190,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i:<.*[:]?vmlframe.*?[\\s/+]*?src[\\s/+]*=)\" \\\n    \"id:941200,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# This rule tries to match all the possible ways to write 'javascript' using\n# html entities, and javascript escape sequences.\n# Regular expression generated from regex-assembly/941210.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941210\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:v|&#(?:0*(?:86|118)|x0*[57]6);)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;)).\" \\\n    \"id:941210,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'Javascript Word Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Regular expression generated from regex-assembly/941220.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941220\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)(?:v|&#(?:0*(?:118|86)|x0*[57]6);)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*(?:98|66)|x0*[46]2);)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[\\t\\n\\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;)).\" \\\n    \"id:941220,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)<EMBED[\\s/+].*?(?:src|type).*?=\" \\\n    \"id:941230,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx <[?]?import[\\s/+\\S]*?implementation[\\s/+]*?=\" \\\n    \"id:941240,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:lowercase,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Regular expression generated from regex-assembly/941250.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941250\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)<META[\\s\\x0b\\+/].*?http-equiv[\\s\\x0b\\+/]*=[\\s\\x0b\\+/]*[\\\"'`]?(?:[crs]|&#x?0*(?:6[37]|43|99|[578][23]|11[45]);?)\" \\\n    \"id:941250,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i:<META[\\s/+].*?charset[\\s/+]*=)\" \\\n    \"id:941260,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)<LINK[\\s/+].*?href[\\s/+]*=\" \\\n    \"id:941270,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)<BASE[\\s/+].*?href[\\s/+]*=\" \\\n    \"id:941280,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)<APPLET[\\s/+>]\" \\\n    \"id:941290,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Regular expression generated from regex-assembly/941300.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941300\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)<OBJECT[\\s\\x0b\\+/].*?(?:type|c(?:ode(?:type)?|lassid)|data)[\\s\\x0b\\+/]*=\" \\\n    \"id:941300,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html\n# US-ASCII encoding bypass listed on XSS filter evasion\n# Reported by Mazin Ahmed\n#\n# This evasion covered by this chain of rules is specific to webservers that deliver content in US-ASCII.\n# Only Apache Tomcat is known (according to the page linked above) to be vulnerable to this and probably has to be\n# misconfigured for this to happen.\n#\n# Since US-ASCII is a seven bit encoding, bit 8 is ignored. Consider the following ISO 8859-1 sequence:\n#\n# ¼script¾alert(¢XSS¢)¼/script¾\n#\n# A filter looking for tags will usually not match against this sequence because there are no angle brackets (< / >). However,\n# the characters where the brackets would be are ISO 8859-1 characters:\n# - ¼: 0x00BC\n# - ¾: 0x00BE\n# - ¢: 0x00A2\n#\n# And this is how the sequence looks in in US-ASCII:\n#\n# <script>alert(\"XSSB\")</script/>\n#\n# This enables an attacker to craft a string that will be delivered in a form that a browser will execute as script\n# while being ignored by input filters.\n#\n# This rule looks for a start tag sequence that looks like \"<...>\" (checks for hex and plain to be sure).\n# Because the bytes matched occur in many different languages encoded as multibyte characters (e.g. UTF-8)\n# (e.g. German umlauts, Russian characters) this isn't very helpful and can cause many false positives. We, therefore,\n# use a chained rule to also look for an end tag sequence that looks like \"</...>\". Only if the chained rule matches will\n# the request be blocked.\n#\n# This is of course still not perfect but should at least make it harder to hide most tags using this technique while\n# requiring very specific patterns in a language to match, which should get rid of most false positives.\n# These rules would, for example, not guard against an element without an end tag, e.g. \"<img... />\".\n#\n# US-ASCII on Wikipedia: https://en.wikipedia.org/wiki/ASCII\n# ISO 8859-1 on Wikipedia: https://en.wikipedia.org/wiki/ISO/IEC_8859-1\n\n# Regular expression generated from regex-assembly/941310.ra and\n# regex-assembly/941310-chain1.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941310 941310-chain1\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx \\x{bc}[^>\\x{be}]*[>\\x{be}]|<[^\\x{be}]*\\x{be}\" \\\n    \"id:941310,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,\\\n    msg:'US-ASCII Malformed Encoding XSS Filter - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-tomcat',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule MATCHED_VARS \"@rx \\x{bc}[\\s\\x0b]*/[\\s\\x0b]*[^>\\x{be}]*[>\\x{be}]|<[\\s\\x0b]*/[\\s\\x0b]*[^\\x{be}]*\\x{be}\" \\\n        \"setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# https://nedbatchelder.com/blog/200704/xss_with_utf7.html\n# UTF-7 encoding XSS filter evasion for IE.\n# Reported by Vladimir Ivanov\n#\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx \\+ADw-.*(?:\\+AD4-|>)|<.*\\+AD4-\" \\\n    \"id:941350,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,\\\n    msg:'UTF-7 Encoding IE XSS - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-internet-explorer',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Defend against JSFuck and Hieroglyphy obfuscation of Javascript code\n#\n# https://en.wikipedia.org/wiki/JSFuck\n# https://github.com/alcuadrado/hieroglyphy\n#\n# These JS obfuscations mostly aim for client side XSS exploits, hence the\n# integration of this rule into the XSS rule group. But serverside JS could\n# also be attacked via these techniques.\n#\n# Detection pattern / Core elements of JSFuck and Hieroglyphy are the\n# following two items:\n# !![]\n# !+[]\n#\n# ModSecurity always transforms \"+\" into \" \" with query strings and the\n# URLENCODE body processor (but not for JSON). So we need to check for\n# the following patterns:\n# !![]\n# !+[]\n# ! []\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx ![!+ ]\\[\\]\" \\\n    \"id:941360,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'JSFuck / Hieroglyphy obfuscation detected',\\\n    logdata:'Matched Data: Suspicious payload found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242/63',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# Prevent 941180 bypass by using JavaScript global variables\n# Refer to: https://www.secjuice.com/bypass-xss-filters-using-javascript-global-variables/\n#\n# Examples:\n#    - /?search=/?a=\";+alert(self[\"document\"][\"cookie\"]);//\n#    - /?search=/?a=\";+document+/*foo*/+.+/*bar*/+cookie;//\n#\n# Regular expression generated from regex-assembly/941370.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941370\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?:self|document|t(?:his|op)|window)[\\s\\x0b]*(?:/\\*|[\\)\\[]).+?(?:\\]|\\*/)\" \\\n    \"id:941370,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,t:compressWhitespace,\\\n    msg:'JavaScript global variable found',\\\n    logdata:'Matched Data: Suspicious JS global variable found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242/63',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# JavaScript methods which take code as a string types are considered unsafe.\n# Unsafe JS functions like eval(), setInterval(), setTimeout()\n# Unsafe JS constructor new Function()\n# https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#dangerous-contexts\n# https://snyk.io/blog/5-ways-to-prevent-code-injection-in-javascript-and-node-js/\n#\n# Regular expression generated from regex-assembly/941390.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941390\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)\\b(?:eval|set(?:timeout|interval)|new[\\s\\x0b]+Function|a(?:lert|tob)|btoa|(?:promp|impor)t|con(?:firm|sole\\.(?:log|dir))|fetch)[\\s\\x0b]*[\\(\\{]\" \\\n    \"id:941390,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:htmlEntityDecode,t:jsDecode,\\\n    msg:'Javascript method detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-nodejs',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# JavaScript function without parentheses\n# Reference: https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses\n#\n# Example Payloads:\n# [].sort.call`${alert}1337`\n# [].map.call`${eval}\\\\u{61}lert\\x281337\\x29`\n# Reflect.apply.call`${navigation.navigate}${navigation}${[name]}`\n#\n# Regular expression generated from regex-assembly/941400.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941400\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx ((?:\\[[^\\]]*\\]|Reflect)[^\\.]*\\.).*(?:map|sort|apply)[^\\.]*\\..*call[^`]*`.*`\" \\\n    \"id:941400,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:compressWhitespace,\\\n    msg:'XSS JavaScript function without parentheses',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:941013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:941014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n#\n# This is a stricter sibling of rule 941100.\n#\nSecRule REQUEST_FILENAME|REQUEST_HEADERS:Referer \"@detectXSS\" \\\n    \"id:941101,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'XSS Attack Detected via libinjection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ XSS Filters - Category 5 ]=-\n# HTML attributes - src, style and href\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)\\b(?:s(?:tyle|rc)|href)\\b[\\s\\S]*?=\" \\\n    \"id:941150,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\\\n    msg:'XSS Filter - Category 5: Disallowed HTML Attributes',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n\n#\n# [Deny List Keywords from Node-Validator]\n# https://github.com/validatorjs/validator.js/\n# This rule is a stricter sibling of 941180 (PL1)\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@contains -->\" \\\n    \"id:941181,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:lowercase,t:removeNulls,\\\n    msg:'Node-Validator Deny List Keywords',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n\n#\n# -=[ XSS Filters from IE ]=-\n\n# Detect tags that are the most common direct HTML injection points.\n#\n#     <a href=javascript:...\n#     <applet src=\"...\" type=text/html>\n#     <applet src=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgvWFNTLyk8L3NjcmlwdD4\" type=text/html>\n#     <base href=javascript:...\n#     <base href=... // change base URL to something else to exploit relative filename inclusion\n#     <bgsound src=javascript:...\n#     <body background=javascript:...\n#     <body onload=...\n#     <embed src=http://www.example.com/flash.swf allowScriptAccess=always\n#     <embed src=\"data:image/svg+xml;\n#     <frameset><frame src=\"javascript:...\"></frameset>\n#     <iframe src=javascript:...\n#     <img src=x onerror=...\n#     <input type=image src=javascript:...\n#     <layer src=...\n#     <link href=\"javascript:...\" rel=\"stylesheet\" type=\"text/css\"\n#     <link href=\"http://www.example.com/xss.css\" rel=\"stylesheet\" type=\"text/css\"\n#     <meta http-equiv=\"refresh\" content=\"0;url=javascript:...\"\n#     <meta http-equiv=\"refresh\" content=\"0;url=http://;javascript:...\" // evasion\n#     <meta http-equiv=\"link\" rel=stylesheet content=\"http://www.example.com/xss.css\">\n#     <meta http-equiv=\"Set-Cookie\" content=\"NEW_COOKIE_VALUE\">\n#     <object data=http://www.example.com\n#     <object type=text/x-scriptlet data=...\n#     <object type=application/x-shockwave-flash data=xss.swf>\n#     <object classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:...></object> // not verified\n#     <script>...</script>\n#     <script src=http://www.example.com/xss.js></script> - TODO add another rule for this\n#     <script src=\"data:text/javascript,alert(1)\"></script>\n#     <script src=\"data:text/javascript;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpOzwvc2NyaXB0Pg==\"></script>\n#     <style>STYLE</style>\n#     <style type=text/css>STYLE</style>\n#     <style type=text/javascript>alert('xss')</style>\n#     <table background=javascript:...\n#     <td background=javascript:\n#\n#\n# NOTES\n#\n#  - Reference the WASC Script Mapping Project - http://projects.webappsec.org/Script-Mapping\n#\n#  - Not using closing brackets because they are not needed for the\n#    attacks to succeed. The following seems to work in FF: <body/s/onload=...\n#\n#  - Also, browsers sometimes tend to translate < into >, in order to \"repair\"\n#    what they think was a mistake made by the programmer/template designer.\n#\n#  - Browsers are flexible when it comes to what they accept as separator between\n#    tag names and attributes. The following is commonly used in payloads: <img/src=...\n#    A better example: <BODY onload!#$%&amp;()*~+-_.,:;?@[/|\\]^=alert(\"XSS\")>\n#\n#  - Grave accents are sometimes used as an evasion technique (as a replacement for quotes),\n#    but I don't believe we need to look for quotes anywhere.\n#\n#  - Links do not have to be fully qualified. For example, the following works:\n#    <script src=\"//ha.ckers.org/.j\">\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Regular expression generated from regex-assembly/941320.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941320\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx <(?:a(?:bbr|cronym|ddress|pplet|rea|udioscope)?|b(?:ase(?:front)?|do|gsound|ig|l(?:(?:ackfac|ockquot)e|ink)|ody|[qr]|utton)?|c(?:aption|enter|ite|o(?:de|l(?:group)?|mment))|d(?:[dt]|e?l|fn|i[rv])|em(?:bed)?|f(?:ieldset|n|o(?:nt|rm)|rame(?:set)?)|h(?:[1r]|ead|tml)|i(?:frame|layer|mg|n(?:put|s)|sindex)?|k(?:db|eygen)|l(?:a(?:bel|yer)|egend|i(?:mittext|nk|sting)?)|m(?:a(?:p|rquee)|e(?:nu|ta)|ulticol)|no(?:br|embed|frames|s(?:cript|martquotes))|o(?:bject|l|pt(?:group|ion))|p(?:aram|laintext|re)?|q|r(?:t|uby)|s(?:amp|cript|e(?:lect|rver)|hadow|idebar|mall|pa(?:cer|n)|t(?:r(?:ike|ong)|yle)|u[bp])?|t(?:(?:ab|it)le|body|[dr]|extarea|(?:foo)?t|h(?:ead)?)|ul?|(?:va|wb)r|xm[lp])[^0-9A-Z_a-z]\" \\\n    \"id:941320,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:jsDecode,t:lowercase,\\\n    msg:'Possible XSS Attack Detected - HTML Tag Handler',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242/63',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/941330.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 941330\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)[\\\"'] *(?:[^ '0-:_a-z~]|in).*?(?:(?:l|\\x5cu006C)(?:o|\\x5cu006F)(?:c|\\x5cu0063)(?:a|\\x5cu0061)(?:t|\\x5cu0074)(?:i|\\x5cu0069)(?:o|\\x5cu006F)(?:n|\\x5cu006E)|(?:n|\\x5cu006E)(?:a|\\x5cu0061)(?:m|\\x5cu006D)(?:e|\\x5cu0065)|(?:o|\\x5cu006F)(?:n|\\x5cu006E)(?:e|\\x5cu0065)(?:r|\\x5cu0072)(?:r|\\x5cu0072)(?:o|\\x5cu006F)(?:r|\\x5cu0072)|(?:v|\\x5cu0076)(?:a|\\x5cu0061)(?:l|\\x5cu006C)(?:u|\\x5cu0075)(?:e|\\x5cu0065)(?:O|\\x5cu004F)(?:f|\\x5cu0066)).*?=\" \\\n    \"id:941330,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:htmlEntityDecode,t:compressWhitespace,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)[\\\"\\'][ ]*(?:[^a-z0-9~_:\\' ]|in).+?[.].+?=\" \\\n    \"id:941340,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:htmlEntityDecode,t:compressWhitespace,\\\n    msg:'IE XSS Filters - Attack Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# Defend against AngularJS client side template injection\n#\n# Of course, pure client-side AngularJS commands can not be intercepted.\n# But once a command is sent to the server, the CRS will trigger.\n#\n# https://portswigger.net/research/xss-without-html-client-side-template-injection-with-angularjs\n#\n# Example payload:\n# http://localhost/login?user=%20x%20%7B%7Bconstructor.constructor(%27alert(1)%27)()%7D%7D%20.%20ff\n# Decoded argument:\n# {{constructor.constructor('alert(1)')()}}\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx \\{\\{.*?}}\" \\\n    \"id:941380,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'AngularJS client side template injection detected',\\\n    logdata:'Matched Data: Suspicious payload found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'attack-xss',\\\n    tag:'xss-perf-disable',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-XSS',\\\n    tag:'capec/1000/152/242/63',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:941015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:941016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:941017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:941018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-941-APPLICATION-ATTACK-XSS\"\n",
+    "owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:942011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:942012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# References:\n#\n# SQL Injection Knowledgebase (via @LightOS) -\n# http://websec.ca/kb/sql_injection\n#\n# SQLi Filter Evasion Cheat Sheet -\n# http://websec.wordpress.com/2010/12/04/sqli-filter-evasion-cheat-sheet-mysql/\n#\n# SQL Injection Cheat Sheet -\n# http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/\n#\n# SQLMap's Tamper Scripts (for evasions)\n# https://github.com/sqlmapproject/sqlmap\n#\n\n#\n# -=[ LibInjection Check ]=-\n#\n# There is a stricter sibling of this rule at 942101. It covers REQUEST_BASENAME and REQUEST_FILENAME.\n#\n# Ref: https://github.com/libinjection/libinjection\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@detectSQLi\" \\\n    \"id:942100,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,\\\n    msg:'SQL Injection Attack Detected via libinjection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    multiMatch,\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ Detect DB Names ]=-\n#\n# Regular expression generated from regex-assembly/942140.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942140\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:d(?:atabas|b_nam)e[^0-9A-Z_a-z]*\\(|(?:information_schema|m(?:aster\\.\\.sysdatabases|s(?:db|ys(?:ac(?:cess(?:objects|storage|xml)|es)|modules2?|(?:object|querie|relationship)s))|ysql\\.db)|northwind|pg_(?:catalog|toast)|tempdb)\\b|s(?:chema(?:_name\\b|[^0-9A-Z_a-z]*\\()|(?:qlite_(?:temp_)?master|ys(?:aux|\\.database_name))\\b))\" \\\n    \"id:942140,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack: Common DB Names Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ SQL Function Names ]=-\n#\n# This rule has a stricter sibling to this rule (942152) that checks for SQL function names in\n# request headers referer and user-agent.\n#\n# Regular expression generated from regex-assembly/942151.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942151\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|eil(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert_tz)?)|t)|rc32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|s_(?:de|en)crypt)|ump)|e(?:n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|insert|object(?:_(?:agg|keys))?|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|insert_id)|case|east|i(?:kely|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2))|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:lygon|w)|rocedure_analyse)|qu(?:ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[12]?|in|oundex|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp))|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*\\(\" \\\n    \"id:942151,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack: SQL function name detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ PHPIDS - Converted SQLI Filters ]=-\n#\n# https://raw.githubusercontent.com/PHPIDS/PHPIDS/master/lib/IDS/default_filter.xml\n#\n# The rule 942160 prevents time-based blind SQL injection attempts\n# by prohibiting sleep() or benchmark(,) functions:\n#\n# * The sleep command takes a number of seconds as an argument.\n# * The benchmark command executes the specified expression multiple times.\n#\n# Using a long sleep time or high number of executions, you can create a delay\n# with the response from the server.  This allows to determine whether the\n# query has been executed or not.  A high response time proves that the SQLi\n# worked successfully. It can now be equipped with the real payload.\n#\n# Therefore this rule does not prevent the attack itself, but blocks an\n# attacker from using the standard utils to tinker with blind SQLi.\n#\n# A positive side effect is that it prevents certain DoS attacks via the directives\n# described above.\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i:sleep\\s*?\\(.*?\\)|benchmark\\s*?\\(.*?\\,.*?\\))\" \\\n    \"id:942160,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:replaceComments,\\\n    msg:'Detects blind sqli tests using sleep() or benchmark()',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942170.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942170\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:select|;)[\\s\\x0b]+(?:benchmark|if|sleep)[\\s\\x0b]*?\\([\\s\\x0b]*?\\(?[\\s\\x0b]*?[0-9A-Z_a-z]+\" \\\n    \"id:942170,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects SQL benchmark and sleep injection attempts including conditional queries',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942190.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942190\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\\"'`](?:[\\s\\x0b]*![\\s\\x0b]*[\\\"'<->`]|;?[\\s\\x0b]*(?:having|select|union\\b[\\s\\x0b]*(?:all|(?:distin|sele)ct))\\b[\\s\\x0b]*[^\\s\\x0b])|\\b(?:(?:(?:c(?:onnection_id|urrent_user)|database|schema|user)[\\s\\x0b]*?|select.*?[0-9A-Z_a-z]?user)\\(|exec(?:ute)?[\\s\\x0b]+master\\.|from[^0-9A-Z_a-z]+information_schema[^0-9A-Z_a-z]|into[\\s\\x0b\\+]+(?:dump|out)file[\\s\\x0b]*?[\\\"'`]|union(?:[\\s\\x0b]select[\\s\\x0b]@|[\\s\\x0b\\(0-9A-Z_a-z]*?select))|[\\s\\x0b]*?exec(?:ute)?.*?[^0-9A-Z_a-z]xp_cmdshell|[^0-9A-Z_a-z]iif[\\s\\x0b]*?\\(\" \\\n    \"id:942190,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:removeCommentsChar,\\\n    msg:'Detects SQL code execution and information gathering attempts',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Magic number crash in PHP strtod from 2011:\n# https://www.exploringbinary.com/php-hangs-on-numeric-value-2-2250738585072011e-308/\n#\n# Regular expression generated from regex-assembly/942220.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942220\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)^(?:json\\.)?(?:429496729[56]|2(?:14748364[78]|.22507385850720(?:07|11)e-308)|-(?:214748364[89]|0000023456)|00000(?:12345|23456)|1e309)$\" \\\n    \"id:942220,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Looking for integer overflow attacks, these are taken from skipfish, except 2.2.2250738585072011e-308 is the \\\"magic number\\\" crash',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942230.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942230\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\s\\x0b\\(\\)]case[\\s\\x0b]+when.*?then|\\)[\\s\\x0b]*?like[\\s\\x0b]*?\\(|select.*?having[\\s\\x0b]*?[^\\s\\x0b]+[\\s\\x0b]*?[^\\s\\x0b0-9A-Z_a-z]|if[\\s\\x0b]?\\([0-9A-Z_a-z]+[\\s\\x0b]*?[<->~]\" \\\n    \"id:942230,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects conditional SQL injection attempts',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942240.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942240\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)alter[\\s\\x0b]*?[0-9A-Z_a-z]+.*?char(?:acter)?[\\s\\x0b]+set[\\s\\x0b]+[0-9A-Z_a-z]+|[\\\"'`](?:;*?[\\s\\x0b]*?waitfor[\\s\\x0b]+(?:time|delay)[\\s\\x0b]+[\\\"'`]|;.*?:[\\s\\x0b]*?goto)\" \\\n    \"id:942240,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects MySQL charset switch and MSSQL DoS attempts',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942250.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942250\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)m(?:erge.*?using|atch[\\s\\x0b]*?[\\(\\)\\+-\\-0-9A-Z_a-z]+[\\s\\x0b]*?against)[\\s\\x0b]*?\\(|execute[\\s\\x0b]*?immediate[\\s\\x0b]*?[\\\"'`]\" \\\n    \"id:942250,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)union.*?select.*?from\" \\\n    \"id:942270,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Looking for basic sql injection. Common attack string for mysql, oracle and others',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942280.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942280\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)select[\\s\\x0b]*?pg_sleep|waitfor[\\s\\x0b]*?delay[\\s\\x0b]?[\\\"'`]+[\\s\\x0b]?[0-9]|;[\\s\\x0b]*?shutdown[\\s\\x0b]*?(?:[#;\\{]|/\\*|--)\" \\\n    \"id:942280,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942290.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942290\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\[?\\$(?:a(?:bs|c(?:cumulator|osh?)|dd(?:ToSet)?|ll(?:ElementsTrue)?|n(?:d|yElementTrue)|rray(?:ElemA|ToObjec)t|sinh?|tan[2h]?|vg)|b(?:etween|i(?:narySize|t(?:And|Not|(?:O|Xo)r)?)|ottomN?|sonSize|ucket(?:Auto)?)|c(?:eil|mp|o(?:n(?:cat(?:Arrays)?|d|vert)|sh?|unt|variance(?:Po|Sam)p)|urrentDate)|d(?:a(?:te(?:Add|Diff|From(?:Parts|String)|Subtract|T(?:o(?:Parts|String)|runc))|yOf(?:Month|Week|Year))|e(?:greesToRadians|nseRank|rivative)|iv(?:ide)?|ocumentNumber)|e(?:(?:a|lemMat)ch|q|x(?:ists|p(?:MovingAvg|r)?))|f(?:i(?:lter|rstN?)|loor|unction)|g(?:etField|roup|te?)|(?:hou|xo|yea)r|i(?:fNull|n(?:c|dexOf(?:Array|Bytes|CP)|tegral)?|s(?:Array|Number|o(?:DayOfWeek|Week(?:Year)?)))|jsonSchema|l(?:astN?|et|i(?:ke|(?:nearFil|tera)l)|n|o(?:cf|g(?:10)?)|t(?:e|rim)?)|m(?:a(?:p|xN?)|e(?:dian|rgeObjects|ta)|i(?:llisecond|n(?:N|ute)?)|o(?:d|nth)|ul(?:tiply)?)|n(?:atural|e|in|o[rt])|o(?:bjectToArray|r)|p(?:ercentile|o(?:[pw]|sition)|roject|u(?:ll(?:All)?|sh))|r(?:a(?:diansToDegrees|n(?:[dk]|ge))|e(?:(?:duc|nam)e|gex(?:Find(?:All)?|Match)?|place(?:All|One)|verseArray)|ound|trim)|s(?:(?:ampleRat|lic)e|e(?:cond|t(?:Difference|(?:Equal|WindowField)s|Field|I(?:ntersection|sSubset)|OnInsert|Union)?)|(?:hif|pli|qr)t|i(?:nh?|ze)|ort(?:Array)?|t(?:dDev(?:Po|Sam)p|r(?:Len(?:Bytes|CP)|casecmp))|u(?:b(?:str(?:Bytes|CP)?|tract)|m)|witch)|t(?:anh?|ext|o(?:Bool|D(?:(?:at|oubl)e|ecimal)|HashedIndexKey|Int|Lo(?:ng|wer)|ObjectId|String|U(?:UID|pper)|pN?)|r(?:im|unc)|s(?:Increment|Second)|ype)|unset|w(?:eek|here)|zip)\\b\\]?\" \\\n    \"id:942290,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Finds basic MongoDB SQL injection attempts',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# This rule has a stricter sibling (942321) that checks for MySQL and PostgreSQL procedures / functions in\n# request headers referer and user-agent.\n#\n# Regular expression generated from regex-assembly/942320.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942320\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)create[\\s\\x0b]+(?:function|procedure)[\\s\\x0b]*?[0-9A-Z_a-z]+[\\s\\x0b]*?\\([\\s\\x0b]*?\\)[\\s\\x0b]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][\\s\\x0b]*?[0-9A-Z_a-z]+|iv[\\s\\x0b]*?\\([\\+\\-]*[\\s\\x0b\\.0-9]+,[\\+\\-]*[\\s\\x0b\\.0-9]+\\))|exec[\\s\\x0b]*?\\([\\s\\x0b]*?@|(?:lo_(?:impor|ge)t|procedure[\\s\\x0b]+analyse)[\\s\\x0b]*?\\(|;[\\s\\x0b]*?(?:declare|open)[\\s\\x0b]+[\\-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[\\s\\x0b]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)\" \\\n    \"id:942320,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects MySQL and PostgreSQL stored procedure/function injections',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942350.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942350\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)create[\\s\\x0b]+function[\\s\\x0b].+[\\s\\x0b]returns|;[\\s\\x0b]*?(?:alter|(?:(?:cre|trunc|upd)at|re(?:nam|plac))e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)\\b[\\s\\x0b]*?[\\(\\[]?[0-9A-Z_a-z]{2,}\" \\\n    \"id:942350,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:replaceComments,\\\n    msg:'Detects MySQL UDF injection and other data/structure manipulation attempts',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# This rule has two stricter sibling: 942361 and 942362.\n# The keywords 'alter' and 'union' led to false positives.\n# Therefore they have been moved to PL2 and the keywords have been extended on PL1.\n# The original version also had loose word boundaries and context checksum cause further false positives.\n# Because fixing those introduced bypass, the original variant was moved to PL2 as 942362.\n#\n# Sources for SQL ALTER statements:\n# MySQL: https://dev.mysql.com/doc/refman/5.7/en/sql-syntax-data-definition.html\n# Oracle/PLSQL: https://docs.oracle.com/search/?q=alter&size=60&category=database\n# PostgreQSL: https://www.postgresql.org/search/?u=%2Fdocs&q=alter\n# MSSQL: https://learn.microsoft.com/en-us/sql/t-sql/statements/statements?view=sql-server-ver16\n# DB2: https://www.ibm.com/docs/en/search/alter?scope=SSEPGG_9.5.0\n#\n# Regular expression generated from regex-assembly/942360.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942360\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[\\s\\x0b]+(?:char|group_concat|load_file)\\b[\\s\\x0b]*\\(?|end[\\s\\x0b]*?\\);)|[\\s\\x0b\\(]load_file[\\s\\x0b]*?\\(|[\\\"'`][\\s\\x0b]+regexp[^0-9A-Z_a-z]|[\\\"'0-9A-Z_-z][\\s\\x0b]+as\\b[\\s\\x0b]*[\\\"'0-9A-Z_-z]+[\\s\\x0b]*\\bfrom|^(?:json\\.)?[^A-Z_a-z]+[\\s\\x0b]*?(?:(?:(?:(?:cre|trunc)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[\\s\\x0b]+[0-9A-Z_a-z]+|u(?:pdate[\\s\\x0b]+[0-9A-Z_a-z]+|nion[\\s\\x0b]*(?:all|(?:sele|distin)ct)\\b)|alter[\\s\\x0b]*(?:a(?:(?:ggregat|pplication[\\s\\x0b]*rol)e|s(?:sembl|ymmetric[\\s\\x0b]*ke)y|u(?:dit|thorization)|vailability[\\s\\x0b]*group)|b(?:roker[\\s\\x0b]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[\\s\\x0b]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[\\s\\x0b]*group|in)))|m(?:a(?:s(?:k|ter[\\s\\x0b]*key)|terialized)|e(?:ssage[\\s\\x0b]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[\\s\\x0b]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[\\s\\x0b]*schema|srobject))\\b)\" \\\n    \"id:942360,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects concatenated basic SQL injection and SQLLFI attempts',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ Detect MySQL in-line comments ]=-\n#\n# MySQL in-line comments can be used to bypass SQLi detection.\n#\n# Ref: https://dev.mysql.com/doc/refman/8.0/en/comments.html:\n# SELECT /*! STRAIGHT_JOIN */ col1 FROM table1,table2 WHERE ...\n# CREATE TABLE t1(a INT, KEY (a)) /*!50110 KEY_BLOCK_SIZE=1024 */;\n# SELECT /*+ BKA(t1) */ FROM ... ;\n#\n# http://localhost/test.php?id=9999+or+{if+length((/*!5000select+username/*!50000from*/user+where+id=1))>0}\n#\n# The minimal string that triggers this regexp is: /*!*/ or /*+*/.\n# The rule 942500 is related to 942440 which catches both /*! and */ independently.\n#\n# Regular expression generated from regex-assembly/942500.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942500\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)/\\*[\\s\\x0b]*?[!\\+](?:[\\s\\x0b\\(\\)\\-0-9=A-Z_a-z]+)?\\*/\" \\\n    \"id:942500,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'MySQL in-line comment detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    multiMatch,\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# This rule catches an authentication bypass via SQL injection that abuses semi-colons to end the SQL query early.\n# Any characters after the semi-colon are ignored by some DBMSes (e.g. SQLite).\n#\n# An example of this would be:\n#   email=admin%40juice-sh.op';&password=foo\n#\n# The server then turns this into:\n#   SELECT * FROM users WHERE email='admin@juice-sh.op';' AND password='foo'\n#\n# Regular expression generated from regex-assembly/942540.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942540\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx ^(?:[^']*'|[^\\\"]*\\\"|[^`]*`)[\\s\\x0b]*;\" \\\n    \"id:942540,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:replaceComments,\\\n    msg:'SQL Authentication bypass (split query)',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'paranoia-level/1',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# This rule catches on Scientific Notation bypass payloads in MySQL\n# Reference: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MySQL%20Injection.md#scientific-notation\n#\n# Regular expression generated from regex-assembly/942560.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942560\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)1\\.e(?:[\\(\\),]|\\.[\\$0-9A-Z_a-z])\" \\\n    \"id:942560,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:replaceComments,\\\n    msg:'MySQL Scientific Notation payload detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# This rule tries to match JSON SQL syntax that could be used as a bypass technique.\n# Referring to this research: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf\n#\n# Regular expression generated from regex-assembly/942550.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942550\n#\nSecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\\"'`][\\[\\{][^#\\]\\}]*[\\]\\}]+[\\\"'`]|(?:[\\-@]>?|<@|@[\\?@]|\\?(?:(?:)|&|\\|#>)|#(?:>>|-)|->>|[<>])[\\\"'`](?:[\\[\\{][^#\\]\\}]*[\\]\\}]+[\\\"'`]|\\$[\\.\\[])|\\bjson_extract\\b[^\\(]*\\([^\\)]*\\)\" \\\n    \"id:942550,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:removeWhitespace,\\\n    msg:'JSON-Based SQL Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:942013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:942014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n#\n# -=[ SQL Operators ]=-\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Regular expression generated from regex-assembly/942120.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942120\n#\nSecRule ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/*|XML://@* \"@rx (?i)[!=]=|&&|\\|\\||->|>[=>]|<(?:[<=]|>(?:[\\s\\x0b]+binary)?)|\\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\\\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\\b|[0-9A-Z_a-z]*?_))|(?:likel(?:ihood|y)|unlikely)[\\s\\x0b]*\\()|r(?:egexp|like)[\\s\\x0b]+binary|not[\\s\\x0b]+between[\\s\\x0b]+(?:0[\\s\\x0b]+and|(?:'[^']*'|\\\"[^\\\"]*\\\")[\\s\\x0b]+and[\\s\\x0b]+(?:'[^']*'|\\\"[^\\\"]*\\\"))|is[\\s\\x0b]+null|like[\\s\\x0b]+(?:null|[0-9A-Z_a-z]+[\\s\\x0b]+escape\\b)|(?:^|[^0-9A-Z_a-z])in[\\s\\x0b\\+]*\\([\\s\\x0b\\\"0-9]+[^\\(\\)]*\\)|[!<->][\\s\\x0b]*all\\b\" \\\n    \"id:942120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack: SQL Operator Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ SQL Tautologies ]=-\n#\n# Boolean-based SQL injection or tautology attack. Boolean values (True or False) are used to carry out\n# this type of SQL injection. The malicious SQL query forces the web application to return a different result de-\n# pending on whether the query returns a TRUE or FALSE result.\n#\n# The original 942130 was split in two rules:\n# - 942130 targets tautologies using equalities (e.g. 1 = 1)\n# - 942131 targets tautologies using inequalities (e.g. 1 != 2)\n#\n# We use captures to check for (in)equality in the regexp. So TX.1 will capture the left hand side (LHS) of the inequality,\n# and TX.2 will capture the right hand side (RHS) of the logical query.\n#\n# Regular expression generated from regex-assembly/942130.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942130\n#\nSecRule ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\s\\x0b\\\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b[\\s\\x0b\\\"'-\\)`]*?(?:=|<=>|(?:sounds[\\s\\x0b]+)?like|glob|r(?:like|egexp))[\\s\\x0b\\\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b\" \\\n    \"id:942130,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:replaceComments,\\\n    msg:'SQL Injection Attack: SQL Boolean-based attack detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{TX.942130_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.942130_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule TX:1 \"@streq %{TX.2}\" \\\n        \"t:none,\\\n        setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Rule Targeting logical inequalities that return TRUE (e.g. 1 != 2)\n#\n#\n# We use captures to check for (in)equality in the regexp. So TX.1 will capture the left hand side (LHS) of the inequality,\n# and TX.2 will capture the right hand side (RHS) of the logical query.\n#\n# Regular expression generated from regex-assembly/942131.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942131\n#\nSecRule ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\s\\x0b\\\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b[\\s\\x0b\\\"'-\\)`]*?(?:![<->]|<[=>]?|>=?|\\^|is[\\s\\x0b]+not|not[\\s\\x0b]+(?:like|r(?:like|egexp)))[\\s\\x0b\\\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b\" \\\n    \"id:942131,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,t:replaceComments,\\\n    msg:'SQL Injection Attack: SQL Boolean-based attack detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{TX.942131_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    multiMatch,\\\n    setvar:'tx.942131_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule TX:1 \"!@streq %{TX.2}\" \\\n        \"t:none,\\\n        setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ SQL Function Names ]=-\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Regular expression generated from regex-assembly/942150.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942150\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|g(?:lob|roup_concat)|h(?:ex|our)|i(?:f(?:null)?|if|n(?:str)?)|l(?:ast(?:_insert_rowid)?|ength|ike(?:l(?:ihood|y))?|n|o(?:ad_extension|g(?:10|2)?|wer(?:pi)?|cal)|trim)|m(?:ax|in(?:ute)?|o(?:d|nth))|n(?:ullif|ow)|p(?:i|ow(?:er)?|rintf|assword)|quote|r(?:a(?:dians|ndom(?:blob)?)|e(?:p(?:lace|eat)|verse)|ound|trim|ight)|s(?:i(?:gn|nh?)|oundex|q(?:lite_(?:compileoption_(?:get|used)|offset|source_id|version)|rt)|u(?:bstr(?:ing)?|m)|econd|leep)|t(?:anh?|otal(?:_changes)?|r(?:im|unc)|ypeof|ime)|u(?:n(?:icode|likely)|(?:pp|s)er)|zeroblob|bin|v(?:alues|ersion)|week|year)[^0-9A-Z_a-z]*\\(\" \\\n    \"id:942150,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack: SQL function name detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ SQL Authentication Bypasses ]=-\n#\n# Authentication bypass occurs when the attacker can log in as another user\n# without knowing the user's password. The example bypass could look like this:\n#\n# x' OR 'x\n#\n# Because of the quantity of different rules they are split into:\n# - 942540 PL1\n# - 942180 PL2\n# - 942260 PL2\n# - 942340 PL2\n# - 942520 PL2\n#   - 942521 PL2\n#   - 942522 PL2\n\n# Regular expression generated from regex-assembly/942180.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942180\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:/\\*)+[\\\"'`]+[\\s\\x0b]?(?:--|[#\\{]|/\\*)?|[\\\"'`](?:[\\s\\x0b]*(?:(?:x?or|and|div|like|between)[\\s\\x0b\\-0-9A-Z_a-z]+[\\(\\)\\+-\\-<->][\\s\\x0b]*[\\\"'0-9`]|[!=\\|](?:[\\s\\x0b!\\+\\-0-9=]+[^\\[]*[\\\"'\\(`].*|[\\s\\x0b!0-9=]+[^0-9]*[0-9]+)$|(?:like|print)[^0-9A-Z_a-z]+[\\\"'\\(0-9A-Z_-z]|;)|(?:[<>~]+|[\\s\\x0b]*[^\\s\\x0b0-9A-Z_a-z]?=[\\s\\x0b]*|[^0-9A-Z_a-z]*?[\\+=]+[^0-9A-Z_a-z]*?)[\\\"'`])|[0-9][\\\"'`][\\s\\x0b]+[\\\"'`][\\s\\x0b]+[0-9]|^(?:json\\.)?admin[\\s\\x0b]*?[\\\"'`]|[\\s\\x0b\\\"'\\(`][\\s\\x0b]*?glob[^0-9A-Z_a-z]+[\\\"'\\(0-9A-Z_-z]|[\\s\\x0b]is[\\s\\x0b]*?0[^0-9A-Z_a-z]|where[\\s\\x0b][\\s\\x0b,-\\.0-9A-Z_a-z]+[\\s\\x0b]=\" \\\n    \"id:942180,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects basic SQL authentication bypass attempts 1/3',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Regular expression generated from regex-assembly/942200.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942200 942200-chain1\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i),(?:[^\\)]*?(?:(?:0x[0-9a-f]+|\\([0-9a-f]+\\))(?:$|[\\\"'`](?:$|[^\\\"'`]+[\\\"'`])|(?:\\r?\\n)?\\z)|[\\\"'`][^\\\"'`]+[\\\"'`])|[^\\s\\x0b\\)]+[\\\"'`](?:$|(?:\\r?\\n)?\\z))|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[\\s\\x0b]*?\\([\\s\\x0b]*?space[\\s\\x0b]*?\\(\" \\\n    \"id:942200,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects MySQL comment-/space-obfuscated injections and backtick termination',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule MATCHED_VARS \"!@rx ^[,\\-0-9=A-Z_a-z]+$\" \\\n        \"t:none,\\\n        setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Regular expression generated from regex-assembly/942210.