OWASP ModSec CRS Paranoia Mode Sibling 958977 - Revision history

Zino: /* 958977 : PHP Injection Attack: Configuration Directive Found */

2016-03-10T09:33:59Z

‎958977 : PHP Injection Attack: Configuration Directive Found

Zino: /* 958977 : PHP Injection Attack: Configuration Directive Found */

2016-03-10T09:31:34Z

‎958977 : PHP Injection Attack: Configuration Directive Found

Dune73 at 07:18, 8 March 2016

2016-03-08T07:18:53Z

Zino: /* 958977 : PHP Injection Attack: Configuration Directive Found */

2016-02-24T12:25:41Z

‎958977 : PHP Injection Attack: Configuration Directive Found

Zino: Created page with "''This page contains a proposal for a stricter rule-clone for ModSecurity CRS Paranoia Mode.'' == 958977 : PHP Injection Attack: Configurat..."

2016-02-23T08:41:07Z

Created page with "''This page contains a proposal for a stricter rule-clone for ModSecurity CRS Paranoia Mode.'' == 