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942210\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:&&|\\|\\||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[\\s\\x0b\\(]+[0-9A-Z_a-z]+[\\s\\x0b\\)]*?[!\\+=]+[\\s\\x0b0-9]*?[\\\"'-\\)=`]|[0-9](?:[\\s\\x0b]*?(?:and|between|div|like|x?or)[\\s\\x0b]*?[0-9]+[\\s\\x0b]*?[\\+\\-]|[\\s\\x0b]+group[\\s\\x0b]+by.+\\()|/[0-9A-Z_a-z]+;?[\\s\\x0b]+(?:and|between|div|having|like|x?or|select)[^0-9A-Z_a-z]|(?:[#;]|--)[\\s\\x0b]*?(?:alter|drop|(?:insert|update)[\\s\\x0b]*?[0-9A-Z_a-z]{2,})|@.+=[\\s\\x0b]*?\\([\\s\\x0b]*?select|[^0-9A-Z_a-z]SET[\\s\\x0b]*?@[0-9A-Z_a-z]+\" \\\n    \"id:942210,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects chained SQL injection attempts 1/2',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942260.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942260\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\\"'`][\\s\\x0b]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|\\|\\||&&)[\\s\\x0b]+[\\s\\x0b0-9A-Z_a-z]+=[\\s\\x0b]*?[0-9A-Z_a-z]+[\\s\\x0b]*?having[\\s\\x0b]+|like[^0-9A-Z_a-z]*?[\\\"'0-9`])|[0-9A-Z_a-z][\\s\\x0b]+like[\\s\\x0b]+[\\\"'`]|like[\\s\\x0b]*?[\\\"'`]%|select[\\s\\x0b]+?[\\s\\x0b\\\"'-\\),-\\.0-9A-\\[\\]_-z]+from[\\s\\x0b]+\" \\\n    \"id:942260,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects basic SQL authentication bypass attempts 2/3',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942300.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942300\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\)[\\s\\x0b]*?when[\\s\\x0b]*?[0-9]+[\\s\\x0b]*?then|[\\\"'`][\\s\\x0b]*?(?:[#\\{]|--)|/\\*![\\s\\x0b]?[0-9]+|\\b(?:(?:binary|cha?r)[\\s\\x0b]*?\\([\\s\\x0b]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:egexp|like))[\\s\\x0b]+[0-9A-Z_a-z]+\\()|(?:\\|\\||&&)[\\s\\x0b]*?[0-9A-Z_a-z]+\\(\" \\\n    \"id:942300,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects MySQL comments, conditions and ch(a)r injections',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942310.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942310\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:\\([\\s\\x0b]*?select[\\s\\x0b]*?[0-9A-Z_a-z]+|coalesce|order[\\s\\x0b]+by[\\s\\x0b]+if[0-9A-Z_a-z]*?)[\\s\\x0b]*?\\(|\\*/from|\\+[\\s\\x0b]*?[0-9]+[\\s\\x0b]*?\\+[\\s\\x0b]*?@|[0-9A-Z_a-z][\\\"'`][\\s\\x0b]*?(?:(?:[\\+\\-=@\\|]+[\\s\\x0b]+?)+|[\\+\\-=@\\|]+)[\\(0-9]|@@[0-9A-Z_a-z]+[\\s\\x0b]*?[^\\s\\x0b0-9A-Z_a-z]|[^0-9A-Z_a-z]!+[\\\"'`][0-9A-Z_a-z]|[\\\"'`](?:;[\\s\\x0b]*?(?:if|while|begin)|[\\s\\x0b0-9]+=[\\s\\x0b]*?[0-9])|[\\s\\x0b\\(]+case[0-9]*?[^0-9A-Z_a-z].+[tw]hen[\\s\\x0b\\(]\" \\\n    \"id:942310,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects chained SQL injection attempts 2/2',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ SQL Injection Probings ]=-\n#\n# This is a group of three similar rules aiming to detect SQL injection probings.\n#\n# 942330 PL 2\n# 942370 PL 2\n# 942490 PL 3\n# Regular expression generated from regex-assembly/942330.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942330\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\\"'`][\\s\\x0b]*?\\b(?:x?or|div|like|between|and)\\b[\\s\\x0b]*?[\\\"'`]?[0-9]|\\x5cx(?:2[37]|3d)|^(?:.?[\\\"'`]$|[\\\"'\\x5c`]*?(?:[\\\"'0-9`]+|[^\\\"'`]+[\\\"'`])[\\s\\x0b]*?\\b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|\\|\\||&&)\\b[\\s\\x0b]*?[\\\"'0-9A-Z_-z][!&\\(\\)\\+-\\.@])|[^\\s\\x0b0-9A-Z_a-z][0-9A-Z_a-z]+[\\s\\x0b]*?[\\-\\|][\\s\\x0b]*?[\\\"'`][\\s\\x0b]*?[0-9A-Z_a-z]|@(?:[0-9A-Z_a-z]+[\\s\\x0b]+(?:and|x?or|div|like|between)\\b[\\s\\x0b]*?[\\\"'0-9`]+|[\\-0-9A-Z_a-z]+[\\s\\x0b](?:and|x?or|div|like|between)\\b[\\s\\x0b]*?[^\\s\\x0b0-9A-Z_a-z])|[^\\s\\x0b0-:A-Z_a-z][\\s\\x0b]*?[0-9][^0-9A-Z_a-z]+[^\\s\\x0b0-9A-Z_a-z][\\s\\x0b]*?[\\\"'`].|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]\" \\\n    \"id:942330,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects classic SQL injection probings 1/3',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942340.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942340\n#\n# Note that part of 942340.data is already optimized, to avoid a\n# Regexp::Assemble behaviour, where the regex is not optimized very nicely.\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)in[\\s\\x0b]*?\\(+[\\s\\x0b]*?select|(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between)[\\s\\x0b]+|(?:\\|\\||&&)[\\s\\x0b]*?)[\\s\\x0b\\+0-9A-Z_a-z]+(?:regexp[\\s\\x0b]*?\\(|sounds[\\s\\x0b]+like[\\s\\x0b]*?[\\\"'`]|[0-9=]+x)|[\\\"'`](?:[\\s\\x0b]*?(?:(?:[0-9]+[\\s\\x0b]*?(?:--|#)|is[\\s\\x0b]*?(?:[0-9][^\\\"'`]+[\\\"'`]?[0-9A-Z_a-z]|[\\.0-9]+[\\s\\x0b]*?[^0-9A-Z_a-z][^\\\"'`]*[\\\"'`])|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between)[\\s\\x0b]+|(?:\\|\\||&&)[\\s\\x0b]*?)(?:array[\\s\\x0b]*?\\[|(?:tru|fals)e\\b|[0-9A-Z_a-z]+(?:[\\s\\x0b]*?!?~|[\\s\\x0b]+(?:not[\\s\\x0b]+)?similar[\\s\\x0b]+to[\\s\\x0b]+))|[%&<->\\^]+[0-9]+[\\s\\x0b]*?(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between)=)|(?:[^0-9A-Z_a-z]+[\\+\\-0-9A-Z_a-z]+[\\s\\x0b]*?=[\\s\\x0b]*?[0-9][^0-9A-Z_a-z]+|\\|?[\\-0-9A-Z_a-z]{3,}[^\\s\\x0b,\\.0-9A-Z_a-z]+)[\\\"'`])|\\bexcept[\\s\\x0b]+(?:select\\b|values[\\s\\x0b]*?\\()\" \\\n    \"id:942340,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects basic SQL authentication bypass attempts 3/3',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This rule is a stricter sibling of 942360.\n# The keywords 'alter' and 'union' led to false positives.\n# Therefore they have been moved to PL2 and the keywords have been extended on PL1.\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i:^(?:json\\.)?[\\W\\d]+\\s*?(?:alter|union)\\b)\" \\\n    \"id:942361,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects basic SQL injection based on keyword alter or union',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This rule is a stricter sibling of 942360.\n# The loose word boundaries and light context led to false positives.\n# Because the stricter variant does miss quite a few legitimate payloads, the loose version was moved to PL2.\n#\n# Regular expression generated from regex-assembly/942362.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942362\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[\\s\\x0b]+(?:char|group_concat|load_file)[\\s\\x0b]?\\(?|end[\\s\\x0b]*?\\);|[\\s\\x0b\\(]load_file[\\s\\x0b]*?\\(|[\\\"'`][\\s\\x0b]+regexp[^0-9A-Z_a-z]|[^A-Z_a-z][\\s\\x0b]+as\\b[\\s\\x0b]*[\\\"'0-9A-Z_-z]+[\\s\\x0b]*\\bfrom|^(?:json\\.)?[^A-Z_a-z]+[\\s\\x0b]*?(?:create[\\s\\x0b]+[0-9A-Z_a-z]+|(?:d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load|(?:renam|truncat)e|u(?:pdate|nion[\\s\\x0b]*(?:all|(?:sele|distin)ct))|alter[\\s\\x0b]*(?:a(?:(?:ggregat|pplication[\\s\\x0b]*rol)e|s(?:sembl|ymmetric[\\s\\x0b]*ke)y|u(?:dit|thorization)|vailability[\\s\\x0b]*group)|b(?:roker[\\s\\x0b]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[\\s\\x0b]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[\\s\\x0b]*group|in)))|m(?:a(?:s(?:k|ter[\\s\\x0b]*key)|terialized)|e(?:ssage[\\s\\x0b]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[\\s\\x0b]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[\\s\\x0b]*schema|srobject)))\\b)\" \\\n    \"id:942362,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects concatenated basic SQL injection and SQLLFI attempts',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# This rule is a sibling of 942330. See that rule for a description and overview.\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Regular expression generated from regex-assembly/942370.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942370\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\\"'`](?:[\\s\\x0b]*?(?:(?:\\*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?[\\\"'`]|(?:x?or|div|like|between|and)[\\s\\x0b][^0-9]+[\\-0-9A-Z_a-z]+[^0-9]*)[0-9]|[^\\s\\x0b0-9\\?A-Z_a-z]+[\\s\\x0b]*?[^\\s\\x0b0-9A-Z_a-z]+[\\s\\x0b]*?[\\\"'`]|[^\\s\\x0b0-9A-Z_a-z]+[\\s\\x0b]*?[^A-Z_a-z](?:[^#]*#|.*?--))|[^\\*]*\\*[\\s\\x0b]*?[0-9])|\\^[\\\"'`]|[%\\(-\\+\\-<>][\\-0-9A-Z_a-z]+[^\\s\\x0b0-9A-Z_a-z]+[\\\"'`][^,]\" \\\n    \"id:942370,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects classic SQL injection probings 2/3',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942380.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942380\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:having\\b(?:[\\s\\x0b]+(?:[0-9]{1,10}|'[^=]{1,10}')[\\s\\x0b]*?[<->]| ?(?:[0-9]{1,10} ?[<->]+|[\\\"'][^=]{1,10}[ \\\"'<-\\?\\[]+))|ex(?:ecute(?:\\(|[\\s\\x0b]{1,5}[\\$\\.0-9A-Z_a-z]{1,5}[\\s\\x0b]{0,3})|ists[\\s\\x0b]*?\\([\\s\\x0b]*?select\\b)|(?:create[\\s\\x0b]+?table.{0,20}?|like[^0-9A-Z_a-z]*?char[^0-9A-Z_a-z]*?)\\()|select.*?case|from.*?limit|order[\\s\\x0b]by|exists[\\s\\x0b](?:[\\s\\x0b]select|s(?:elect[^\\s\\x0b](?:if(?:null)?[\\s\\x0b]\\(|top|concat)|ystem[\\s\\x0b]\\()|\\bhaving\\b[\\s\\x0b]+[0-9]{1,10}|'[^=]{1,10}')\" \\\n    \"id:942380,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942390.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942390\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\bx?or\\b(?:[\\s\\x0b]+[0-9]{1,10}(?:[\\s\\x0b]*[<->])?|[\\s\\x0b]*[\\\"'][^=]+[\\\"'])|[\\\"'][\\s\\x0b]+\\bx?or\\b[\\s\\x0b]+[^!\\+\\-<->]+[!\\+\\-<->]\" \\\n    \"id:942390,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack using (X)OR',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/942400.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942400\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\band\\b(?:[\\s\\x0b]+(?:[0-9]{1,10}[\\s\\x0b]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|[\\\"'][^=]{1,10}[\\\"']) ?[<->]+)\" \\\n    \"id:942400,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# The former rule id 942410 was split into three new rules: 942410, 942470, 942480\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Regular expression generated from regex-assembly/942410.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942410\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:a(?:(?:b|co)s|vg)|bin|c(?:(?:as|o(?:nver|un))t|h(?:ar(?:set)?|r))|d(?:a(?:te|y)|e(?:fault|grees))|elt|f(?:ield|loor|ormat)|(?:hou|quarte|yea)r|i[fns]|l(?:ast|e(?:ft|ngth)|n|ikelihood|o(?:cal|g|wer))|m(?:ax|in(?:ute)?|o(?:d|nth))|now|p(?:assword|i|o(?:sition|wer))|r(?:awtonhex(?:toraw)?|e(?:p(?:eat|lace)|verse)|ight|ound)|s(?:econd|ign|leep|pace|tddev|um)|t(?:an|ime|o_(?:n?char|(?:day|second)s))|u(?:nlikely|(?:pp|s)er)|v(?:alues|ersion)|week)[^0-9A-Z_a-z]*?\\(\" \\\n    \"id:942410,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# The former rule id 942410 was split into three new rules: 942410, 942470, 942480\n#\n# Regular expression generated from regex-assembly/942470.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942470\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|oacreate|p(?:assword|repare)|replwritetovarbin)|ql_(?:longvarchar|variant))|utl_(?:file|http)|xp_(?:availablemedia|(?:cmdshel|servicecontro)l|dirtree|e(?:numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(?:_enumdomains)?|reg(?:addmultistring|delete(?:key|value)|enum(?:key|value)s|re(?:ad|movemultistring)|write)|terminate(?:_process)?)\" \\\n    \"id:942470,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# The former rule id 942410 was split into three new rules: 942410, 942470, 942480\n#\n# Regular expression generated from regex-assembly/942480.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942480\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b(?:(?:d(?:bms_[0-9A-Z_a-z]+\\.|elete\\b[^0-9A-Z_a-z]*?\\bfrom)|(?:group\\b.*?\\bby\\b.{1,100}?\\bhav|overlay\\b[^0-9A-Z_a-z]*?\\(.*?\\b[^0-9A-Z_a-z]*?plac)ing|in(?:ner\\b[^0-9A-Z_a-z]*?\\bjoin|sert\\b[^0-9A-Z_a-z]*?\\binto|to\\b[^0-9A-Z_a-z]*?\\b(?:dump|out)file)|load\\b[^0-9A-Z_a-z]*?\\bdata\\b.*?\\binfile|s(?:elect\\b.{1,100}?\\b(?:(?:.*?\\bdump\\b.*|(?:count|length)\\b.{1,100}?)\\bfrom|(?:data_typ|from\\b.{1,100}?\\bwher)e|instr|to(?:_(?:cha|numbe)r|p\\b.{1,100}?\\bfrom))|ys_context)|u(?:nion\\b.{1,100}?\\bselect|tl_inaddr))\\b|print\\b[^0-9A-Z_a-z]*?@@)|(?:collation[^0-9A-Z_a-z]*?\\(a|@@version|;[^0-9A-Z_a-z]*?\\b(?:drop|shutdown))\\b|'(?:dbo|msdasql|s(?:a|qloledb))'\" \\\n    \"id:942480,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ SQL Injection Character Anomaly Usage ]\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# This rules attempts to gauge when there is an excessive use of\n# meta-characters within a single parameter payload.\n#\n# Expect a lot of false positives with this rule.\n# The most likely false positive instances will be free-form text fields.\n# This will make it necessary to disable the rule for certain known parameters.\n# The following directive is an example to switch off the rule globally for\n# the parameter foo. Place this instruction in your configuration after\n# the include directive for the Core Rules Set.\n#\n# SecRuleUpdateTargetById 942430 \"!ARGS:foo\"\n#\n\n# Regular expression generated from regex-assembly/942430.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942430\n#\nSecRule ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx ((?:(?:[!-\\+\\-:->@\\[\\]\\^`\\{-~]|\\x{c2}\\x{b4}|\\x{e2}\\x80[\\x98\\x99])[^!-\\+\\-:->@\\[\\]\\^`\\{-~]*?){12})\" \\\n    \"id:942430,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)',\\\n    logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.warning_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'\"\n\n#\n# -=[ Detect SQL Comment Sequences ]=-\n#\n# Example Payloads Detected:\n# -------------------------\n# OR 1#\n# DROP sampletable;--\n# admin'--\n# DROP/*comment*/sampletable\n# DR/**/OP/*bypass deny listing*/sampletable\n# SELECT/*avoid-spaces*/password/**/FROM/**/Members\n# SELECT /*!32302 1/0, */ 1 FROM tablename\n# ‘ or 1=1#\n# ‘ or 1=1-- -\n# ‘ or 1=1/*\n# ' or 1=1;\\x00\n# 1='1' or-- -\n# ' /*!50000or*/1='1\n# ' /*!or*/1='1\n# 0/**/union/*!50000select*/table_name`foo`/**/\n# -------------------------\n#\n# The chained rule is designed to prevent false positives by specifically\n# targeting JWT tokens and common tokens (brid, fbclid, gclid, recaptcha, ttclid, etc).\n#\n# Starting with 'ey' targets JWT tokens, where the 'ey'\n# prefix corresponds to the beginning of the Base64-encoded header section.\n#\n# example:\n# $ echo '{\"' | base64\n# eyIK\n#\n# Regular expressions generated from regex-assembly/942440.ra and regex-assembly/942440-chain1.ra.\n# To update the regular expressions run the following shell scripts\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942440\n#   crs-toolchain regex update 942440-chain1\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx /\\*!?|\\*/|[';]--|--(?:[\\s\\x0b]|[^\\-]*?-)|[^&\\-]#.*?[\\s\\x0b]|;?\\x00\" \\\n    \"id:942440,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Comment Sequence Detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule MATCHED_VARS \"!@rx ^(?:ey[\\-0-9A-Z_a-z]+\\.ey[\\-0-9A-Z_a-z]+\\.)?[\\-0-9A-Z_a-z]+$\" \\\n        \"t:none,\\\n        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ SQL Bin / Hex Evasion Methods ]=-\n#\n# Hex encoding detection:\n# (?i:\\b0x[a-f\\d]{3,}) will match any 3 or more hex bytes after \"0x\", together forming a hexadecimal payload(e.g 0xf00, 0xf00d and so on)\n#\n# Regular expression generated from regex-assembly/942450.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942450\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\b0x[0-9a-f]{3,}|(?:x'[0-9a-f]{3,}|b'[01]{10,})'\" \\\n    \"id:942450,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Bin or Hex Encoding Identified',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# -=[ Detect SQLi bypass: backticks ]=-\n#\n# Quotes and backticks can be used to bypass SQLi detection.\n#\n# Example:\n# GET http://localhost/test.php?id=9999%20or+{`if`(2=(select+2+from+wp_users+where+user_login='admin'))}\n#\n# The minimum text between the ticks or backticks must be 2 (if, for example) and a maximum of 29.\n# 29 is a compromise: The lower this number (29), the lower the probability of FP and the higher the probability of false negatives.\n# In tests we got a minimum number of FP with {2,29}.\n#\n# Base64 encoding detection:\n# (?:[A-Za-z0-9+/]{4})+ #match any number of 4-letter blocks of the base64 char set\n# (?:[A-Za-z0-9+/]{2}== #match 2-letter block of the base64 char set followed by \"==\", together forming a 4-letter block\n# |                     # or\n# [A-Za-z0-9+/]{3}=     #match 3-letter block of the base64 char set followed by \"=\", together forming a 4-letter block\n# )?\n#\n# The minimal string that triggers this regexp is: `if`\n#\n# The rule 942511 is similar to this rule, but triggers on normal quotes\n# ('if'). That rule runs in paranoia level 3 or higher since it is prone to\n# false positives in natural text.\n#\n# Regular expression generated from regex-assembly/942510.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942510\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx `(?:[\\s\\x0b\\(\\)\\+\\-0-9<=@-Z_a-\\{\\}]{2,29}|(?:[\\+/-9A-Za-z]{4})+(?:(?:[\\+/-9A-Za-z]{2}=|[\\+/-9A-Za-z]{3})=)?)`\" \\\n    \"id:942510,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQLi bypass attempt by ticks or backticks detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# Regular expression generated from regex-assembly/942520.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942520\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)[\\\"'`][\\s\\x0b]*?(?:(?:is[\\s\\x0b]+not|not[\\s\\x0b]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[\\s\\x0b]+like)\\b|[%&\\*\\+\\-/<->\\^\\|]{1,3})\" \\\n    \"id:942520,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects basic SQL authentication bypass attempts 4.0/4',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# Complementary rule to PL2 942520 that block and/or-based bypasses.\n# It blocks data with odd number of quotes and then (and|or).\n#\n# The rule uses the expression ^b*a*(b*a*b*a*)* to odd number of a's. It's not\n# vulnerable to ReDos as it executes linearly many steps compared to input size.\n#\n# Regular expression generated from regex-assembly/942521.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942521\n#\nSecRule REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^\\\"]*?(?:\\\"[^\\\"]*?\\\"[^\\\"]*?)*?\\\"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[\\s\\x0b]*([0-9A-Z_a-z]+)\\b\" \\\n    \"id:942521,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects basic SQL authentication bypass attempts 4.1/4',\\\n    logdata:'Matched Data: %{TX.0} found within %{TX.942521_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.942521_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule TX:1 \"@rx ^(?:and|or)$\" \\\n        \"t:none,\\\n        setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# Complementary rule to PL2 942521 that block escaped quotes followed by (and|or)\n#\nSecRule ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx \\x5c['\\\"`](?:.*?['\\\"`])?\\s*(?:and|or)\\b\" \\\n    \"id:942522,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects basic SQL authentication bypass attempts 4.1/4',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# This is a sibling of rule 942100 that adds checking of the path.\n#\n# REQUEST_BASENAME provides the last url segment (slash excluded).\n# This segment is the most likely to be used for injections. Stripping out\n# the slash permits libinjection to do not consider it as a payload starting\n# with not unary arithmetical operators (not a valid SQL command, e.g.\n# '/9 union all'). The latter would lead to do not detect malicious payloads.\n#\n# REQUEST_FILENAME matches SQLi payloads inside (or across) other segments\n# of the path. Here, libinjection will detect a true positive only if\n# the url leading slash is considered as part of a comment block or part\n# of a string (with a quote or double quote after it). In these circumstances,\n# previous slashes do not affect libinjection result, making it able to detect\n# some SQLi inside the path.\n#\nSecRule REQUEST_BASENAME|REQUEST_FILENAME \"@detectSQLi\" \\\n    \"id:942101,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,\\\n    msg:'SQL Injection Attack Detected via libinjection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# -=[ SQL Function Names ]=-\n#\n# This rule is a stricter sibling of 942151.\n# This rule 942152 checks for the same regex in request headers referer and user-agent.\n#\n# Regular expression generated from regex-assembly/942152.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942152\n#\nSecRule REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent \"@rx (?i)\\b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|eil(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|rc32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|insert_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[12]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*\\(\" \\\n    \"id:942152,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQL Injection Attack: SQL function name detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n#\n# This rule is a stricter sibling of 942320.\n# It checks for the same regex in request headers referer and user-agent.\n#\n# Regular expression generated from regex-assembly/942321.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942321\n#\nSecRule REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent \"@rx (?i)create[\\s\\x0b]+(?:function|procedure)[\\s\\x0b]*?[0-9A-Z_a-z]+[\\s\\x0b]*?\\([\\s\\x0b]*?\\)[\\s\\x0b]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][\\s\\x0b]*?[0-9A-Z_a-z]+|iv[\\s\\x0b]*?\\([\\+\\-]*[\\s\\x0b\\.0-9]+,[\\+\\-]*[\\s\\x0b\\.0-9]+\\))|exec[\\s\\x0b]*?\\([\\s\\x0b]*?@|(?:lo_(?:impor|ge)t|procedure[\\s\\x0b]+analyse)[\\s\\x0b]*?\\(|;[\\s\\x0b]*?(?:declare|open)[\\s\\x0b]+[\\-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[\\s\\x0b]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)\" \\\n    \"id:942321,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects MySQL and PostgreSQL stored procedure/function injections',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:942015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:942016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n#\n# [ SQL HAVING queries ]\n#\n# This pattern was split off from rule 942250 due to frequent\n# false positives in English text. Testing showed that SQL\n# injections with HAVING should be detected by libinjection\n# (rule 942100).\n#\n# This is a stricter sibling of rule 942250.\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\W+\\d*?\\s*?\\bhaving\\b\\s*?[^\\s\\-]\" \\\n    \"id:942251,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects HAVING injections',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n# This rule is a stricter sibling of 942330. See that rule for a\n# description and overview.\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx [\\\"'`][\\s\\d]*?[^\\w\\s]\\W*?\\d\\W*?.*?[\\\"'`\\d]\" \\\n    \"id:942490,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Detects classic SQL injection probings 3/3',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n#\n# [ SQL Injection Character Anomaly Usage ]\n#\n# This rule attempts to gauge when there is an excessive use of\n# meta-characters within a single parameter payload.\n#\n# It is similar to 942430, but focuses on Cookies instead of\n# GET/POST parameters.\n#\n# Expect a lot of false positives with this rule.\n# The most likely false positive instances will be complex session ids.\n# This will make it necessary to disable the rule for certain known cookies.\n# The following directive is an example to switch off the rule globally for\n# the cookie foo_id. Place this instruction in your configuration after\n# the include directive for the Core Rules Set.\n#\n# SecRuleUpdateTargetById 942420 \"!REQUEST_COOKIES:foo_id\"\n#\n\n# Regular expression generated from regex-assembly/942420.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942420\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES \"@rx ((?:(?:[!-\\+\\-:->@\\[\\]\\^`\\{-~]|\\x{c2}\\x{b4}|\\x{e2}\\x80[\\x98\\x99])[^!-\\+\\-:->@\\[\\]\\^`\\{-~]*?){8})\" \\\n    \"id:942420,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)',\\\n    logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.warning_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# This is a stricter sibling of rule 942430.\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n\n# Regular expression generated from regex-assembly/942431.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942431\n#\nSecRule ARGS_NAMES|!ARGS_NAMES:/^[\\w]+\\[[\\w\\-]+\\]\\[[\\w\\-]*?\\]$/|!ARGS_NAMES:/^[\\w]+\\[[\\w\\-]+\\]\\[[\\w\\-]+\\]\\[[\\w\\-]*?\\]$/|ARGS|XML:/*|XML://@* \"@rx ((?:(?:[!-\\+\\-:->@\\[\\]\\^`\\{-~]|\\x{c2}\\x{b4}|\\x{e2}\\x80[\\x98\\x99])[^!-\\+\\-:->@\\[\\]\\^`\\{-~]*?){6})\" \\\n    \"id:942431,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)',\\\n    logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.warning_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# [ Repetitive Non-Word Characters ]\n#\n# This rule attempts to identify when multiple (4 or more) non-word characters\n# are repeated in sequence.\n#\n# The pattern may occur in some normal texts, e.g. \"foo....\" will match.\n#\n# If your traffic contains languages that include accented characters, such as French,\n# Spanish, or German, be aware that you may encounter more false positives than\n# usual. In this case, you may consider increasing the consecutive occurrence limit\n# to 5 instead of 4.\n#\n# This will help avoid common triggers such as \"test=+à+\", which is frequent in French.\n#\n# All languages that use characters without a valid representation outside of UTF-8\n# (i.e., relying solely on multi-byte sequences such as %E6%84%9B (Japanese))\n# are incompatible with this rule.\n# In such cases, the rule should be globally disabled.\n#\nSecRule ARGS \"@rx \\W{4}\" \\\n    \"id:942460,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# -=[ Detect SQLi bypass: quotes ]=-\n#\n# Quotes and backticks can be used to bypass SQLi detection.\n#\n# Example:\n# GET http://localhost/test.php?id=9999%20or+{`if`(2=(select+2+from+wp_users+where+user_login='admin'))}\n#\n# The minimum text between the ticks or backticks must be 2 (if, for example) and a maximum of 29.\n# 29 is a compromise: The lower this number (29), the lower the probability of FP and the higher the probability of false negatives.\n# In tests we got a minimum number of FP with {2,29}.\n#\n# Base64 encoding detection:\n# (?:[A-Za-z0-9+/]{4})+ #match any number of 4-letter blocks of the base64 char set\n# (?:[A-Za-z0-9+/]{2}== #match 2-letter block of the base64 char set followed by \"==\", together forming a 4-letter block\n# |                     # or\n# [A-Za-z0-9+/]{3}=     #match 3-letter block of the base64 char set followed by \"=\", together forming a 4-letter block\n# )?\n#\n# The minimal string that triggers this regexp is: 'if'\n#\n# The rule 942510 is similar to this rule, but triggers on backticks\n# (`if`). That rule runs in paranoia level 2 or higher since the risk of\n# false positives in natural text is still present but lower than this\n# rule.\n#\n# Regular expression generated from regex-assembly/942511.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942511\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx '(?:[\\s\\x0b\\(\\)\\+\\-0-9<=@-Z_a-\\{\\}]{2,29}|(?:[\\+/-9A-Za-z]{4})+(?:(?:[\\+/-9A-Za-z]{2}=|[\\+/-9A-Za-z]{3})=)?)'\" \\\n    \"id:942511,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQLi bypass attempt by ticks detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n# Detects ';\n# ' Single quote. Used to delineate a query with an unmatched quote.\n# ; Terminate a query. A prematurely terminated query creates an error.\n# Explanation source:\n# https://hwang.cisdept.cpp.edu/swanew/Text/SQL-Injection.htm\n#\n# Bug Bounty example: email=admin@juice-sh.op';&password=foo\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx ';\" \\\n    \"id:942530,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'SQLi query termination detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:942017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:942018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n#\n# [ SQL Injection Character Anomaly Usage ]\n#\n# This is a stricter sibling of rule 942420.\n#\n\n# Regular expression generated from regex-assembly/942421.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942421\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES \"@rx ((?:(?:[!-\\+\\-:->@\\[\\]\\^`\\{-~]|\\x{c2}\\x{b4}|\\x{e2}\\x80[\\x98\\x99])[^!-\\+\\-:->@\\[\\]\\^`\\{-~]*?){3})\" \\\n    \"id:942421,\\\n    phase:1,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)',\\\n    logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/4',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.warning_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# This is a stricter sibling of rule 942430.\n#\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n\n# Regular expression generated from regex-assembly/942432.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 942432\n#\nSecRule ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx ((?:(?:[!-\\+\\-:->@\\[\\]\\^`\\{-~]|\\x{c2}\\x{b4}|\\x{e2}\\x80[\\x98\\x99])[^!-\\+\\-:->@\\[\\]\\^`\\{-~]*?){2})\" \\\n    \"id:942432,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)',\\\n    logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-sqli',\\\n    tag:'paranoia-level/4',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SQLI',\\\n    tag:'capec/1000/152/248/66',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'WARNING',\\\n    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.warning_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'\"\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-942-APPLICATION-ATTACK-SQLI\"\n",
+    "owasp-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:943011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:943012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# Session fixation\n#\n# -=[ References ]=-\n# http://projects.webappsec.org/Session-Fixation\n# http://projects.webappsec.org/w/page/13246960/Session%20Fixation\n# http://capec.mitre.org/data/definitions/61.html\n#\n# Regular expression generated from regex-assembly/943100.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 943100\n#\nSecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*|XML://@* \"@rx (?i)\\.cookie\\b.*?;[^0-9A-Z_a-z]*?(?:expires|domain)[^0-9A-Z_a-z]*?=|\\bhttp-equiv[^0-9A-Z_a-z]+set-cookie\\b\" \\\n    \"id:943100,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'Possible Session Fixation Attack: Setting Cookie Values in HTML',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-fixation',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SESSION-FIXATION',\\\n    tag:'capec/1000/225/21/593/61',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Regular expression generated from regex-assembly/943110.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 943110\n#\nSecRule ARGS_NAMES \"@rx ^(?:json\\.)?(?:j(?:se(?:ssionid|rvsession)|wsession)|(?:asp(?:\\.net_)?session|zend_session_)id|p(?:hpsessi(?:on|d)|lay_session)|(?:(?:w(?:eblogic|l)|rack\\.|laravel_)sessio|(?:next-auth\\.session-|meteor_login_)toke)n|s(?:(?:ession[\\-_]?|ails\\.s)id|hiny-token)|_(?:session_id|(?:(?:flask|rails)_sessio|_(?:secure|host)-next-auth\\.session-toke)n)|c(?:f(?:s?id|token)|onnect\\.sid|akephp|i_session)|koa[\\.:]sess)$\" \\\n    \"id:943110,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referer',\\\n    logdata:'Matched Data: %{TX.0} found within %{TX.943110_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-fixation',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SESSION-FIXATION',\\\n    tag:'capec/1000/225/21/593/61',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.943110_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule REQUEST_HEADERS:Referer \"@rx ^(?:ht|f)tps?://(.*?)/\" \\\n        \"capture,\\\n        chain\"\n        SecRule TX:1 \"!@endsWith %{request_headers.host}\" \\\n            \"setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\\\n            setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Regular expression generated from regex-assembly/943120.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 943120\n#\nSecRule ARGS_NAMES \"@rx ^(?:json\\.)?(?:j(?:se(?:ssionid|rvsession)|wsession)|(?:asp(?:\\.net_)?session|session[\\-_]?)id|phpsessi(?:on|d)|(?:weblogic|laravel_)session|_(?:session_id|flask_session)|c(?:f(?:s?id|token)|onnect\\.sid))$\" \\\n    \"id:943120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'Possible Session Fixation Attack: SessionID Parameter Name with No Referer',\\\n    logdata:'Matched Data: %{TX.0} found within %{TX.943120_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-fixation',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-SESSION-FIXATION',\\\n    tag:'capec/1000/225/21/593/61',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.943120_matched_var_name=%{matched_var_name}',\\\n    chain\"\n    SecRule &REQUEST_HEADERS:Referer \"@eq 0\" \\\n        \"setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:943013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:943014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:943015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:943016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:943017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:943018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION\"\n",
+    "owasp-crs/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n# Many rules check request bodies, use \"SecRequestBodyAccess On\" to enable it on main modsecurity configuration file.\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:944011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:944012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n# This rule is also triggered by an Apache Struts exploit:\n# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/xsscx/cve-2017-5638 ]\n#\n# This rule is also triggered by an Apache Struts Remote Code Execution exploit:\n# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ]\n#\n# This rule is also triggered by an Apache Struts Remote Code Execution exploit:\n# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ]\n#\n# This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit:\n# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ]\n#\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \\\n    \"@rx java\\.lang\\.(?:runtime|processbuilder)\" \\\n    \"id:944100,\\\n    phase:2,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Remote Command Execution: Suspicious Java class detected',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/137/6',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# This rule is also triggered by the following exploit(s):\n# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/xsscx/cve-2017-5638 ]\n# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ]\n# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ]\n# [ Java deserialization vulnerability/Apache Struts (CVE-2017-9805) ]\n# [ Java deserialization vulnerability/Oracle Weblogic (CVE-2017-10271) ]\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\n# Generic rule to detect processbuilder or runtime calls, if any of those is found and the same target contains\n# java. unmarshaller or base64data to trigger a potential payload execution\n# tested with https://www.exploit-db.com/exploits/42627/ and https://www.exploit-db.com/exploits/43458/\n\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \"@rx (?:runtime|processbuilder)\" \\\n    \"id:944110,\\\n    phase:2,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Remote Command Execution: Java process spawn (CVE-2017-9805)',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/248',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule MATCHED_VARS|XML:/*|XML://@* \"@rx (?i)(?:unmarshaller|base64data|java\\.)\" \\\n        \"setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Magic bytes detected and payload included possibly RCE vulnerable classes detected and process execution methods detected\n# anomaly score set to critical as all conditions indicate the request try to perform RCE.\n# Regular expression generated from regex-assembly/944120.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 944120\n#\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \\\n    \"@rx (?:clonetransform|xmldecod)er|f(?:orclosure|ilewriter)|in(?:stantiate(?:factory|transformer)|vokertransformer)|(?:prototype(?:clone|serialization)factor|getpropert)y|whileclosure\" \\\n    \"id:944120,\\\n    phase:2,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Remote Command Execution: Java serialization (CVE-2015-4852)',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/248',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule MATCHED_VARS \"@rx (?:runtime|processbuilder)\" \\\n        \"setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# This rule is also triggered by the following exploit(s):\n# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/mazen160/struts-pwn ]\n# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/xsscx/cve-2017-5638 ]\n# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ]\n# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ]\n# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ]\n# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45262 ]\n# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45260 ]\n#\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_FILENAME|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \\\n    \"@pmFromFile java-classes.data\" \\\n    \"id:944130,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Suspicious Java class detected',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/248',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n#\n# [ Java Script Uploads ]\n#\n# Block file uploads with filenames ending in Java scripts (.jsp, .jspx)\n#\n# Many application contain Unrestricted File Upload vulnerabilities.\n# https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload\n#\n# Attackers may use such a vulnerability to achieve remote code execution\n# by uploading a script file. If the upload storage location is predictable\n# and not adequately protected, the attacker may then request the uploaded\n# file and have the code within it executed on the server.\n#\n# Also block files with trailing dot (.) or slash (/) characters after\n# the extension (ref V29-260924).\n#\n# Some AJAX uploaders use the nonstandard request headers X-Filename,\n# X_Filename, or X-File-Name to transmit the file name to the server;\n# scan these request headers as well as multipart/form-data file names.\n#\nSecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name \"@rx .*\\.(?:jsp|jspx)[./]*$\" \\\n    \"id:944140,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,t:removeWhitespace,\\\n    msg:'Java Injection Attack: Java Script File Upload Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-java',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n# Log4J / Log4Shell Defense\n#\n# This addresses exploits against the Log4J library described in several CVEs:\n# * CVE-2021-44228\n# * CVE-2021-44832\n# * CVE-2021-45046\n# * CVE-2021-45105\n#\n# See https://coreruleset.org/20211213/crs-and-log4j-log4shell-cve-2021-44228/\n#\n# This rule attempts to detect two things:\n# * Nested use of ${\n# * use of ${jndi:... without the closing bracket\n#\n# Rule 932130 is also essential for defense since there are certain\n# bypasses of the log4j rules that can be caught by 932130.\n#\n# The payload is not displayed in the alert message since log4j could\n# potentially be executed on the logviewer.\n#\n# This rule has stricter siblings: 944151 (PL2), 944152 (PL4)\n#\n# Regular expression generated from regex-assembly/944150.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 944150\n#\nSecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \"@rx (?i)(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)(?:[^\\}]{0,15}(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)|jndi|ctx)\" \\\n    \"id:944150,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,\\\n    log,\\\n    msg:'Potential Remote Command Execution: Log4j / Log4shell',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/137/6',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:944013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:944014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n# This is a stricter sibling of 944150.\n# It is a re-iteration of said rule without the curly bracket distance limiter\n# between the nested \"${\". This is prone to backtracking and therefore a potential\n# DoS problem for backtracking regular expression engines (e.g. PCRE2), but it also avoids evasions that fill the space between the nested\n# elements with arbitrary data.\n#\n# Regular expression generated from regex-assembly/944151.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 944151\n#\nSecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \"@rx (?i)(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)(?:[^\\}]*(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)|jndi|ctx)\" \\\n    \"id:944151,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,\\\n    log,\\\n    msg:'Potential Remote Command Execution: Log4j / Log4shell',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/137/6',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# [ Java deserialization vulnerability/Apache Commons (CVE-2015-4852) ]\n#\n# Detect exploitation of \"Java deserialization\" Apache Commons.\n#\n# Based on rules by @spartantri.\n# https://spartantri.com/ModSecurity/?p=44\n#\n# Interesting references about the vulnerability\n# https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/\n# https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet\n#\n# Potential false positives with random fields, the anomaly level is set low to avoid blocking request\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \\\n    \"@rx \\xac\\xed\\x00\\x05\" \\\n    \"id:944200,\\\n    phase:2,\\\n    block,\\\n    msg:'Magic bytes Detected, probable java serialization in use',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/248',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Detecting possible base64 text to match encoded magic bytes \\xac\\xed\\x00\\x05 with padding encoded in base64 strings are rO0ABQ KztAAU Cs7QAF\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \\\n    \"@rx (?:rO0ABQ|KztAAU|Cs7QAF)\" \\\n    \"id:944210,\\\n    phase:2,\\\n    block,\\\n    msg:'Magic bytes Detected Base64 Encoded, probable java serialization in use',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/248',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/944240.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 944240\n#\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \\\n    \"@rx (?:clonetransform|xmldecod)er|f(?:orclosure|ilewriter)|in(?:stantiate(?:factory|transformer)|vokertransformer)|(?:prototype(?:clone|serialization)factor|getpropert)y|whileclosure\" \\\n    \"id:944240,\\\n    phase:2,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Remote Command Execution: Java serialization (CVE-2015-4852)',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/248',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n# This rule is also triggered by the following exploit(s):\n# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]\n#\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \\\n    \"@rx java\\b.+(?:runtime|processbuilder)\" \\\n    \"id:944250,\\\n    phase:2,\\\n    block,\\\n    t:lowercase,\\\n    msg:'Remote Command Execution: Suspicious Java method detected',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/248',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\n# This rule is also triggered by the following exploit(s):\n# - https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/\n#\n# Regular expression generated from regex-assembly/944260.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 944260\n#\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \\\n    \"@rx class\\.module\\.classLoader\\.resources\\.context\\.parent\\.pipeline|springframework\\.context\\.support\\.FileSystemXmlApplicationContext\" \\\n    \"id:944260,\\\n    phase:2,\\\n    block,\\\n    t:urlDecodeUni,\\\n    msg:'Remote Command Execution: Malicious class-loading payload',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/248',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:944015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:944016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n# Interesting keywords for possibly RCE on vulnerable classes and methods base64 encoded\n# Keywords = ['runtime', 'processbuilder', 'clonetransformer', 'forclosure', 'instantiatefactory', 'instantiatetransformer', 'invokertransformer', 'prototypeclonefactory', 'prototypeserializationfactory', 'whileclosure']\n#for item in keywords:\n#   pad='\\x00'\n#   for padding in xrange(3):\n#     print base64.b64encode(''.join([pad*padding,item])).replace('=','')[padding:],\n#cnVudGltZQ HJ1bnRpbWU BydW50aW1l cHJvY2Vzc2J1aWxkZXI HByb2Nlc3NidWlsZGVy Bwcm9jZXNzYnVpbGRlcg Y2xvbmV0cmFuc2Zvcm1lcg GNsb25ldHJhbnNmb3JtZXI BjbG9uZXRyYW5zZm9ybWVy Zm9yY2xvc3VyZQ GZvcmNsb3N1cmU Bmb3JjbG9zdXJl aW5zdGFudGlhdGVmYWN0b3J5 Gluc3RhbnRpYXRlZmFjdG9yeQ BpbnN0YW50aWF0ZWZhY3Rvcnk aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg Gluc3RhbnRpYXRldHJhbnNmb3JtZXI BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy aW52b2tlcnRyYW5zZm9ybWVy Gludm9rZXJ0cmFuc2Zvcm1lcg BpbnZva2VydHJhbnNmb3JtZXI cHJvdG90eXBlY2xvbmVmYWN0b3J5 HByb3RvdHlwZWNsb25lZmFjdG9yeQ Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5 Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ d2hpbGVjbG9zdXJl HdoaWxlY2xvc3VyZQ B3aGlsZWNsb3N1cmU\n#\n# Regular expression generated from regex-assembly/944300.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 944300\n#\nSecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \\\n    \"@rx c(?:nVudGltZQ|HJv(?:Y2Vzc2J1aWxkZXI|dG90eXBl(?:Y2xvbmVmYWN0b3J5|c2VyaWFsaXphdGlvbmZhY3Rvcnk)))|H(?:J1bnRpbWU|Byb(?:2Nlc3NidWlsZGVy|3RvdHlwZ(?:WNsb25lZmFjdG9yeQ|XNlcmlhbGl6YXRpb25mYWN0b3J5))|doaWxlY2xvc3VyZQ)|B(?:(?:ydW50aW1|mb3JjbG9zdXJ)l|wcm9(?:jZXNzYnVpbGRlcg|0b3R5cGV(?:jbG9uZWZhY3Rvcnk|zZXJpYWxpemF0aW9uZmFjdG9yeQ))|jbG9uZXRyYW5zZm9ybWVy|pbn(?:N0YW50aWF0Z(?:WZhY3Rvcnk|XRyYW5zZm9ybWVy)|Zva2VydHJhbnNmb3JtZXI)|3aGlsZWNsb3N1cmU)|Y2xvbmV0cmFuc2Zvcm1lcg|G(?:Nsb25ldHJhbnNmb3JtZXI|ZvcmNsb3N1cmU|lu(?:c3RhbnRpYXRl(?:ZmFjdG9yeQ|dHJhbnNmb3JtZXI)|dm9rZXJ0cmFuc2Zvcm1lcg))|Zm9yY2xvc3VyZQ|aW5(?:zdGFudGlhdGV(?:mYWN0b3J5|0cmFuc2Zvcm1lcg)|2b2tlcnRyYW5zZm9ybWVy)|d2hpbGVjbG9zdXJl\" \\\n    \"id:944300,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Base64 encoded string matched suspicious keyword',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/248',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:944017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:944018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n# This is a stricter sibling of 944150.\n# It simply checks for the existence of `${`, taking into account the same encoding evasions\n# as 944150.\n#\n# Regular expression generated from regex-assembly/944152.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 944152\n#\nSecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Cookie|XML:/*|XML://@* \"@rx (?i)(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)\" \\\n    \"id:944152,\\\n    phase:2,\\\n    block,\\\n    t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,\\\n    log,\\\n    msg:'Potential Remote Command Execution: Log4j / Log4shell',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/4',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/ATTACK-JAVA',\\\n    tag:'capec/1000/152/137/6',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'\"\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-944-APPLICATION-ATTACK-JAVA\"\n",
+    "owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n# Summing up the blocking and detection anomaly scores in phase 1\n# even when early blocking is disabled, we need to sum up the scores in phase 1\n# this prevents bugs in phase 5 if Apache skips phases because of error handling\n# See: https://github.com/coreruleset/coreruleset/issues/2319#issuecomment-1047503932\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 1\" \\\n    \"id:949052,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 1\" \\\n    \"id:949152,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 2\" \\\n    \"id:949053,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 2\" \\\n    \"id:949153,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 3\" \\\n    \"id:949054,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 3\" \\\n    \"id:949154,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 4\" \\\n    \"id:949055,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 4\" \\\n    \"id:949155,\\\n    phase:1,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'\"\n\n# at start of phase 2, we reset the aggregate scores to 0 to prevent duplicate counting of per-PL scores\n# this is necessary because the per-PL scores are counted across phases\nSecAction \\\n    \"id:949059,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=0'\"\n\nSecAction \\\n    \"id:949159,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_inbound_anomaly_score=0'\"\n\n# Summing up the blocking and detection anomaly scores in phase 2\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 1\" \\\n    \"id:949060,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 1\" \\\n    \"id:949160,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 2\" \\\n    \"id:949061,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 2\" \\\n    \"id:949161,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 3\" \\\n    \"id:949062,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 3\" \\\n    \"id:949162,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 4\" \\\n    \"id:949063,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 4\" \\\n    \"id:949163,\\\n    phase:2,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'\"\n\n\nSecMarker \"BEGIN-REQUEST-BLOCKING-EVAL\"\n\n#\n# -=[ Anomaly Mode: Overall Transaction Anomaly Score ]=-\n#\n\n# if early blocking is active, check threshold in phase 1\nSecRule TX:BLOCKING_INBOUND_ANOMALY_SCORE \"@ge %{tx.inbound_anomaly_score_threshold}\" \\\n    \"id:949111,\\\n    phase:1,\\\n    deny,\\\n    t:none,\\\n    msg:'Inbound Anomaly Score Exceeded in phase 1 (Total Score: %{TX.BLOCKING_INBOUND_ANOMALY_SCORE})',\\\n    tag:'anomaly-evaluation',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    chain\"\n    SecRule TX:EARLY_BLOCKING \"@eq 1\"\n\n# always check threshold in phase 2\nSecRule TX:BLOCKING_INBOUND_ANOMALY_SCORE \"@ge %{tx.inbound_anomaly_score_threshold}\" \\\n    \"id:949110,\\\n    phase:2,\\\n    deny,\\\n    t:none,\\\n    msg:'Inbound Anomaly Score Exceeded (Total Score: %{TX.BLOCKING_INBOUND_ANOMALY_SCORE})',\\\n    tag:'anomaly-evaluation',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:949011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:949012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:949013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:949014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:949015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:949016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:949017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:949018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-REQUEST-949-BLOCKING-EVALUATION\"\n",
+    "owasp-crs/rules/REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n# This file is used as an exception mechanism to remove common false positives\n# that may be encountered. This file does not contain any runtime rule-exclusions\n# and so it must loaded after all the request rules have been created. The tests for this\n# file can be found in `REQUEST-999-COMMON-EXCEPTIONS-AFTER/999999.yaml`\n\n# To have a standard order, please:\n#\n# 1. Keep all the exceptions that target the same cookie (or cookie regexp together)\n# 2. Order them by rule id.\n# 3. Add a blank line when the cookie/cookie regexp changes, so it shows visually\n\n# Google Analytics Cookies\n# Matches:\n#   _ga\n#   _ga_5WLQM4K1ZX\nSecRuleUpdateTargetById 932240 \"!REQUEST_COOKIES:/^_ga(?:_\\w+)?$/\"\nSecRuleUpdateTargetById 941100 \"!REQUEST_COOKIES:/^_ga(?:_\\w+)?$/\"\nSecRuleUpdateTargetById 942290 \"!REQUEST_COOKIES:/^_ga(?:_\\w+)?$/\"\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:/^_ga(?:_\\w+)?$/\"\nSecRuleUpdateTargetById 942550 \"!REQUEST_COOKIES:/^_ga(?:_\\w+)?$/\"\n\n# Google Ads Cookie\nSecRuleUpdateTargetById 941100 \"!REQUEST_COOKIES:__gads\"\nSecRuleUpdateTargetById 942290 \"!REQUEST_COOKIES:__gads\"\nSecRuleUpdateTargetById 942420 \"!REQUEST_COOKIES:__gads\"\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:__gads\"\nSecRuleUpdateTargetById 942550 \"!REQUEST_COOKIES:__gads\"\nSecRuleUpdateTargetById 942420 \"!REQUEST_COOKIES:__gpi\"\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:__gpi\"\n\n# Google Funding Choices cookie\nSecRuleUpdateTargetById 941100 \"!REQUEST_COOKIES:FCCDCF\"\nSecRuleUpdateTargetById 942200 \"!REQUEST_COOKIES:FCCDCF\"\nSecRuleUpdateTargetById 942290 \"!REQUEST_COOKIES:FCCDCF\"\nSecRuleUpdateTargetById 942340 \"!REQUEST_COOKIES:FCCDCF\"\nSecRuleUpdateTargetById 942370 \"!REQUEST_COOKIES:FCCDCF\"\nSecRuleUpdateTargetById 942420 \"!REQUEST_COOKIES:FCCDCF\"\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:FCCDCF\"\nSecRuleUpdateTargetById 942490 \"!REQUEST_COOKIES:FCCDCF\"\nSecRuleUpdateTargetById 942550 \"!REQUEST_COOKIES:FCCDCF\"\n\n# Security cookie for Google Ads\nSecRuleUpdateTargetById 942420 \"!REQUEST_COOKIES:__eoi\"\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:__eoi\"\n\n# Google Analytics Funding Choices cookie\nSecRuleUpdateTargetById 942340 \"!REQUEST_COOKIES:FCNEC\"\nSecRuleUpdateTargetById 942370 \"!REQUEST_COOKIES:FCNEC\"\nSecRuleUpdateTargetById 942420 \"!REQUEST_COOKIES:FCNEC\"\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:FCNEC\"\n\n# Prebid.js share cookie\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:sharedid\"\n\n# Microsoft Clarity tracking cookie\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:_clsk\"\n\n# Microsoft Clarity marketing cookie\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:_clck\"\n\n# AWS Load balancer cookie\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:_awl\"\n\n# Prebid.js Cookie\n# Matches:\n#   pbjs-id5id\nSecRuleUpdateTargetById 941100 \"!REQUEST_COOKIES:/^pbjs-\\w+$/\"\nSecRuleUpdateTargetById 942200 \"!REQUEST_COOKIES:/^pbjs-\\w+$/\"\nSecRuleUpdateTargetById 942290 \"!REQUEST_COOKIES:/^pbjs-\\w+$/\"\nSecRuleUpdateTargetById 942340 \"!REQUEST_COOKIES:/^pbjs-\\w+$/\"\nSecRuleUpdateTargetById 942370 \"!REQUEST_COOKIES:/^pbjs-\\w+$/\"\nSecRuleUpdateTargetById 942420 \"!REQUEST_COOKIES:/^pbjs-\\w+$/\"\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:/^pbjs-\\w+$/\"\nSecRuleUpdateTargetById 942490 \"!REQUEST_COOKIES:/^pbjs-\\w+$/\"\nSecRuleUpdateTargetById 942550 \"!REQUEST_COOKIES:/^pbjs-\\w+$/\"\n\n# Matomo Referer Cookie\nSecRuleUpdateTargetById 941320 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 941330 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 941340 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942370 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942380 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942390 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942400 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942410 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942420 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942421 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942440 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942450 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942470 \"!REQUEST_COOKIES:/^_pk_ref/\"\nSecRuleUpdateTargetById 942480 \"!REQUEST_COOKIES:/^_pk_ref/\"\n\n# False positive with a json variable called `profile`, specifically happens on\n# libModSecurity3/Coraza only.\nSecRuleUpdateTargetById 930120 \"!ARGS_NAMES:/^json\\.profile[.\\w\\-]*$/\"\n",
+    "owasp-crs/rules/RESPONSE-950-DATA-LEAKAGES.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n# We reused paranoia level skip rules 950010, 950011, and 950018.\n# These rule identifiers were in use in CRSv2, so we used different\n# identifiers in CRSv3 to avoid conflicts (950020, 950021 and 950022).\n# In CRSv4, for the sake of a consistent structure, we use these\n# identifiers again, so that the skip rules of PL can be defined in the\n# same way for all files.\n# Rule id 950130 has been kept - this ID also was introduced at first\n# rule to avoid the collision.\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n# Skip all response body rules if RESPONSE_BODY is compressed.\nSecRule RESPONSE_HEADERS:Content-Encoding \"@pm gzip compress deflate br zstd\" \\\n    \"id:950020,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    skipAfter:BEGIN-RESPONSE-959-BLOCKING-EVALUATION\"\n\n# Skip all response headers rules if TX:crs_skip_response_analysis is set.\nSecRule TX:crs_skip_response_analysis \"@eq 1\" \\\n    \"id:950021,\\\n    phase:3,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\n\n# Skip all response body rules if TX:crs_skip_response_analysis is set.\nSecRule TX:crs_skip_response_analysis \"@eq 1\" \\\n    \"id:950022,\\\n    phase:4,\\\n    pass,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:950011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:950012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ Directory Listing ]=-\n#\nSecRule RESPONSE_BODY \"@rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>\\[To Parent Directory\\]</[Aa]><br>)\" \\\n    \"id:950130,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Directory Listing',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES',\\\n    tag:'capec/1000/118/116/54/127',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n#\n# -=[ CGI Source Code Leakage ]=-\n#\n# A CGI script begins normally with #! and the interpreter,\n# for example:\n#\n# #!/usr/bin/perl\n# #!/usr/bin/python\n# #!/usr/bin/ruby\n#\n# If the CGI script processors or MIME type handlers are misconfigured,\n# the script's source code could be erroneously returned to the client.\nSecRule RESPONSE_BODY \"@rx ^#\\!\\s?/\" \\\n    \"id:950140,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'CGI source code leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n#\n# -=[ ASP.NET Errors ]=-\n#\nSecRule RESPONSE_BODY \"@pmFromFile asp-dotnet-errors.data\" \\\n    \"id:950150,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'ASP.NET exception leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-aspnet',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES',\\\n    tag:'capec/1000/118/116/54/127',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:950013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:950014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n#\n# -=[ The application is not available - 5xx level status code ]=-\n#\nSecRule RESPONSE_STATUS \"@rx ^5\\d{2}$\" \\\n    \"id:950100,\\\n    phase:3,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'The Application Returned a 500-Level Status Code',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES',\\\n    tag:'capec/1000/152',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl2=+%{tx.error_anomaly_score}'\"\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:950015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:950016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:950017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:950018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-RESPONSE-950-DATA-LEAKAGES\"\n",
+    "owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:951011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:951012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ SQL Error Leakages ]=-\n#\n# Ref: https://github.com/sqlmapproject/sqlmap\n# Ref: https://github.com/Arachni/arachni/tree/master/components/checks/active/sql_injection/regexps\n#\nSecRule RESPONSE_BODY \"!@pmFromFile sql-errors.data\" \\\n    \"id:951100,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    skipAfter:END-SQL-ERROR-MATCH-PL1\"\n\n# Regular expression generated from regex-assembly/951110.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951110\n#\nSecRule RESPONSE_BODY \"@rx (?i)(?:JET|Access) Database Engine|\\[Microsoft\\]\\[ODBC Microsoft Access Driver\\]\" \\\n    \"id:951110,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Microsoft Access SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-msaccess',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951120.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951120\n#\nSecRule RESPONSE_BODY \"@rx (?i)\\bORA-[0-9][0-9][0-9][0-9][0-9]:|java\\.sql\\.SQLException|Oracle(?: erro|[^\\(\\)]{0,20}Drive)r|Warning.{1,10}o(?:ci_.{1,30}|ra_.{1,20})\" \\\n    \"id:951120,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Oracle SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-oracle',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951130.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951130\n#\nSecRule RESPONSE_BODY \"@rx (?i)DB2 SQL error|\\[IBM\\]\\[CLI Driver\\]\\[DB2/6000\\]|CLI Driver.*DB2|db2_[0-9A-Z_a-z]+\\(\\)\" \\\n    \"id:951130,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'DB2 SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-db2',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951140.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951140\n#\nSecRule RESPONSE_BODY \"@rx (?i)\\[DM_QUERY_E_SYNTAX\\]|has occurred in the vicinity of:\" \\\n    \"id:951140,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'EMC SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-emc',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\nSecRule RESPONSE_BODY \"@rx (?i)Dynamic SQL Error\" \\\n    \"id:951150,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'firebird SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-firebird',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\nSecRule RESPONSE_BODY \"@rx (?i)Exception (?:condition )?\\d+\\. Transaction rollback\\.\" \\\n    \"id:951160,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Frontbase SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-frontbase',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\nSecRule RESPONSE_BODY \"@rx (?i)org\\.hsqldb\\.jdbc\" \\\n    \"id:951170,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'hsqldb SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-hsqldb',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951180.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951180\n#\nSecRule RESPONSE_BODY \"@rx (?i)An illegal character has been found in the statement|com\\.informix\\.jdbc|Exception.*Informix\" \\\n    \"id:951180,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'informix SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-informix',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951190.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951190\n#\nSecRule RESPONSE_BODY \"@rx (?i)Warning.*ingres_|Ingres(?: SQLSTATE|[^0-9A-Z_a-z].*Driver)\" \\\n    \"id:951190,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'ingres SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-ingres',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951200.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951200\n#\nSecRule RESPONSE_BODY \"@rx (?i)<b>Warning</b>: ibase_|Unexpected end of command in statement\" \\\n    \"id:951200,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'interbase SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-interbase',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951210.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951210\n#\nSecRule RESPONSE_BODY \"@rx (?i)Warning.{1,10}maxdb[\\(\\):_a-z]{1,26}:\" \\\n    \"id:951210,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'maxDB SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-maxdb',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951220.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951220\n#\nSecRule RESPONSE_BODY \"@rx (?i)S(?:y(?:stem\\.Data\\.(?:OleDb\\.OleDb|SqlClient\\.Sql)Except|ntax error (?:in string|.*) in query express)ion|intaxis incorrecta cerca de)|\\[(?:SqlException|M(?:icrosoft\\]\\[ODBC SQL Server|acromedia\\]\\[SQLServer JDBC) Driver\\])|(?:Exception.*[^0-9A-Z_a-z]System\\.Data\\.SqlClie|Conversion failed when converting the varchar value .*? to data type i)nt\\.|D(?:river.*SQL[ \\-_]*Server|ata type mismatch in criteria expression\\.)|Microsoft OLE DB Provider for (?:ODBC Drivers|SQL Server)|(?:(?:OLE DB.*SQL Serv|Procedure or function '.{1,128}' expects paramet)e|Incorrect syntax nea)r|Unclosed quotation mark (?:after|before) the character string|'80040e14'|(?:ADODB\\.Field \\(0x800A0BCD|mssql_query\\()\\)|the used select statements have different number of columns|Warning.*mssql_.*\" \\\n    \"id:951220,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'mssql SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-mssql',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951230.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951230\n#\nSecRule RESPONSE_BODY \"@rx (?i)supplied argument is not a valid MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array\\(\\)|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient\\.)|\\[MySQL\\]\\[ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[\\(\\)_a-z]{1,26})?|(?:ERROR [0-9]{4} \\([0-9a-z]{5}\\)|XPATH syntax error):\" \\\n    \"id:951230,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'mysql SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-mysql',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951240.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951240\n#\nSecRule RESPONSE_BODY \"@rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|(?:pg_(?:query|exec)\\(\\) \\[|org\\.postgresql\\.util\\.PSQLException):|Warning.{1,20}\\bpg_.*|valid PostgreSQL result|Npgsql\\.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er\" \\\n    \"id:951240,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'postgres SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-pgsql',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951250.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951250\n#\nSecRule RESPONSE_BODY \"@rx (?i)Warning.*(?:sqlite_|SQLite3::)|S(?:QLite(?:/JDBCDriver|\\.Exception)|ystem\\.Data\\.SQLite\\.SQLiteException)\" \\\n    \"id:951250,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'sqlite SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-sqlite',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\n# Regular expression generated from regex-assembly/951260.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 951260\n#\nSecRule RESPONSE_BODY \"@rx (?i)Sybase(?: message:|.*Server message)|Warning.{2,20}sybase\" \\\n    \"id:951260,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Sybase SQL Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-sybase',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\\\n    tag:'capec/1000/118/116/54',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'\"\n\nSecMarker \"END-SQL-ERROR-MATCH-PL1\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:951013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:951014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:951015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:951016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:951017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:951018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-RESPONSE-951-DATA-LEAKAGES-SQL\"\n",
+    "owasp-crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:952011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:952012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ Java Errors ]=-\n#\n# Ref: https://github.com/andresriancho/w3af/blob/master/w3af/plugins/grep/error_pages.py\n#\n# Regular expression generated from regex-assembly/952110.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 952110\n#\nSecRule RESPONSE_BODY \"@rx (?i)\\b(?:java[\\.a-z]+E(?:xception|rror)|(?:org|com)\\.[\\.a-z]+Exception|Exception in thread \\\"[^\\\"]*\\\"|at[\\s\\x0b]+(?:ja(?:vax?|karta)|org|com))\\b\" \\\n    \"id:952110,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Java Errors',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-JAVA',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:952013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:952014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:952015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:952016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:952017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:952018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-RESPONSE-952-DATA-LEAKAGES-JAVA\"\n",
+    "owasp-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:953011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:953012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ PHP Error Message Leakage ]=-\n#\nSecRule RESPONSE_BODY \"@pmFromFile php-errors.data\" \\\n    \"id:953100,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-PHP',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n#\n# -=[ PHP source code leakage ]=-\n#\n# Detect some common PHP keywords in output.\n#\nSecRule RESPONSE_BODY \"@rx (?:\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\$_(?:(?:pos|ge)t|session))\\b\" \\\n    \"id:953110,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP source code leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-PHP',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n# Detect the presence of the PHP open tag \"<? \", \"<?= \" or \"<?php \" in output.\n#\n# To prevent false positives (due to the short \"<?\" sequences), we also include,\n# the space after it in an attempt to stop alerts in binary output.\n# And we make it case insensitive.\n#\nSecRule RESPONSE_BODY \"@rx (?i)<\\?(?:=|php)?\\s+\" \\\n    \"id:953120,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP source code leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-PHP',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:953013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:953014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n#\n# -=[ PHP Error Message Leakage ]=-\n#\n# This is a stricter sibling of rule 953100.\n# This stricter sibling checks for additional error messages which has a higher chance to appear in common language and uses regular\n# expressions to reduce false positives where possible.\n#\n# Regular expression generated from regex-assembly/953101.ra.\n# To update the regular expression run the following shell script\n# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):\n#   crs-toolchain regex update 953101\n#\nSecRule RESPONSE_BODY \"@rx (?i)Empty string|F(?:ile size is|reeing memory)|Header (?:name )?\\\"|Invalid date|No active class|(?:Out of memor|cannot be empt)y|Pa(?:ir level|ssword is too long)|Re(?:ading file|starting!)|S(?:ession is not active|tatic function\\b)|T(?:elling\\.\\.\\.|he function\\b)|(?:Unknown reas|invalid opti)on|e(?:mpty password|rror reading)\" \\\n    \"id:953101,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-PHP',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl2=+%{tx.error_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:953015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:953016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:953017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:953018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-RESPONSE-953-DATA-LEAKAGES-PHP\"\n",
+    "owasp-crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:954011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:954012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n# IIS default location\n# This rule has a stricter sibling 954101, which also detects the path, but without the drive letter.\nSecRule RESPONSE_BODY \"@rx (?i)[a-z]:[\\x5c/]inetpub\\b\" \\\n    \"id:954100,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Disclosure of IIS install location',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-iis',\\\n    tag:'platform-windows',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\nSecRule RESPONSE_BODY \"@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| \\(0x80040e31\\)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error\\.</h2>|cannot connect to the server: timed out)\" \\\n    \"id:954110,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Application Availability Error',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-iis',\\\n    tag:'platform-windows',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n#\n# IIS Errors leakage\n#\nSecRule RESPONSE_BODY \"@pmFromFile iis-errors.data\" \\\n    \"id:954120,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'IIS Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-iis',\\\n    tag:'platform-windows',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n\nSecRule RESPONSE_STATUS \"!@rx ^404$\" \\\n    \"id:954130,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'IIS Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-iis',\\\n    tag:'platform-windows',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    chain\"\n    SecRule RESPONSE_BODY \"@rx \\bServer Error in.{0,50}?\\bApplication\\b\" \\\n        \"capture,\\\n        t:none,\\\n        setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:954013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:954014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n# This rule is a stricter sibling of rule 954100, which also detects the path but must start with a\n# drive letter.\n# IIS default location\nSecRule RESPONSE_BODY \"@rx (?i)[\\x5c/]inetpub\\b\" \\\n    \"id:954101,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Disclosure of IIS install location',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-multi',\\\n    tag:'platform-iis',\\\n    tag:'platform-windows',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl2=+%{tx.error_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:954015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:954016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:954017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:954018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-RESPONSE-954-DATA-LEAKAGES-IIS\"\n",
+    "owasp-crs/rules/RESPONSE-955-WEB-SHELLS.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. (not) All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:955011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-955-WEB-SHELLS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:955012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-955-WEB-SHELLS\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n# For performance reasons, most of the shells are matched using this rule.\n# This rule is intended for PHP web shells.\nSecRule RESPONSE_BODY \"@pmFromFile web-shells-php.data\" \\\n    \"id:955100,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Web shell detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# r57 web shell\nSecRule RESPONSE_BODY \"@rx <title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>\" \\\n    \"id:955110,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'r57 web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# WSO web shell\nSecRule RESPONSE_BODY \"@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=(?:Windows-1251|UTF-8)?'><title>.*?(?: -)? W[Ss][Oo] [0-9.]+</title>\" \\\n    \"id:955120,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'WSO web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# b4tm4n web shell (https://github.com/k4mpr3t/b4tm4n)\nSecRule RESPONSE_BODY \"@rx B4TM4N SH3LL</title>[^<]*<meta name='author' content='k4mpr3t'/>\" \\\n    \"id:955130,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'b4tm4n web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Mini Shell web shell\nSecRule RESPONSE_BODY \"@rx <title>Mini Shell</title>[^D]*Developed By LameHacker\" \\\n    \"id:955140,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Mini Shell web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Ashiyane web shell\nSecRule RESPONSE_BODY \"@rx <title>\\.:: [^~]*~ Ashiyane V [0-9.]+ ::\\.</title>\" \\\n    \"id:955150,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Ashiyane web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Symlink_Sa web shell\nSecRule RESPONSE_BODY \"@rx <title>Symlink_Sa [0-9.]+</title>\" \\\n    \"id:955160,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Symlink_Sa web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# CasuS web shell\nSecRule RESPONSE_BODY \"@rx <title>CasuS [0-9.]+ by MafiABoY</title>\" \\\n    \"id:955170,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'CasuS web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# GRP WebShell\nSecRule RESPONSE_BODY \"@rx ^<html>\\r\\n<head>\\r\\n<title>GRP WebShell [0-9.]+ \" \\\n    \"id:955180,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'GRP WebShell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# NGHshell web shell\nSecRule RESPONSE_BODY \"@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>\\n$\" \\\n    \"id:955190,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'NGHshell web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# SimAttacker web shell\nSecRule RESPONSE_BODY \"@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ - \" \\\n    \"id:955200,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'SimAttacker web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Unknown web shell\nSecRule RESPONSE_BODY \"@rx ^<!DOCTYPE html>\\n<html>\\n<!-- By Artyum [^<]*<title>Web Shell</title>\" \\\n    \"id:955210,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Unknown web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# lama's'hell web shell\nSecRule RESPONSE_BODY \"@rx <title>lama's'hell v. [0-9.]+</title>\" \\\n    \"id:955220,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'lama\\'s\\'hell web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# lostDC web shell\nSecRule RESPONSE_BODY \"@rx ^ *<html>\\n[ ]+<head>\\n[ ]+<title>lostDC - \" \\\n    \"id:955230,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'lostDC web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Unknown web shell\nSecRule RESPONSE_BODY \"@rx ^<title>PHP Web Shell</title>\\r\\n<html>\\r\\n<body>\\r\\n    <!-- Replaces command with Base64-encoded Data -->\" \\\n    \"id:955240,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Unknown web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Unknown web shell\nSecRule RESPONSE_BODY \"@rx ^<html>\\n<head>\\n<div align=\\\"left\\\"><font size=\\\"1\\\">Input command :</font></div>\\n<form name=\\\"cmd\\\" method=\\\"POST\\\" enctype=\\\"multipart/form-data\\\">\" \\\n    \"id:955250,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Unknown web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Ru24PostWebShell web shell\n# Removed '- ' from the end of the pattern so this file won't get detected as\n# malware by Windows Defender.\nSecRule RESPONSE_BODY \"@rx ^<html>\\n<head>\\n<title>Ru24PostWebShell \" \\\n    \"id:955260,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Ru24PostWebShell web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# s72 Shell web shell\nSecRule RESPONSE_BODY \"@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King</title>\" \\\n    \"id:955270,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'s72 Shell web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# PhpSpy web shell\nSecRule RESPONSE_BODY \"@rx ^<html>\\r\\n<head>\\r\\n<meta http-equiv=\\\"Content-Type\\\" content=\\\"text/html; charset=gb2312\\\">\\r\\n<title>PhpSpy Ver [0-9]+</title>\" \\\n    \"id:955280,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PhpSpy web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# g00nshell web shell\nSecRule RESPONSE_BODY \"@rx ^ <html>\\n\\n<head>\\n\\n<title>g00nshell v[0-9.]+ \" \\\n    \"id:955290,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'g00nshell web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# PuNkHoLic shell web shell\n# Various versions has this text written little differently so we need to do\n# t:removeWhitespace and t:lowercase.\nSecRule RESPONSE_BODY \"@contains <title>punkholicshell</title>\" \\\n    \"id:955300,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,t:removeWhitespace,t:lowercase,\\\n    msg:'PuNkHoLic shell web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# azrail web shell\nSecRule RESPONSE_BODY \"@rx ^<html>\\n      <head>\\n             <title>azrail [0-9.]+ by C-W-M</title>\" \\\n    \"id:955310,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'azrail web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# SmEvK_PaThAn Shell web shell\nSecRule RESPONSE_BODY \"@rx >SmEvK_PaThAn Shell v[0-9]+ coded by <a href=\" \\\n    \"id:955320,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'SmEvK_PaThAn Shell web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# Shell I web shell\nSecRule RESPONSE_BODY \"@rx ^<html>\\n<title>[^~]*~ Shell I</title>\\n<head>\\n<style>\" \\\n    \"id:955330,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Shell I web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# b374k m1n1 web shell\nSecRule RESPONSE_BODY \"@rx ^ <html><head><title>:: b374k m1n1 [0-9.]+ ::</title>\" \\\n    \"id:955340,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'b374k m1n1 web shell',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n# This rule is intended for ASP web shells.\nSecRule RESPONSE_BODY \"@pmFromFile web-shells-asp.data\" \\\n    \"id:955400,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'ASP Web shell detected',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:955013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-955-WEB-SHELLS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:955014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-955-WEB-SHELLS\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n# webadmin.php file manager\n# This is placed in PL2 because of too generic pattern.\nSecRule RESPONSE_BODY \"@contains <h1 style=\\\"margin-bottom: 0\\\">webadmin.php</h1>\" \\\n    \"id:955350,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'webadmin.php file manager',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/WEB-SHELLS',\\\n    tag:'capec/1000/225/122/17/650',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.outbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:955015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-955-WEB-SHELLS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:955016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-955-WEB-SHELLS\"\n\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:955017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-955-WEB-SHELLS\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:955018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-955-WEB-SHELLS\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-RESPONSE-955-WEB-SHELLS\"\n",
+    "owasp-crs/rules/RESPONSE-956-DATA-LEAKAGES-RUBY.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:956011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-956-DATA-LEAKAGES-RUBY\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:956012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-956-DATA-LEAKAGES-RUBY\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n#\n# -=[ RUBY Error Message Leakage ]=-\n#\nSecRule RESPONSE_BODY \"@pmFromFile ruby-errors.data\" \\\n    \"id:956100,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'RUBY Information Leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-ruby',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-RUBY',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:956013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-956-DATA-LEAKAGES-RUBY\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:956014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-956-DATA-LEAKAGES-RUBY\"\n\n\n# Detect the presence of the Ruby ERB templates \"<%\", \"<%= \" and slim interpolation \"#{}\" in output.\n#\n# To prevent false positives (due to the short \"<%\" sequences), we also check for [#=\\s] after an opening tag.\n#\n# This rule is placed at PL-2 since it also matches common templating format with various JavaScript templating engines.\n#\nSecRule RESPONSE_BODY \"@rx (?i)(?:<%[=#\\s]|#\\{[^}]+\\})\" \\\n    \"id:956110,\\\n    phase:4,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'Ruby source code leakage',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-ruby',\\\n    tag:'platform-multi',\\\n    tag:'attack-disclosure',\\\n    tag:'paranoia-level/2',\\\n    tag:'OWASP_CRS',\\\n    tag:'OWASP_CRS/DATA-LEAKAGES-RUBY',\\\n    tag:'capec/1000/118/116',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    severity:'ERROR',\\\n    setvar:'tx.outbound_anomaly_score_pl2=+%{tx.error_anomaly_score}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:956015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-956-DATA-LEAKAGES-RUBY\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:956016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-956-DATA-LEAKAGES-RUBY\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:956017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-956-DATA-LEAKAGES-RUBY\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:956018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-956-DATA-LEAKAGES-RUBY\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-RESPONSE-956-DATA-LEAKAGES-RUBY\"\n",
+    "owasp-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n# You should set the score to the proper threshold you would prefer. If kept at \"@gt 0\"\n# it will work similarly to previous Mod CRS rules and will create an event in the error_log\n# file if there are any rules that match.  If you would like to lessen the number of events\n# generated in the error_log file, you should increase the anomaly score threshold to\n# something like \"@gt 20\".  This would only generate an event in the error_log file if\n# there are multiple lower severity rule matches or if any 1 higher severity item matches.\n#\n# You should also set the desired disruptive action (deny, redirect, etc...).\n#\n\nSecMarker \"BEGIN-RESPONSE-959-BLOCKING-EVALUATION\"\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n\n# Summing up the blocking and detection anomaly scores in phase 3\n# even when early blocking is disabled, we need to sum up the scores in phase 3\n# this prevents bugs in phase 5 if Apache skips phases because of error handling\n# See: https://github.com/coreruleset/coreruleset/issues/2319#issuecomment-1047503932\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 1\" \\\n    \"id:959052,\\\n    phase:3,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl1}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 1\" \\\n    \"id:959152,\\\n    phase:3,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl1}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 2\" \\\n    \"id:959053,\\\n    phase:3,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl2}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 2\" \\\n    \"id:959153,\\\n    phase:3,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl2}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 3\" \\\n    \"id:959054,\\\n    phase:3,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl3}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 3\" \\\n    \"id:959154,\\\n    phase:3,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl3}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 4\" \\\n    \"id:959055,\\\n    phase:3,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl4}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 4\" \\\n    \"id:959155,\\\n    phase:3,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl4}'\"\n\n# at start of phase 4, we reset the aggregate scores to 0 to prevent duplicate counting of per-PL scores\n# this is necessary because the per-PL scores are counted across phases\nSecAction \\\n    \"id:959059,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=0'\"\n\nSecAction \\\n    \"id:959159,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_outbound_anomaly_score=0'\"\n\nSecMarker \"EARLY_BLOCKING_ANOMALY_SCORING\"\n\n# Summing up the blocking and detection anomaly scores in phase 4\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 1\" \\\n    \"id:959060,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl1}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 1\" \\\n    \"id:959160,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl1}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 2\" \\\n    \"id:959061,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl2}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 2\" \\\n    \"id:959161,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl2}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 3\" \\\n    \"id:959062,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl3}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 3\" \\\n    \"id:959162,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl3}'\"\n\nSecRule TX:BLOCKING_PARANOIA_LEVEL \"@ge 4\" \\\n    \"id:959063,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl4}'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@ge 4\" \\\n    \"id:959163,\\\n    phase:4,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl4}'\"\n\n#\n# -=[ Anomaly Mode: Overall Transaction Anomaly Score ]=-\n#\n\n# if early blocking is active, check threshold in phase 3\nSecRule TX:BLOCKING_OUTBOUND_ANOMALY_SCORE \"@ge %{tx.outbound_anomaly_score_threshold}\" \\\n    \"id:959101,\\\n    phase:3,\\\n    deny,\\\n    t:none,\\\n    msg:'Outbound Anomaly Score Exceeded in phase 3 (Total Score: %{tx.blocking_outbound_anomaly_score})',\\\n    tag:'anomaly-evaluation',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    chain\"\n    SecRule TX:EARLY_BLOCKING \"@eq 1\"\n\n# always check threshold in phase 4\nSecRule TX:BLOCKING_OUTBOUND_ANOMALY_SCORE \"@ge %{tx.outbound_anomaly_score_threshold}\" \\\n    \"id:959100,\\\n    phase:4,\\\n    deny,\\\n    t:none,\\\n    msg:'Outbound Anomaly Score Exceeded (Total Score: %{tx.blocking_outbound_anomaly_score})',\\\n    tag:'anomaly-evaluation',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0'\"\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:959011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:959012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:959013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:959014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:959015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:959016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:959017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:959018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-RESPONSE-959-BLOCKING-EVALUATION\"\n",
+    "owasp-crs/rules/RESPONSE-980-CORRELATION.conf": "# ------------------------------------------------------------------------\n# OWASP CRS ver.4.30.0\n# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\n# Copyright (c) 2021-2026 CRS project. All rights reserved.\n#\n# The OWASP CRS is distributed under\n# Apache Software License (ASL) version 2\n# Please see the enclosed LICENSE file for full details.\n# ------------------------------------------------------------------------\n\n#\n# This file is used in post processing after the response has been sent to\n# the client (in the logging phase).  Its purpose is to provide inbound+outbound\n# correlation of events to provide a more intelligent designation as to the outcome\n# or result of the transaction - meaning, was this a successful attack?\n#\n\n#\n# -= Paranoia Level 0 (empty) =- (apply unconditionally)\n#\n\n# Combine inbound and outbound scores\nSecAction \\\n    \"id:980099,\\\n    phase:5,\\\n    pass,\\\n    t:none,\\\n    nolog,\\\n    noauditlog,\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0',\\\n    setvar:'tx.blocking_anomaly_score=%{tx.blocking_inbound_anomaly_score}',\\\n    setvar:'tx.blocking_anomaly_score=+%{tx.blocking_outbound_anomaly_score}',\\\n    setvar:'tx.detection_anomaly_score=%{tx.detection_inbound_anomaly_score}',\\\n    setvar:'tx.detection_anomaly_score=+%{tx.detection_outbound_anomaly_score}',\\\n    setvar:'tx.anomaly_score=%{tx.blocking_inbound_anomaly_score}',\\\n    setvar:'tx.anomaly_score=+%{tx.blocking_outbound_anomaly_score}'\"\n\n#\n# -=[ Anomaly Score Reporting ]=-\n#\n\n# -= Reporting Level 0 =- (Skip over reporting when tx.reporting_level is 0)\nSecRule TX:REPORTING_LEVEL \"@eq 0\" \"id:980041,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REPORTING\"\n\n# -= Reporting Level 5 =- (Jump to reporting rule immediately when tx.reporting_level is 5 or greater)\nSecRule TX:REPORTING_LEVEL \"@ge 5\" \"id:980042,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:LOG-REPORTING\"\n\n# -= Zero detection score =- (Skip over reporting when sum of inbound and outbound detection score is equal to 0)\nSecRule TX:DETECTION_ANOMALY_SCORE \"@eq 0\" \"id:980043,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REPORTING\"\n\n# -= Blocking score exceeds threshold =- (Jump to reporting rule immediately if a blocking score exceeds a threshold)\nSecRule TX:BLOCKING_INBOUND_ANOMALY_SCORE \"@ge %{tx.inbound_anomaly_score_threshold}\" \"id:980044,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:LOG-REPORTING\"\nSecRule TX:BLOCKING_OUTBOUND_ANOMALY_SCORE \"@ge %{tx.outbound_anomaly_score_threshold}\" \"id:980045,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:LOG-REPORTING\"\n\n# -= Reporting Level 2 =- (Skip over reporting when tx.reporting_level is less than 2)\nSecRule TX:REPORTING_LEVEL \"@lt 2\" \"id:980046,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REPORTING\"\n\n# -= Detection score exceeds threshold =- (Jump to reporting rule immediately if a detection score exceeds a threshold)\nSecRule TX:DETECTION_INBOUND_ANOMALY_SCORE \"@ge %{tx.inbound_anomaly_score_threshold}\" \"id:980047,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:LOG-REPORTING\"\nSecRule TX:DETECTION_OUTBOUND_ANOMALY_SCORE \"@ge %{tx.outbound_anomaly_score_threshold}\" \"id:980048,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:LOG-REPORTING\"\n\n# -= Reporting Level 3 =- (Skip over reporting when tx.reporting_level is less than 3)\nSecRule TX:REPORTING_LEVEL \"@lt 3\" \"id:980049,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REPORTING\"\n\n# -= Blocking score greater than zero =- (Jump to reporting rule immediately when sum of inbound and outbound blocking score is greater than zero)\nSecRule TX:BLOCKING_ANOMALY_SCORE \"@gt 0\" \"id:980050,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:LOG-REPORTING\"\n\n# -= Reporting Level 4 =- (Skip over reporting when tx.reporting_level is less than 4)\nSecRule TX:REPORTING_LEVEL \"@lt 4\" \"id:980051,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-REPORTING\"\n\n# At this point, the reporting level is 4 and there's a non-zero detection\n# score (already established by rule 980043) so fall through to the reporting\n# rule.\n\n\n# Requests that land on the following SecMarker:\n# - At reporting level 5 (unconditional reporting)\n# - At reporting levels 1-4 when a blocking score exceeds a threshold\n# - At reporting levels 2-4 when a detection score exceeds a threshold\n# - At reporting levels 3-4 when the total blocking score is greater than zero\n# - At reporting level 4 when the total detection score is greater than zero\nSecMarker \"LOG-REPORTING\"\n\n# Inbound and outbound - all requests\n#crs-linter:ignore:pass_nolog\nSecAction \\\n    \"id:980170,\\\n    phase:5,\\\n    pass,\\\n    t:none,\\\n    noauditlog,\\\n    msg:'Anomaly Scores: \\\n(Inbound Scores: blocking=%{tx.blocking_inbound_anomaly_score}, detection=%{tx.detection_inbound_anomaly_score}, per_pl=%{tx.inbound_anomaly_score_pl1}-%{tx.inbound_anomaly_score_pl2}-%{tx.inbound_anomaly_score_pl3}-%{tx.inbound_anomaly_score_pl4}, threshold=%{tx.inbound_anomaly_score_threshold}) - \\\n(Outbound Scores: blocking=%{tx.blocking_outbound_anomaly_score}, detection=%{tx.detection_outbound_anomaly_score}, per_pl=%{tx.outbound_anomaly_score_pl1}-%{tx.outbound_anomaly_score_pl2}-%{tx.outbound_anomaly_score_pl3}-%{tx.outbound_anomaly_score_pl4}, threshold=%{tx.outbound_anomaly_score_threshold}) - \\\n(SQLI=%{tx.sql_injection_score}, XSS=%{tx.xss_score}, RFI=%{tx.rfi_score}, LFI=%{tx.lfi_score}, RCE=%{tx.rce_score}, PHPI=%{tx.php_injection_score}, HTTP=%{tx.http_violation_score}, SESS=%{tx.session_fixation_score}, COMBINED_SCORE=%{tx.anomaly_score})',\\\n    tag:'reporting',\\\n    tag:'OWASP_CRS',\\\n    ver:'OWASP_CRS/4.30.0'\"\n\nSecMarker \"END-REPORTING\"\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:980011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-980-CORRELATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:980012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-980-CORRELATION\"\n#\n# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:980013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-980-CORRELATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:980014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-980-CORRELATION\"\n#\n# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:980015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-980-CORRELATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:980016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-980-CORRELATION\"\n#\n# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)\n#\n\n\n\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:980017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-980-CORRELATION\"\nSecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:980018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.30.0',skipAfter:END-RESPONSE-980-CORRELATION\"\n#\n# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)\n#\n\n\n\n#\n# -= Paranoia Levels Finished =-\n#\nSecMarker \"END-RESPONSE-980-CORRELATION\"\n",
+    "owasp-crs/rules/ai-critical-artifacts.data": "# AI coding assistant directories (issue #4474)\n# Block: high-confidence paths only. @pmFromFile substring match:\n# Directory entries (trailing slash) block that path and everything under it,\n# e.g. .claude/ blocks /.claude/* and any path containing .claude/\n\n# Anthropic Claude Code — settings, hooks, MCP refs, env; API keys in settings.local.json\n.claude/\n# Cursor IDE — MCP defs, API keys in env, project rules; high secrets risk\n.cursor/\n# Continue.dev — config with models, MCP servers, API keys\n.continue/\n# Aider — chat history, config; API keys in .aider.conf.yml\n.aider/\n# Roo Code (Roo Code Inc.) — MCP defs, API keys in env, alwaysAllow\n.roo/\n# Zed editor — project settings, MCP servers, language server config\n.zed/\n# Cline (Claude Dev) — rules, MCP settings; prompt-injection vector\n.cline/\n# Kiro — hooks (agentSpawn, preToolUse), steering, specs; automation creds\n.kiro/\n# Codeium Windsurf — project rules, MCP config\n.windsurf/\n# Atlassian Rovo Dev — project-level review-agent instructions, prompt-injection vector\n.rovodev/\n# OpenAI Codex CLI — project-scoped config.toml; model config, sandbox, MCP settings\n.codex/\n# OpenCode — agents, commands, plugins config\n.opencode/\n# Agent Zero — project config: project.json, .a0proj/variables.env, .a0proj/secrets.env (API keys, tokens)\n.a0proj/\n# Plandex — plans, context; config\n.plandex/\n# Fabric — patterns, fabric.env; env/secrets\n.fabric/\n# n8n — workflows, credentials (when N8N_USER_FOLDER in project); encryption key, SQLite\n.n8n/\n# JetBrains Junie\n.junie/\n# Gemini CLI Config File (Critical)\n.gemini/\n# OpenClaw\n.openclaw/\n# ClawdBot\n.clawdbot/\n# TrustClaw (In most installations but not official)\n.trustclaw/\n# ZeroClaw\n.zeroclaw/\n# Warp Terminal\n.warp/\n# Qwen Code\n.qwen_code\n# Crush AI\n.crush\n",
+    "owasp-crs/rules/asp-dotnet-errors.data": "# This file contains a list of common errors and exceptions encountered in ASP.NET applications.\n#\n### Core .NET Exceptions\n# - System.Exception Types: https://learn.microsoft.com/en-us/dotnet/api/system.exception?view=netframework-4.8#derived\n# - System Namespace: https://learn.microsoft.com/en-us/dotnet/api/system?view=netframework-4.8\n#\n### ASP.NET Specific Errors\n# - ASP.NET Error Handling: https://learn.microsoft.com/en-us/aspnet/web-forms/overview/older-versions-getting-started/aspnet-ajax/understanding-asp-net-ajax-debugging-capabilities\n# - HttpException Class: https://learn.microsoft.com/en-us/dotnet/api/system.web.httpexception?view=netframework-4.8\n#\n### MVC Errors\n# - System.Web.Mvc Namespace: https://learn.microsoft.com/en-us/dotnet/api/system.web.mvc?view=aspnet-mvc-5.2\n# - ASP.NET MVC Error Handling: https://learn.microsoft.com/en-us/aspnet/mvc/overview/older-versions-1/controllers-and-routing/handling-errors\n#\n### Entity Framework Errors\n# - System.Data.Entity.Core.EntityException: https://learn.microsoft.com/en-us/dotnet/api/system.data.entity.core.entityexception?view=entity-framework-6.2.0\n# - Entity Framework Exception Types: https://learn.microsoft.com/en-us/dotnet/api/system.data.entity.infrastructure?view=entity-framework-6.2.0\n#\n### Identity and Authentication Errors\n# - Microsoft.AspNet.Identity Namespace: https://learn.microsoft.com/en-us/previous-versions/aspnet/dn613291(v=vs.108)\n# - Microsoft.Owin.Security Namespace: https://learn.microsoft.com/en-us/previous-versions/dn308572(v=owin.2.0)\n#\n### Web API Errors\n# - System.Web.Http Namespace: https://learn.microsoft.com/en-us/dotnet/api/system.web.http?view=aspnetwebapi-5.2\n# - Exception Handling in ASP.NET Web API: https://learn.microsoft.com/en-us/aspnet/web-api/overview/error-handling/exception-handling\n\n#\n# Core .NET Exceptions\nSystem.NullReferenceException\nSystem.ArgumentException\nSystem.InvalidOperationException\nSystem.IndexOutOfRangeException\nSystem.IO.IOException\nSystem.Net.WebException\nSystem.OutOfMemoryException\nSystem.StackOverflowException\nSystem.FormatException\nSystem.DivideByZeroException\nSystem.ArgumentNullException\nSystem.ArgumentOutOfRangeException\nSystem.NotImplementedException\nSystem.NotSupportedException\nSystem.Data.SqlClient.SqlException\nSystem.UnauthorizedAccessException\nSystem.Security.SecurityException\nSystem.Web.HttpException\n\n# ASP.NET Specific Errors\nHttpException\nViewStateException\nHttpRequestValidationException\nHttpCompileException\nHttpParseException\nHttpUnhandledException\nHttpRequestWrapper\nHttpResponseWrapper\nHttpServerUtilityWrapper\nHttpSessionStateWrapper\nHttpStaticObjectsCollectionWrapper\n\n# MVC Errors\nSystem.Web.Mvc.HttpAntiForgeryException\nSystem.Web.Mvc.Controller\nSystem.Web.Mvc.ActionResult\nSystem.Web.Mvc.ViewResult\nSystem.Web.Mvc.RedirectResult\nSystem.Web.Mvc.RedirectToRouteResult\nSystem.Web.Mvc.JsonResult\nSystem.Web.Mvc.ContentResult\nSystem.Web.Mvc.HttpStatusCodeResult\nSystem.Web.Mvc.FileResult\nSystem.Web.Mvc.View\nSystem.Web.Mvc.PartialViewResult\n\n# Entity Framework Errors\nSystem.Data.Entity.Core.EntityException\nSystem.Data.Entity.Infrastructure.DbUpdateException\nSystem.Data.Entity.Validation.DbEntityValidationException\nSystem.Data.Entity.Core.OptimisticConcurrencyException\nSystem.Data.Entity.Infrastructure.DbUpdateConcurrencyException\n\n# Identity and Authentication Errors\nMicrosoft.AspNet.Identity.IdentityResult\nMicrosoft.AspNet.Identity.UserManager\nMicrosoft.AspNet.Identity.SignInManager\nMicrosoft.AspNet.Identity.RoleManager\nMicrosoft.AspNet.Identity.Owin\nMicrosoft.Owin.Security\nMicrosoft.Owin.Security.DataProtection\n\n# Web API Errors\nSystem.Web.Http.HttpResponseException\nSystem.Web.Http.HttpRequestException\nSystem.Web.Http.HttpError\nSystem.Web.Http.HttpRouteCollection\n",
+    "owasp-crs/rules/iis-errors.data": "# This list comes from the default IIS error pages\n# To regenerate, get the files from a default IIS installation (C:\\inetpub\\custerr\\en-US) and use:\n# PowerShell: Get-ChildItem \"C:\\inetpub\\custerr\\en-US\\*.htm\" | ForEach-Object { Select-String -Path $_.FullName -Pattern \"<title>.*</title>\" }\n# Or on Unix-like systems after copying the files: grep -h '<title' *.htm\n\n<title>401.1 - Unauthorized: Access is denied due to invalid credentials.</title>\n<title>401.2 - Unauthorized: Access is denied due to server configuration.</title>\n<title>401.3 - Unauthorized: Access is denied due to an ACL set on the requested resource.</title>\n<title>401.4 - Unauthorized: Authorization failed by filter installed on the Web server.</title>\n<title>401.5 - Unauthorized: Authorization failed by an ISAPI/CGI application.</title>\n<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>\n<title>403.1 - Forbidden: Execute access is denied.</title>\n<title>403.10 - Forbidden: Web server is configured to deny Execute access.</title>\n<title>403.11 - Forbidden: Password has been changed.</title>\n<title>403.12 - Forbidden: Client certificate is denied access by the server certificate mapper.</title>\n<title>403.13 - Forbidden: Client certificate has been revoked on the Web server.</title>\n<title>403.14 - Forbidden: Directory listing denied.</title>\n<title>403.15 - Forbidden: Client access licenses have exceeded limits on the Web server.</title>\n<title>403.16 - Forbidden: Client certificate is ill-formed or is not trusted by the Web server.</title>\n<title>403.17 - Forbidden: Client certificate has expired or is not yet valid.</title>\n<title>403.18 - Forbidden: Cannot execute requested URL in the current application pool.</title>\n<title>403.19 - Forbidden: Cannot execute CGIs for the client in this application pool.</title>\n<title>403.2 - Forbidden: Read access is denied.</title>\n<title>403.3 - Forbidden: Write access is denied.</title>\n<title>403.4 - Forbidden: SSL is required to view this resource.</title>\n<title>403.5 - Forbidden: SSL 128 is required to view this resource.</title>\n<title>403.6 - Forbidden: IP address of the client has been rejected.</title>\n<title>403.7 - Forbidden: SSL client certificate is required.</title>\n<title>403.8 - Forbidden: DNS name of the client is rejected.</title>\n<title>403.9 - Forbidden: Too many clients are trying to connect to the Web server.</title>\n<title>403 - Forbidden: Access is denied.</title>\n<title>404.1 - File or directory not found: Web site not accessible on the requested port.</title>\n<title>404.11 - URL is double-escaped.</title>\n<title>404.12 - URL has high bit characters.</title>\n<title>404.14 - URL too long.</title>\n<title>404.15 - Query-String too long.</title>\n<title>404.2 - File or directory not found: Lockdown policy prevents this request.</title>\n<title>404.3 - File or directory not found: MIME map policy prevents this request.</title>\n<title>404.4 - File or directory not found: No module handler is registered to handle the request.</title>\n<title>404.5 - URL sequence denied.</title>\n<title>404.6 - HTTP verb denied.</title>\n<title>404.7 - File extension denied.</title>\n<title>404.8 - URL namespace hidden.</title>\n<title>404.9 - File attribute hidden.</title>\n<title>404 - File or directory not found.</title>\n<title>405 - HTTP verb used to access this page is not allowed.</title>\n<title>406 - Client browser does not accept the MIME type of the requested page.</title>\n<title>412 - Precondition set by the client failed when evaluated on the Web server.</title>\n<title>413.1 - Content-Length too large.</title>\n<title>431 - Request header too long.</title>\n<title>500.13 - Server error: Web server is too busy.</title>\n<title>500.14 - Server error: Invalid application configuration on the server.</title>\n<title>500.15 - Server error: Direct requests for GLOBAL.ASA are not allowed.</title>\n<title>500.16 - Server error: UNC authorization credentials incorrect.</title>\n<title>500.17 - Server error: URL authorization store cannot be found.</title>\n<title>500.18 - Server error: URL authorization store cannot be opened.</title>\n<title>500.19 - Server error: Data for this file is configured improperly.</title>\n<title>500 - Internal server error.</title>\n<title>501 - Header values specify a method that is not implemented.</title>\n<title>502 - Web server received an invalid response while acting as a gateway or proxy server.</title>\n",
+    "owasp-crs/rules/java-classes.data": "# Java Classes for use with Java RCEs\n#\n# Used With Rule 944130 in Apache Struts and Oracle Weblogic RCEs Detection:\n#\n# CVE-2017-5638  (2017.01.29) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638\n# CVE-2017-9791  (2017.06.21) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9791\n# CVE-2017-9805  (2017.06.21) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9805\n# CVE-2017-10271 (2017.06.21) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10271\n# CVE-2018-11776 (2018.06.05) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11776\n# CVE-2021-44228 (2021.11.26) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228\n#\n# Additional Resources\n# Apache S2-057 (2019.01.20) https://cwiki.apache.org/confluence/display/WW/S2-057\n\ncom.opensymphony.xwork2\ncom.sun.org.apache\nclassLoader\ndeclaredClass\nfreemarker.core\nfreemarker.template\nfreemarker.ext.rhino\njava.io.BufferedInputStream\njava.io.BufferedReader\njava.io.ByteArrayInputStream\njava.io.ByteArrayOutputStream\njava.io.CharArrayReader\njava.io.DataInputStream\njava.io.File\njava.io.FileOutputStream\njava.io.FilePermission\njava.io.FileWriter\njava.io.FilterInputStream\njava.io.FilterOutputStream\njava.io.FilterReader\njava.io.InputStream\njava.io.IOException\njava.io.LineNumberReader\njava.io.ObjectInputStream\njava.io.ObjectOutputStream\njava.io.OutputStream\njava.io.PipedOutputStream\njava.io.PipedReader\njava.io.PrintStream\njava.io.PushbackInputStream\njava.io.Reader\njava.io.StringReader\njava.lang.Class\njava.lang.Enum\njava.lang.Integer\njava.lang.Number\njava.lang.Object\njava.lang.Process\njava.lang.ProcessBuilder\njava.lang.reflect\njava.lang.Runtime\njava.lang.String\njava.lang.System\njava.net.HttpURLConnection\njava.net.JarURLConnection\njava.net.DatagramSocket\njava.net.MulticastSocket\njava.net.ServerSocket\njava.net.Socket\njava.net.URL\njavassist\njavax.naming.InitialContext\njavax.script.ScriptEngineManager\njavax.xml.parsers\njavax.xml.stream\nOgnlContext\nOgnlUtil\norg.apache.commons\norg.apache.struts\norg.apache.struts2\norg.dom4j.io.SAXReader\norg.jdom2.input.SAXBuilder\norg.omg.CORBA\norg.xml.sax\nPropertyUtilsBean\njava.beans.XMLDecode\njava.nio.file\nsun.reflect\n",
+    "owasp-crs/rules/lfi-os-files.data": "# This list comes from:\n# - https://github.com/lightos/Panoptic\n# - https://github.com/danielmiessler/SecLists\n# /proc and /sys entries should be kept in sync with restricted-files.data\n\n# Entries in this list generally use the shortest path that suffices for identifying them as dangerous.\n# .ssh/id_rsa and .ssh/id_dsa for example, are both dangerous paths but are represented in this list as .ssh.\n# The same applies to different log files below /var/log/mysql: var/log/mysql is enough to tell us that the request is suspicious.\n# Additionally, similar paths with different roots are represented as a single entry.\n# For example, the two entries usr/local/mysql/data/mysql.err and xampp/mysql/data/mysql.err are\n# represented as mysal/data, as that is enough to identify the paths as being suspicious.\n\n\n# Most of the dotfile entries can be generated from the following three commands.\n# Unfortunately, the output contains many more entries, including some file\n# extensions. There are also some entries that probably added by hand.\n# curl -s https://raw.githubusercontent.com/lightos/Panoptic/master/home.txt | grep -E \"^\\.\" |  awk  '{ print tolower($0) }' | sort | uniq\n# curl -s https://raw.githubusercontent.com/lightos/Panoptic/master/cases.xml | grep \"file value\" | cut -d'\"' -f2 | grep -E \"^\\.\" |  awk  '{ print tolower($0) }' | sort | uniq\n# curl -s https://raw.githubusercontent.com/danielmiessler/SecLists/master/Fuzzing/fuzz-Bo0oM.txt | grep -Ev '\\\\|\\.\\.|=\\b|%' | grep -E \"^\\.\" |  awk  '{ print tolower($0) }' | sort | uniq\n.access/\n.addressbook\n.anydesk/\n.aptitude/config\n.atom/\n.aws/\n.azure/\n.bash_\n.bashrc\n.boto\n.cache/\n.cache/notify-osd.log\n.cargo/\n.claude\n.config.local.php\n.config/\n.coverage\n.coveralls.yml\n.credentials\n.cshrc\n.cups/\n.cvs\n.dbus/\n.deployment-secrets.txt\n.docker/\n.dockerenv\n.dockerignore\n.drush/\n.DS_Store\n# .env\n.envrc\n.eslintignore\n.fbcindex\n.forward\n.ftpconfig\n.gem/\n.git/\n.gitattributes\n.gitconfig\n.gitignore\n.gitkeep\n.gitmodules\n.gnome/\n.gnome2/\n.gnomerc/\n.gnupg/\n.google_authenticator\n.gsutil/\n.hg/\n.hgignore\n/.history\n.hplip/hplip.conf\n.htaccess\n.htdigest\n.htpasswd\n.ipynb_checkpoints/\n.java/\n.ksh_history\n.kube/\n.lesshst\n.lftp/\n.lhistory\n.lighttpdpassword\n.lldb-history\n.local/bin/\n.local/lib/\n.local/share/\n.local/state/\n.lynx_cookies\n.minikube/\n.msmtprc\n.my.cnf\n.myscmserverinfo\n.mysql_history\n.nano_history\n.netrc\n.node_repl_history\n.npm/\n.npmrc\n.nsconfig\n.nsr\n.nvm/\n.oh-my-\n# .pac\n# .pass\n# .passwd\n.password-store\n.pearrc\n.pgpass\n.php_history\n.pinerc\n.pki/\n.proclog\n.procmailrc\n/.profile\n.psql_history\n# .pwd\n.pytest_cache/\n.python_history\n.rediscli_history\n.remote-sync.json\n.rhistory\n.rhosts\n.rustup\n.rustup/\n.s3cfg\n.secrets\n.selected_editor\n.settings/\n.sh_history\n.snap/\n.sqlite_history\n.ssh/\n.subversion/\n.svn/\n.svnignore\n.tconn/\n.tcshrc\n.terraform.lock.hcl\n.terraform/\n.thunderbird/\n.tmux.conf\n.tools/\n.tor/\n.travis.yaml\n.travis.yml\n.vagrant.d/\n.vidalia/\n.vim/\n.viminfo\n.vimrc\n.vmware/\n.vscode\n.web.config.swp\n.wget-hsts\n.www_acl\n.wwwacl\n.xauthority\n.yarnrc\n.zhistory\n.zsh_history\n.zshenv\n.zshrc\n\n/php.ini\n/tmp/\n\n# Generic config filenames and common permutations\nconfig.asp\nconfig_dev.asp\nconfig-dev.asp\nconfig.dev.asp\nconfig_prod.asp\nconfig-prod.asp\nconfig.prod.asp\nconfig.sample.asp\nconfig-sample.asp\nconfig_sample.asp\nconfig_test.asp\nconfig-test.asp\nconfig.test.asp\nconfig.ini\nconfig_dev.ini\nconfig-dev.ini\nconfig.dev.ini\nconfig_prod.ini\nconfig-prod.ini\nconfig.prod.ini\nconfig.sample.ini\nconfig-sample.ini\nconfig_sample.ini\nconfig_test.ini\nconfig-test.ini\nconfig.test.ini\nconfig.json\nconfig_dev.json\nconfig-dev.json\nconfig.dev.json\nconfig_prod.json\nconfig-prod.json\nconfig.prod.json\nconfig.sample.json\nconfig-sample.json\nconfig_sample.json\nconfig_test.json\nconfig-test.json\nconfig.test.json\nconfig.php\nconfig_dev.php\nconfig-dev.php\nconfig.dev.php\nconfig_prod.php\nconfig-prod.php\nconfig.prod.php\nconfig.sample.php\nconfig-sample.php\nconfig_sample.php\nconfig_test.php\nconfig-test.php\nconfig.test.php\nconfig.pl\nconfig_dev.pl\nconfig-dev.pl\nconfig.dev.pl\nconfig_prod.pl\nconfig-prod.pl\nconfig.prod.pl\nconfig.sample.pl\nconfig-sample.pl\nconfig_sample.pl\nconfig_test.pl\nconfig-test.pl\nconfig.test.pl\nconfig.py\nconfig_dev.py\nconfig-dev.py\nconfig.dev.py\nconfig_prod.py\nconfig-prod.py\nconfig.prod.py\nconfig.sample.py\nconfig-sample.py\nconfig_sample.py\nconfig_test.py\nconfig-test.py\nconfig.test.py\nconfig.rb\nconfig_dev.rb\nconfig-dev.rb\nconfig.dev.rb\nconfig_prod.rb\nconfig-prod.rb\nconfig.prod.rb\nconfig.sample.rb\nconfig-sample.rb\nconfig_sample.rb\nconfig_test.rb\nconfig-test.rb\nconfig.test.rb\nconfig.toml\nconfig_dev.toml\nconfig-dev.toml\nconfig.dev.toml\nconfig_prod.toml\nconfig-prod.toml\nconfig.prod.toml\nconfig.sample.toml\nconfig-sample.toml\nconfig_sample.toml\nconfig_test.toml\nconfig-test.toml\nconfig.test.toml\nconfig.txt\nconfig_dev.txt\nconfig-dev.txt\nconfig.dev.txt\nconfig_prod.txt\nconfig-prod.txt\nconfig.prod.txt\nconfig.sample.txt\nconfig-sample.txt\nconfig_sample.txt\nconfig_test.txt\nconfig-test.txt\nconfig.test.txt\nconfig.xml\nconfig_dev.xml\nconfig-dev.xml\nconfig.dev.xml\nconfig_prod.xml\nconfig-prod.xml\nconfig.prod.xml\nconfig.sample.xml\nconfig-sample.xml\nconfig_sample.xml\nconfig_test.xml\nconfig-test.xml\nconfig.test.xml\nconfig.yaml\nconfig_dev.yaml\nconfig-dev.yaml\nconfig.dev.yaml\nconfig_prod.yaml\nconfig-prod.yaml\nconfig.prod.yaml\nconfig.sample.yaml\nconfig-sample.yaml\nconfig_sample.yaml\nconfig_test.yaml\nconfig-test.yaml\nconfig.test.yaml\nconfig.yml\nconfig_dev.yml\nconfig-dev.yml\nconfig.dev.yml\nconfig_prod.yml\nconfig-prod.yml\nconfig.prod.yml\nconfig.sample.yml\nconfig-sample.yml\nconfig_sample.yml\nconfig_test.yml\nconfig-test.yml\nconfig.test.yml\nconfig.sample.inc.php\ncredentials.json\nsecrets.json\nsecrets.yaml\nsecrets.yml\n# Compressed database dumps\n.sql.001\n.sql.7z\n.sql.bz\n.sql.ace\n.sql.arj\n.sql.cpio\n.sql.gz\n.sql.lha\n.sql.lz\n.sql.pa\n.sql.pea\n.sql.r00\n.sql.r01\n.sql.r02\n.sql.r03\n.sql.r04\n.sql.r05\n.sql.r06\n.sql.r07\n.sql.r08\n.sql.r09\n.sql.rar\n.sql.rev\n.sql.tar\n.sql.taz\n.sql.tbz\n.sql.tgz\n.sql.txz\n.sql.uha\n.sql.xz\n.sql.yz1\n.sql.z\n# CVE-2023-49103\nphpinfo.php\n# AWS cli\naws.yaml\naws.yml\naws-key.yaml\naws-key.yml\n# Python cache\n__pycache__/\n# Windows system ini files\nboot.ini\nsystem.ini\nwin.ini\n# NodeJS log file\npm2.log\n# Generic log filename\ndebug.log\n# Mysql/MariaDB config file\ndebian.cnf\nmy.cnf\nmysql.cnf\nmysqldump.cnf\n# FTP config files\nftp-sync.json\n# Yarn log files\nyarn-debug.log\nyarn-error.log\n# Code coverage config file\ncoverage.xml\n# Apache httpd entries can be generated with the following command:\n# curl -s https://raw.githubusercontent.com/lightos/Panoptic/master/cases.xml | grep \"file value\" | cut -d'\"' -f2 | awk -F/ '{ { if (length($NF) > 0) {v1 = NF-1; v2 = NF} else {v1 = NF-2; v2 = NF-1} print tolower($v1\"/\"$v2) }) }' | grep apache | sort | uniq\napache/access.conf\napache/apache.conf\napache/apache2.conf\napache/audit_log\napache/conf\napache/default-server.conf\napache/error_log\napache/error.log\napache/httpd.conf\napache/log\napache2/apache.conf\napache2/apache2.conf\napache2/conf\napache2/default-server.conf\napache2/envvars\napache2/httpd.conf\napache2/httpd2.conf\napache2/logs\napache2/mods\napache2/ports.conf\napache2/sites\napache2/ssl-global.conf\napache2/vhosts.d\napache22/conf\napache22/httpd.conf\napache22/logs\napache24/conf\napache24/httpd.conf\napache24/logs\napp/etc/local.xml\nboot.ini\nboot/grub/grub.cfg\nboot/grub/menu.lst\nconfig.sample.php\nconfig.inc.php\nconfig/app.php\nconfig/custom.php\nconfig/database.php\nconfig/parameters.php\nconfig/settings.inc.php\nconfiguration.php\ncpanel/logs\ndatabase.yaml\ndatabase.yml\ndata/elasticsearch\ndata/kafka\ndefaults.inc.php\netc/.java\netc/acpi\netc/adduser.conf\netc/alias\netc/alsa\netc/alternatives\netc/amavis\netc/anacrontab\netc/ansible\netc/apache/access.conf\netc/apache/apache.conf\netc/apache/default-server.conf\netc/apache/httpd.conf\netc/apache/vhosts.conf\netc/apache2\netc/apm\netc/apparmor\netc/apport\netc/apt\netc/asciidoc\netc/at.allow\netc/at.deny\netc/audit\netc/avahi\netc/bash.bashrc\netc/bash_completion.d\netc/bashrc\netc/bind\netc/binfmt.d\netc/bluetooth\netc/bonobo-activation\netc/bootptab\netc/brltty\netc/byobu\netc/ca-certificates\netc/calendar\netc/casper.conf\netc/centos-release\netc/chatscripts\netc/chkrootkit.conf\netc/chromium-browser\netc/chrootusers\netc/chttp.conf\netc/clam.d\netc/clamav\netc/cni\netc/console-setup\netc/coraza-waf\netc/cracklib\netc/cron.allow\netc/cron.d\netc/cron.hourly\netc/cron.monthly\netc/cron.weekly\netc/cron.yearly\netc/crontab\netc/crowdsec\netc/crypttab\netc/cups\netc/cvs-cron.conf\netc/cvs-pserver.conf\netc/dbus-1\netc/dconf\netc/debconf.conf\netc/debian_version\netc/default\netc/deluser.conf\netc/depmod.d\netc/dhcp\netc/dictionaries-common\netc/dkms\netc/dns2tcpd.conf\netc/dnsmasq.d\netc/docker\netc/dockeretc/dpkg\netc/dovecot\netc/e2fsck.conf\netc/elasticsearch\netc/emacs\netc/env.php\netc/environment.d\netc/esound/esd.conf\netc/etter.conf\netc/exports\netc/fail2ban\netc/fedora-release\netc/firebird\netc/firefox\netc/firewall\netc/fonts\netc/foremost.conf\netc/freshclam.conf\netc/fstab\netc/ftpaccess\netc/ftpchroot\netc/ftphosts\netc/ftpusers\netc/fuse.conf\netc/fwupd\netc/gconf\netc/gdb\netc/gdm3\netc/geoclue\netc/ghostscript\netc/gimp\netc/gitlab\netc/glvnd\netc/gnome\netc/gnucash\netc/gnustep\netc/groff\netc/group\netc/grub.conf\netc/grub.d\netc/gshadow\netc/gss\netc/gtk-2.0\netc/gtk-3.0\netc/hdparm.conf\netc/host.conf\netc/hostname\netc/hosts\netc/hp\netc/http/conf\netc/http/httpd.conf\netc/httpd\netc/ifplugd\netc/imagemagick-6\netc/inetd.conf\netc/init\netc/insserv.conf.d\netc/ipfw\netc/iproute2\netc/iptables\netc/issue\netc/java\netc/kafka\netc/kbd/config\netc/kernel\netc/kibana\netc/ld.so.conf\netc/ldap\netc/letsencrypt\netc/libblockdev\netc/libibverbs.d\netc/libnl-3\netc/libpaper.d\netc/libreoffice\netc/lighttpd\netc/lilo.conf\netc/logcheck\netc/login.defs\netc/logrotate.conf\netc/logrotate.d\netc/logstash\netc/logwatch\netc/lsb-release\netc/ltrace.conf\netc/lvm\netc/lynx\netc/mail\netc/mandrake-release\netc/manpath.config\netc/mc\netc/menu\netc/miredo-server.conf\netc/miredo.conf\netc/miredo/miredo-server.conf\netc/miredo/miredo.conf\netc/modprobe.d\netc/modsecurity\netc/modulesf\netc/mongod.conf\netc/monit\netc/mono\netc/motd\netc/mplayer\netc/mpv\netc/mtab\netc/mtools.conf\netc/muddleftpd\netc/muddleftpd.com\netc/muttrc.d\netc/my.cnf\netc/my.conf\netc/mysql\netc/netplan\netc/network\netc/networkmanager\netc/newsyslog.conf\netc/newt\netc/nghttpx\netc/nginx\netc/nikto\netc/npasswd\netc/nsswitch.conf\netc/nuxeo.conf\netc/odbcdatasources\netc/openal\netc/opendkim\netc/opendmarc\netc/openldap/ldap.conf\netc/openmpi\netc/opt\netc/os-release\netc/osxhttpd\netc/osync\netc/packagekit\netc/pam.conf\netc/pam.d\netc/pam.d/proftpd\netc/passwd\netc/password\netc/pcmcia\netc/perl\netc/php\netc/pki\netc/pm\netc/polkit-1\netc/postfix\netc/postgresql\netc/ppp\netc/printcap\netc/profile\netc/proftp.conf\netc/proftpd\netc/pulse\netc/pure-ftpd\netc/pureftpd\netc/python\netc/qemu\netc/rc.conf\netc/rc.d/rc.httpd\netc/rc0.d\netc/rc1.d\netc/rc2.d\netc/rc3.d\netc/rc4.d\netc/rc5.d\netc/rc6.d\netc/rcs.d\netc/redhat-release\netc/redis-sentinel.conf\netc/redis.conf\netc/resolv.conf\netc/resolvconf\netc/rsyslog.d\netc/samba\netc/sane.d\netc/scw-release\netc/security\netc/selinux\netc/sensors.conf\netc/sensors.d\netc/sensors3.conf\netc/sgml\netc/shadow\netc/signon-ui\netc/skel\netc/slackware-release\netc/smb.conf\netc/smbpasswd\netc/smi.conf\netc/snmp\netc/sogo\netc/sound\netc/spamassassin\netc/speech-dispatcher\netc/squid\netc/squirrelmail\netc/ssh\netc/ssl\netc/sso\netc/stunnel\netc/subgid\netc/subuid\netc/subversion\netc/sudoers\netc/suse-release\netc/sw-cp-server/applications.d\netc/sysconfig\netc/sysctl.conf\netc/sysctl.d\netc/syslog.conf\netc/sysstat\netc/system-release-cpe\netc/systemd\netc/termcap\netc/terminfo\netc/texmf\netc/thermald\netc/thnuclnt\netc/thunderbird\netc/timezone\netc/timidity\netc/tinyproxy\netc/tmpfiles.d\netc/tor/tor-tsocks.conf\netc/tsocks.conf\netc/ubuntu-advantage\netc/udev\netc/udisks2\netc/ufw\netc/unbound\netc/update-manager\netc/update-motd.d\netc/update-notifier\netc/updatedb.conf\netc/upower\netc/urlview\netc/usb_modeswitch.d\netc/utmp\netc/vhcs2/proftpd/proftpd.conf\netc/vim\netc/vmware\netc/vsftpd.chroot_list\netc/vsftpd.conf\netc/vsftpd/vsftpd.conf\netc/vulkan\netc/w3m\netc/webmin\netc/wicd\netc/wireshark\netc/wpa_supplicant\netc/wu-ftpd\netc/x11\netc/xdg\netc/xml\ngitlab.rb\ngitlab_config_\ngruntfile.js\nhome/postgres\nhttp/httpd.conf\nhttpd/conf/httpd.conf\nincludes/configure.php\ninetpub/wwwroot/global.asa\ninitial_root_password\njakarta/dist/tomcat\njakarta/tomcat/conf\njakarta/tomcat/logs\nlibrary/webserver/documents\nlighttpd/conf\nlighttpd/lighttpd.conf\nlighttpd/log\nlocalsettings.php\nlogs/access_log\nlogs/access.log\nlogs/error_log\nlogs/error.log\nlogs/pure-ftpd.log\nlogs/samba.log\nlogs/security_debug_log\nlogs/security_log\nlsws/conf\nlsws/logs\nmysql/bin/my.ini\nmysql/data\nmysql/my.cnf\nmysql/my.ini\nnginx/conf/nginx.conf\nnpm-debug.log\nopt/apache\nopt/apache2\nopt/httpd/apache.conf\nopt/httpd/apache2.conf\nopt/httpd/conf/\nopt/jboss\nopt/lampp\nopt/nuxeo\nopt/tomcat\nopt/xampp\npackage-lock.json\npackage.json\nparameters.yml\npgsql/bin/pg_passwd\npgsql/data\nphp/apache.conf\nphp/apache2.conf\nphp/httpd.conf\nphp5/apache.conf\nphp5/apache2.conf\nphp5/httpd.conf\npostgresql/log/\n/proc/\nproc/0\nproc/1\nproc/2\nproc/3\nproc/4\nproc/5\nproc/6\nproc/7\nproc/8\nproc/9\nproc/acpi\nproc/asound\nproc/bootconfig\nproc/buddyinfo\nproc/bus\nproc/cgroups\nproc/cmdline\nproc/config.gz\nproc/consoles\nproc/cpuinfo\nproc/crypto\nproc/devices\nproc/diskstats\nproc/dma\nproc/docker\nproc/driver\nproc/dynamic_debug\nproc/execdomains\nproc/fb\nproc/filesystems\nproc/fs\nproc/interrupts\nproc/iomem\nproc/ioports\nproc/ipmi\nproc/irq\nproc/kallsyms\nproc/kcore\nproc/key-users\nproc/keys\nproc/kmsg\nproc/kpagecgroup\nproc/kpagecount\nproc/kpageflags\nproc/latency_stats\nproc/loadavg\nproc/locks\nproc/mdstat\nproc/meminfo\nproc/misc\nproc/modules\nproc/mounts\nproc/mpt\nproc/mtd\nproc/mtrr\nproc/net\nproc/pagetypeinfo\nproc/partitions\nproc/pressure\nproc/sched_debug\nproc/schedstat\nproc/scsi\nproc/self\nproc/slabinfo\nproc/softirqs\nproc/stat\nproc/swaps\nproc/sys\nproc/sysrq-trigger\nproc/sysvipc\nproc/thread-self\nproc/timer_list\nproc/timer_stats\nproc/tty\nproc/uptime\nproc/version\nproc/version_signature\nproc/vmallocinfo\nproc/vmstat\nproc/zoneinfo\nprogram files\npsa/admin\npureftpd/etc\nroot/anaconda-ks.cfg\nrouting.yml\nsamba/lib\nsb/config\nsecurity.yml\nserver/default/conf\nserver/default/deploy\nserver/default/log\nservices.yml\nsftp.json\nsites/default/default.settings.php\nsites/default/settings.local.php\nsites/default/settings.php\nsquirrelmail/www\n/sys/\nsys/block\nsys/bus\nsys/class\nsys/dev\nsys/devices\nsys/firmware\nsys/fs\nsys/hypervisor\nsys/kernel\nsys/module\nsys/power\nsystem/library/webobjects/adaptors\nsystem32/config\nsystem32/inetsrv/config\ntmp/access.log\ntmp/kafka-logs\ntypo3conf/localconf.php\nusr/etc/pure-ftpd.conf\nusr/home/user/lighttpd\nusr/lib/cron/log\nusr/lib/php\nusr/lib/rpm/rpm.log\nusr/lib/security\nusr/local/zeus/web\nusr/pkg/etc/httpd\nusr/pkgsrc/net/pureftpd\nusr/ports/contrib/pure-ftpd\nusr/ports/ftp/pure-ftpd\nusr/sbin/mudlogd\nusr/sbin/mudpasswd\nusr/share/adduser\nusr/share/logs\nusr/share/squirrelmail\nusr/share/tomcat\nusr/spool/lp\nusr/spool/mqueue\nvar/adm\nvar/apache/logs\nvar/apache2/config.inc\nvar/cpanel\nvar/cron/log\nvar/data/elasticsearch\nvar/data/mysql-bin\nvar/htmp\nvar/lib/elasticsearch\nvar/lib/mysql\nvar/lib/pgsql\nvar/lib/squirrelmail\nvar/lighttpd\nvar/local/www/conf\nvar/log\nvar/lp/logs\nvar/mail\nvar/mysql-bin\nvar/mysql.log\nvar/nm2/postgresql.conf\nvar/postgresql\nvar/run/utmp\nvar/saf/_log\nvar/saf/port/log\nvar/spool\nvar/webmin\nvar/www\nvolumes/macintosh_hd\nvolumes/webbackup\nwamp/bin/apache\nwamp/bin/mysql\nwamp/bin/php\nwamp/logs\nweb.config\n# Java servlet container\nMETA-INF/\nWEB-INF/\nwebpack.config.js\nwindows/comsetup.log\nwindows/debug/netsetup.log\nwindows/odbc.ini\nwindows/repair/setup.log\nwindows/setupact.log\nwindows/setupapi.log\nwindows/setuperr.log\nwindows/system32\nwindows/syswow64\nwindows/updspapi.log\nwindows/windowsupdate.log\nwindows/wmsetup.log\nwinnt/repair\nwinnt/system32/logfiles\nwp-config.\nwp-config-\nwp-config_\nwp-cli.\nwww/conf/httpd.conf\nwww/logs\nxampp/apache/logs\nxampp/filezillaftp\nxampp/htdocs\nxampp/mercurymail\nxampp/mysql/data\nxampp/php\nxampp/sendmail\nxampp/webalizer/webalizer.conf\nyarn.lock\ncargo.toml\n# ash shell\n.ashrc\n.ash_history\n# NuShell\nconfig.nu\n# Cshell history file\n.csh_history\n# KornShell config file\n.kshrc\n# Fish Startup file\nconfig.fish\n# tcsh history file\n.tcsh_history\n\n\npyproject.toml\npytest.ini\ngo.mod\ngo.sum\nsetup.py\nbuild.zig.zon\n\n# GNU screen\n.screenrc\n\n# Chocolatey package manager\n.chocolatey/\n# Gradle build tool\n.gradle/\n# Python IDLE\n.idlerc/\n# Kaggle config\n.kaggle/\n# Keras deep learning framework\n.keras/\n# MyPy type checker cache\n.mypy_cache/\n# Red Hat Subscription Manager config\n.redhat/\n# NPM node modules\nnode_modules/\n# Bun Dir\n.bun/\n# Bun global config\n.bunfig.toml\n# Ruby Shell config\n.irbrc/\n# Ruby Shell history\n.irb_history\n# Pry REPL config\n.pryrc/\n# RubyGems config\n.gemrc\n# RubyGems dir\n.gem/\n# Bundler dir\n.bundle/\n# Ruby environment manager\n.rbenv/\n# Ruby Environment Manager\n.rvm/\n# RuboCop config file\n.rubocop.yml\n# PIP config\n.pip/\n# Conda\n.condarc\nanaconda3/\nminiconda3/\n# PyEnv\n.pyenv/\n# Apache Maven\n.m2/\n# SDKMAN!\n.sdkman/\n# Eclipse IDE\n.eclipse/\n# NPM Global Dir\n.npm-global/\n# YarnRc config file\n.yarnrc.yml\n# Prettier\n.prettierrc\n# Node-GYP\n.node-gyp\n# Curl Config File\n.curlrc\n# Wget Config File\n.wgetrc\n# Perl REPL & Core files\n.perldb\n.perl_repl_history\n.perlhistory\nperl/\n# CPAN & Cpan+\n.cpan/\n.cpanplus/\n# perlenv\n.plenv\n# Kotlin Core & Cache\n.konan/\n# Kotlin REPL\n.kotlinc_history\n# git credentials\n.git-credentials\n# OpenVPN config\n.openvpn/\nopenvpn/\n# WireGuard config\nwg-clients/\n# gFTP dir\n.gftp/\n# LFTP Configuration File\n.lftprc\n# NCFTP Conf Dir\n.ncftp/\n# Rsync Exclude File and Logs\n.rsync_exclude\nrsync.log\n# Wine dir\n.wine/\n# Nano Config Files & Dirs\n.nanorc\n.nano/\n# PostGresQL connection file\n.pg_service.conf\n# MySQL Login file\n.mylogin.cnf\n# MongoDB config\n.mongodb/\n.mongoshrc.js\n# Mongo shell\n.dbshell\n# PGAdmin config\n.pgadmin/\n# pm2 configs/logs/database\n.pm2/\n# Stubby config\n.stubby.yml\n.getdns/\n# Dig config\n.digrc\n# Unbond config\n.unbound/\n# mb sync config\n.mbsyncrc\n# OfflineIMAP config\n.offlineimaprc\n# getmail config\n.getmail/\n# usermin config\n.usermin/\n# cpanel ssl cerificates configs\n.cpanel/\n# OpenSSL\n.openssl.cnf\n# Terraform plugin cache dir and config file\n.terraformrc\n.terraform.d/\n# Pulimi\n.pulumi/\n.linode-cli/\n.oci/\n.opc/\n# SQL*Plus startup files and history\n.sqlplus_history\nlogin.sql\n# Microsoft EditorConfig config\n.editorconfig\n# Data Dog config\n.datadog-agent/\n# WP Cli config\n.wp-cli/\n# IBM Cloud Cli config\n.bluemix/\n.ibmcloud/\n# Python & Pip\n.pypirc\n# Open Build Service (OBS)\n.oscrc\n.osc_cookiejar\n# BitBucket CI/CD Pipelines\nbitbucket-pipelines.yml\n# Node & PNPM Packages\n.pnpmrc\n.pnpm-store/\n# DB Config common file\ndbconn.php\n# Erlang & RabbitMQ\n.erlang.cookie\n# Kubernetes & Helm\nkustomization.yml\nChart.yaml\n# Frontend Deployment\nvercel.json\nnetlify.toml\nremix.config.js\n",
+    "owasp-crs/rules/php-errors.data": "# The contents of this list come from the [PHP source code](https://github.com/php/php-src).\n#\n# There are different types of errors that might be thrown. An easy way to discover them is to\n# get any text that comes from the error handling functions: `zend_error`, `zend_throw_error`, `soap_error0`, etc.\n# Using the regexp `_error([0-9])?\\(` will give you all. And you can see them using:\n# `grep -h -E -r -o --exclude=\"*.phpt\" '\\w+_error([0-9])?\\(' * | sort | uniq`\n#\n# After getting the list, there are two different types of errors: those with literal text, and those that include\n# print format args like `%s`, `%d`, `%zu`, etc. We sort them in two groups.\n#\n# The first group is just anything without formatting args. Only text, sorted ascending. Command used:\n#   - `grep -E -h -r --exclude=\"*.phpt\" '_error([0-9])?\\(' * | awk -F\\\" '{ print $2;} ' | sed -e 's/ \\\\$/ \"/g' | sort | uniq | grep -v '%'`\n# Post processing might be necessary to adjust strings that can cause false positives, such as\n# - line is very short\n# - line is a (partial) common English sentence, like `Can use`, `Attribute`, etc.\n# - text coming from php unit/regression tests, like 'DROP TABLE IF EXISTS test_bug_71863`\n#\n# The second group will be the part with format strings. Only text, sorted ascending.\n# This will need a more careful processing. The format string will appear in the text result,\n# but it will (of course) be substituted by some variable value. So we need to clean more text here.\n# The easiest way is to split a line whenever a format string is found. This will shorten the texts but,\n# then we can sort out the ones we don't want to include more easily.\n# We also remove:\n# - text with just one word (likely to be FP), or one word, one space (optional) and one non-word (optional),\n#   which will match things like `Collect \"`, `Method` or `Class `.\n#\n# Command used:\n#   - `grep -E -h -r --exclude=\"*.phpt\" '_error([0-9])?\\(' * | awk -F\\\" '/%/ { print $2;} ' | sed -e 's/ \\\\$/ \"/g' -e 's/%[zlp][ud]/\\n/g' -e 's/%[a-z]/\\n/g'  -e 's/%\\.\\*s/\\n/g' | sort | uniq | grep -E -v '^\\w+\\s?\\W?$' | grep -E -v '^\\W+$'\n#\n# Anything that is too short, or nonsense, we remove.\n\n# Group without format strings\n\nAPI is restricted by \"\ncan't be temporary enabled (it may be only disabled till the end of request)\nhas not been properly started, can't compile file\nis not a valid backing value for enum \"\n# is too long\n# &\n# *\n# **\n# +\n# -\n# /\n64-bit format codes are not available for 32-bit versions of PHP\n# :\n: module registration failed!\n: opcache.huge_code_pages has no affect as huge page is not supported\n# ???\nA 'day of year' can only come after a year has been found\nA PHP Object cannot be converted to a XPath-string\nA four digit ISO year could not be found\nA four digit year could not be found\nA meridian could not be found\nA non-numeric value encountered\nA single digit day of week could not be found\nA six digit microsecond could not be found\nA textual day could not be found\nA textual month could not be found\nA thread value other than 1 is not supported by this implementation\nA three digit day-of-year could not be found\nA three digit millisecond could not be found\nA two digit ISO week could not be found\nA two digit day could not be found\nA two digit hour could not be found\nA two digit minute could not be found\nA two digit month could not be found\nA two digit second could not be found\nA two digit year could not be found\nAccess violation (Segmentation fault) encountered\\ntrying to abort cleanly...\nAddress buffer overflow\nAn error occurred while invoking the authorizer callback\nAn iterator cannot be used with foreach by reference\nApache is running a threaded MPM, but your PHP Module is not compiled to be threadsafe.  You need to recompile PHP.\nArray and string offset access syntax with curly braces is no longer supported\nArray callback has to contain indices 0 and 1\nArray callback must have exactly two elements\nArray of functions is not allowed\nArray of incomplete type is not allowed\nArray of object IDs cannot be empty\nArray of values must be an associative array with string keys\nArray of void type is not allowed\nArray sizes are inconsistent\nArray to string conversion\nAttempt to assign an invalid callback, insufficient number of arguments\nAttempt to assign element of non C array\nAttempt to assign property of non-object\nAttempt to assign read-only location\nAttempt to call non C function pointer\nAttempt to cast owned C pointer\nAttempt to count() on non C array\nAttempt to iterate on non C array\nAttempt to perform assign of owned C pointer\nAttempt to perform assign pointer to owned C data\nAttempt to read element of non C array\nAttempt to read over data boundary\nAttempt to read over string boundary\nAttempt to read property \"\nAttempt to write over data boundary\nAttempting to set reference to non referenceable value\nAttempting to use non-attribute class \"\n# Attribute \"\nAttribute class \"\nAutomatic conversion of false to array is deprecated\nBackup failed: source database is busy\nBackup failed: source database is locked\nBad GD2 header\nBad scan conversion character \"\nBad unserialize data\nBit field \"\nBreakpoint exists at #\nBreakpoint exists for opline #\nC array index out of bounds\nCPU doesn't support SSE2\nCTRL events can only be received on the main thread\nCTRL events trapping is only supported on console\nCan only throw objects\nCan only use PDO::FETCH_FUNC in PDOStatement::fetchAll()\n# Can use \"\nCan't bind a lob for output\nCan't cache files in chroot() directory with too big inode\n# Can't create a temporary mailbox:\nCan't initialize heap\n# Can't re-open '$new_mailbox' mailbox:\nCannot access \"\nCannot access node list without offset\nCannot access parser properties before loading data\nCannot access property starting with \"\nCannot add element to the array as the next element is already occupied\nCannot add newnode as the previous sibling of refnode\nCannot add next element to object of type FFI\\\\CData\nCannot allocate callback\nCannot append to WeakMap\nCannot append to an attribute list\nCannot apply [] to ResourceBundle object\nCannot assign an empty string to a string offset\nCannot assign by reference to an array dimension of an object\nCannot assign by reference to overloaded object\nCannot bind an instance to a static closure\nCannot call callback\nCannot call constructor\nCannot call default session handler\nCannot call forward_static_call() when no class scope is active\nCannot change opcache.jit setting at run-time (JIT is disabled)\nCannot check dimension on a COM object\nCannot compare DateInterval objects\nCannot connect to HTTPS server through proxy\n# Cannot connect to IMAP server\n# Cannot connect to IMAP server $server:\nCannot convert to resource type\nCannot copy hash\nCannot create duplicate attribute\nCannot create unnamed attribute\nCannot delete dimension from a COM object\nCannot delete properties from a COM object\nCannot directly construct AddressInfo, use socket_addrinfo_lookup() instead\nCannot directly construct CurlHandle, use curl_init() instead\nCannot directly construct CurlMultiHandle, use curl_multi_init() instead\nCannot directly construct CurlShareHandle, use curl_share_init() instead\nCannot directly construct DeflateContext, use deflate_init() instead\nCannot directly construct FTP\\\\Connection, use ftp_connect() or ftp_ssl_connect() instead\nCannot directly construct IMAP\\\\Connection, use imap_open() instead\nCannot directly construct InflateContext, use inflate_init() instead\nCannot directly construct LDAP\\\\Connection, use ldap_create() instead\nCannot directly construct LDAP\\\\Result, use the dedicated functions instead\nCannot directly construct LDAP\\\\ResultEntry, use the dedicated functions instead\nCannot directly construct OpenSSLAsymmetricKey, use openssl_pkey_new() instead\nCannot directly construct OpenSSLCertificate, use openssl_x509_read() instead\nCannot directly construct OpenSSLCertificateSigningRequest, use openssl_csr_new() instead\nCannot directly construct PgSql\\\\Connection, use pg_connect() or pg_pconnect() instead\nCannot directly construct PgSql\\\\Lob, use pg_lo_open() instead\nCannot directly construct PgSql\\\\Result, use a dedicated function instead\nCannot directly construct Shmop, use shmop_open() instead\nCannot directly construct Socket, use socket_create() instead\nCannot directly construct SysvMessageQueue, use msg_get_queue() instead\nCannot directly construct SysvSemaphore, use sem_get() instead\nCannot directly construct SysvSharedMemory, use shm_attach() instead\nCannot directly construct XMLParser, use xml_parser_create() or xml_parser_create_ns() instead\nCannot directly construct mysqli_warning\nCannot end an oplog without starting it\nCannot fetch SoapServer object\nCannot fetch all data from the symbol table, invalid data source\nCannot fetch all the constants, invalid data source\nCannot fetch information from a fiber that has not been started or is terminated\nCannot fetch the callable from a fiber that has terminated\nCannot fit all OIDs for SET query into one packet, using multiple queries\nCannot free EnchantBroker object with open EnchantDictionary objects\nCannot instantiate FFI\\\\CData of zero size\nCannot instantiate user-supplied statement class\nCannot leak variable that is not refcounted\nCannot load module \"\nCannot lock mutex\nCannot manually construct InternalIterator\nCannot modify header information - headers already sent\nCannot open \"\nCannot prepare callback\nCannot prepare callback CIF\nCannot re-assign $this\nCannot read property\nCannot rebind scope of closure created from function\nCannot rebind scope of closure created from method\nCannot register a reverse output handler conflict outside of MINIT\nCannot register an output handler alias outside of MINIT\nCannot register an output handler conflict outside of MINIT\nCannot resume a fiber that is not suspended\nCannot resume an already running generator\nCannot start a fiber that has already been started\nCannot start a fiber that is the target of another fiber\nCannot suspend in a force-closed fiber\nCannot suspend outside of a fiber\nCannot switch fibers in current execution context\nCannot throw objects that do not implement Throwable\nCannot unbind $this of closure using $this\nCannot unbind $this of method\nCannot unset $this\nCannot unset PDORow offset\nCannot unset PDORow property\nCannot unset offset in a non-array variable\nCannot unset string offsets\n# Cannot use \"\nCannot use 'readonly' as method modifier\nCannot use [] for reading\nCannot use [] on objects in constant expression\nCannot use a scalar value as an array\nCannot use empty array elements in arrays\nCannot use list() as standalone expression\nCannot use object as array\nCannot use temporary expression in write context\nCannot write to PDORow offset\nCannot write to PDORow property\nCannot write to read-only property\nCannot yield from finally in a force-closed generator\nCase folding mode must be one of the PDO::CASE_* constants\n# Class \"\nClass name must be a valid object or a string\nCollator class not defined\nColumn index must be greater than or equal to 0\nComparison of incompatible C types\nCorrupt member variable name\n# Could not allocate parser\nCould not copy from temporary stream - ini file truncated\nCould not create WBMP\nCould not create gdImage\nCould not fetch data, invalid data source\nCould not fetch file name, invalid data source, aborting included file listing\nCould not fetch included file count, invalid data source\nCould not find information about included file...\nCould not get x-size\nCould not get y-size\nCould not read color palette\nCould not save WBMP\nCouldn't fetch backtrace, invalid data source\nCouldn't switch frames, invalid data source\nData must be loaded before expanding\nData must be loaded before reading\nDateFormat class not defined\nDatePeriod has not been initialized correctly\nDatePeriod::__construct() accepts (DateTimeInterface, DateInterval, int [, int]), or (DateTimeInterface, DateInterval, DateTime [, int]), or (string [, int]) as arguments\nDateTimeInterface can't be implemented by user classes\nDay of week must be between 1 and 7\nDifferent numbers of variable names and field specifiers\nDirect instantiation of WeakReference is not allowed, use WeakReference::create instead\nDirective oci8.old_oci_close_semantics is deprecated\nDirectory object is already initialized\nDivision by zero\n# Done\n# Done.\nDouble date specification\nDouble time specification\nDouble timezone specification\n# Dummy\nDuplicate field name \"\nDuring class fetch\nEOF before image was complete\nEmpty string as an extension\nEncoding mode must be ZLIB_ENCODING_RAW, ZLIB_ENCODING_GZIP or ZLIB_ENCODING_DEFLATE\nEncoding: '*' may only be first arraySize value in list\nEncoding: Can't decode apache map, missing key\nEncoding: Can't decode apache map, missing value\nEncoding: Can't decode apache map, only Strings or Longs are allowed as keys\nEncoding: Cannot find encoding\nEncoding: Error calling from_xml callback\nEncoding: Error calling to_xml callback\nEncoding: Internal Error\nEncoding: Invalid timestamp\nEncoding: Restriction: invalid enumeration value \"\nEncoding: Restriction: length greater than 'maxLength'\nEncoding: Restriction: length is not equal to 'length'\nEncoding: Restriction: length less than 'minLength'\nEncoding: SoapVar has no 'enc_type' property\nEncoding: Violation of encoding rules\nEncoding: object has no 'any' property\nEnumerator value \"\nEpoch doesn't fit in a PHP integer\nError casting object to string in collator_convert_object_to_string()\nError converting utf16 to utf8 in collator_convert_zval_utf16_to_utf8()\nError from compressing\nError mode must be one of the PDO::ERRMODE_* constants\nError reading comproessed chunk\nEscaped character expected\nExecution context not set!\nExpected array for frame\nFFI API is restricted by \"\nFFI internal error. Unsupported parameter type\nFFI internal error. Unsupported return type\nFFI passing array is not implemented\nFFI passing struct/union is not implemented\nFFI return array is not implemented\nFFI return struct/union is not implemented\nFFI::load() doesn't work in conjunction with \"\nFFI\\\\CData\nFFI\\\\CData or FFI\\\\CType\nFFI\\\\CData or string\nFFI\\\\CType is not a function\nFFI\\\\CType is not a pointer\nFFI\\\\CType is not a structure\nFFI\\\\CType is not an array\nFFI\\\\CType is not an enumeration\nFFI\\\\Cdata is not a C string\nFFI\\\\Cdata is not a pointer\nFTP does not support simultaneous read/write connections\nFTP proxy may only be used in read mode\nFail to read header\nFailed to clone SpoofChecker object\nFailed to create closure from callable\nFailed to find breakpoint #\nFailed to read property due to libxml error\nFetch mode must be a bitmask of PDO::FETCH_* constants\nFile Upload Mime headers garbled\nFile name is not a string\nFile upload error - unable to create a temporary file\nFilename cannot be empty\nFirst array member is not a valid class name or object\nFormat literal not found\nFound unconstructed BreakIterator\nFound unconstructed IntlCalendar\nFound unconstructed IntlDateFormatter\nFound unconstructed IntlDatePatternGenerator\nFound unconstructed IntlIterator\nFound unconstructed IntlTimeZone\nFound unconstructed MessageFormatter\nFound unconstructed NumberFormatter\nFound unconstructed ResourceBundle\nFound unconstructed Spoofchecker\nFound unconstructed transliterator\nFound unexpected data\nGC buffer overflow (GC disabled)\\n\nGenerated salt too short\nGenerator already closed\nGenerator currently running\nGenerator passed to yield from was aborted without proper return and is unable to continue\nGet commit status\nGlob support is not available\nGot chunk\nHTTP request failed!\nHTTP wrapper does not support writeable connections\nHandler name must be a string\nHeader may not contain\nHeader may not contain NUL bytes\nHeader name cannot be numeric,\nHeader to delete may not contain colon.\nHour cannot be higher than 12\nISO Week must be between 1 and 53\nIgnoring session_start() because a session has already been started\nIllegal member variable name\nIllegal offset type\nIllegal offset type in isset or empty\nIllegal offset type in unset\nIllegal string offset\n# Illegal string offset \"\nImplicit conversion from float-string \"\nImpossible to not specify a stdin delimiter without -rr\nImpossible to yield from the Generator being currently run\nIncompatible types when assigning\nIncomplete enum \"\nIncomplete struct \"\nIncomplete union \"\n# Incorrect \"\nInput string is too long\nInstantiation of class Closure is not allowed\nInsufficient data for unserializing -\n# Interface \"\nInternal error: Failed to retrieve the argument's reflection object\nInternal error: Failed to retrieve the reflection object\nInternal help error, non-unique alias \"\nInterned string buffer overflow\nIntlCalendar::set() has no variant with exactly 4 parameters\nIntlGregorianCalendar object is already constructed\nIntlRuleBasedBreakIterator object is already constructed\n# Invalid \"\nInvalid OID value passed\nInvalid RelaxNG Validation Context\nInvalid Schema Validation Context\nInvalid XBM\nInvalid XPath Context\nInvalid arguments to print, expected nothing, function name or method name\nInvalid bcrypt cost parameter specified:\nInvalid boundary in multipart/form-data POST data\nInvalid browscap ini file:\nInvalid characters passed for attempted conversion, these have been ignored\nInvalid column index\nInvalid document encoding\nInvalid finfo object\nInvalid number of threads\nInvalid object handle\nInvalid or uninitialized EnchantBroker object\nInvalid or uninitialized EnchantDictionary object\nInvalid or uninitialized SNMP object\nInvalid or uninitialized XMLWriter object\nInvalid or uninitialized Zip object\nInvalid parameter type for conditional breakpoint\nInvalid run command, cannot put further arguments after stdin\nInvalid run command, unterminated escape sequence\nInvalid scanner mode\nInvalid serialization data for DatePeriod object\nInvalid serialization data for DateTime object\nInvalid serialization data for DateTimeImmutable object\nInvalid serialization data for DateTimeZone object\nInvalid stream/context parameter\nInvalid timezone offset in minutes\nIterated value is no longer an array or object\nIterator does not support rewinding\nIterator not initialized or already consumed\nJIT is compatible only with CALL and HYBRID VM. JIT disabled.\nJIT is incompatible with third party extensions that override zend_execute_ex(). JIT disabled.\nJIT is incompatible with third party extensions that setup user opcode handlers. JIT disabled.\nKey array must be of the form array(0 => key, 1 => phrase)\nLDAP connection has already been closed\nLDAP result has already been closed\nLength is too large to safely generate\nLine is not an int\nLocale class not defined\nMalformed input\nMaximum number of allowable file uploads has been exceeded\nMemory Manager Disabled!\nMemory allocation failed for IP_ADAPTER_ADDRESSES struct\nMemory cost is outside of allowed memory range\nMeridian can only come after an hour has been found\nMethod name must be a string\nMissing boundary in multipart/form-data POST data\nMissing expected time part\nMissing format specifier at end of string\nMissing padding character\nMissing redirection target\nMixing of ISO dates with natural dates is not allowed\nMode must be one of 'r', 'r+', 'w', or 'w+'\nModification of ArrayObject during sorting is prohibited\n# Module \"\nMulti OID walks are not supported!\nNULL pointer dereference\nNanoseconds was not in the range 0 to 999 999 999 or seconds was negative\nNegative width in bit-field \"\nNo PostgreSQL connection opened yet\nNo URL resource specified\nNo active op array!\nNo active symbol table!\nNo execution context\nNo execution context set\nNo file uploaded\nNo function table loaded\n# No key \"\nNo more entries in hash table!\nNo pattern was provided\nNo resource supplied\nNo security protocol supported\nNo session id returned by function\nNo set command selected!\nNo stream arrays were passed\nNo string was provided\nNo variant with 4 arguments (excluding trailing NULLs)\nNode from wrong document\nNode must be associated with a document\nNormalizer class not defined\nNot Executing!\nNot a full path given or extension_dir ini setting is not set\nNot a valid gd2 file\nNot enough data available to satisfy format\nNot enough free shared space to allocate\n# Not executing\n# Not executing!\nNot executing, and execution context not set\n# Not running\nNot supported in multithreaded Web servers\n# Not yet implemented\nNothing to execute!\nNothing was deleted, no corresponding watchpoint found\nNumber is not an integer string\nNumber of bind variables doesn't match number of fields in prepared statement\nNumberFormatter class not defined\nNumberFormatter object is already constructed\nOCIAttrGet: OCI_ATTR_CALL_TIMEOUT\nOCIAttrSet: OCI_ATTR_ACTION\nOCIAttrSet: OCI_ATTR_CALL_TIMEOUT\nOCIAttrSet: OCI_ATTR_CLIENT_IDENTIFIER\nOCIAttrSet: OCI_ATTR_CLIENT_INFO\nOCIAttrSet: OCI_ATTR_MODULE\nOCIAttrSet: OCI_ATTR_PASSWORD\nOCIAttrSet: OCI_ATTR_SERVER\nOCIAttrSet: OCI_ATTR_SESSION\nOCIAttrSet: OCI_ATTR_USERNAME\nOCIEnvNlsCreate: Check the character set is valid and that PHP has access to Oracle libraries and NLS data\nOCIHandleAlloc: OCI_HTYPE_SESSION\nOCIHandleAlloc: OCI_HTYPE_SVCCTX\nOCINlsCharSetNameToId: unknown character set name\nOCINlsNumericInfoGet: OCI_NLS_CHARSET_MAXBYTESZ\nOCIServerDetach\nOCISessionBegin\nOCIStmtExecute\nOCIStmtFetch\nOCIStmtPrepare\nOCITransCommit\nOCITransRollback\nOCI_NEED_DATA\nObject is not initialized\nObject not initialized\nOne parameter to a memory allocation multiplication is negative or zero, failing operation gracefully\\n\nOnly 'cdata' property may be read\nOnly 'cdata' property may be set\nOnly arrays and Traversables can be unpacked\nOnly classes can be marked with #[ZendTestAttribute]\nOnly the first byte will be assigned to the string offset\nOnly the leftmost array can be undimensioned\nOnly variable references should be returned by reference\nOnly variable references should be yielded by reference\nOnly variables should be assigned by reference\nOnly variables should be passed by reference\n# Option \"\nOptions should have the form [\\\nOverflow in enumeration values \"\nPDO object is not initialized, constructor was not called\nPDO object is uninitialized\nPDO::ATTR_STATEMENT_CLASS class must be a valid class\nPDO::ATTR_STATEMENT_CLASS class must be derived from PDOStatement\nPDO::ATTR_STATEMENT_CLASS value must be an array with the format\nPDO::FETCH_INTO and PDO::FETCH_CLASS cannot be set as the default fetch mode\nPNG support is not available\nPOST Content-Length of\nPaletter image not supported by webp\nParser must not be called recursively\nParsing Schema: <restriction> or <extension> expected in complexContent\nParsing Schema: attribute has both 'ref' and 'type' attributes\nParsing Schema: attribute has both 'ref' attribute and subtype\nParsing Schema: attribute has both 'type' attribute and subtype\nParsing Schema: attribute has no 'name' nor 'ref' attributes\nParsing Schema: attributeGroup has both 'ref' attribute and subattribute\nParsing Schema: attributeGroup has no 'name' nor 'ref' attributes\nParsing Schema: can't import schema. Namespace must not match the enclosing schema 'targetNamespace'\nParsing Schema: complexType has no 'name' attribute\nParsing Schema: element has both 'default' and 'fixed' attributes\nParsing Schema: element has both 'itemType' attribute and subtype\nParsing Schema: element has both 'ref' and 'fixed' attributes\nParsing Schema: element has both 'ref' and 'nillable' attributes\nParsing Schema: element has both 'ref' and 'type' attributes\nParsing Schema: element has both 'ref' attribute and subtype\nParsing Schema: element has both 'type' attribute and subtype\nParsing Schema: element has no 'name' nor 'ref' attributes\nParsing Schema: expected <restriction> or <extension> in simpleContent\nParsing Schema: expected <restriction>, <list> or <union> in simpleType\nParsing Schema: extension has no 'base' attribute\nParsing Schema: group has both 'ref' attribute and subcontent\nParsing Schema: group has no 'name' nor 'ref' attributes\nParsing Schema: include has no 'schemaLocation' attribute\nParsing Schema: missing restriction value\nParsing Schema: redefine has no 'schemaLocation' attribute\nParsing Schema: restriction has no 'base' attribute\nParsing Schema: simpleType has no 'name' attribute\nParsing WSDL: <binding> has no name attribute\nParsing WSDL: <message> has no name attribute\nParsing WSDL: <portType> has no name attribute\nParsing WSDL: <service> has no name attribute\nParsing WSDL: Could not find any usable binding services in WSDL.\nParsing WSDL: Couldn't bind to service\nParsing WSDL: Missing 'name' attribute for <binding>\nParsing WSDL: Missing 'name' attribute for <operation>\nParsing WSDL: Missing 'type' attribute for <binding>\nParsing WSDL: Missing message attribute for <header>\nParsing WSDL: Missing part attribute for <header>\nParsing WSDL: No address associated with <port>\nParsing WSDL: No binding associated with <port>\nParsing WSDL: No location associated with <port>\nParsing WSDL: Unspecified encodingStyle\nPassword hashing failed for unknown reason\nPath cannot be empty\nPath to document must not contain any null bytes\nPostgreSQL connection has already been closed\nPostgreSQL large object has already been closed\nPostgreSQL result has already been closed\nPrecision must be an integer\nPreloading doesn't work in \"\nPreloading failed to initgroups(\\\nPreloading is incompatible with first-exec and profile triggered JIT\nPrivate methods cannot be final as they are never overridden by other classes\nProduct of memory allocation multiplication would exceed INT_MAX, failing operation gracefully\\n\nProperty access is not allowed yet\nProperty queryString is read only\nPutting buf...\nPutting int...\nPutting word...\nRead Error: truncated data\nRead-only segment cannot be written\nReading gd2 header info\nRecursion detected\nRedeclaration of \"\nRedefinition of \"\nRedirection limit reached, aborting\nRegistered tick function cannot be unregistered while it is being executed\nRemote file already exists and overwrite context option not specified\nResourceBundle does not support writable iterators\nResourceBundle object is already constructed\nReturning by reference from a void function is deprecated\nSNMP output print format must be an SNMP_OID_OUTPUT_* constant\nSNMP retrieval method must be a bitmask of SNMP_VALUE_LIBRARY, SNMP_VALUE_PLAIN, and SNMP_VALUE_OBJECT\nSNMP::$max_oids must be greater than 0 or null\nSOAP-ERROR:\nSQLAllocHandle (DBC)\nSQLAllocHandle: STMT\nSQLAllocStmt\nSQLBindCol\nSQLBindParameter\nSQLColAttribute\nSQLColumnPrivileges\nSQLColumns\nSQLConnect\nSQLDataSources\nSQLDescribeCol\nSQLDescribeParameter\nSQLDriverConnect\nSQLEndTran: Commit\nSQLEndTran: Rollback\nSQLExecDirect\nSQLExecute\nSQLFetchScroll\nSQLForeignKeys\nSQLFreeStmt\nSQLGetCursorName\nSQLGetData\nSQLGetTypeInfo\nSQLMoreResults\nSQLPrepare\nSQLPrimaryKeys\nSQLProcedureColumns\nSQLProcedures\nSQLRowCount\nSQLSetConnectAttr AUTOCOMMIT\nSQLSetConnectAttr AUTOCOMMIT = OFF\nSQLSetConnectAttr AUTOCOMMIT = ON\nSQLSetConnectAttr SQL_ODBC_CURSORS\nSQLSetConnectOption\nSQLSetCursorName\nSQLSetEnvAttr: ODBC3\nSQLSetEnvAttr: SQL_ATTR_CP_MATCH\nSQLSetStmtAttr: SQL_ATTR_CURSOR_SCROLLABLE\nSQLSpecialColumns\nSQLStatistics\nSQLTablePrivileges\nSQLTables\nSQLTransact\nSQLite Extension are disabled\nSSL: failed invoking reneg limit notification callback\nSSL: failed loading CA names from cafile\nSchema must be set prior to reading\nSecond array member is not a valid method\nSecurity level must be one of \"\nSecurity protocol must be \"\nSecurity protocol must be one of \"\nSeeking...\nServer doesn't support FTPS.\nSession id must be a string\nSet autocommit\nSetConnectOption\nSetStmtOption\nShared memory block has already been destroyed\nSimpleXMLElement is not properly initialized\nSoapHeader::__construct(): \"\nSoapServer::addFunction(): Function \"\nSoapServer::addSoapHeader() may be called only during SOAP request processing\nSoapServer::setPersistence(): Persistence cannot be set when the SOAP server is used in function mode\nSome opcache.jit_debug bits cannot be changed after startup\nSpoofchecker class not defined\nString offset cast occurred\nString size overflow\nTCP/IP option is not available for error logging\n# The\n# The \"\nThe (unset) cast is no longer supported\nThe DateTime object has not been correctly initialized by its constructor\nThe InternalIterator object has not been properly initialized\nThe additional headers cannot contain the \"\nThe authorizer callback returned an invalid type: expected int\nThe authorizer callback returned an invalid value\nThe command \"\nThe driver_version property is deprecated\nThe escaped character could not be found\nThe filter.default ini setting is deprecated\nThe first parameter in session.save_path is invalid\nThe first parameter makes no sense !\nThe format separator does not match\nThe inner constructor wasn't initialized with an iterator instance\nThe number of elements in the type definition string must match the number of bind variables\nThe number of variables must match the number of parameters in the prepared statement\nThe object is in an invalid state as the parent constructor was not called\nThe parent constructor was not called: the object is in an invalid state\nThe passed argument was not a stack !\nThe second parameter in session.save_path is invalid\nThe separation symbol ([;:/.,-]) could not be found\nThe separation symbol could not be found\nThe stack contains nothing !\nThe timezone could not be found in the database\nThis shared object is nor a Zend extension nor a module\nThrowing from FFI callbacks is not allowed\nTime cost is outside of allowed time range\nTimezone database is corrupt. Please file a bug report as this should never happen\nTimezone initialization failed\nToo many arguments\nTrailing data\nTrait \"\nTransliterator class not defined\nTransliterator::$id is read-only\nTrying to compare uninitialized DateTimeZone objects\nType float/double is not allowed at position\nType must be a single character\nType must be of type string when object ID is a string\nUnable to activate SSL mode\nUnable to bind parameter number\nUnable to call custom replacement function\nUnable to cast node to string\nUnable to find my handle property\nUnable to generate salt\nUnable to initialize the input buffer\nUnable to open extensions outside the defined directory\nUnable to resume from offset\nUnconstructed Transliterator object cannot be cloned\nUndefined C type \"\nUndefined array key\nUndefined array key \"\nUndefined constant \"\nUndefined period specifier\nUndefined variable $this\nUnexpected character\nUnexpected data found.\nUnexpected failure hashing password\nUninitialized string offset\nUnknown SOAP version\nUnknown and uncaught modification type.\nUnknown file open mode\nUnknown format specifier \"\nUnmatched [ in format string\nUnsupported \"\nUnsupported argument type\nUnsupported attribute \"\nUnsupported attribute type\nUnsupported constant expression\nUnsupported operand types\nUse after free()\n# Use of \"\nUser-supplied function must be a valid callback\nUser-supplied statement class cannot have a public constructor\nUser-supplied statement does not accept constructor arguments\nUsing $this when not in object context\nUsing ${expr} (variable variables) in strings is deprecated, use {${expr}} instead\nUsing ${var} in strings is deprecated, use {$var} instead\nUsing raw format data\nValue must be of type string when object ID is a string\nVariable is not assigned by any conversion specifiers\nVariadic function closures are not supported\nVirtualAlloc() failed\nVirtualFree() failed\nWeakMap key must be an object\nWebP decode: realloc failed\nWidth must be an integer\n# Width of \"\nWriting index\nWrong argument number\nWrong field name\nWrong type of bit field \"\nXMLReader::expand() requires the DOM extension to be enabled\nXPath query did not return a nodeset\nYear out of range (0-9999)\nYou MUST load PDO before loading any PDO drivers\nYou cannot initialize a GdFont object except through helper functions\nYou cannot initialize a GdImage object except through helper functions\nYou cannot initialize a PSpell\\\\Config object except through helper functions\nYou cannot initialize a PSpell\\\\Dictionary object except through helper functions\nYou should not create a tidyNode manually\nZero width in bit-field \"\n[] operator not supported for SplFixedArray\n[] operator not supported for strings\n# \\\n# ^\n__clone method called on non-object\nand argument #2 ($string_2) must have the same length\nand argument #2 ($values) must have the same number of elements\nargs element is not an array\n# array\nattempt to cast to larger type\nattempt to read over data boundary\nattempt to read over string boundary\nattempt to use a closed file\nattempt to write over data boundary\nauto_detect_line_endings is deprecated\navif error - Could not allocate memory\navif error - Could not create GD truecolor image\navif error - avif doesn't support palette images\navif error - couldn't allocate memory\navif error - image dimensions are too large\navif error - image dimensions must not be zero\nbad type specifier while parsing parameters\nc-client imap_getacl failed\ncall a method\n# calling\ncan't allocate continuation\ncan't re-open '$new_mailbox' mailbox:\n# cannot be \"\ncannot be 0 for the POSIX_S_IFCHR and POSIX_S_IFBLK modes\ncannot be PDO::FETCH_LAZY in PDOStatement::fetchAll()\ncannot be a class constant\ncannot be a recursive array\ncannot be an array when working on a single string\ncannot be empty when HMAC is requested\ncannot be null for non-static methods\ncannot be null for the chosen cipher algorithm\ncannot be null when argument #1 ($objectOrMethod) is an object\ncannot be null when argument #2 ($name) is a string\ncannot be null when argument #2 ($wrapper_or_options) is a string\ncannot be null when argument #3 ($atime) is an integer\ncannot be null when the socket type is AF_INET\ncannot be null when the socket type is AF_INET6\ncannot be provided when argument #2 ($wrapper_or_options) is an array\ncannot be true when argument #2 ($width) is 0\ncannot change a protected metatable\ncannot combine mode \"\n# cannot contain\n# cannot contain \"\ncannot contain empty keys\ncannot create tempnam\ncannot have a fractional part\ncannot use multiple endian options\ncannot use multiple word order options\nconnect.inc: Failed to connect as '$user' to '$dbase':\ncontains a closed socket\ncontains an invalid cURL option\ncontains invalid encoding \"\ncorrupt magic file\ncould not dup descriptor for temp file\ncould not find any valid magic files!\ncould not obtain parameters for parsing\ndeclare(encoding=...) ignored because\ndefine(): Argument #3 ($case_insensitive) is ignored since declaration of case-insensitive constants is no longer supported\ndeflate_init(): \"\nerror converting input string\nerror copying from pipe to temp file\nerror seeking\nerror while writing to temp file\nfailed setting compression level\nfailed to invoke callback\nfile is already closed\nfile_override_enabled has no effect when file_cache_only is set\nfirst character must be one of \"\nfree() non a C pointer\nfunc_get_arg() cannot be called from the global scope\nfunc_get_args() cannot be called from the global scope\nfunc_num_args() must be called from a function context\ngd-jpeg error: cannot allocate gdImage struct\ngd-jpeg: error: jpeg library was compiled for 12-bit precision. This is mostly useless, because JPEGs on the web are 8-bit and such versions of the jpeg library won't read or write them. GD doesn't support these unusual images. Edit your jmorecfg.h file to specify the correct precision and completely 'make clean' and 'make install' libjpeg again. Sorry\ngd-jpeg: error: jpeg library was compiled for 12-bit precision. This is mostly useless, because JPEGs on the web are 8-bit and such versions of the jpeg library won't read or write them. GD doesn't support these unusual images. Edit your jmorecfg.h file to specify the correct precision and completely 'make clean' and 'make install' libjpeg again. Sorry.\ngd-jpeg: warning: jpeg_finish_decompress reports suspended data source\ngd-jpeg: warning: jpeg_start_decompress reports suspended data source\ngd-png error: cannot allocate gdImage struct\ngd-png error: cannot allocate gray palette\ngd-png error: cannot allocate libpng info struct\ngd-png error: cannot allocate libpng main struct\ngd-png error: compression level must be 0 through 9\ngd-png error: no colors in palette\ngd-png error: setjmp returns error condition\ngd-tga: premature end of image data\\n\ngd-webp cannot allocate temporary buffer\ngd-webp cannot get webp info\ngd-webp encoding failed\ngd2 header complete\ngd2: EOF while reading\\n\nget_called_class() must be called from within a class\nget_class() without arguments must be called from within a class\nhas already been closed\nindividual body cannot be empty\ninfinite recursion prevented\ninput LOB is no longer a stream\ninvalid capture index\ninvalid format (repeated flags)\ninvalid format (width or precision too long)\ninvalid order function for sorting\ninvalid pattern capture\nis an invalid DocumentType object\nis an invalid configuration option, \"\nis an invalid offset\n# is invalid\nis not a supported source encoding\nis not a supported target encoding\nis not a valid cURL multi option\nis not a valid cURL option\nis not a valid cURL share option\nis not a valid codepoint\nis not a valid encoding\nis not a valid fault code\nis not a valid node type\nis not an integer string\n# is not well-formed\n# is out of range\nis required when using this extract type\n# is too large\n# is too long\nis uninitialized\niterable type is now a compile time alias for array|Traversable,\njday must be between 2440588 and\nmalformed pattern (ends with\nmalformed pattern (missing\nmb_chr() does not support the \"\nmb_ord() does not support the \"\nmb_strpos(): Unknown error\n# missing\n# modify a property\n# must be \"\nmust be 0 or 1 for attribute MYSQLI_STMT_ATTR_UPDATE_MAX_LENGTH\nmust be 1 for SQLSetConnectOption(), or 2 for SQLSetStmtOption()\nmust be CL_EXPUNGE or 0\nmust be CP_UID or 0\nmust be FORK_NOSIGCHLD or FORK_WAITPID\nmust be FT_UID or 0\nmust be Palette\nmust be RegexIterator::MATCH, RegexIterator::GET_MATCH,\nmust be SOAP_FUNCTIONS_ALL when an integer is passed\nmust be SODIUM_CRYPTO_AEAD_AES256GCM_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_AEAD_AES256GCM_NPUBBYTES bytes long\nmust be SODIUM_CRYPTO_AEAD_CHACHA20POLY1305_IETF_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_AEAD_CHACHA20POLY1305_IETF_NPUBBYTES bytes long\nmust be SODIUM_CRYPTO_AEAD_CHACHA20POLY1305_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_AEAD_CHACHA20POLY1305_NPUBBYTES bytes long\nmust be SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES bytes long\nmust be SODIUM_CRYPTO_AUTH_BYTES bytes long\nmust be SODIUM_CRYPTO_AUTH_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_BOX_KEYPAIRBYTES bytes long\nmust be SODIUM_CRYPTO_BOX_NONCEBYTES bytes long\nmust be SODIUM_CRYPTO_BOX_PUBLICKEYBYTES bytes long\nmust be SODIUM_CRYPTO_BOX_SECRETKEYBYTES bytes long\nmust be SODIUM_CRYPTO_BOX_SEEDBYTES bytes long\nmust be SODIUM_CRYPTO_KDF_BYTES_MIN bytes long\nmust be SODIUM_CRYPTO_KDF_CONTEXTBYTES bytes long\nmust be SODIUM_CRYPTO_KX_KEYPAIRBYTES bytes long\nmust be SODIUM_CRYPTO_KX_PUBLICKEYBYTES bytes long\nmust be SODIUM_CRYPTO_KX_SEEDBYTES bytes long\nmust be SODIUM_CRYPTO_PWHASH_SALTBYTES bytes long\nmust be SODIUM_CRYPTO_PWHASH_SCRYPTSALSA208SHA256_SALTBYTES bytes long\nmust be SODIUM_CRYPTO_SCALARMULT_SCALARBYTES bytes long\nmust be SODIUM_CRYPTO_SECRETBOX_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_SECRETBOX_NONCEBYTES bytes long\nmust be SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_HEADERBYTES bytes long\nmust be SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_SHORTHASH_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_SIGN_BYTES bytes long\nmust be SODIUM_CRYPTO_SIGN_KEYPAIRBYTES bytes long\nmust be SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES bytes long\nmust be SODIUM_CRYPTO_SIGN_SECRETKEYBYTES bytes long\nmust be SODIUM_CRYPTO_SIGN_SEEDBYTES bytes long\nmust be SODIUM_CRYPTO_STREAM_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_STREAM_NONCEBYTES bytes long\nmust be SODIUM_CRYPTO_STREAM_XCHACHA20_KEYBYTES bytes long\nmust be SODIUM_CRYPTO_STREAM_XCHACHA20_NONCEBYTES bytes long\nmust be STR_PAD_LEFT, STR_PAD_RIGHT, or STR_PAD_BOTH\nmust be ST_UID or 0\nmust be TrueColor\nmust be a 3x3 array\nmust be a DNS_* constant\nmust be a NumberFormatter::TYPE_* constant\nmust be a PHP_XML_OPTION_* constant\nmust be a PREG_* constant\nmust be a RecursiveTreeIterator::PREFIX_* constant\nmust be a UConverter::REASON_* constant\nmust be a a valid normalization form\nmust be a bitmask of CP_UID, and CP_MOVE\nmust be a bitmask of FT_UID, FT_PEEK, and FT_INTERNAL\nmust be a bitmask of FT_UID, FT_PREFETCHTEXT, and FT_INTERNAL\nmust be a bitmask of IMAP_GC_TEXTS, IMAP_GC_ELT, and IMAP_GC_ENV\nmust be a bitmask of OP_READONLY, OP_ANONYMOUS, OP_HALFOPEN,\nmust be a bitmask of PDO::FETCH_* constants\nmust be a bitmask of SA_* constants\nmust be a bitmask of SE_FREE, and SE_UID\nmust be a bitmask of SE_UID, and SE_NOPREFETCH\nmust be a bitmask of SNMP_VALUE_LIBRARY, SNMP_VALUE_PLAIN, and SNMP_VALUE_OBJECT\nmust be a bitmask of the OP_* constants, and CL_EXPUNGE\nmust be a bz2 stream\nmust be a callable, null given\nmust be a combination of CLONE_* flags\nmust be a cryptographic hashing algorithm if HMAC is requested\nmust be a greater than 0\nmust be a greater than or equal to 0\nmust be a list array\nmust be a multiple of argument #2 ($word_size)\nmust be a non-empty string\nmust be a reference to a state\nmust be a single character\nmust be a two-letter ISO 3166-1 compatible country code\nmust be a user-defined class name, internal class name given\nmust be a valid DNS record type\nmust be a valid Directory resource\nmust be a valid Hash Context resource\nmust be a valid SNMP protocol version\nmust be a valid URL component identifier,\nmust be a valid XML attribute\nmust be a valid XML node\nmust be a valid access mode\nmust be a valid array offset type\nmust be a valid attribute filter flag\nmust be a valid base64 string\nmust be a valid base64 variant identifier\nmust be a valid bit mask of PGSQL_CONV_FORCE_NULL, PGSQL_DML_NO_CONV,\nmust be a valid bit mask of PGSQL_CONV_IGNORE_DEFAULT,\nmust be a valid calendar ID\nmust be a valid callback, function \"\nmust be a valid charset\nmust be a valid class\nmust be a valid codepage\nmust be a valid comparison operator\nmust be a valid cryptographic hashing algorithm\nmust be a valid data source URI\nmust be a valid data source name\nmust be a valid data source name (via URI)\nmust be a valid element type\nmust be a valid encoding, \"\nmust be a valid extract type\nmust be a valid flag value\nmust be a valid format value\nmust be a valid function name, function \"\nmust be a valid hashing algorithm\nmust be a valid hexadecimal string\nmust be a valid identifier\nmust be a valid language, \"\nmust be a valid method name\nmust be a valid mode\nmust be a valid parser property\nmust be a valid password hashing algorithm\nmust be a valid resource type\nmust be a valid sort flag\nmust be a valid stream/context\nmust be a valid type\nmust be an ASSERT_* constant\nmust be an INPUT_* constant\nmust be an OPENSSL_ENCODING_* constant\nmust be an SNMP_OID_OUTPUT_* constant\nmust be an array or a sort flag\nmust be an array or a sort flag that has not already been specified\nmust be an integer indexed array\nmust be an object that has a \"\nmust be at least as long as the block size\nmust be at most 3 characters\nmust be at most SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_MESSAGEBYTES_MAX bytes long\nmust be between -1 and 255\nmust be between -1 and 9\nmust be between 0 and 255\nmust be between 0 and the segment size\nmust be between 1 and 32\nmust be between 1 and 4 (inclusive)\nmust be between 1 and 65535\nmust be between 1 and 65535 when argument #5 ($raw) is true\nmust be between 1 and 7\nmust be between 1 and the number of elements in argument #1 ($array)\nmust be between 1970 and 2037 (inclusive)\nmust be between 2 and 36 (inclusive)\nmust be contained in argument #1 ($haystack)\nmust be contained in argument #1 ($main_str)\nmust be contained in argument #2 ($data)\n# must be either \"\nmust be either COUNT_NORMAL or COUNT_RECURSIVE\nmust be either FTP_ASCII or FTP_BINARY\nmust be either IntlCalendar::WALLTIME_FIRST or\nmust be either Locale::ACTUAL_LOCALE or Locale::VALID_LOCALE\nmust be either MYSQLI_STORE_RESULT or MYSQLI_USE_RESULT\nmust be either MYSQLI_USE_RESULT or MYSQLI_STORE_RESULT with MYSQLI_ASYNC as an optional bitmask flag\nmust be either PGSQL_STATUS_LONG or PGSQL_STATUS_STRING\nmust be either SIG_DFL or SIG_IGN when an integer value is given\nmust be either SQL_FETCH_FIRST or SQL_FETCH_NEXT\nmust be either Transliterator::FORWARD or Transliterator::REVERSE\nmust be empty or a single character\nmust be greater or equal than 0\nmust be greater than 0\nmust be greater than 0 for attribute MYSQLI_STMT_ATTR_PREFETCH_ROWS\n# must be greater than 0 for the \"\n# must be greater than 0 for the FTP_TIMEOUT_SEC option\nmust be greater than or equal to -1\nmust be greater than or equal to 0\nmust be greater than or equal to 0 when using the threshold mode\nmust be greater than or equal to 1\nmust be greater than or equal to 3\nmust be greater than or equal to SODIUM_CRYPTO_KDF_BYTES_MIN\nmust be greater than or equal to argument #1 ($min)\nmust be in the range of 0-255\nmust be integer-indexed\nmust be less than 65535 bytes\nmust be less than argument #2 ($maximum)\nmust be less than or equal to 1048576\nmust be less than or equal to INT_MAX - 4 bytes\nmust be less than or equal to SODIUM_CRYPTO_KDF_BYTES_MAX\nmust be less than or equal to argument #2 ($max)\nmust be less than or equal to the length of argument #2 ($buf)\nmust be less than the number of fields for this result set\nmust be less than the number of the arguments passed to the currently executed function\nmust be longer than 2 characters\nmust be null for a tar- or zip-based phar stub, string given\nmust be null when argument #1 ($lifetime_or_options) is an array\nmust be null when argument #2 ($name) is an array\nmust be null when argument #2 ($wrapper_or_options) is an array\nmust be null when argument #4 ($seconds) is null\nmust be odd if argument #1 ($a) is negative\nmust be of type PgSql\\\\Connection when the connection is provided\nmust be of type array when argument #2 ($replacement) is an array, string given\nmust be of type array when using translate or scale\nmust be of type array, string given\nmust be of type string when argument #1 ($ldap) is an LDAP instance\nmust be of type string, array given\nmust be of type string|int|float|bool|null\n# must be one character\n# must be one of\n# must be one of \"\nmust be one of AF_UNIX, AF_INET, or AF_INET6\nmust be one of AF_UNIX, AF_INET6, or AF_INET\nmust be one of E_USER_ERROR, E_USER_WARNING, E_USER_NOTICE,\nmust be one of FTP_TIMEOUT_SEC, FTP_AUTOSEEK, or FTP_USEPASVADDRESS\nmust be one of GMP_ROUND_ZERO, GMP_ROUND_PLUSINF, or GMP_ROUND_MINUSINF\nmust be one of GRAPHEME_EXTR_COUNT, GRAPHEME_EXTR_MAXBYTES, or GRAPHEME_EXTR_MAXCHARS\nmust be one of IMG_FLIP_VERTICAL, IMG_FLIP_HORIZONTAL, or IMG_FLIP_BOTH\nmust be one of IntlCalendar::WALLTIME_FIRST,\nmust be one of IntlPartsIterator::KEY_SEQUENTIAL,\nmust be one of LOCK_SH, LOCK_EX, or LOCK_UN\nmust be one of MYSQLI_NUM, MYSQLI_ASSOC, or MYSQLI_BOTH\nmust be one of PDO::FETCH_BOTH, PDO::FETCH_ASSOC, or PDO::FETCH_NUM\nmust be one of PGSQL_ASSOC, PGSQL_NUM, or PGSQL_BOTH\nmust be one of PGSQL_NOTICE_LAST, PGSQL_NOTICE_ALL, or PGSQL_NOTICE_CLEAR\nmust be one of PGSQL_SEEK_SET, PGSQL_SEEK_CUR, or PGSQL_SEEK_END\nmust be one of PHPDBG_COLOR_PROMPT, PHPDBG_COLOR_NOTICE, or PHPDBG_COLOR_ERROR\nmust be one of PRIO_PGRP, PRIO_USER, or PRIO_PROCESS\nmust be one of SOAP_ACTOR_NEXT, SOAP_ACTOR_NONE, or SOAP_ACTOR_UNLIMATERECEIVER\nmust be one of SOCK_STREAM, SOCK_DGRAM, SOCK_SEQPACKET,\nmust be one of SQL_CUR_USE_IF_NEEDED,\nmust be one of STREAM_SHUT_RD, STREAM_SHUT_WR, or STREAM_SHUT_RDWR\nmust be one of SUNFUNCS_RET_TIMESTAMP, SUNFUNCS_RET_STRING, or SUNFUNCS_RET_DOUBLE\nmust be one of Spoofchecker::ASCII, Spoofchecker::SINGLE_SCRIPT_RESTRICTIVE,\nmust be one of ZLIB_ENCODING_RAW, ZLIB_ENCODING_GZIP, or ZLIB_ENCODING_DEFLATE\nmust be one of ZLIB_NO_FLUSH, ZLIB_PARTIAL_FLUSH, ZLIB_SYNC_FLUSH, ZLIB_FULL_FLUSH, ZLIB_BLOCK, or ZLIB_FINISH\nmust be one of the MB_CASE_* constants\nmust be one of the MYSQLI_CURSOR_TYPE_* constants\nmust be one of the MYSQLI_TRANS_* constants\nmust be one of the PDO::FETCH_* constants\nmust be one of the SORT* constants\nmust be provided for instance properties\nmust be provided when argument #2 ($wrapper_or_options) is a string\nmust be specified when enabling encryption\nmust be the same size as argument #1 ($im1)\n# must contain a \"\nmust contain arrays only containing the \"\nmust contain arrays with consecutive integer indices starting from 0\nmust contain at least 1 valid key\nmust contain at least one element\nmust contain only arrays, where each array is a control\nmust contain only one of CachingIterator::CALL_TOSTRING,\nmust contain only string keys\nmust contain only strings\nmust contain only valid cURL options\nmust contain only valid callbacks\nmust have 6 elements\n# must have a \"\nmust have a correct length\nmust have a multiple of 4 elements\nmust have a valid syntax\n# must have an \"\nmust have an even number of elements\nmust have at least one color\nmust have at least one element\nmust have consecutive integer indices starting from 0\nmust have exactly two elements: \"\n# must have key \"\nmust have the node attribute\nmust have the same number of elements as the links array\n# must not be empty\nmust not be the spl_autoload_call() function\nmust not be zero\nmust not combine 'H' and 'K' flags\nmust not combine 'h' and 'C' flags\nmust not combine 'h' and 'c' flags\nmust not combine 'h' and 'k' flags\nmust not combine 'k' and 'C' flags\nmust not combine 'k' and 'c' flags\nmust not contain any null bytes\nmust not contain empty strings\nmust not contain null bytes\nmust not contain strings with null bytes\nmust not exceed the specified range\nmust not go past 23:59:59, December 31, 3000, UTC\nmust not include RFMEM value, not allowed within this context\nmust not include RFSIGSHARE value, not allowed within this context\nmust not include both RFFDG and RFCFDG, because these flags are mutually exclusive\nmust only contain array keys \"\nmust only contain arrays\nmust only contain arrays and streams\nmust only contain objects of type LDAP\nmust only contain string values\nmust only contain string-indexed arrays\nmust only contain the \"\nmust specify at least one encoding\nmust use PDO::FETCH_CLASSTYPE with PDO::FETCH_CLASS\nmust use PDO::FETCH_SERIALIZE with PDO::FETCH_CLASS\nmysqli_data_seek() cannot be used in MYSQLI_USE_RESULT mode\nmysqli_num_rows() cannot be used in MYSQLI_USE_RESULT mode\nmysqli_result::data_seek() cannot be used in MYSQLI_USE_RESULT mode\nname conflict for module\nnegative array index\nno magic files loaded\n# not implemented\n# not passed\nonly the leftmost array can be undimensioned\nopcache.file_cache must be a full path of accessible directory.\\n\nopcache.max_wasted_percentage must be set between 1 and 50.\\n\nopcache.memory_consumption is set below the required 8MB.\\n\n# option \"\npdo_oci_handle_factory\n# phar error: \"\nphar error: Directory not empty\nphar error: cannot create directory \"\nphar error: cannot remove directory \"\nphar error: cannot rmdir directory \"\nphar error: file \"\nphar error: invalid url \"\nphar error: invalid url or non-existent phar \"\nphar error: no directory in \"\nphar error: not a phar stream url \"\nphar error: not a phar url \"\nphar error: open mode append not supported\nphar error: unlink failed\nphar error: write operations disabled by the php.ini setting phar.readonly\nphar file \"\nphar url \"\npthread_mutex_init\npthread_mutexattr_destroy\npthread_mutexattr_init\npthread_mutexattr_settype\n# put.\nremote cafile streams are disabled for security purposes\nrfc2397: illegal URL\nrfc2397: illegal media type\nrfc2397: illegal parameter\nrfc2397: no comma in URL\nrfc2397: unable to decode\nrun command is disallowed during hard interrupt\nsecond character must be one of \"\nset break used incorrectly: set break [id] <on|off>\nset breaks used incorrectly: set breaks <on|off>\nset colors used incorrectly: set colors <on|off>\nset lines used incorrectly: set lines <number>\nset pagination used incorrectly: set pagination <on|off>\nsh command is disallowed during hard interrupt\nsocket type must be one of AF_UNIX, AF_INET, or AF_INET6\nsocket_select(): At least one array argument must be passed\nsodium_init()\nstring slice too long\nthird character must be \"\ntidy object is not initialized\ntoo many captures\ntoo many results to unpack\nunbalanced pattern\nunexpected <EOF>\nunexpected character 'escape_char(ch)'\nunexpected sequence 'escape_string(yy_text, 1 + YYPOS - yy_text))'\nunfinished capture\nunlink of \"\nupload_max_filesize of\nusage set stepping [<opcode|line>]\nvar_export does not handle circular references\nvasprintf failed\nwrong number of arguments to\nwrong size for the hashed password\nzend.assertions may be completely enabled or disabled only in php.ini\nzlib window size (logarithm) (\n# |\n\n# Group with format strings\n\n#   into (\n# ($end)\n# (after\n(breaking at opline\n(path:\n(tried to allocate\n- dynamic modules are not supported\nChunks Wide\nChunks vertically\n# \\n\n# already defined\n# and\n# and %%H\n# and property\n# argument\n# arguments are required,\narguments for the fetch mode provided,\n# as array\nas execution context, not a valid file or symlink\n# as non static\n# at continuation\n# at line\n# bytes\nbytes (Current memory usage is\nbytes exhausted (tried to allocate\nbytes exhausted at\n# bytes passed\nbytes were written, expected to write\n# bytes)\nbytes) (tried to allocate\n# bytes) at\n# bytes,\nbytes. Uncompressing into buffer of\ncannot be instantiated\ncannot be of type array\ncannot be passed by reference\ncannot contain non abstract method\n# characters to \"\nchunk index entries\n# colours\ncommand is disallowed during hard interrupt\n# constant\ncontains a null byte\n# could not be converted to\ncould not be converted to bool\ncould not be converted to string\n# could not be found\ncould not compile file\ndid not create an Iterator\ndied before SIGKILL was sent\ndoes not have a constructor, cannot pass arguments\ndoes not match enum backing type\ndoes not support method calls\ndoesn't exist in class\n# done.\n# elements\n# elements,\n# exists\n# expected\nfile is closed\n# for cases\n# for initialization\n# for parameter\nfor stream_metadata\n# from\n# from uncompress\n# given\n# given, called in\n# has no effect\nhas no unserializer\n# held by property\nimplements the Serializable interface, which is deprecated. Implement __serialize() and __unserialize() instead (or in addition, if support for old PHP versions is necessary)\n# in\n# in table for\ninstance wasn't initialized properly\n# is deprecated\nis greater than \\\\377\nis inapplicable to this socket type\n# is installed\nis nor an array nor an object\n# is not a string\nis not a user defined function, no oplines exist\nis not a user defined method, no oplines exist\nis not a valid backing value for enum \"\nis not a valid phar archive\n# is not allowed\n# is not callable\nis not compatible with property\n# is undefined\n# items,\n# magic\n# method\n# module failed\nmust be a field name from this result set\nmust be greater than or equal to 0\nmust be less than the number of fields for this result set\nmust be passed by reference, value given\n# must be public\nmust not be accessed before initialization\n# not found\nobject is already closed\nobject is not fully initialized\nobject_id:\nof C function '\n# of type\n# offset\n# on line\n# on string\noplines in file\noplines in function\noplines in method\noption must have an array value\n# or null,\noverwrites previous argument\npacket. PID=\n# parameter\n# passed and\n# passed in\n# past its maximal value\n# past its minimal value\n# points\npoints in array with only\n# present\n# property\n# provided\nreadonly property\n# received\nrequires PDO API version\nrequires Zend Engine API version\n# resource\n# resource supplied\n# returned\n# size\n# supports only version\n# to\n# to property\nto reference held by property\n# to write index\nused as array\nwas built with configuration\nwhen argument #1 ($search) is\n# when declared\nwith an empty name\n' (include_path='\n' (info)\\n\n' (mem)\\n\n' (tried:\n#' (value '\n#' (wrong \"\n' (wrong header)\\n\n#' already defined\n' already defined in '\n# ' and '\n# ' at line\n# ' doesn't exist\n# ' excepted checksum: 0x%08x actual checksum: 0x%08x\\n\n# ' flags\n' for reading from stdin\n' from PHP '\n# ' from type '\n# ' has fixed value '\n' in <message>\n' in s[np]printf call\n' is not a valid mode for fopen\n' is not a valid utf-8 string\n# ' is not allowed)\n# ' is too\n' must have a single part\n# ' not present\n' of C struct/union\n' of non C struct/union\n# ' property\n# ' type='\n# ' value='\n# ') failed:\n', FFI_LIB defined twice\n', FFI_SCOPE defined twice\n', bad FFI_LIB define\n', bad FFI_SCOPE define\n', cannot read_file\n', cannot resolve C function '\n', cannot resolve C variable '\n', different 'targetNamespace'\n# ', expecting '\n# ', expecting at least\n', expecting exactly\n', file doesn't exist\n# ', found '\n# ', found PHP '\n', namespace must not match the enclosing schema 'targetNamespace'\n', not a regular file\n# ', redefinition of '\n', unexpected 'targetNamespace'='\n# ':  expected=0x%08x, found=0x%08x\n# '\\n\n() (previously declared in\n() - access must be exactly one of public, protected or private\n() can only be called after a stylesheet has been imported\n() cannot be a NULL function\n() cannot be abstract\n() cannot be static\n() cannot take arguments\n() cannot take arguments by reference\n() does not accept unknown named parameters\n# () dynamically\n# () expects\n() expects at least\n() expects at most\n() expects at most 2 argument for the fetch mode provided,\n() expects exactly\n() expects exactly 0 arguments,\n() expects exactly 1 argument for the fetch mode provided,\n() expects exactly 2 argument for PDO::FETCH_FUNC,\n# () from\n() from global scope\n() from scope\n() has been disabled for security reasons\n() is deprecated\n() must be static\n() must have public visibility\n() must not return a value,\n() must take exactly %\n() must take exactly 1 argument\n# () on\n() to object of class\n(): Argument #\n(): Argument #1 ($callback) must be a valid callback,\n(): Argument #1 ($pieces) must be of type array, string given\n(): Argument #1 ($value) must be of type Countable|array,\n(): Array value for VLV control must have a \"\n(): Array value for VLV control must have an \"\n(): Array value for VLV control must have either an \"\n(): Attempt to close cURL handle from a callback\n(): Attempt to reset cURL handle from a callback\n(): Class of end date must be exactly DateTime or DateTimeImmutable, object of class\n(): Class of start date must be exactly DateTime or DateTimeImmutable, object of class\n(): Control OID\n(): Control must have a \"\n(): Control must have an \"\n(): Disabling safe uploads is no longer supported\n(): Expects exactly 3 arguments when argument #3\n(): If option \"\n# (): Option \"\n(): Option must be a valid callback\n(): Parameter #\n(): Return type must be\n(): Return value must be of type\n(): Sort key list must have an \"\n# (): The\n(): The provided file handle must be writable\n(): cURL option must not contain any null bytes\n(): never-returning function must not implicitly return\n# (): no\n# (): option \"\n(): option array cannot have numeric keys\n(): supplied argument is not a valid\n(): supplied resource is not a valid\n# ) after startup\n) at index\n# ) cannot be found\n# ) could not be found\n# ) for command\n) from chunk\n# ) from position\n# ) is already in use\n) is not user defined\n# ) must be of type\n) the file does not exist\n# ), from\n), not a regular file or symlink\n), please try to set opcache.use_cwd to 0 in ini file\n# ), y from\n# ).\\n\n# , %%G, %\n, as this would result in an inconsistent type conversion\n# , because the name is already in use\n# , cannot run\n, check path and permissions\n, ensure the file exists\n# , err\n, file does not exist\n, invalid data source\n# , it does not exist\n, it is not a regular file\n, not found or invalid zend extension / module:\n, or -2 and -36\n, whereas running engine is\n, which does not match the installed Zend Engine API version\n. Node no longer exists\n. Packet size=\n: Only one of seed or secret is to be passed for initialization\n: Secret length must be >=\n: Unable to register functions, unable to load\n: integer overflow in format string\n: not enough arguments\n: too few arguments\n: unknown format code\n::__clone() from\n::__construct()\n::__serialize() must return an array\n::__toString() implemented without string return type\n::__toString() must return a string\n::__toString() must return a string value\n::getCurrentLine(): Return value must be of type string,\n::offsetSet() instead\n# > in all\n> in attribute\n> in attributeGroup\n> in choice\n> in complexContent\n> in complexType\n> in element\n> in extension\n> in group\n> in list\n> in restriction\n> in schema\n> in sequence\n> in simpleContent\n> in simpleType\n> in union\nAccess to undeclared static property\nAccessing static property\nAdded key '\nAllowed memory size of\nAlready Positioned in file to\nAn infinite value cannot be converted to base\nArginfo / zpp mismatch during call of\nArgument number specifier must be greater than zero and less than\nArray of functions is not allowed at line\nAttempt to assign an invalid callback,\nAttempt to assign field '\nAttempt to assign read-only C variable '\nAttempt to assign read-only field '\nAttempt to assign undefined C variable '\nAttempt to assign undefined field '\nAttempt to call undefined C function '\nAttempt to read field '\nAttempt to read property \"\nAttempt to read undefined C variable '\nAttempt to read undefined field '\nAttempt to unset static property\nAttempting to kill locker\nAttempting to use non-attribute class \"\n# Attribute class\nAttribute class \"\nAttribute constructor of class\nAttribute value must be of type bool for selected attribute,\nAttribute value must be of type int for selected attribute,\nBackup failed:\nBad chunk size:\nBad data format:\nBad magic format `\nBad scan conversion character \"\nBad version:\nBit field \"\nBlacklist JIT compilation failed,\nBreakpoint already exists for\n# Breakpoint at\nBreakpoint exists at\nBreakpoint exists for\nCached script '\n# Call to\nCall to a member function\nCall to undefined function\nCall to undefined method\n# Cannot access\nCannot access offset of type\nCannot access property of object of type\nCannot append properties to objects, use\n# Cannot assign\nCannot bind closure to scope of internal class\nCannot bind method\n# Cannot call\nCannot call abstract method\nCannot call private\n# Cannot create\nCannot create dynamic property\nCannot create mutex (error\n# Cannot declare\nCannot declare self-referencing constant\n# Cannot decrement\nCannot decrement property\nCannot dynamically load\nCannot get fiber return value:\n# Cannot increment\nCannot increment property\nCannot instantiate abstract class\nCannot instantiate enum\nCannot instantiate interface\nCannot instantiate trait\nCannot load blacklist file:\nCannot load module \"\nCannot modify header information - headers already sent by (output started at\nCannot modify readonly property\nCannot modify readonly property DatePeriod::$\nCannot open \"\nCannot perform bitwise not on\n# Cannot redeclare\nCannot set breakpoint in\n# Cannot stat\nCannot unset readonly property\n# Cannot use\nCannot use \"\nCannot use object of type\nCannot write read-only property\nChecksum failed for '\nChunkSize:\nChunks:\nCommand array element\nConditional break\nCould not add variable: OID='\nCould not fetch class\n# Could not find\nCould not find the class\nCould not list function\n# Could not load\nCould not open '\nCould not open file\n# Couldn't fetch\nCouldn't fetch function\nCreation of dynamic property\nData starts at\nDeclaration does not declare anything at line\nDuplicate field name \"\n# Duplicate tag\nDuplicate value in enum\nEncoding: Attribute '\nEncoding: Element '\nEncoding: External reference '\nEncoding: Restriction: invalid enumeration value \"\nEncoding: Unresolved reference '\nEncoding: Violation of id and ref information items '\nEncoding: object has no '\nEncoding: string '\nEnum case type\nEnumerator value \"\nErroneous data format for unserializing '\nError in packet at\nError while receiving public key. PID=\nError while sending QUERY packet. PID=\nError while sending INIT_DB packet. PID=\nError while sending public key request packet. PID=\nError: OID not increasing:\nFFI Parser:\nFFI: Failed pre-loading '\nFFI: failed pre-loading '\nFTP server reports\nFailed identify data\nFailed loading '\nFailed loading Zend extension '\nFailed loading scope '\nFailed opening required '\nFailed resolving C function '\nFailed resolving C variable '\nFailed to check locker\nFailed to compile\nFailed to compile code for expression\nFailed to create closure from callable:\nFailed to create new session ID:\nFailed to create session ID by collision:\nFailed to create session ID:\nFailed to create test table: [\nFailed to create(read) session ID:\nFailed to drop old test table: [\nFailed to execute\nFailed to find the requested color (\nFailed to find the requested element (\nFailed to open\nFailed to open or create\nFailed to open session:\nFailed to send SIGKILL to locker\nFailed to set execution context (\nFailed to set memory limit to\nFailed to set up data channel:\nFailed to stat\nFatal error:\nFile cached script loaded into memory '\nFlexible array member in union at line\nFlexible array member not at end of struct at line\nForced restart at\n# Format:\nFunction registration failed - duplicate name -\nFunction returning array is not allowed at line\nFunction returning function is not allowed at line\nGetAdaptersAddresses failed:\nGot file code:\n# HTTP request failed!\n# Header name \"\nIllegal length modifier specified '\nIllegal string offset \"\n# Image is\nImage palette completed:\nImplicit conversion from float-string \"\nIncompatible types when assigning to type '\nIncomplete C type\nIncomplete enum \"\nIncomplete struct \"\nIncomplete type at line\nIncomplete union \"\nInconsistent entries in `\nIncorrect number of arguments for C function '\nIndex must be between 0 and\nIndex size is\nIndirect modification of overloaded element of\nIndirect modification of overloaded property\nInstantiation of\nInternal help error, non-unique alias \"\nInvalid access level for\n# Invalid action\nInvalid backtrace size\nInvalid callback\nInvalid file for conditional break\nInvalid format type\nInvalid object identifier:\nInvalid opcode name\nInvalid range supplied: start=%0.0f end=%0.0f\nInvalid redirect URL!\nIt's not possible to assign a complex type to\nKLockers:\nKilled locker\nLargest compressed chunk is\nLoading blacklist file:  '\nMAX_FILE_SIZE of %\nMissing arginfo for\nMissing mime boundary at the end of the data for file\nMultiple calling convention specifiers at line\nNamed parameter $\nNegative array index at line\nNegative width in bit-field \"\nNo blacklist file found matching:\nNo frame #\nNo help topic found for\n# No key \"\n# No response from\nNot allowed to call handler '\nOID value must be of type string|int,\nObject of class\nObject of type\nOctal escape sequence overflow \\\\\nOffset out of range %\nOnly the leftmost array can be undimensioned at line\nOut of memory (allocated\nOutput buffer space exceeded\nOutput overrun of %\nOverflow in enumeration values \"\nPDO: driver\nPDO::ATTR_STATEMENT_CLASS constructor_args must be of type ?array,\nPDO::ATTR_STATEMENT_CLASS value must be of type array,\nPackets out of order. Expected\nParse Error:\nParsing Schema: attribute '\nParsing Schema: attributeGroup '\nParsing Schema: can't import schema from '\nParsing Schema: can't include schema from '\nParsing Schema: element '\nParsing Schema: group '\nParsing Schema: unexpected <\nParsing Schema: unresolved element 'ref' attribute '\nParsing Schema: unresolved group 'ref' attribute '\nParsing WSDL: <binding> '\nParsing WSDL: <fault> with name '\nParsing WSDL: <message> '\nParsing WSDL: <portType> '\nParsing WSDL: <service> '\nParsing WSDL: Couldn't find <definitions> in '\nParsing WSDL: Couldn't load from '\nParsing WSDL: Missing <message> with name '\nParsing WSDL: Missing <portType> with name '\nParsing WSDL: Missing <portType>/<operation> with name '\nParsing WSDL: Missing name for <fault> of '\nParsing WSDL: Missing name for <input> of '\nParsing WSDL: Missing name for <output> of '\nParsing WSDL: Missing part '\nParsing WSDL: No <binding> element with name '\nParsing WSDL: No name associated with <part> '\nParsing WSDL: The fault message '\nParsing WSDL: Unexpected WSDL element <\nParsing WSDL: Unexpected extensibility element <\nParsing WSDL: Unknown encodingStyle '\nParsing WSDL: Unknown required WSDL extension '\nPassing incompatible argument\nPositioning in file to\nPossible integer overflow in zend_arena_calloc() (\nPrecision -1 is only supported for %\nPrecision must be between -1 and\nPrecision must be greater than zero and less than\nPreloading failed to initgroups(\\\nPreloading failed to setgid(\nPreloading failed to setuid(\nProcessing Chunk\nProcessing Chunk (\nREQUEST_BODY_FILE: open('\nRedeclaration of \"\nRedefinition of \"\nRedirection target must be of type int,\nReference with value of type\nRequires 1 or 2 arguments,\nRequires 2 or 3 arguments,\nRestart Scheduled! Reason:\nRestartC(+1):\nRestartC(-1):\nRestartC:\nSession callback must have a return value of type bool,\n# Size of `\n# Size:\nSoapHeader::__construct(): \"\nSoapServer::addFunction(): Function \"\nStruct/union can't contain an instance of itself at line\nStuck count for pid\nStuck count for thread id\nThe arguments array must contain\n# The class\nThe class requested (\n# The command \"\nThe expanded parameter requires SQLite3 >= 3.14 and\nThe function requested (\nThe magic method\n# The method\nThe requested class (\nThe requested function (\nThe requested name (\nThe source of the requested class (\nThe use statement with non-compound name '\n# There are only\nToo few arguments to function\nTrying to access array offset on value of type\nTrying to clone an uncloneable object of class\n# Trying to use\nType float/double is not allowed at position\nType kind must be dispatchable, %08x given\nTyped property\nTyped static property\nUnable to bind parameter number\nUnable to call handler\nUnable to clear statement:\nUnable to close database:\nUnable to execute statement:\nUnable to initialize module\nUnable to load extension at '\nUnable to open blob:\nUnable to prepare statement:\nUnable to read stream for parameter\nUnable to register module\nUnable to reset statement:\nUnable to set busy timeout:\nUnable to startup Zend extension\nUnable to startup module\nUncaught exception\nUndefined C type \"\nUndefined array key \"\nUndefined constant\nUndefined constant \"\nUndefined offset for object of type\nUndefined property:\nUndefined variable $\nUnknown class '\nUnknown format specifier \"\nUnknown named parameter $\n# Unknown option\nUnknown parameter type:\nUnlockAll:\nUnsupported array index type at line\nUnsupported attribute \"\nUnsupported calling convention line\nUnsupported content type:  '\nUnsupported declare '\nUnsupported encoding [\nUnsupported node type:\nUnsupported operand types:\nUnsupported parameter type (\nUnsupported type _Complex at line\nUnsupported type specifier combination at line\nUpdateC(+1):\nUpdateC(-1):\nUpdateC:\nUploaded file size 0 - file [\n# Value for\nValue must be of type string|int|float|null,\n# Value of type\nValues must be of type string|int|float|bool|null,\n# Version:\nWidth must be greater than zero and less than\n# Width of \"\nWrong COM_STMT_PREPARE response size. Received\nWrong parameter count for\nWrong type of bit field \"\nZero width in bit-field \"\n# [%03d/\n# [%03d] Cannot remove records, [\n# [%03d] [\n[clean] Failed to drop old test table: [\n# \\n\n] cannot be found (missing integer key)\n# ] not saved\n# ] only has\n# array item\narray_key_exists(): Argument #2 ($array) must be of type array,\navif error -\nbad argument #\nbad magic in `\ncall_user_func_array(): Argument #2 ($args) must be of type array,\ncannot allocate %\ncannot find entry `\n# cannot map `\ncannot mprotect `\n# cannot open `\ncannot open tmp file `\n# cannot read `\ncannot read fd\ncannot read magic file `\n# cannot stat `\ncannot write tmp file `\ncontains invalid encoding \"\ncontains invalid flag: '\ncontains invalid type for element\ncorrupted file '\n# error writing `\nfailed loading cafile stream: `\nfailed pre-loading '\nforeach() argument must be of type array|object,\nfunction type is not allowed at line\ngd-jpeg, libjpeg: recoverable error:\ngd-jpeg, libjpeg: strace message:\ngd-png color_type is palette, colors:\ngd-png warning: image data references out-of-range color index (\nget_class(): Argument #1 ($object) must be of type object,\ngetcwd() failed for '\ngetifaddrs() failed\n# indirect count (\nindividual body must be of type array,\ninvalid mode 0\n# invalid option\ninvalid replacement value (a\ninvalid value (\nis an invalid configuration option, \"\nlu is not a multiple of\nmagic element size\nmalformed pattern (ends with\nmb_chr() does not support the \"\nmb_ord() does not support the \"\nmm_malloc failed, avail\n# must be\nmust be a 3x3 array, matrix[\nmust be a class name compatible with\nmust be a class name derived from\nmust be a file name or a stream resource,\nmust be a string, an array(class, method), or a callable object,\nmust be a valid callback or null,\nmust be a valid callback,\nmust be a valid callback, function \"\nmust be a valid class name,\nmust be a valid encoding, \"\nmust be a valid function name, function \"\nmust be a valid language, \"\nmust be an instance of mysqli,\n# must be between\nmust be between 0 and\nmust be between 2 and\nmust be greater than 0 and less than\nmust be greater than or equal to\n# Commented out according to this: https://github.com/coreruleset/coreruleset/issues/3390\n#must be less than\n# Commented out according to this: https://github.com/coreruleset/coreruleset/issues/3390\n#must be less than or equal to\nmust be less than or equal to argument #\n# must be of type\nmust be of type ?\nmust be of type ?array,\nmust be of type Countable|array,\nmust be of type DOMNode|string,\nmust be of type LDAP|array,\nmust be of type SimpleXMLElement|DOMNode,\nmust be of type SoapHeader|array|null,\nmust be of type array for the LDAP_OPT_CLIENT_CONTROLS option,\nmust be of type array,\nmust be of type array|string|int,\nmust be of type bool for the FTP_AUTOSEEK option,\nmust be of type bool for the FTP_USEPASVADDRESS option,\nmust be of type callable|int,\nmust be of type int for the FTP_TIMEOUT_SEC option,\nmust be of type int,\nmust be of type object,\nmust be of type object|string,\nmust be of type resource|string,\nmust be of type string or file-resource,\nmust be of type string,\nmust be of type string|int|array,\nmust be of type string|int|float|bool,\nmust be of type zero-terminated string or array,\n# must consist of exactly\n# must contain a \"\n# must have key \"\nmust not combine '\nmust only have elements of type Socket,\nmust only have elements of type string|int,\nname conflict for module\nname use count (\n# negative offset\nno function environment for tail call at level\nno valid certs found cafile stream: `\nopcache cannot create directory for file '\nopcache cannot create file '\nopcache cannot read from file '\nopcache cannot unlock file '\nopcache cannot write to file '\nopcache.max_accelerated_files is set above the limit (\nopcache.max_accelerated_files is set below the required minimum (\nphar error: \"\nphar error: Could not write\nphar error: cannot create directory \"\nphar error: cannot remove directory \"\nphar error: cannot rmdir directory \"\nphar error: file \"\nphar error: invalid url \"\nphar error: invalid url or non-existent phar \"\nphar error: no directory in \"\nphar error: not a phar stream url \"\nphar error: not a phar url \"\nphar file \"\nphar url \"\nremap to huge page\nrequest_startup() for\nskip Can't bind to LDAP Server - [\nskip Can't connect to MySQL Server - [\nstack overflow (\nstring too long: `\nstrlen(): Argument #1 ($str) must be of type string,\n# u) exceeded\n# unlink of \"\nunreadable symlink `\nupload_max_filesize of\nvoid type is not allowed at line\nwrite() failed -\nzend_signal: handler was replaced for signal (\nzend_signal: shutdown with non-zero blocking depth (\nzlib >= 1.2.4 required for BLOCK deflate; current version:\n# |int,\n# |int|null,\n# |string,\n# |string|null,\n",
+    "owasp-crs/rules/php-function-names-933150.data": "##! File autogenerated by util/php-dictionary-gen with: -a 30 -F 90000 using crs-toolchain util fp-finder\narray_diff_uassoc\narray_diff_ukey\narray_filter\narray_intersect_uassoc\narray_intersect_ukey\narray_key_exists\narray_map\narray_push\narray_reduce\narray_shift\narray_udiff\narray_udiff_assoc\narray_udiff_uassoc\narray_uintersect\narray_uintersect_assoc\narray_uintersect_uassoc\narray_values\nbase64_decode\nbase64_encode\nbson_decode\nbson_encode\nbzdecompress\nbzopen\ncall_user_func\nclass_exists\nconvert_uuencode\ncurl_exec\ncurl_file_create\ncurl_init\ndebug_backtrace\ndirname\nerror_reporting\nescapeshellarg\nescapeshellcmd\nexif_imagetype\nexif_read_data\nexif_tagname\nexif_thumbnail\nfclose\nfile_exists\nfile_get_contents\nfinfo_open\nfsockopen\nftp_connect\nftp_get\nftp_nb_get\nftp_nb_put\nftp_put\nfunction_exists\nfwrite\nget_cfg_var\nget_class\nget_class_methods\nget_class_vars\nget_current_user\nget_defined_constants\nget_defined_functions\nget_defined_vars\nget_meta_tags\ngetcwd\ngetenv\ngetimagesize\ngetlastmod\ngetmygid\ngetmyinode\ngetmypid\ngetmyuid\ngzcompress\ngzdecode\ngzdeflate\ngzencode\ngzfile\ngzinflate\ngzopen\ngzread\ngzuncompress\ngzwrite\nhash_file\nhash_hmac_file\nhash_update_file\nheader_register_callback\nhex2bin\nhighlight_file\nhtml_entity_decode\nhtmlentities\nhtmlspecialchars\nhtmlspecialchars_decode\nimage2wbmp\nimagecreatefromgif\nimagecreatefromjpeg\nimagecreatefrompng\nimagecreatefromwbmp\nimagecreatefromxbm\nimagecreatefromxpm\nimagegd\nimagegd2\nini_get\nini_get_all\nini_set\niptcembed\nis_array\nis_dir\nis_executable\nis_file\nis_null\nis_numeric\nis_object\nis_readable\nis_writable\nis_writeable\niterator_apply\njson_decode\njson_encode\nmb_ereg\nmb_ereg_match\nmb_ereg_replace\nmb_ereg_replace_callback\nmb_eregi\nmb_eregi_replace\nmb_parse_str\nmd5_file\nmethod_exists\nmove_uploaded_file\nmysql_query\nnumber_format\nob_clean\nob_end_clean\nob_end_flush\nob_flush\nob_get_clean\nob_get_contents\nob_get_flush\nob_start\nodbc_connect\nodbc_exec\nodbc_execute\nodbc_result\nodbc_result_all\nparse_ini_file\nparse_str\nparse_url\npfsockopen\npg_connect\npg_execute\npg_prepare\npg_query\nphp_strip_whitespace\nphp_uname\nphpversion\nposix_getegid\nposix_geteuid\nposix_getgid\nposix_getlogin\nposix_getpwnam\nposix_getpwuid\nposix_kill\nposix_mkfifo\nposix_mknod\nposix_ttyname\npreg_match\npreg_match_all\npreg_replace\npreg_replace_callback\npreg_replace_callback_array\npreg_split\nprint_r\nproc_close\nproc_get_status\nproc_nice\nproc_open\nproc_terminate\nputenv\nrawurldecode\nrawurlencode\nread_exif_data\nreaddir\nreadgzfile\nregister_shutdown_function\nregister_tick_function\nrename_function\nrunkit_constant_add\nrunkit_constant_redefine\nrunkit_function_add\nrunkit_function_copy\nrunkit_function_redefine\nrunkit_function_rename\nrunkit_method_add\nrunkit_method_copy\nrunkit_method_redefine\nrunkit_method_rename\nsession_set_save_handler\nsession_start\nset_error_handler\nset_exception_handler\nset_include_path\nset_magic_quotes_runtime\nsetdefaultstub\nsettype\nsha1_file\nshell_exec\nshow_source\nsimplexml_load_file\nsimplexml_load_string\nsocket_connect\nsocket_create\nspl_autoload_register\nsqlite_array_query\nsqlite_create_aggregate\nsqlite_create_function\nsqlite_exec\nsqlite_open\nsqlite_popen\nsqlite_query\nsqlite_single_query\nsqlite_unbuffered_query\nstr_replace\nstream_context_create\nstream_socket_client\nstripcslashes\nstripslashes\nstrlen\nstrpos\nstrrev\nstrtolower\nstrtotime\nstrtoupper\nuasort\nucfirst\nuksort\nurldecode\nurlencode\nvar_dump\nzlib_decode\n",
+    "owasp-crs/rules/php-variables.data": "# The data in this list comes from\n# https://www.php.net/manual/en/reserved.variables.php\n# https://www.php.net/manual/en/language.variables.superglobals.php\n# https://www.php.net/manual/en/language.constants.predefined.php\n\n#  These superglobal variables are:\n$GLOBALS\n$_COOKIE\n$_ENV\n$_FILES\n$_GET\n$_POST\n$_REQUEST\n$_SERVER\n$_SESSION\n$argc\n$argv\n$http_​response_​header\n# Deprecated\n$php_​errormsg\n\n# This is really old, completely deprecated vars (PHP >= 4 < 5.3)\n$HTTP_COOKIE_VARS\n$HTTP_ENV_VARS\n$HTTP_GET_VARS\n$HTTP_POST_FILES\n$HTTP_POST_VARS\n$HTTP_RAW_POST_DATA\n$HTTP_REQUEST_VARS\n$HTTP_SERVER_VARS\n",
+    "owasp-crs/rules/restricted-files.data": "# Apache\n# (no slash; also guards against old.htaccess, old.htpasswd, etc.)\n.htaccess\n.htdigest\n.htpasswd\n# home level dotfiles (keep in sync with lfi-os-files.data).\n# Also include commented values (e.g., `# .env`), but not comments.\n# grep -E \"^(#\\s*)?\\.\\S+$\" lfi-os-files.data | sed 's/^#\\s*//'\n.access/\n.addressbook\n.anydesk/\n.aptitude/config\n.atom/\n.aws/\n.azure/\n.bash_\n.bashrc\n.boto\n.cache/\n.cache/notify-osd.log\n.cargo/\n.claude\n.config.local.php\n.config/\n.coverage\n.coveralls.yml\n.credentials\n.cshrc\n.cups/\n.cvs\n.dbus/\n.deployment-secrets.txt\n.aiignore\n.cursorignore\n.docker/\n.dockerenv\n.dockerignore\n.drush/\n.env\n.envrc\n.eslintignore\n.fbcindex\n.forward\n.ftpconfig\n.gem/\n.git/\n.gitattributes\n.gitconfig\n.gitignore\n.gitkeep\n.gitmodules\n.gnome/\n.gnome2/\n.gnomerc/\n.gnupg/\n.google_authenticator\n.gsutil/\n.hg/\n.hgignore\n#/.history\n.hplip/hplip.conf\n.htaccess\n.htdigest\n.htpasswd\n.ipynb_checkpoints/\n.java/\n.ksh_history\n.kube/\n.lesshst\n.lftp/\n.lhistory\n.lighttpdpassword\n.lldb-history\n.local/bin/\n.local/lib/\n.local/share/\n.local/state/\n.lynx_cookies\n.minikube/\n.msmtprc\n.my.cnf\n.myscmserverinfo\n.mysql_history\n.nano_history\n.netrc\n.node_repl_history\n.npm/\n.npmrc\n.nsconfig\n.nsr\n.nvm/\n.oh-my-\n# .pac\n.pass\n.passwd\n.password-store\n.pearrc\n.pgpass\n.php_history\n.pinerc\n.pki/\n.proclog\n.procmailrc\n.profile\n.psql_history\n.pwd\n.pytest_cache/\n.python_history\n.rediscli_history\n.remote-sync.json\n.rhistory\n.rhosts\n.rustup\n.s3cfg\n.secrets\n.selected_editor\n.settings/\n.sh_history\n.snap/\n.sqlite_history\n.ssh/\n.subversion/\n.svn/\n.svnignore\n.tconn/\n.tcshrc\n.terraform.lock.hcl\n.terraform/\n.thunderbird/\n.tmux.conf\n.tools/\n.tor/\n.travis.yaml\n.travis.yml\n.vagrant.d/\n.vidalia/\n.vim/\n.viminfo\n.vimrc\n.vmware/\n.vscode\n.web.config.swp\n.wget-hsts\n.www_acl\n.wwwacl\n.xauthority\n.yarnrc\n.zhistory\n.zsh_history\n.zshenv\n.zshrc\n\n# Generic config filenames and common permutations\nconfig.asp\nconfig_dev.asp\nconfig-dev.asp\nconfig.dev.asp\nconfig_prod.asp\nconfig-prod.asp\nconfig.prod.asp\nconfig.sample.asp\nconfig-sample.asp\nconfig_sample.asp\nconfig_test.asp\nconfig-test.asp\nconfig.test.asp\nconfig.ini\nconfig_dev.ini\nconfig-dev.ini\nconfig.dev.ini\nconfig_prod.ini\nconfig-prod.ini\nconfig.prod.ini\nconfig.sample.ini\nconfig-sample.ini\nconfig_sample.ini\nconfig_test.ini\nconfig-test.ini\nconfig.test.ini\nconfig.json\nconfig_dev.json\nconfig-dev.json\nconfig.dev.json\nconfig_prod.json\nconfig-prod.json\nconfig.prod.json\nconfig.sample.json\nconfig-sample.json\nconfig_sample.json\nconfig_test.json\nconfig-test.json\nconfig.test.json\nconfig.php\nconfig_dev.php\nconfig-dev.php\nconfig.dev.php\nconfig_prod.php\nconfig-prod.php\nconfig.prod.php\nconfig.sample.php\nconfig-sample.php\nconfig_sample.php\nconfig_test.php\nconfig-test.php\nconfig.test.php\nconfig.pl\nconfig_dev.pl\nconfig-dev.pl\nconfig.dev.pl\nconfig_prod.pl\nconfig-prod.pl\nconfig.prod.pl\nconfig.sample.pl\nconfig-sample.pl\nconfig_sample.pl\nconfig_test.pl\nconfig-test.pl\nconfig.test.pl\nconfig.py\nconfig_dev.py\nconfig-dev.py\nconfig.dev.py\nconfig_prod.py\nconfig-prod.py\nconfig.prod.py\nconfig.sample.py\nconfig-sample.py\nconfig_sample.py\nconfig_test.py\nconfig-test.py\nconfig.test.py\nconfig.rb\nconfig_dev.rb\nconfig-dev.rb\nconfig.dev.rb\nconfig_prod.rb\nconfig-prod.rb\nconfig.prod.rb\nconfig.sample.rb\nconfig-sample.rb\nconfig_sample.rb\nconfig_test.rb\nconfig-test.rb\nconfig.test.rb\nconfig.toml\nconfig_dev.toml\nconfig-dev.toml\nconfig.dev.toml\nconfig_prod.toml\nconfig-prod.toml\nconfig.prod.toml\nconfig.sample.toml\nconfig-sample.toml\nconfig_sample.toml\nconfig_test.toml\nconfig-test.toml\nconfig.test.toml\nconfig.txt\nconfig_dev.txt\nconfig-dev.txt\nconfig.dev.txt\nconfig_prod.txt\nconfig-prod.txt\nconfig.prod.txt\nconfig.sample.txt\nconfig-sample.txt\nconfig_sample.txt\nconfig_test.txt\nconfig-test.txt\nconfig.test.txt\nconfig.xml\nconfig_dev.xml\nconfig-dev.xml\nconfig.dev.xml\nconfig_prod.xml\nconfig-prod.xml\nconfig.prod.xml\nconfig.sample.xml\nconfig-sample.xml\nconfig_sample.xml\nconfig_test.xml\nconfig-test.xml\nconfig.test.xml\nconfig.yaml\nconfig_dev.yaml\nconfig-dev.yaml\nconfig.dev.yaml\nconfig_prod.yaml\nconfig-prod.yaml\nconfig.prod.yaml\nconfig.sample.yaml\nconfig-sample.yaml\nconfig_sample.yaml\nconfig_test.yaml\nconfig-test.yaml\nconfig.test.yaml\nconfig.yml\nconfig_dev.yml\nconfig-dev.yml\nconfig.dev.yml\nconfig_prod.yml\nconfig-prod.yml\nconfig.prod.yml\nconfig.sample.yml\nconfig-sample.yml\nconfig_sample.yml\nconfig_test.yml\nconfig-test.yml\nconfig.test.yml\nconfig.sample.inc.php\ncredentials.json\nsecrets.json\nsecrets.yaml\nsecrets.yml\n# Compressed database dumps\n.sql.001\n.sql.7z\n.sql.bz\n.sql.ace\n.sql.arj\n.sql.cpio\n.sql.gz\n.sql.lha\n.sql.lz\n.sql.pa\n.sql.pea\n.sql.r00\n.sql.r01\n.sql.r02\n.sql.r03\n.sql.r04\n.sql.r05\n.sql.r06\n.sql.r07\n.sql.r08\n.sql.r09\n.sql.rar\n.sql.rev\n.sql.tar\n.sql.taz\n.sql.tbz\n.sql.tgz\n.sql.txz\n.sql.uha\n.sql.xz\n.sql.yz1\n.sql.z\n# GitLab Omnibus\ngitlab.rb\ngitlab_config_\ninitial_root_password\n# AWS cli\naws.yaml\naws.yml\naws-key.yaml\naws-key.yml\n# October CMS credentials file\n/auth.json\n# Wordpress\n/debug.log\n/error.log\n/errors.log\nwp-config.\nwp-config-\nwp-config_\n# Symfony\n/config/parameters.yml\n/config/routing.yml\n/config/security.yml\n/config/services.yml\n# Drupal\n/sites/default/default.settings.php\n/sites/default/settings.php\n/sites/default/settings.local.php\n# PrestaShop configuration files\n/config/settings.inc.php\n/app/config/parameters.php\n# Magento\n/app/etc/env.php\n/app/etc/local.xml\n# ASP.NET\n/Web.config\n# Node\n/package.json\n/package-lock.json\n/npm-shrinkwrap.json\n/gruntfile.js\n/npm-debug.log\n/webpack.config.js\n/yarn.lock\n# Composer\n/composer.json\n/composer.lock\n/packages.json\n# OSX\n/.DS_Store\n# WS FTP\n/.ws_ftp.ini\n# New Per-Project Files\n.idea\nnbproject/\nbower.json\n.bowerrc\n.eslintrc\n.jshintrc\n.gitlab-ci.yml\n.travis.yml\ndatabase.yaml\ndatabase.yml\nDockerfile\n# PHP_CodeSniffer configuration files\n.php_cs.dist\n.phpcs.xml\nphpcs.xml\n.phpcs.xml.dist\nphpcs.xml.dist\n# Windows desktop configuration file\nDesktop.ini\n# Windows Explorer cache of thumbnail images\nThumbs.db\n# PHP configuration files\n.user.ini\nphp.ini\n# Oracle WebLogic Server configuration file\nweblogic.xml\n# Common names for local PHP error logs\nphp_error.log\nphp_errors.log\n# Java directory for non-public application data\nMETA-INF/\nWEB-INF/\n# Fortinet SSL VPN session file\nsslvpn_websession\n# BlockCypher log file used in code examples\nBlockCypher.log\n# Roundcube Webmail\nconfig.inc.php\nconfig.sample.php\ndefaults.inc.php\n# Contains credentials for SendGrid service\nsendgrid.env\n# Fish shell files\n.fish\nfish_variables\n# CVE-2023-5003\nldap-authentication-report.csv\n# OpenStack-Ansible credentials file\nuser_secrets.yml\n# File used by Visual Studio to store sensitive data\nsecrets.json\n# Docker definition files, first two are commented out\n# as they are matched by the rest of the files\n#docker-compose.yml\n#docker-compose.yaml\ncompose.yml\ncompose.yaml\n# CVE-2023-49103\nphpinfo.php\n# Python cache\n__pycache__/\n# Windows system ini files\nboot.ini\nsystem.ini\nwin.ini\n# NodeJS log file\npm2.log\n# Generic log filename\ndebug.log\n# Mysql/MariaDB config file\ndebian.cnf\nmy.cnf\nmysql.cnf\nmysqldump.cnf\n# FTP config files\nftp-sync.json\n# Yarn log files\nyarn-debug.log\nyarn-error.log\n# Code coverage config file\ncoverage.xml\n\n# /proc entries (keep in sync with lfi-os-files.data)\n# grep -E \"^proc/\" lfi-os-files.data\nproc/0\nproc/1\nproc/2\nproc/3\nproc/4\nproc/5\nproc/6\nproc/7\nproc/8\nproc/9\nproc/acpi\nproc/asound\nproc/bootconfig\nproc/buddyinfo\nproc/bus\nproc/cgroups\nproc/cmdline\nproc/config.gz\nproc/consoles\nproc/cpuinfo\nproc/crypto\nproc/devices\nproc/diskstats\nproc/dma\nproc/docker\nproc/driver\nproc/dynamic_debug\nproc/execdomains\nproc/fb\nproc/filesystems\nproc/fs\nproc/interrupts\nproc/iomem\nproc/ioports\nproc/ipmi\nproc/irq\nproc/kallsyms\nproc/kcore\nproc/key-users\nproc/keys\nproc/kmsg\nproc/kpagecgroup\nproc/kpagecount\nproc/kpageflags\nproc/latency_stats\nproc/loadavg\nproc/locks\nproc/mdstat\nproc/meminfo\nproc/misc\nproc/modules\nproc/mounts\nproc/mpt\nproc/mtd\nproc/mtrr\nproc/net\nproc/pagetypeinfo\nproc/partitions\nproc/pressure\nproc/sched_debug\nproc/schedstat\nproc/scsi\nproc/self\nproc/slabinfo\nproc/softirqs\nproc/stat\nproc/swaps\nproc/sys\nproc/sysrq-trigger\nproc/sysvipc\nproc/thread-self\nproc/timer_list\nproc/timer_stats\nproc/tty\nproc/uptime\nproc/version\nproc/version_signature\nproc/vmallocinfo\nproc/vmstat\nproc/zoneinfo\n/proc/\n\nsftp.json\n\n# /sys entries (keep in sync with lfi-os-files.data)\n# grep -E \"^sys/\" lfi-os-files.data\nsys/block\nsys/bus\nsys/class\nsys/dev\nsys/devices\nsys/firmware\nsys/fs\nsys/hypervisor\nsys/kernel\nsys/module\nsys/power\n/sys/\n\n# Vite.js development server endpoints (CVE-2025-30208)\n# These endpoints allow arbitrary file system access and should never be exposed\n/@fs/\n/@id/\n\ncargo.toml\n# ash shell\n.ashrc\n.ash_history\n# NuShell\nconfig.nu\n# Cshell history file\n.csh_history\n# KornShell config file\n.kshrc\n# Fish Startup file\nconfig.fish\n# tcsh history file\n.tcsh_history\n\n\npyproject.toml\npytest.ini\ngo.mod\ngo.sum\nsetup.py\nbuild.zig.zon\n\n# GNU screen\n.screenrc\n\n# Chocolatey package manager\n.chocolatey/\n# Gradle build tool\n.gradle/\n# Python IDLE\n.idlerc/\n# Kaggle config\n.kaggle/\n# Keras deep learning framework\n.keras/\n# MyPy type checker cache\n.mypy_cache/\n# Red Hat Subscription Manager config\n.redhat/\n# NPM node modules\nnode_modules/.bin/\nnode_modules/.cache/\n# Bun Dir\n.bun/\n# Bun global config\n.bunfig.toml\n# Ruby Shell config\n.irbrc/\n# Ruby Shell history\n.irb_history\n# Pry REPL config\n.pryrc/\n# RubyGems config\n.gemrc\n# RubyGems dir\n.gem/\n# Bundler dir\n.bundle/\n# Ruby environment manager\n.rbenv/\n# RVM dir\n.rvm/\n# RuboCop config file\n.rubocop.yml\n# PIP config\n.pip/\n# Conda\n.condarc\nanaconda3/\nminiconda3/\n# PyEnv\n.pyenv/\n# Apache Maven\n.m2/\n# SDKMAN!\n.sdkman/\n# Eclipse IDE\n.eclipse/\n# NPM Global Dir\n.npm-global/\n# YarnRc config file\n.yarnrc.yml\n# Prettier\n.prettierrc\n# Node-GYP\n.node-gyp\n# Curl Config File\n.curlrc\n# Wget Config File\n.wgetrc\n# Perl REPL & Core files\n.perldb\n.perl_repl_history\n.perlhistory\nperl/lib\nperl/bin\n# CPAN & Cpan+\n.cpan/\n.cpanplus/\n# perlenv\n.plenv\n# Kotlin Core & Cache\n.konan/\n# Kotlin REPL\n.kotlinc_history\n# git credentials\n.git-credentials\n# OpenVPN config\n.openvpn/\nopenvpn/\n# WireGuard config\nwg-clients/\n# gFTP dir\n.gftp/\n# LFTP Configuration File\n.lftprc\n# NCFTP Conf Dir\n.ncftp/\n# Rsync Exclude File and Logs\n.rsync_exclude\nrsync.log\n# Wine dir\n.wine/\n# Nano Config Files & Dirs\n.nanorc\n.nano/\n# PostGresQL connection file\n.pg_service.conf\n# MySQL Login file\n.mylogin.cnf\n# MongoDB config\n.mongodb/\n.mongoshrc.js\n# Mongo shell\n.dbshell\n# PGAdmin config\n.pgadmin/\n# pm2 configs/logs/database\n.pm2/\n# Stubby config\n.stubby.yml\n.getdns/\n# Dig config\n.digrc\n# Unbond config\n.unbound/\n# mb sync config\n.mbsyncrc\n# OfflineIMAP config\n.offlineimaprc\n# getmail config\n.getmail/\n# usermin config\n.usermin/\n# cpanel ssl cerificates configs\n.cpanel/\n# OpenSSL\n.openssl.cnf\n# Terraform plugin cache dir and config file\n.terraformrc\n.terraform.d/\n# Pulimi\n.pulumi/\n.linode-cli/\n.oci/\n.opc/\n# SQL*Plus startup files and history\n.sqlplus_history\nlogin.sql\n# Microsoft EditorConfig config\n.editorconfig\n# Data Dog config\n.datadog-agent/\n# WP Cli config\n.wp-cli/\n# IBM Cloud Cli config\n.bluemix/\n.ibmcloud/\n# Python & Pip\n.pypirc\n# Open Build Service (OBS)\n.oscrc\n.osc_cookiejar\n# BitBucket CI/CD Pipelines\nbitbucket-pipelines.yml\n# Node & PNPM Packages\n.pnpmrc\n.pnpm-store/\n# DB Config common file\ndbconn.php\n# Erlang & RabbitMQ\n.erlang.cookie\n# Kubernetes & Helm\nkustomization.yml\nChart.yaml\n# Frontend Deployment\nvercel.json\nnetlify.toml\nremix.config.js\n",
+    "owasp-crs/rules/ruby-errors.data": "#### Core Ruby Errors\nArgumentError:\nArgumentError (\nIndexError:\nIndexError (\nLoadError:\nLoadError (\nLocalJumpError:\nLocalJumpError (\nNameError:\nNameError (\nNoMethodError:\nNoMethodError (\nNotImplementedError:\nNotImplementedError (\nRangeError:\nRangeError (\nRuntimeError:\nRuntimeError (\nScriptError:\nScriptError (\nSecurityError:\nSecurityError (\nStandardError:\nStandardError (\nSyntaxError:\nSyntaxError (\nSystemExit:\nSystemExit (\nTypeError:\nTypeError (\nZeroDivisionError:\nZeroDivisionError (\n\n#### Ruby on Rails Errors\nActionController::RoutingError\nActionController::InvalidAuthenticityToken\nActionController::ParameterMissing\nActionController::UnknownFormat\nActionController::BadRequest\nActionController::UrlGenerationError\nActionController::RedirectBackError\nActionController::InvalidCrossOriginRequest\nActiveRecord::RecordNotFound\nActiveRecord::RecordInvalid\nActiveRecord::StatementInvalid\nActiveRecord::RecordNotUnique\nActiveRecord::ConnectionTimeoutError\nActiveRecord::SerializationTypeMismatch\nActiveRecord::Deadlocked\nActiveRecord::SubclassNotFound\nActiveModel::ForbiddenAttributesError\nActiveSupport::MessageVerifier::InvalidSignature\nActiveSupport::DeprecationException\n\n#### Database & ORM Errors (ActiveRecord, PostgreSQL, MySQL, SQLite)*\nPG::ConnectionBad\nPG::UndefinedTable\nPG::UndefinedColumn\nPG::SyntaxError\nPG::UniqueViolation\nPG::CheckViolation\nPG::ForeignKeyViolation\nPG::NotNullViolation\nPG::InvalidTextRepresentation\nPG::CharacterNotInRepertoire\nMysql2::Error\nMysql2::TimeoutError\nSQLite3::BusyException\nSQLite3::ConstraintException\n\n#### Rack Middleware & Web Server Errors (Puma, Unicorn, Thin, WEBrick)\nRack::Timeout::RequestTimeoutException\nRack::Lint::LintError\nRack::QueryParser::ParameterTypeError\nPuma::HttpParserError\nUnicorn::ClientShutdown\nThin::ConnectionError\nWEBrick::HTTPStatus::InternalServerError\n\n#### JSON, Serialization, and Parsing Errors*\nJSON::ParserError\nJSON::GeneratorError\nOj::ParseError\nOj::GeneratorError\n\n#### Network & HTTP Client Errors\nSocketError\nEOFError:\nOpenSSL::SSL::SSLError\nTimeout::Error\nNet::ReadTimeout\nNet::OpenTimeout\nNet::HTTPBadResponse\nNet::HTTPHeaderSyntaxError\n\n#### File Handling & System Errors\nErrno::ENOENT\nErrno::EACCES\nErrno::ECONNREFUSED\nErrno::ETIMEDOUT\nErrno::EPIPE\nErrno::EMFILE\nSystemCallError\n\n#### Authentication & Security Errors*\nDevise::Unauthorized\nJWT::DecodeError\nJWT::ExpiredSignature\nBCrypt::Errors::InvalidHash\n\n#### Threading & Concurrency Errors\nThreadError\nFiberError\nMutex::LockError\n\n#### View Rendering Errors\nActionView::Template::Error\nActionView::MissingTemplate\nActionView::MissingPartial\nActionView::Template::Handlers::ERB::ERBError\nActionView::SyntaxErrorInTemplate\nActionView::Template::Handlers::Builder::TemplateError\nActionView::Helpers::NumberHelper::InvalidNumberError\nActionView::TemplateError\n",
+    "owasp-crs/rules/scanners-user-agents.data": "# This file lists what we think the most widely used\n# security scanners identifyable via their user agents.\n#\n# The list is curated by hand. Attempts to machine-generate\n# a larger list leads to a lot of false positives and edge\n# cases where certain scanners / bots are welcome in certain\n# situations. We consider this a baseline of unwanted scanners.\n\n\n# http://www.arachni-scanner.com/\narachni\n\n# Mozilla/6.0 used by Cobaltstrike GraphStrike server\n# Technically valid user-agent, but only Mozilla/5.0 is used in practice.\nMozilla/6.0\n\nbetabot\n\nbewica-security-scan\n\n# Backup File Artifacts Checker\n# https://github.com/mazen160/bfac\nBFAC\n\n# Commix\n# https://github.com/commixproject/commix\ncommix\n\n# Detectify website vulnerability scanner\n# https://detectify.com/\nDetectify\n\n# hidden page scanner\n# (deprecated) https://www.owasp.org/index.php/Category:OWASP_DirBuster_Project\ndirbuster\n\nfimap\n\n# vuln scanner\n# https://github.com/ffuf/ffuf\nfuzz faster\n\n# WhatWaf, fingerprint and bypass WAFs\n# https://github.com/Ekultek/WhatWaf\nwhatwaf\n\n# Scanner that looks for existing or hidden web objects\n# https://github.com/OJ/gobuster\ngobuster\n\n# sql injection\nhavij\n\nhexometer\n\njbrofuzz\n\njorgee\n\nlibwhisker\n\n# port scanner\n# https://github.com/robertdavidgraham/masscan\nmasscan\n\nmorfeus\n\n# The Mysterious Mozlila User Agent bot\n# https://trunc.org/learning/the-mozlila-user-agent-bot\nMozlila\n\n# Typo of Mozilla/5.0 user-agent\nMozilla/5.g\n\n# Nessus\n# http://www.tenable.com/products/nessus-vulnerability-scanner\nnessus\n\nnetlab360\n\nnetsparker\n\n# OWASP Nettacker\nnettacker\n\n# vuln scanner\n# https://cirt.net/Nikto2\nnikto\n\nnmap\n\n# https://github.com/projectdiscovery/nuclei\nnuclei\n\n# http://www.openvas.org/\nopenvas\n\n# https://aws.amazon.com/fr/security-agent/\nsecurityagent\n\nsitelockspider\n\n# SQL Injections\n# http://sqlmap.org/\nsqlmap\n\n# https://www.cyber.nj.gov/threat-profiles/trojan-variants/sysscan\nsysscan\n\n# https://github.com/google/tsunami-security-scanner\nTsunamiSecurityScanner\n\nw3af.org\n\n# http://www.robotstxt.org/db/webbandit.html\nwebbandit\n\n# (deprecated) http://www.scrt.ch/en/attack/downloads/webshag\nwebshag\n\n# https://github.com/xmendez/wfuzz\nwfuzz\n\nwhatweb\n\nwprecon\n\n# wordpress vuln scanner\n# https://wpscan.org/\nwpscan\n\n# feroxbuster directory fuzzer\nferoxbuster\n\n# (deprecated) https://github.com/LeakIX/l9explore\nl9explore\n\n# (deprecated) https://github.com/LeakIX/l9tcpid\nl9tcpid\n\n# https://github.com/wapiti-scanner/wapiti\nwapiti\n\n# https://subgraph.com/vega/\nvega/\n\n# https://docs.rapid7.com/appspider/\nappspider\n\n# https://github.com/swatv3nub/IronWASP\nironwasp\n\n# https://github.com/spinkham/skipfish\nskipfish\n\n# https://www.qualys.com/apps/web-app-scanning\nqualysguard\n\n# https://nstalker.com/\nn-stalker\n\n# https://www.acunetix.com/\nacunetix\n\n# https://github.com/dionach/CMSmap\ncmsmap\n\n# https://github.com/xxgrunge/sqlninja\nsqlninja\n\n# https://github.com/s0md3v/XSStrike\nxsstrike\n\n# https://github.com/epsylon/xsser\nxsser\n\n# https://github.com/OWASP/joomscan\njoomscan\n\n# https://github.com/SamJoan/droopescan\ndroopescan\n\n# ZGrab scanner (Mozilla/5.0 zgrab/0.x)\n# https://zmap.io\nzgrab\n\n# Ghauri SQL Injection\nGhauri\n\nzmeu\n\n# https://github.com/Chocapikk/wpprobe\nWPProbe\n\n# SSTIMap\n# https://github.com/vladko312/SSTImap\nSSTIMap\n\n# Hydra\nMozilla/4.0 (Hydra)\n\n# (deprecated) https://github.com/epinna/tplmap\ntplmap\n\n# https://github.com/wireghoul/dotdotpwn\nDotDotPwn\n\n# https://github.com/bitquark/shortscan\nshortscan\n\n# (deprecated) https://github.com/P0cL4bs/Kadimus\nKadimus\n\n# https://github.com/D35m0nd142/LFISuite\nLFISuite\n\n# https://github.com/lightos/Panoptic\nMozilla/5.0 (compatible; Panoptic\n\n# https://github.com/hansmach1ne/LFImap\nLFImap\n\n# https://github.com/dolevf/graphw00f\ngraphw00f\n\n# https://github.com/dolevf/graphql-cop\ngraphql-cop\n\n# https://github.com/ron190/jsql-injection\njSQL\n\n# https://github.com/praetorian-inc/noseyparker\nnoseyparker\n\n# TruffleHog\nTruffleHog\n\n# https://www.yeswehack.com/\nYesWeHack-Hunter\n\n# https://github.com/Hackmanit/TInjA\nTInjA\n\n# IBM Security AppScan\nMozilla/5.0 (compatible; AppScan;\n",
+    "owasp-crs/rules/sql-errors.data": "MySqlClient.\nServer message\nSQL error\nOracle error\nJET Database Engine\nProcedure or function\nSQLite.Exception\n[IBM][CLI Driver][DB2/6000]\nthe used select statements have different number of columns\norg.postgresql.util.PSQLException\nAccess Database Engine\nIncorrect syntax near\nSyntax error in string in query expression\nSQLiteException\n' doesn't exist\nCLI Driver\non MySQL result index\nsybase\ncom.informix.jdbc\n[MySQL][ODBC\nError\nhas occurred in the vicinity of:\nSintaxis incorrecta cerca de\nMySQL server version for the right syntax to use\ncom.mysql.jdbc.exceptions\nYou have an error in your SQL syntax near\nYou have an error in your SQL syntax;\nAn illegal character has been found in the statement\npg_query() [:\nsupplied argument is not a valid MySQL\nmssql_query()\nmysql_fetch_array()\nException\njava.sql.SQLException\nColumn count doesn't match value count at row\nSybase message\nSQL Server\nPostgreSQL query failed:\nDynamic SQL Error\nSystem.Data.SQLite.SQLiteException\nSQLite/JDBCDriver\nUnclosed quotation mark before the character string\nSystem.Data.SqlClient.\nUnclosed quotation mark after the character string\nSystem.Data.OleDb.OleDbException\n[DM_QUERY_E_SYNTAX]\n[SqlException\nUnexpected end of command in statement\nvalid PostgreSQL result\npg_exec() [:\n[SQL Server]\n[SQLITE_ERROR]\nMicrosoft OLE DB Provider for ODBC Drivers\nPostgreSQL\norg.hsqldb.jdbc\nADODB.Field (0x800A0BCD)\nSQL syntax\nSystem.Data.SqlClient.SqlException\nData type mismatch in criteria expression.\nDriver\nDB2 SQL error\nSybase message:\nORA-\n[Microsoft][ODBC SQL Server Driver]\n'80040e14'\nMicrosoft OLE DB Provider for SQL Server\n in query expression\nNpgsql.\nvalid MySQL result\nsupplied argument is not a valid PostgreSQL result\ndb2_\nIngres SQLSTATE\nColumn count doesn't match\nWarning\n[Microsoft][ODBC Microsoft Access Driver]\n[Macromedia][SQLServer JDBC Driver]\n<b>Warning</b>: ibase_\nRoadhouse.Cms.\nDB2 SQL error:\nSQLSTATE[\nMySQLSyntaxErrorException\ncheck the manual that corresponds to your MySQL server version\ncheck the manual that fits your MySQL server version\ncheck the manual that corresponds to your MariaDB server version\ncheck the manual that fits your MariaDB server version\ncheck the manual that corresponds to your Drizzle server version\ncheck the manual that fits your Drizzle server version\nZend_Db_Adapter_Mysqli_Exception\nZend_Db_Statement_Mysqli_Exception\nMySqlException\nSyntax error or access violation\nMemSQL does not support this type of query\nis not supported by MemSQL\nunsupported nested scalar subselect\nPG::SyntaxError:\nsyntax error at or near\nERROR: parser: parse error at or near\norg.postgresql.jdbc\nPSQLException\nSystem.Data.SqlClient.SqlConnection.OnError\nMicrosoft SQL Native Client error\ncom.jnetdirect.jsql\nmacromedia.jdbc.sqlserver\nZend_Db_Adapter_Sqlsrv_Exception\nZend_Db_Statement_Sqlsrv_Exception\ncom.microsoft.sqlserver.jdbc\nSQLSrvException\nSQLServerException\nquoted string not properly terminated\nSQL command not properly ended\nmacromedia.jdbc.oracle\noracle.jdbc\nZend_Db_Adapter_Oracle_Exception\nZend_Db_Statement_Oracle_Exception\nOracleException\ncom.ibm.db2.jcc\nZend_Db_Adapter_Db2_Exception\nZend_Db_Statement_Db2_Exception\nibm_db_dbi.ProgrammingError\nInformix ODBC Driver\nODBC Informix driver\nweblogic.jdbc.informix\nIfxException\norg.firebirdsql.jdbc\nMicrosoft.Data.SQLite.SQLiteException\nSQLite error\nsqlite3.OperationalError:\nSQLite3::SQLException\norg.sqlite.JDBC\nDriverSapDB\ncom.sap.dbtech.jdbc\nInvalid keyword or missing delimiter\nSybSQLException\nSybase.Data.AseClient\ncom.sybase.jdbc\ncom.ingres.gcf.jdbc\ncom.frontbase.jdbc\nSyntax error 1. Missing\nSemantic error\norg.h2.jdbc\n[42000-192]\n[MonetDB][ODBC Driver\nnl.cwi.monetdb.jdbc\nSyntax error: Encountered\norg.apache.derby\nERROR 42X01\ncom.vertica.jdbc\norg.jkiss.dbeaver.ext.vertica\ncom.vertica.dsi.dataengine\ncom.mckoi.JDBCDriver\ncom.mckoi.database.jdbc\ncom.facebook.presto.jdbc\nio.prestosql.jdbc\ncom.simba.presto.jdbc\nUNION query has different number of fields:\nAltibase.jdbc.driver\ncom.mimer.jdbc\nSyntax error: failed at position\nio.crate.client.jdbc\nencountered after end of query\nA comparison operator is required here\n-10048: Syntax error\nSQ074: Line\nSR185: Undefined procedure\nSQ200: No table\nVirtuoso S0002 Error\n[Virtuoso Driver][Virtuoso Server]\n[Virtuoso iODBC Driver][Virtuoso Server]\nConversion failed when converting the varchar value\ninvalid input syntax for integer:\nXPATH syntax error:\n",
+    "owasp-crs/rules/ssrf-no-scheme.data": "# SSRF patterns without schemes\n#\n# This file contains localhost and internal DNS names that are commonly used\n# in SSRF attacks. These patterns are checked without URI schemes to catch\n# cases where frameworks automatically prepend 'http://' or 'https://'.\n#\n# Sources:\n# - https://gist.githubusercontent.com/jhaddix/78cece26c91c6263653f31ba453e273b/raw/a4869d58a5ce337d1465c2d1b29777b9eecd371f/cloud_metadata.txt\n# - https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf\n# - https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery\n# - https://github.com/assetnote/blind-ssrf-chains\n# - https://github.com/coreruleset/coreruleset/issues/4427\n\n# Standard hosts aliases\nlocalhost/\nlocalhost.localdomain/\nlocalhost4/\nlocalhost4.localdomain4/\nipv6-localhost/\nip6-loopback/\n\n# Docker based aliases\nhost.docker.internal/\ngateway.docker.internal/\nkubernetes.docker.internal/\n\n# Podman\nhost.containers.internal/\n\n# K8s API local service\nkubernetes.default.svc.cluster.local/\n\n# Testing services\nlocaltest.me/\nlvh.me/\n",
+    "owasp-crs/rules/ssrf.data": "# Sources:\n# - https://gist.githubusercontent.com/jhaddix/78cece26c91c6263653f31ba453e273b/raw/a4869d58a5ce337d1465c2d1b29777b9eecd371f/cloud_metadata.txt\n# - https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf\n# - https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery\n# - https://github.com/assetnote/blind-ssrf-chains\n\n## AWS\n# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories\n#\n# To fully protect, use IMDSv2 (see https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/)\n\nhttp://instance-data/latest/\nhttp://169.254.169.254/latest/\n\n# Common evasion techniques:\nhttp://2852039166/latest/\nhttp://025177524776/latest/\nhttp://0251.0376.0251.0376/latest/\nhttp://0xA9.0xFE.0xA9.0xFE/latest/\nhttp://0xA9FEA9FE/latest/\nhttp://0251.254.169.254/latest/\nhttp://[::ffff:a9fe:a9fe]/latest/\nhttp://[0:0:0:0:0:ffff:a9fe:a9fe]/latest/\nhttp://[0:0:0:0:0:ffff:169.254.169.254]/latest/\nhttp://169.254.169.254.nip.io/latest/\nhttp://nicob.net/redir-http-169.254.169.254:80-\n\n# http://127.0.0.1\nhttp://2130706433/\n# http://192.168.0.1\nhttp://3232235521/\n# http://192.168.1.1\nhttp://3232235777/\n# http://169.254.169.254\nhttp://2852039166/\n# IPv6 base\nhttp://[::]:\n\n# localhost bypass\nhttp://localtest.me\nhttp://127.0.0.1.nip.io\nhttp://127.127.127.127\nhttp://127.0.1.3\nhttp://127.0.0.0\nhttp://127.0.0.1\nhttp://0.0.0.0\nhttp://localhost\nhttp://0177.0.0.1/\nhttp://[::1]\nhttp://[0000::1]\nhttp://[::ffff:127.0.0.1]\nhttp://[0:0:0:0:0:ffff:127.0.0.1]\nhttp://0/\nhttp://127.1\nhttp://127.0.1\nhttp:127.0.0.1\n\n# AWS ECS\nhttp://169.254.170.2/v2\n\n## Google Cloud\n#  https://cloud.google.com/compute/docs/metadata/overview\n#  - Requires the header \"Metadata-Flavor: Google\" or \"X-Google-Metadata-Request: True\"\n\nhttp://169.254.169.254/computeMetadata/v1/\nhttp://metadata.google.internal/computeMetadata/v1/\nhttp://metadata/computeMetadata/v1/\n# Common evasion techniques:\nhttp://2852039166/computeMetadata/v1/\nhttp://025177524776/computeMetadata/v1/\nhttp://0251.0376.0251.0376/computeMetadata/v1/\nhttp://[::ffff:a9fe:a9fe]/computeMetadata/v1/\nhttp://[0:0:0:0:0:ffff:a9fe:a9fe]/computeMetadata/v1/\nhttp://[0:0:0:0:0:ffff:169.254.169.254]/computeMetadata/v1/\nhttp://169.254.169.254.nip.io/computeMetadata/v1/\nhttp://0xA9.0xFE.0xA9.0xFE/computeMetadata/v1/\nhttp://0xA9FEA9FE/computeMetadata/v1/\nhttp://0251.254.169.254/computeMetadata/v1/\n\n# Google gopher SSRF\ngopher://metadata.google.internal\n\n# Google allows recursive pulls\nhttp://metadata.google.internal/computeMetadata/v1/instance/disks/?recursive=true\n\n## Google\n#  Beta does NOT require a header atm\nhttp://metadata.google.internal/computeMetadata/v1beta1/\n\n## Digital Ocean\n# https://developers.digitalocean.com/documentation/metadata/\n\nhttp://169.254.169.254/metadata/v1.json\n# This other prefix will be used from Azure: http://169.254.169.254/metadata/v1/\n\n## Packetcloud\n\nhttps://metadata.packet.net/userdata\n\n## Azure\n#\n# To be effective, these also have to:\n#\n# - contain the header Metadata: true\n# - not contain an X-Forwarded-For header\n\nhttp://169.254.169.254/metadata/v1/\nhttp://169.254.169.254/metadata/instance?api-version=2017-04-02\nhttp://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text\n# Common evasion techniques:\nhttp://2852039166/metadata/v1/\nhttp://025177524776/metadata/v1/\nhttp://0251.0376.0251.0376/metadata/v1/\nhttp://[::ffff:a9fe:a9fe]/metadata/v1/\nhttp://[0:0:0:0:0:ffff:a9fe:a9fe]/metadata/v1/\nhttp://[0:0:0:0:0:ffff:169.254.169.254]/metadata/v1/\nhttp://169.254.169.254.nip.io/metadata/v1/\nhttp://0xA9.0xFE.0xA9.0xFE/metadata/v1/\nhttp://0xA9FEA9FE/metadata/v1/\nhttp://0251.254.169.254/metadata/v1/\n\n## OpenStack/RackSpace\nhttp://169.254.169.254/openstack\n\n## HP Helion\n# (header required? unknown)\nhttp://169.254.169.254/2009-04-04/meta-data/\n\n## Oracle Cloud\nhttp://192.0.0.192/latest/\n\n## Alibaba\nhttp://100.100.100.200/latest/meta-data/\n\n# Rancher metadata\nhttp://rancher-metadata/\n\n# Local Docker\nhttp://127.0.0.1:2375\nhttp://2130706433:2375/\nhttp://[::]:2375/\nhttp://[0000::1]:2375/\nhttp://[0:0:0:0:0:ffff:127.0.0.1]:2375/\nhttp://2130706433:2375/\nhttp://017700000001:2375/\nhttp://0x7f000001:2375/\nhttp://0xc0a80014:2375/\n# Kubernetes etcd\nhttp://127.0.0.1:2379\n\n# Enclosed alphanumerics\nhttp://169。254。169。254\nhttp://169｡254｡169｡254\nhttp://⑯⑨。②⑤④。⑯⑨｡②⑤④\nhttp://⓪ⓧⓐ⑨｡⓪ⓧⓕⓔ｡⓪ⓧⓐ⑨｡⓪ⓧⓕⓔ\nhttp://⓪ⓧⓐ⑨ⓕⓔⓐ⑨ⓕⓔ\nhttp://②⑧⑤②⓪③⑨①⑥⑥\nhttp://④②⑤｡⑤①⓪｡④②⑤｡⑤①⓪\nhttp://⓪②⑤①。⓪③⑦⑥。⓪②⑤①。⓪③⑦⑥\nhttp://⓪⓪②⑤①｡⓪⓪⓪③⑦⑥｡⓪⓪⓪⓪②⑤①｡⓪⓪⓪⓪⓪③⑦⑥\nhttp://[::①⑥⑨｡②⑤④｡⑯⑨｡②⑤④]\nhttp://[::ⓕⓕⓕⓕ:①⑥⑨。②⑤④。⑯⑨。②⑤④]\nhttp://⓪ⓧⓐ⑨。⓪③⑦⑥。④③⑤①⑧\nhttp://⓪ⓧⓐ⑨｡⑯⑥⑧⑨⑥⑥②\nhttp://⓪⓪②⑤①。⑯⑥⑧⑨⑥⑥②\nhttp://⓪⓪②⑤①｡⓪ⓧⓕⓔ｡④③⑤①⑧\n\n# Java only blind ssrf\njar:http://127.0.0.1!/\njar:https://127.0.0.1!/\njar:ftp://127.0.0.1!/\n\n# Other PL1 protocols\ngopher://127.0.0.1\ngopher://localhost\n\n# AWS Lambda\nhttp://localhost:9001/2018-06-01/runtime/\n",
+    "owasp-crs/rules/unix-shell-aliases.data": "# This list only includes shell aliases that are included in various Distro's out of the box\n# to limit false positives. The number of shell aliases that can exist are infinite.\n\n# ls\nl\nla\nll\n",
+    "owasp-crs/rules/unix-shell-builtins.data": "# Unix Shell Builtins\nalias\nbuiltin\nchdir\ndone\nendif\nendsw\nesac\neval\nexport\nfg\nfi\nforeach\nfunction\nhistory\nhup\nrepeat\nset\nsetenv\nzmodload\n",
+    "owasp-crs/rules/unix-shell.data": "# This list has generic unix shell variables, shells and commands that affect Unix systems.\n# To generate the list, we get the data from all places first. Strip or add the path to commands so it begins with `bin`.\n# Sort the file content ascending, and remove duplicate lines.\n#\n# Data comes from multiple places, listed below.\n# - Binaries:\n#   - GTFOBins. Update list using `curl -H \"Accept: application/vnd.github.v3+json\" https://api.github.com/repos/GTFOBins/GTFOBins.github.io/contents/_gtfobins | jq '.[].name' | grep '.md' | tr -d '\"' | cut -f1 -d.`\n# - Shell lists:\n#   - https://tldp.org/LDP/Linux-Filesystem-Hierarchy/html/etc.html\n#   - https://en.wikipedia.org/wiki/Unix_shell\n#   - https://hyperpolyglot.org/unix-shells\n# - Generic shell variables (Ad-Hoc for now, needs references)\n# - Generic /etc and /dev files (Ad-Hoc, needs references)\n# - Compression and decompression utilities present on Arch Linux (as of 2022-08-02) and Debian 11\n\n${CDPATH}\n${DIRSTACK}\n${HOME}\n${HOSTNAME}\n${IFS}\n${OLDPWD}\n${OSTYPE}\n${PATH}\n${PWD}\n${SHELL}\n$CDPATH\n$DIRSTACK\n$HOME\n$HOSTNAME\n$IFS\n$OLDPWD\n$OSTYPE\n$PATH\n$PWD\n$SHELL\nbin/7z\nbin/7za\nbin/7zr\nbin/7zx\nbin/GET\nbin/HEAD\nbin/POST\nbin/aa-\nbin/ab\nbin/addgroup\nbin/adduser\nbin/agetty\nbin/alpine\nbin/ansible\nbin/apparmor_\nbin/apt\nbin/apt-get\nbin/aptitude\nbin/ar\nbin/arch\nbin/aria2c\nbin/arj\nbin/arj-register\nbin/arjdisp\nbin/arp\nbin/as\nbin/ascii-xfr\nbin/ascii85\nbin/ash\nbin/aspell\nbin/at\nbin/atobm\nbin/audit2allow\nbin/audit2why\nbin/auditctl\nbin/aureport\nbin/aurepot\nbin/ausearch\nbin/avcstat\nbin/awk\nbin/aws\nbin/axel\nbin/base32\nbin/base64\nbin/basename\nbin/basenc\nbin/bash\nbin/batch\nbin/blkid\nbin/bpftrace\nbin/breaksw\nbin/bridge\nbin/brwap\nbin/bsdcat\nbin/bsdiff\nbin/bsdtar\nbin/bundler\nbin/bunzip2\nbin/busctl\nbin/busybox\nbin/byebug\nbin/byobu\nbin/bzcat\nbin/bzcmp\nbin/bzdiff\nbin/bzegrep\nbin/bzexe\nbin/bzfgrep\nbin/bzgrep\nbin/bzip2\nbin/bzip2recover\nbin/bzless\nbin/bzmore\nbin/bzz\nbin/c89\nbin/c89-gcc\nbin/c99\nbin/c99-gcc\nbin/cancel\nbin/capsh\nbin/cargo\nbin/cargo-audit\nbin/cargo-miri\nbin/cargo-watch\nbin/cat\nbin/cc\nbin/certbot\nbin/chattr\nbin/chcat\nbin/chcon\nbin/check_by_ssh\nbin/check_cups\nbin/check_log\nbin/check_memory\nbin/check_raid\nbin/check_ssl_cert\nbin/check_statusfile\nbin/checkmodule\nbin/checkpolicy\nbin/chef\nbin/chef-\nbin/chflags\nbin/chgpasswd\nbin/chgrp\nbin/chmod\nbin/choom\nbin/chown\nbin/chpass\nbin/chroot\nbin/chsh\nbin/clang\nbin/clang++\nbin/clippy-driver\nbin/cmp\nbin/cobc\nbin/cobcrun\nbin/column\nbin/comm\nbin/command\nbin/composer\nbin/compress\nbin/coproc\nbin/core_perl/zipdetails\nbin/cowsay\nbin/cowthink\nbin/cp\nbin/cpan\nbin/cpio\nbin/cpulimit\nbin/crash\nbin/cron\nbin/crontab\nbin/cscli\nbin/csh\nbin/csplit\nbin/csvtool\nbin/cupsfilter\nbin/curl\nbin/cut\nbin/dash\nbin/date\nbin/dd\nbin/df\nbin/dhclient\nbin/dialog\nbin/diff\nbin/dig\nbin/dir\nbin/dmesg\nbin/dmidecode\nbin/dmsetup\nbin/dnf\nbin/doas\nbin/docker\nbin/docker-\nbin/dosbox\nbin/dpkg\nbin/dpkg-\nbin/du\nbin/dvips\nbin/e2fsck\nbin/easy_install\nbin/eb\nbin/echo\nbin/ed\nbin/efax\nbin/egrep\nbin/emacs\nbin/env\nbin/env-update\nbin/eqn\nbin/es\nbin/esh\nbin/ex\nbin/exec\nbin/exiftool\nbin/expand\nbin/expect\nbin/expr\nbin/facter\nbin/fc\nbin/fdfind\nbin/fdisk\nbin/fdmount\nbin/fdumount\nbin/fetch\nbin/fgrep\nbin/file\nbin/filetest\nbin/find\nbin/findcon\nbin/finger\nbin/fish\nbin/fixfiles\nbin/flock\nbin/fmt\nbin/fold\nbin/fping\nbin/fping6\nbin/ftp\nbin/ftpstats\nbin/ftpwho\nbin/gawk\nbin/gcc\nbin/gcore\nbin/gdb\nbin/gem\nbin/genhomedircon\nbin/genie\nbin/genisoimage\nbin/getcap\nbin/getenforce\nbin/getfacl\nbin/getsebool\nbin/ghc\nbin/ghc-\nbin/ghci\nbin/ghci-\nbin/gimp\nbin/ginsh\nbin/git\nbin/go\nbin/gpg\nbin/grc\nbin/grcat\nbin/grep\nbin/groupmod\nbin/grubby\nbin/gtester\nbin/gunzip\nbin/gzcat\nbin/gzexe\nbin/gzip\nbin/hash\nbin/hd\nbin/head\nbin/hexdump\nbin/highlight\nbin/hostid\nbin/hostname\nbin/hping3\nbin/htdigest\nbin/htop\nbin/htpasswd\nbin/iconv\nbin/id\nbin/ifconfig\nbin/iftop\nbin/indexcon\nbin/install\nbin/ionice\nbin/ip\nbin/ip6tables\nbin/ipconfig\nbin/ippeveprinter\nbin/ippfind\nbin/ipptool\nbin/iptables\nbin/irb\nbin/ispell\nbin/java\nbin/jexec\nbin/jjs\nbin/jobs\nbin/join\nbin/journalctl\nbin/jq\nbin/jrunscript\nbin/kill\nbin/killall\nbin/knife\nbin/ksh\nbin/ksshell\nbin/last\nbin/lastcomm\nbin/lastlog\nbin/lastlogin\nbin/latex\nbin/ld\nbin/ldconfig\nbin/ldd\nbin/less\nbin/lessecho\nbin/lessfile\nbin/lesspipe\nbin/lftp\nbin/lftpget\nbin/links\nbin/ln\nbin/load_policy\nbin/local\nbin/locate\nbin/loginctl\nbin/logname\nbin/logsave\nbin/look\nbin/losetup\nbin/lp\nbin/ls\nbin/ls-F\nbin/lsb_release\nbin/lscpu\nbin/lshw\nbin/lsmod\nbin/lsof\nbin/lspci\nbin/lsusb\nbin/ltrace\nbin/lua\nbin/lualatex\nbin/luatex\nbin/lwp-download\nbin/lwp-dump\nbin/lwp-mirror\nbin/lwp-request\nbin/lynx\nbin/lz\nbin/lz4\nbin/lz4c\nbin/lz4cat\nbin/lzcat\nbin/lzcmp\nbin/lzdiff\nbin/lzegrep\nbin/lzfgrep\nbin/lzgrep\nbin/lzless\nbin/lzma\nbin/lzmadec\nbin/lzmainfo\nbin/lzmore\nbin/mail\nbin/mailq\nbin/mailx\nbin/make\nbin/man\nbin/matchpathcon\nbin/mawk\nbin/mkdir\nbin/mkfifo\nbin/mknod\nbin/mktemp\nbin/mlocate\nbin/more\nbin/mosquitto\nbin/mount\nbin/msgattrib\nbin/msgcat\nbin/msgconv\nbin/msgfilter\nbin/msgmerge\nbin/msguniq\nbin/mtr\nbin/mutt\nbin/mv\nbin/mysql\nbin/mysqladmin\nbin/mysqldump\nbin/mysqldumpslow\nbin/mysqlhotcopy\nbin/mysqlshow\nbin/nano\nbin/nasm\nbin/nawk\nbin/nc\nbin/nc.openbsd\nbin/nc.traditional\nbin/ncat\nbin/neofetch\nbin/net\nbin/netcat\nbin/netkit-ftp\nbin/netplan\nbin/netstat\nbin/newrole\nbin/nice\nbin/nl\nbin/nm\nbin/nmap\nbin/node\nbin/nohup\nbin/nping\nbin/npm\nbin/nroff\nbin/nsenter\nbin/nslookup\nbin/nstat\nbin/octave\nbin/od\nbin/onintr\nbin/openssl\nbin/openvpn\nbin/openvt\nbin/opkg\nbin/pacman\nbin/parted\nbin/passwd\nbin/paste\nbin/patch\nbin/pax\nbin/pdb\nbin/pdb2mb\nbin/pdb3\nbin/pdb3.\nbin/pdflatex\nbin/pdftex\nbin/pdksh\nbin/perf\nbin/perl\nbin/perl5\nbin/perlsh\nbin/perms\nbin/pf\nbin/pftp\nbin/pg\nbin/pgrep\nbin/php\nbin/php-cgi\nbin/php5\nbin/php7\nbin/pic\nbin/pico\nbin/piconv\nbin/pidstat\nbin/pigz\nbin/ping\nbin/ping6\nbin/pip\nbin/pkexec\nbin/pkg\nbin/pkg_info\nbin/pkginfo\nbin/pkill\nbin/policygentool\nbin/popd\nbin/pr\nbin/printenv\nbin/printf\nbin/pry\nbin/ps\nbin/psed\nbin/psftp\nbin/psql\nbin/ptar\nbin/ptardiff\nbin/ptargrep\nbin/ptx\nbin/puppet\nbin/pushd\nbin/pwd\nbin/pxz\nbin/py3versions\nbin/python\nbin/python2\nbin/python3\nbin/pyversions\nbin/rake\nbin/raku\nbin/rar\nbin/rbash\nbin/rc\nbin/rcp\nbin/readelf\nbin/realpath\nbin/reboot\nbin/red\nbin/redcarpet\nbin/rename\nbin/replace\nbin/replcon\nbin/restic\nbin/restorecon\nbin/restorecon_xattr\nbin/restorecond\nbin/rev\nbin/rlogin\nbin/rlwrap\nbin/rm\nbin/rmdir\nbin/rmuser\nbin/rnano\nbin/route\nbin/rpm\nbin/rpmdb\nbin/rpmquery\nbin/rpmverify\nbin/rsync\nbin/rsync-ssl\nbin/ruby\nbin/run-mailcap\nbin/run-parts\nbin/run_init\nbin/runc\nbin/runcon\nbin/rust-analyzer\nbin/rust-gdb\nbin/rust-lldb\nbin/rustc\nbin/rustdoc\nbin/rustfmt\nbin/rustup\nbin/rview\nbin/rvim\nbin/sandbox\nbin/sash\nbin/sched\nbin/scp\nbin/screen\nbin/script\nbin/sdiff\nbin/sealert\nbin/seaudit-report\nbin/sechecker\nbin/secilc\nbin/secon\nbin/sed\nbin/sediff\nbin/seinfo\nbin/selinuxconlist\nbin/selinuxdefcon\nbin/selinuxenabled\nbin/semanage\nbin/semodule\nbin/semodule_\nbin/sendmail\nbin/sepolicy\nbin/service\nbin/sesearch\nbin/sestatus\nbin/setarch\nbin/setcap\nbin/setenforce\nbin/setfacl\nbin/setfiles\nbin/setsebool\nbin/setsid\nbin/sftp\nbin/sg\nbin/sh\nbin/sh.distrib\nbin/shred\nbin/shuf\nbin/shutdown\nbin/sleep\nbin/slsh\nbin/smbclient\nbin/snap\nbin/socat\nbin/soelim\nbin/sort\nbin/source\nbin/split\nbin/sqlite3\nbin/ss\nbin/ssh\nbin/ssh-add\nbin/ssh-agent\nbin/ssh-copy-id\nbin/ssh-keygen\nbin/ssh-keyscan\nbin/sshpass\nbin/stat\nbin/start-stop-daemon\nbin/stdbuf\nbin/strace\nbin/strings\nbin/su\nbin/sudo\nbin/sudo-rs\nbin/sudo_\nbin/sudoedit\nbin/sudoreplay\nbin/svn\nbin/svnadmin\nbin/svnauthz\nbin/svnbench\nbin/svndumpfilter\nbin/svnfsfs\nbin/svnlook\nbin/svnmucc\nbin/svnrdump\nbin/svnserve\nbin/svnsync\nbin/svnversion\nbin/sysctl\nbin/systemctl\nbin/systemd-resolve\nbin/tac\nbin/tail\nbin/tailf\nbin/tar\nbin/task\nbin/taskset\nbin/tbl\nbin/tclsh\nbin/tcpdump\nbin/tcping\nbin/tcptraceroute\nbin/tcsh\nbin/tee\nbin/telnet\nbin/tex\nbin/tftp\nbin/tic\nbin/time\nbin/timedatectl\nbin/timeout\nbin/tmux\nbin/togglesebool\nbin/top\nbin/touch\nbin/traceroute\nbin/traceroute6\nbin/trap\nbin/troff\nbin/tshark\nbin/uconv\nbin/ul\nbin/ulimit\nbin/uname\nbin/uncompress\nbin/unexpand\nbin/uniq\nbin/unlink\nbin/unlz4\nbin/unlzma\nbin/unpigz\nbin/unrar\nbin/unset\nbin/unshare\nbin/unxz\nbin/unzip\nbin/unzstd\nbin/up2date\nbin/update-alternatives\nbin/useradd\nbin/userdel\nbin/usermod\nbin/uudecode\nbin/uuencode\nbin/valgrind\nbin/vi\nbin/view\nbin/vigr\nbin/vim\nbin/vimdiff\nbin/vipw\nbin/virsh\nbin/visudo\nbin/visudo-rs\nbin/volatility\nbin/w\nbin/w3m\nbin/wall\nbin/watch\nbin/wc\nbin/wget\nbin/whiptail\nbin/who\nbin/whoami\nbin/whois\nbin/wireshark\nbin/wish\nbin/xargs\nbin/xelatex\nbin/xetex\nbin/xmodmap\nbin/xmore\nbin/xpad\nbin/xterm\nbin/xxd\nbin/xz\nbin/xzcat\nbin/xzcmp\nbin/xzdec\nbin/xzdiff\nbin/xzegrep\nbin/xzfgrep\nbin/xzgrep\nbin/xzless\nbin/xzmore\nbin/yarn\nbin/yelp\nbin/yes\nbin/yum\nbin/zathura\nbin/zcat\nbin/zcmp\nbin/zdiff\nbin/zegrep\nbin/zfgrep\nbin/zgrep\nbin/zip\nbin/zipcloak\nbin/zipcmp\nbin/zipdetails\nbin/zipgrep\nbin/zipinfo\nbin/zipmerge\nbin/zipnote\nbin/zipsplit\nbin/ziptool\nbin/zless\nbin/zmore\nbin/zrun\nbin/zsh\nbin/zsoelim\nbin/zstd\nbin/zstdcat\nbin/zstdgrep\nbin/zstdless\nbin/zstdmt\nbin/zypper\ndev/fd\ndev/null\ndev/stderr\ndev/stdin\ndev/stdout\ndev/tcp\ndev/udp\ndev/zero\netc/alternatives/rmt\netc/group\netc/master.passwd\netc/passwd\netc/pwd.db\netc/rmt\netc/shadow\netc/shells\netc/spwd.db\nproc/self\nsbin/capsh\nsbin/logsave\nsbin/rmt\nsbin/rmt-dump\nsbin/rmt-tar\nsbin/service\nsbin/start-stop-daemon\n",
+    "owasp-crs/rules/web-shells-asp.data": "# This list contains patterns of various web shells, backdoors and similar\n# software written in ASP language. There is no way how to automatically update\n# this list, so it must be done by hand. Here is a recommended way how to add\n# new malicious software:\n# 1.) As patterns are matched against RESPONSE_BODY, you need to run a malicious\n#     software (ideally in an isolated environment) and catch the output.\n# 2.) In the output, search for static pattern unique enough to match only\n#     the software in question and to not do any FPs. The best pick is usually\n#     a part of HTML code with software name.\n# 3.) Include software name and URL (if available) in the comment above\n#     the pattern.\n#\n# Data comes from multiple places of which some doesn't work anymore. Few are\n# listed below:\n# - https://www.localroot.net/\n# - Google search (keywords like webshells, asp backdoor and similar)\n\n# Akmal archtte id ASPX shell\n<title>Webshell Akmal archtte id</title>\n# ASPYDrv shell\n<html><title>ASPYDrvsInfo</title>\n# RHTOOLS shell\n<html><head><title>RHTOOLS\n",
+    "owasp-crs/rules/web-shells-php.data": "# This list contains patterns of various web shells, backdoors and similar\n# software written in PHP language. There is no way how to automatically update\n# this list, so it must be done by hand. Here is a recommended way how to add\n# new malicious software:\n# 1.) As patterns are matched against RESPONSE_BODY, you need to run a malicious\n#     software (ideally in an isolated environment) and catch the output.\n# 2.) In the output, search for static pattern unique enough to match only\n#     the software in question and to not do any FPs. The best pick is usually\n#     a part of HTML code with software name.\n# 3.) Include software name and URL (if available) in the comment above\n#     the pattern.\n#\n# Data comes from multiple places of which some doesn't work anymore. Few are\n# listed below:\n# - https://github.com/JohnTroony/php-webshells/tree/master/Collection\n# - https://www.localroot.net/\n# - Google search (keywords like webshells, php backdoor and similar)\n\n# 1n73ction web shell\n<title>=[ 1n73ct10n privat shell ]=</title>\n# Ajax/PHP Command Shell web shell\n>Ajax/PHP Command Shell<\n# AK-74 Security Team Web-shell\n.:: :[ AK-74 Security Team Web-shell ]: ::.\n# ALFA-SHELL web shell (deprecated, https://github.com/solevisible)\n~ ALFA TEaM Shell -\n# Andela Yuwono Priv8 Shell web shell\n<title>--==[[ Andela Yuwono Priv8 Shell ]]==--</title>\n# Ani-Shell web shell (https://ani-shell.sourceforge.net/)\n<title>Ani-Shell | India</title>\n# AnonymousFox PHP web shell\n<input type='submit' value='file' /></form>AnonymousFox\n# Antichat Shell web shell\n- Antichat Shell</title>\n# AYT web shell\nAyyildiz Tim  | AYT\n# b374k web shell (https://github.com/b374k/b374k)\n<link rel='SHORTCUT ICON' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyJpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMy1jMDExIDY2LjE0NTY2MSwgMjAxMi8wMi8wNi0xNDo1NjoyNyAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNiAoV2luZG93cykiIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6MkRFNDY2MDQ4MDgyMTFFM0FDRDdBN0MzOTAxNzZFQUYiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6MkRFNDY2MDU4MDgyMTFFM0FDRDdBN0MzOTAxNzZFQUYiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDoyREU0NjYwMjgwODIxMUUzQUNEN0E3QzM5MDE3NkVBRiIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDoyREU0NjYwMzgwODIxMUUzQUNEN0E3QzM5MDE3NkVBRiIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/Pu6UWJYAAAKySURBVHjafFNdSJNhFH7e/fhDkrm2i03QphsxhYSgMIUgIeiiK6/SCAKTKNlFoEtBRfEvXYhM+0GQMtMUL7qSgqS0QCNKTDS6cJWGi6n577Zv3/e+b+934ZgxPfDBd3jP85xznnOOzufz4SCr7R7knKOg4eaVd9WPBgsZY/3NZcWJ0TGaaKeuZzgz2ueMgFF+p6WnL0OAjzMK+f8k+wg4xXxN91D5ns8ok8CRH5S2GogS8HBKk1xud+uBBIwpm5zyRvW/+sHAJuM8nsrMIElHi0/aHAmFl/OI2WRyOevrK/YwJFoD0ecFkfWthpDNRH1Cct4ZOzRaglX/DsY+TcNqTUd2phEjo1OiWg5KKUhJTbua6XTT7SKvSlLpGWB6DUjuWQeW/m4iJIWho8DvBT+2tgOwpZsxM/tm/sn9Trsar2OMq6rOV3X19wncJUNSEsnKSsWifx0BKYTgdhDxiENBfjZCuxJejX0W4frZiAZNZUVxVKYfmcyuKTI15ZxKw4IA74aCCIiMeqZDptWIuV8+hAkXOlFo9eaLNyrvOfdp4Gp/FjKlpMSbLMlY2dhCaCcEnUJgt5sF4QqkkIKsDAtGXn9QSThlMmFCg8gUmELpkXg99FoNwgEJ2jBBWpoBP/8sC7AMi/EY/EvLUBQJCpOMT921hDG5JkIglPd8/7EIFpShCQMnrAYsrW0gLERUwTNfv2FyaloddWmvu25NxTzvaG6MELRVXK/SgL8fHZ9AjsMCKUzFqBhSjQZAkrC6viqyy+ILdxU775bH3APVblW3j3POzuc4bGIHNPgyM4dAcFdtslT07OWcvhRVJIvVtg0/9nhJrGMqqWzpFb1eFYuiVfdbACcGOlvzYx0cOewaVStyuiY5U3JFVbahhx3eQ48plr3obDtHqSxTRZ6K9f5PgAEAm/hvADIkGOQAAAAASUVORK5CYII='>\n# BloodSecurity Hackers Shell web shell\n<title>BloodSecurity Hackers Shell</title>\n# Bypass Attack Shell web shell\n<font color='red' size='6px' face='Fredericka the Great'> Bypass Attack Shell </font>\n# c0derz shell web shell\ntitle='.::[c0derz shell]::.'>\n# C99Shell + N3tShell web shell\n<font face=Webdings size=6><b>!</b></font>\n# Con7ext Shell V.2 web shell\n<title>Con7ext Shell V.2</title>\n# Crystal shell web shell\n<font face=\"Wingdings 3\" size=\"5\">y</font><b>Crystal shell v.\n# Unknown (probably private) web shell\n<title>CUPLIS BYPASSS SHELL</title>\n# CWShell web shell\n~ CWShell ~</font></a>\n# dC3 Security Crew web shell\n&dir&pic=o.b height= width=>\n# Defacing Tool Pro web shell\n<b>[ Defacing Tool Pro v\n# Dive Shell web shell\n<title>Dive Shell - Emperor Hacking Team</title>\n# easy simple php web shell\n<script>document.getElementById(\"cmd\").focus();</script>\n# ex0 shell web shell\ncolor=DeepSkyBlue   size=6>    ## ex0 shell\n# FaTaLSheLL web shell\n<p align=\"center\" class=\"style4\">FaTaLSheLL v\n# G-Security Webshell\n<title>G-Security Webshell</title>\n# Gecko web shell\n<title>Gecko [\n# h4ntu shell web shell\n<title>h4ntu shell [powered by tsoi]</title>\n# IDBTEAM SHELLS file manager\n<H1><center>-=[+] IDBTEAM SHELLS\n# IndoXploit web shell\n<title>IndoXploit</title>\n# KA_uShell web shell\n<KAdot Universal Shell>     |\n## Laudanum PHP Web Shells (http://sourceforge.net/projects/laudanum)\n# Laudanum dns.php\n<title>Laudanum PHP DNS Access</title>\n# Laudanum file.php\n<title>Laudanum PHP File Browser</title>\n# Laudanum host.php\n<title>Laudanum PHP Hostname by IP Lookup</title>\n# Laudanum proxy.php\n<title>Laudanum PHP Proxy</title>\n# Laudanum shell.php\n<title>Laudanum PHP Shell Access</title>\n## Laudanum WordPress Plugin settings.php\n<h2>Laudanum Tools</h2>\n# Lifka Shell web shell\n>LIFKA SHELL</span></big></big></big></a>\n# Loader'z web shell\n<title>Loader'z WEB shell</title>\n# Locus7Shell web shell\nb>--[ x2300 Locus7Shell v.\n# Lolipop web shell\n<title>Lolipop.php - Edited By KingDefacer -\n# MARIJUANA web shell (https://0x5a455553.github.io/MARIJUANA/)\n<link rel=\"icon\" href=\"//0x5a455553.github.io/MARIJUANA/icon.png\" />\n# Matamu Mat web shell\n<title> Matamu Mat </title>\n# MyShell web shell\n<b>MyShell</b> &copy;2001 Digitart Producciones</a>\n# NCC Shell web shell\n<h1>.:NCC:. Shell v\n# PHPShell by Macker web shell\n<font size=3>PHPShell by Macker - Version\n# PHPShell by MAX666 web shell\nPHPShell by MAX666, Private Exploit, For Server Hacking\n# qsd web shell\n<form action=\"\" METHOD=\"GET\" >Execute Shell Command (safe mode is off): <input type=\"text\" name=\"c\"><input type=\"submit\" value=\"Go\"></form>\n# Rootshell web shell\n<p align=\"center\"><font face=\"Verdana\" size=\"2\">Rootshell v\n# rusuh web shell\n<font color=lime>./rusuh</font>\n# Safe0ver web shell\n<font color=\"navy\"><strong>##Safe0ver##</strong></font>\n# Shany's web shell\n<center><h1>Watch Your system Shany was here.</h1></center><center><h1>Linux Shells</h1></center><hr><hr>\n# Simple PHP backdoor web shell\n<!-- Simple PHP backdoor by DK\n# SimShell web shell\n<title>SimShell - Simorgh Security MGZ</title>\n# Sincap web shell\n<title>:: AventGrup ::.. - Sincap\n# Small Shell file manager\n<title>Small Shell - Edited By KingDefacer</title>\n# Small Web Shell\n<title>small web shell by zaco\n# SoldiersofAllah Private Shell web shell\n<title>SoldiersofAllah Private Shell |\n# Sosyete web shell\n<title>Sosyete Safe Mode Bypass Shell -\n# STNC WebShell\n&nbsp;&nbsp;STNC&nbsp;WebShell&nbsp;\n# StresBypass shell web shell\n<font face=\"Wingdings 3\" size=\"5\">y</font><b>StresBypass<span lang=\"en-us\">v\n# SyRiAn Sh3ll web shell\n<title>SyRiAn Sh3ll ~\n# Tiny File Manager\n<title>Tiny File Manager</title>\n# Turk Shell web shell\n<head><title>Wardom | Ne Mutlu T\n<hr>to browse go to http://?d=[directory here]\n# Ustadcage48 Filemanager\n<font color=\"red\">USTADCAGE_48</font> <font color=\"dodgerblue\">FILE MANAGER</font>\n# WebRoot Hack Tools shell\n<title>WebRoot Hack Tools</title>\n# web shell by BLaSTER\n<div align=\"center\"><span class=\"style6\">By BLaSTER</span><br />\n# WinX Shell web shell\n<head><title>-:[GreenwooD]:- WinX Shell</title>\n# wwwolf web shell\n<sup><a href=\"#\" onclick=\"cmd.value=''; cmd.focus(); return false;\">Clear cmd</a></sup>\n# Yourman.sh Mini Shell web shell\n<title>Yourman.sh Mini Shell</title>\n# Zerion Mini Shell web shell\n</div><center><br />Zerion Mini Shell <font color=\n# Zero Byte Mini Shell V2 web shell\n<title>0byt3m1n1-V2</title>\n# Zerostore web shell\n<title>ZEROSHELL | ZEROSTORE</title>\n# MumaSec Web Shell\n<title>中国木马资源网-WwW.MumaSec.TK</title>\n# Langouster web shell\n<font color=\"#886688\" size=\"3\">&copy;Langouster</font>\n# TryYaG Web Shell\n<title>TrYaG Team - TrYaG.php\n# Sunucu Bilgileri Web Shell\n<p align=\"center\">Sunucu Bilgileri: <select size=\"1\" name=\"file\">\n# SimAttacker Web Shell\n<title>SimAttacker -\n# s72 Web Shell\n<title>s72 Shell\n# Ru24Post Web Shell\n<title>Ru24PostWebShell -\n# r57 Web Shell\n<title>:: The r57 shell\n# MOHAJER22 Web Shell\n<title>MOHAJER22</title>\n# IIS Spy Web Shell\n<title>IIS SPY</title>\n# g00nshell Web Shell\n<title>g00nshell\n# News Remote Web Shell\n<title>|| .::News Remote PHP Shell Injection::. ||   </title>\n# ex0shell Web Shell\n<title>ex0shell Shell\n# ErNe Safe Mode Bypass Web Shell\n<tr><td><center><font size=\"4\" color=\"#FFFFFF\"><span style=\"background-color: #000000\">ErNe Safe Mode Bypass\n# lama's'hell Web Shell\n<title>lama's'hell\n ~ Shell I</title>\n# Unknown Web Shells\n<input type=submit name=find value='find writeable'>\n<div align=\"center\">code Author:<span class=\"STYLE1\"><font color='red'> 仗剑孤行　QQ:87074139</font></span></div>\n<b><font color=#83000>Âûïîëíåíèå PHP-êîäà<br> Îòêðûòèå è çàêðûòèå PHP êîäà ( &lt;? è ?> ) ïèñàòü íå íóæíî!</font></b>\n<title>中国木马资源网- WwW.7jyewu.Cn </title>\n<select onchange=\"go('Shell','method='+this.value,this)\">\n<SCRIPT SRC=http://7jyewu.cn/a/a.asp></SCRIPT>\nÈìÿ ñêðèïòà: <input type=text size=13 name=bfileneme value=\"bind.pl\"> Ïîðò: <input type=text size=10 name=bport value=\"65426\">\n<td><a href=\"#\" onclick=\"document.reqs.action.value='shell'; document.reqs.submit();\">| Shell </a></td>\n<title>Backdoor PHP codée par rAidEn & LFL</title>\n",
+    "owasp-crs/rules/windows-powershell-commands.data": "# Sources:\n# Microsoft PowerShell Docs: https://github.com/MicrosoftDocs/PowerShell-Docs\n# - curl -H \"Accept: application/vnd.github.v3+json\" https://api.github.com/repos/MicrosoftDocs/PowerShell-Docs/git/trees/main\\?recursive\\=1 | jq -r '.tree[] .path | capture(\"reference/\\\\d.\\\\d/(.*)/(?<fn>[A-Z]\\\\w+-\\\\w+).md\") | .fn' | sort | uniq\n\npowershell\nAdd-Computer\nAdd-Content\nAdd-History\nAdd-JobTrigger\nAdd-LocalGroupMember\nAdd-Member\nAdd-PSSnapin\nAdd-Type\nCheckpoint-Computer\nClear-Content\nClear-EventLog\nClear-History\nClear-Host\nClear-Item\nClear-ItemProperty\nClear-RecycleBin\nClear-Variable\nCompare-Object\nComplete-Transaction\nCompress-Archive\nConnect-PSSession\nConnect-WSMan\nConvert-Path\nConvert-String\nConvertFrom-Csv\nConvertFrom-Json\nConvertFrom-Markdown\nConvertFrom-SddlString\nConvertFrom-SecureString\nConvertFrom-String\nConvertFrom-StringData\nConvertTo-Csv\nConvertTo-Html\nConvertTo-Json\nConvertTo-SecureString\nConvertTo-Xml\nCopy-Item\nCopy-ItemProperty\nDebug-Job\nDebug-Process\nDebug-Runspace\nDisable-ComputerRestore\nDisable-ExperimentalFeature\nDisable-JobTrigger\nDisable-LocalUser\nDisable-PSBreakpoint\nDisable-PSRemoting\nDisable-PSSessionConfiguration\nDisable-PSTrace\nDisable-PSWSManCombinedTrace\nDisable-RunspaceDebug\nDisable-ScheduledJob\nDisable-WSManCredSSP\nDisable-WSManTrace\nDisconnect-PSSession\nDisconnect-WSMan\nEnable-ComputerRestore\nEnable-ExperimentalFeature\nEnable-JobTrigger\nEnable-LocalUser\nEnable-PSBreakpoint\nEnable-PSRemoting\nEnable-PSSessionConfiguration\nEnable-PSTrace\nEnable-PSWSManCombinedTrace\nEnable-RunspaceDebug\nEnable-ScheduledJob\nEnable-WSManCredSSP\nEnable-WSManTrace\nEnter-PSHostProcess\nEnter-PSSession\nExit-PSHostProcess\nExit-PSSession\nExpand-Archive\nExport-Alias\nExport-BinaryMiLog\nExport-Clixml\nExport-Console\nExport-Counter\nExport-Csv\nExport-FormatData\nExport-ModuleMember\nExport-ODataEndpointProxy\nExport-PSSession\nFind-Command\nFind-DscResource\nFind-Module\nFind-Package\nFind-PackageProvider\nFind-RoleCapability\nFind-Script\nForEach-Object\nFormat-Custom\nFormat-Hex\nFormat-List\nFormat-Table\nFormat-Wide\nGet-Acl\nGet-Alias\nGet-AuthenticodeSignature\nGet-ChildItem\nGet-CimAssociatedInstance\nGet-CimClass\nGet-CimInstance\nGet-CimSession\nGet-Clipboard\nGet-CmsMessage\nGet-Command\nGet-ComputerInfo\nGet-ComputerRestorePoint\nGet-Content\nGet-ControlPanelItem\nGet-Counter\nGet-Credential\nGet-Culture\nGet-Date\nGet-Error\nGet-Event\nGet-EventLog\nGet-EventSubscriber\nGet-ExecutionPolicy\nGet-ExperimentalFeature\nGet-FileHash\nGet-FormatData\nGet-Help\nGet-History\nGet-Host\nGet-HotFix\nGet-InstalledModule\nGet-InstalledScript\nGet-IseSnippet\nGet-Item\nGet-ItemProperty\nGet-ItemPropertyValue\nGet-Job\nGet-JobTrigger\nGet-LocalGroup\nGet-LocalGroupMember\nGet-LocalUser\nGet-Location\nGet-LogProperties\nGet-MarkdownOption\nGet-Member\nGet-Module\nGet-OperationValidation\nGet-PSBreakpoint\nGet-PSCallStack\nGet-PSDrive\nGet-PSHostProcessInfo\nGet-PSProvider\nGet-PSReadLineKeyHandler\nGet-PSReadLineOption\nGet-PSRepository\nGet-PSSession\nGet-PSSessionCapability\nGet-PSSessionConfiguration\nGet-PSSnapin\nGet-PSSubsystem\nGet-Package\nGet-PackageProvider\nGet-PackageSource\nGet-PfxCertificate\nGet-Process\nGet-Random\nGet-Runspace\nGet-RunspaceDebug\nGet-ScheduledJob\nGet-ScheduledJobOption\nGet-Service\nGet-TimeZone\nGet-TraceSource\nGet-Transaction\nGet-TypeData\nGet-UICulture\nGet-Unique\nGet-Uptime\nGet-Variable\nGet-Verb\nGet-WSManCredSSP\nGet-WSManInstance\nGet-WinEvent\nGet-WmiObject\nGroup-Object\nImport-Alias\nImport-BinaryMiLog\nImport-Clixml\nImport-Counter\nImport-Csv\nImport-IseSnippet\nImport-LocalizedData\nImport-Module\nImport-PSSession\nImport-PackageProvider\nImport-PowerShellDataFile\nInstall-Module\nInstall-Package\nInstall-PackageProvider\nInstall-Script\nInvoke-AsWorkflow\nInvoke-CimMethod\nInvoke-Command\nInvoke-Expression\nInvoke-History\nInvoke-Item\nInvoke-OperationValidation\nInvoke-RestMethod\nInvoke-WSManAction\nInvoke-WebRequest\nInvoke-WmiMethod\nJoin-Path\nJoin-String\nLimit-EventLog\nMeasure-Command\nMeasure-Object\nMove-Item\nMove-ItemProperty\nNew-Alias\nNew-CimInstance\nNew-CimSession\nNew-CimSessionOption\nNew-Event\nNew-EventLog\nNew-FileCatalog\nNew-Guid\nNew-IseSnippet\nNew-Item\nNew-ItemProperty\nNew-JobTrigger\nNew-LocalGroup\nNew-LocalUser\nNew-Module\nNew-ModuleManifest\nNew-Object\nNew-PSDrive\nNew-PSRoleCapabilityFile\nNew-PSSession\nNew-PSSessionConfigurationFile\nNew-PSSessionOption\nNew-PSTransportOption\nNew-PSWorkflowExecutionOption\nNew-PSWorkflowSession\nNew-ScheduledJobOption\nNew-ScriptFileInfo\nNew-Service\nNew-TemporaryFile\nNew-TimeSpan\nNew-Variable\nNew-WSManInstance\nNew-WSManSessionOption\nNew-WebServiceProxy\nNew-WinEvent\nOut-Default\nOut-File\nOut-GridView\nOut-Host\nOut-Null\nOut-Printer\nOut-String\nPop-Location\nProtect-CmsMessage\nPublish-Module\nPublish-Script\nPush-Location\nRead-Host\nReceive-Job\nReceive-PSSession\nRegister-ArgumentCompleter\nRegister-CimIndicationEvent\nRegister-EngineEvent\nRegister-ObjectEvent\nRegister-PSRepository\nRegister-PSSessionConfiguration\nRegister-PackageSource\nRegister-ScheduledJob\nRegister-WmiEvent\nRemove-Alias\nRemove-CimInstance\nRemove-CimSession\nRemove-Computer\nRemove-Event\nRemove-EventLog\nRemove-Item\nRemove-ItemProperty\nRemove-Job\nRemove-JobTrigger\nRemove-LocalGroup\nRemove-LocalGroupMember\nRemove-LocalUser\nRemove-Module\nRemove-PSBreakpoint\nRemove-PSDrive\nRemove-PSReadLineKeyHandler\nRemove-PSSession\nRemove-PSSnapin\nRemove-Service\nRemove-TypeData\nRemove-Variable\nRemove-WSManInstance\nRemove-WmiObject\nRename-Computer\nRename-Item\nRename-ItemProperty\nRename-LocalGroup\nRename-LocalUser\nReset-ComputerMachinePassword\nResolve-Path\nRestart-Computer\nRestart-Service\nRestore-Computer\nResume-Job\nResume-Service\nSave-Help\nSave-Module\nSave-Package\nSave-Script\nSelect-Object\nSelect-String\nSelect-Xml\nSend-MailMessage\nSet-Acl\nSet-Alias\nSet-AuthenticodeSignature\nSet-CimInstance\nSet-Clipboard\nSet-Content\nSet-Date\nSet-ExecutionPolicy\nSet-Item\nSet-ItemProperty\nSet-JobTrigger\nSet-LocalGroup\nSet-LocalUser\nSet-Location\nSet-LogProperties\nSet-MarkdownOption\nSet-PSBreakpoint\nSet-PSDebug\nSet-PSReadLineKeyHandler\nSet-PSReadLineOption\nSet-PSRepository\nSet-PSSessionConfiguration\nSet-PackageSource\nSet-ScheduledJob\nSet-ScheduledJobOption\nSet-Service\nSet-StrictMode\nSet-TimeZone\nSet-TraceSource\nSet-Variable\nSet-WSManInstance\nSet-WSManQuickConfig\nSet-WmiInstance\nShow-Command\nShow-ControlPanelItem\nShow-EventLog\nShow-Markdown\nSort-Object\nSplit-Path\nStart-Job\nStart-Process\nStart-Service\nStart-Sleep\nStart-ThreadJob\nStart-Trace\nStart-Transaction\nStart-Transcript\nStop-Computer\nStop-Job\nStop-Process\nStop-Service\nStop-Trace\nStop-Transcript\nSuspend-Job\nSuspend-Service\nSwitch-Process\nTee-Object\nTest-ComputerSecureChannel\nTest-Connection\nTest-FileCatalog\nTest-Json\nTest-ModuleManifest\nTest-PSSessionConfigurationFile\nTest-Path\nTest-ScriptFileInfo\nTest-WSMan\nTrace-Command\nUnblock-File\nUndo-Transaction\nUninstall-Module\nUninstall-Package\nUninstall-Script\nUnprotect-CmsMessage\nUnregister-Event\nUnregister-PSRepository\nUnregister-PSSessionConfiguration\nUnregister-PackageSource\nUnregister-ScheduledJob\nUpdate-FormatData\nUpdate-Help\nUpdate-List\nUpdate-Module\nUpdate-ModuleManifest\nUpdate-Script\nUpdate-ScriptFileInfo\nUpdate-TypeData\nUse-Transaction\nWait-Debugger\nWait-Event\nWait-Job\nWait-Process\nWhere-Object\nWrite-Debug\nWrite-Error\nWrite-EventLog\nWrite-Host\nWrite-Information\nWrite-Output\nWrite-Progress\nWrite-Verbose\nWrite-Warning\n"
+  },
+  "upstreams": [
+    {
+      "id": "owasp-crs",
+      "repository": "coreruleset/coreruleset",
+      "ref": "v4.30.0",
+      "commit": "e03a4f6dabc7a30ebd8c52c97d28a154f590a48f",
+      "files": [
+        {
+          "path": "owasp-crs/LICENSE",
+          "bytes": 11347,
+          "sha256": "676a192d3fc5205a288934ee02c5f934b782b91604a4b93589ba64520a4fec13",
+          "gitBlob": "c11c6604839cffe1d352535f6d35926d0bfbaaa0"
+        },
+        {
+          "path": "owasp-crs/setup.conf",
+          "bytes": 40319,
+          "sha256": "3818cf2a114fc9ac96c184828b8cad20dae78f471edc8cf5b2269a3bc6ee5160",
+          "gitBlob": "e220573947692fac1e448f963e8655fbe09cc2ae"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-901-INITIALIZATION.conf",
+          "bytes": 18607,
+          "sha256": "0a7dfccf87cc2f8ea2afbb3c8ed3e59d69f5cc27d8a934b6b958cb564d28805c",
+          "gitBlob": "f876160d6e310d44d0a7188e34507f15a594d572"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf",
+          "bytes": 1640,
+          "sha256": "8c3e62f2e79d0bb3413e51a61b26d3eccc87cba23d95963b2b1514e5155c27e7",
+          "gitBlob": "f0b664ea46592caf14e8a4b6cc960256834f13c2"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf",
+          "bytes": 2972,
+          "sha256": "1d9a08d955e205e64ebf6313cf4a8f4711956cd19762aac680bf3169612e93a0",
+          "gitBlob": "a30b89b2152a3d0fc569ba3b201b1d9fe5c1433b"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-913-SCANNER-DETECTION.conf",
+          "bytes": 3609,
+          "sha256": "82a6823265f8e191fa4b3f40369a87df3ffd613fd495fbfe8212487844826eb4",
+          "gitBlob": "a0fcc05c1118b7061cf35691edcb71b4a7b1b95a"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf",
+          "bytes": 69018,
+          "sha256": "4550747b301abbfa7a072644c0db04041e971760e678943c29b7a4daa31a403b",
+          "gitBlob": "c2611a1e882fe95a34266bc153569f8bb971c744"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf",
+          "bytes": 24003,
+          "sha256": "d07f08d8af15477ef04f7ff9ebdbffeee081afe78d5c9f174a23a1f38adcae67",
+          "gitBlob": "fef75bdfdb6fab7a62fa581e8a156135ff732e75"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-922-MULTIPART-ATTACK.conf",
+          "bytes": 7616,
+          "sha256": "11497df11f882b14ab16d84a5b9ee6e8df80201bb427ebf9934c53781bacbc8b",
+          "gitBlob": "0299404e5ef9701339db551e8ce59684febb8788"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf",
+          "bytes": 9494,
+          "sha256": "9588c356452d15c75e78ace7faefcb9809ed2b9684ecf33069c6ab44f4c2771f",
+          "gitBlob": "2042f57ebfb86032fc0af8aa5352ad8f044740b0"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf",
+          "bytes": 9696,
+          "sha256": "f0702896585fff0a3d82984d4fcc014136565421170d6a22b766c33324622eb2",
+          "gitBlob": "f9aca2e134925ebfe919395741a9012add0df312"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf",
+          "bytes": 212341,
+          "sha256": "5dc9375267ed955cabe3e5539c80472bdcc82f8603add70806f7919230cb58b3",
+          "gitBlob": "79bac1d851c374c4d80ab55a332ab512b7c4b972"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf",
+          "bytes": 71027,
+          "sha256": "a6b85c6e0424ba1abd8f555487ab10ec2b66b3dd11461dabcf4c3a5f56bd56b7",
+          "gitBlob": "7e030b09dc888d55defa7a64d9aed72cde442787"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf",
+          "bytes": 27170,
+          "sha256": "5d1229f3eae59f6c44436c7377c37f6b158f22380c59fbd52987065349e8dcc1",
+          "gitBlob": "c1857870d4537dad399692b20d1cd124969be34d"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf",
+          "bytes": 55720,
+          "sha256": "2a33fa32daca6b1d2bf354fbe54dcb5355d84fe3362c8b13ca412cf422caaf50",
+          "gitBlob": "eebad123f02b71900b44a4ad0d208cfac7ff36c2"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf",
+          "bytes": 98961,
+          "sha256": "8dadc742af2bb6b7e5b48570cb0201930cd9cfe9e3de94776e736605ea7be228",
+          "gitBlob": "4aa2216d42aee90d204844d4c112b20fe92d6b05"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf",
+          "bytes": 6811,
+          "sha256": "ede2218f226d3b32e1dc4056f72ed771a857a6bad71dbcf3dd457e83d57d6fa5",
+          "gitBlob": "f6e23f5f35d21ea66b208eed5d6814d165f0e572"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
+          "bytes": 23650,
+          "sha256": "3cdeb69d368e425d7066b1694e70969c3b53c3947d562622ca919331fdca8b09",
+          "gitBlob": "fb43a8b6cfc6ba3589ded4756cfd10306476f23f"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf",
+          "bytes": 8089,
+          "sha256": "3ee1a0ca0e88d851a6015cb5f125df78a5a4055540a4427452f53733e2f34f60",
+          "gitBlob": "70f004a8ffb6f200f97b7255313ca941ba4f0a68"
+        },
+        {
+          "path": "owasp-crs/rules/REQUEST-999-COMMON-EXCEPTIONS-AFTER.conf",
+          "bytes": 4813,
+          "sha256": "da61f6f1d5be9b66c2436efc5cd5368ff618954d26cae37204128be21001f99c",
+          "gitBlob": "d78c769e0efd201f1246612e9ec7f7fe281407d5"
+        },
+        {
+          "path": "owasp-crs/rules/RESPONSE-950-DATA-LEAKAGES.conf",
+          "bytes": 6619,
+          "sha256": "c8fd989ad7b5d6ee1db1277f53c8ea3dc0d5428c4d5f554b9071e00c7bdebff8",
+          "gitBlob": "1f8dd712bb1a7cb72e4773f1a98aee5ab7a47e42"
+        },
+        {
+          "path": "owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf",
+          "bytes": 19059,
+          "sha256": "23602734f3f6e87b4638d1dff11d2c96e58ae50b8d2cbb67883dfed8f76d0040",
+          "gitBlob": "bcd5b239cd055cfd2ac1f3a850ce7acc77c07249"
+        },
+        {
+          "path": "owasp-crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf",
+          "bytes": 3400,
+          "sha256": "e86183764723e48dd083dec54044676621451e9a8a08d538171b342f4865d73f",
+          "gitBlob": "3c3c097a1e00a8f795a7b7c211137523a3070363"
+        },
+        {
+          "path": "owasp-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf",
+          "bytes": 6118,
+          "sha256": "bc902951c5d0ba6b458acb6712d2028852340a63692a71d33143afb01583cb45",
+          "gitBlob": "6828b5f5e745ae411c3454f7b307e962f58e7334"
+        },
+        {
+          "path": "owasp-crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf",
+          "bytes": 6117,
+          "sha256": "3a9604c560048e690b2793939d8304ff98e12073cd7a531bf7765bf899c8b714",
+          "gitBlob": "8e95902b45d5578df19427fb7c9cce699bf082fc"
+        },
+        {
+          "path": "owasp-crs/rules/RESPONSE-955-WEB-SHELLS.conf",
+          "bytes": 19297,
+          "sha256": "75c9b00fd730a6f9996e8c68dae70a8412b019bd1be641b3dc45b0adbf53e30e",
+          "gitBlob": "34877dee5ab63539b90a246f6725f210183a2f2e"
+        },
+        {
+          "path": "owasp-crs/rules/RESPONSE-956-DATA-LEAKAGES-RUBY.conf",
+          "bytes": 3790,
+          "sha256": "55be285f03eaac97332d4148e6bc5a64e2db0aba0caac902ac68218a2c607fe6",
+          "gitBlob": "063949d59d109f6e3a6580310ace92c193fb3bd0"
+        },
+        {
+          "path": "owasp-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf",
+          "bytes": 8815,
+          "sha256": "f2f2ebc2b8e63823c9627bd8abe5f1e3debabdff7f775856bdf8cd575e5dfae7",
+          "gitBlob": "6406650ed1dadf9ad3f8b21e236b71f07caadae4"
+        },
+        {
+          "path": "owasp-crs/rules/RESPONSE-980-CORRELATION.conf",
+          "bytes": 7598,
+          "sha256": "8a57cc168c99d0c5bca27edcc26b889582a50323117cd6a4b409e5afcd4b1fc8",
+          "gitBlob": "948d1cda1ab0917a793011d1be49f9e49bbe5302"
+        },
+        {
+          "path": "owasp-crs/rules/ai-critical-artifacts.data",
+          "bytes": 1802,
+          "sha256": "9352bbfff2c5dd86311dfbefaf76a71597402a2eba9cad33bc736b3d2560311a",
+          "gitBlob": "70707d9e4d5b7ec464d45d9233597194a86e4dca"
+        },
+        {
+          "path": "owasp-crs/rules/asp-dotnet-errors.data",
+          "bytes": 3755,
+          "sha256": "a3bb53002692e86fdb06e7045b64bc8f7c74972f824106f566ec48bd528884aa",
+          "gitBlob": "e6cd69b0a3bafb04a3be47fd52197c01b5a5242d"
+        },
+        {
+          "path": "owasp-crs/rules/iis-errors.data",
+          "bytes": 4441,
+          "sha256": "3eac5008e5dee373d0b876e92405af04cc4ce0f73625e7510499f708b516aa40",
+          "gitBlob": "0209d560c01b926c9edb17eb58d39494e1c393aa"
+        },
+        {
+          "path": "owasp-crs/rules/java-classes.data",
+          "bytes": 2157,
+          "sha256": "e939e4af2b219a695f84d905cae484698718beabc0efdbe4236ae1d8dc9e2ca3",
+          "gitBlob": "ada964faf8e9263f053d71a308f44e3412828060"
+        },
+        {
+          "path": "owasp-crs/rules/lfi-os-files.data",
+          "bytes": 18677,
+          "sha256": "2404760c4e8c49701d5a69498ea4bb623c313538787daa43a56f5e3b905aeee4",
+          "gitBlob": "a329e49db10b2f41a56319a32e25a3a6e2fea9e5"
+        },
+        {
+          "path": "owasp-crs/rules/php-errors.data",
+          "bytes": 75748,
+          "sha256": "2c614f73c190bafa8cd4580fa54ac61f198ed295e23c390e318841888bf93dac",
+          "gitBlob": "df584847ad6846484c9703d7db92b55fbcb64056"
+        },
+        {
+          "path": "owasp-crs/rules/php-function-names-933150.data",
+          "bytes": 3342,
+          "sha256": "0331ce6dbb5d72dff674ab713248ea392020c8cfaeaf868e4c284fdbb273fc8e",
+          "gitBlob": "39e2f1a06754a6fc7dd6fdd2e6b73819ac4b20cb"
+        },
+        {
+          "path": "owasp-crs/rules/php-variables.data",
+          "bytes": 610,
+          "sha256": "07ffd3c28d5d79e18e3844352fc3dd122af7e0037dbfebe6ed4dad403e9a95de",
+          "gitBlob": "f5b55ff60e7fe8cdd9f210cfe3c23e75ca5e91b2"
+        },
+        {
+          "path": "owasp-crs/rules/restricted-files.data",
+          "bytes": 11366,
+          "sha256": "17b0ab9a5be2901a520e6f5821ba17b41372fae5224e314eccc0ba3b483c59e7",
+          "gitBlob": "700371c32f25ed7f5644fd4eeeb75aac1290307f"
+        },
+        {
+          "path": "owasp-crs/rules/ruby-errors.data",
+          "bytes": 2803,
+          "sha256": "a72c25e9cf0b51a0984efb5826b7ecf753de50fda36980bb676492451f56d728",
+          "gitBlob": "958c91e2f53d08c3bf947908b0ae85ca9d4c71d0"
+        },
+        {
+          "path": "owasp-crs/rules/scanners-user-agents.data",
+          "bytes": 4063,
+          "sha256": "1a4ac901d8fb2f388db068b9c5dc07d3de4b41b832f5b1dfce5b89933ae968ce",
+          "gitBlob": "8ae222df5db5d56b0404944592d9cd49906cd4db"
+        },
+        {
+          "path": "owasp-crs/rules/sql-errors.data",
+          "bytes": 4363,
+          "sha256": "ba9f3f7070f4c2c6c2d6165da06566f18aee19756c510ccde99aeff57fd5ca1a",
+          "gitBlob": "8b7e9b5ac8336387915bb34869dcc2a197d6956c"
+        },
+        {
+          "path": "owasp-crs/rules/ssrf-no-scheme.data",
+          "bytes": 1085,
+          "sha256": "753805c3b3284a28c2d834c9ce32aab8f3d24257e66c2d64b3308bd8f4aacbd4",
+          "gitBlob": "d1bb9e2da8934cb9ef2cdf53ef4b5925cdbbb23c"
+        },
+        {
+          "path": "owasp-crs/rules/ssrf.data",
+          "bytes": 5428,
+          "sha256": "6305d2a07d3b7997112358a38986fe30c55faa11f9002c3479a687a718bfc66a",
+          "gitBlob": "d37b96997213548d3b4fe9eac655889167db1127"
+        },
+        {
+          "path": "owasp-crs/rules/unix-shell-aliases.data",
+          "bytes": 192,
+          "sha256": "7860d692ba74be8465972e1c348d06b9ba41f61243406cfc7fed82db6fc26bee",
+          "gitBlob": "50e3eef120f0487f3d4d8d1cff346dc3436ddffb"
+        },
+        {
+          "path": "owasp-crs/rules/unix-shell-builtins.data",
+          "bytes": 138,
+          "sha256": "7c7b600b457b06940a440095cf594f0e28de1891020de9840fc9ea7cf1e00e57",
+          "gitBlob": "2246d8f19d699a59b3adc0be466f487692f5439c"
+        },
+        {
+          "path": "owasp-crs/rules/unix-shell.data",
+          "bytes": 9228,
+          "sha256": "de5b0f7b6569e63706cdb68e3a185a26d1f28b2ee12023f4790c1b49bfe35e69",
+          "gitBlob": "698258511ed411a1fc41a8775fc9fae9ec223f45"
+        },
+        {
+          "path": "owasp-crs/rules/web-shells-asp.data",
+          "bytes": 1067,
+          "sha256": "4ebbd5ab8fe4d10f18dd69b56e9e935eb861c1bf327893532221578feaa5c0cc",
+          "gitBlob": "28faa8906d5436a8dfe44d995aecae81868e80f9"
+        },
+        {
+          "path": "owasp-crs/rules/web-shells-php.data",
+          "bytes": 10082,
+          "sha256": "6a9f64c8000c567b9bf87f183895526ecd689937f672f7ee2e7e0fb99668cefc",
+          "gitBlob": "bd00d1d8ffcfd1684b514030ac24b7f07c996944"
+        },
+        {
+          "path": "owasp-crs/rules/windows-powershell-commands.data",
+          "bytes": 7222,
+          "sha256": "5055ffeb4ce22869dee0f611045991e64365e980bba68649f4468aea86476d93",
+          "gitBlob": "db33dae1cce302a9663612142785634c98bb30c7"
+        }
+      ]
+    }
+  ]
+}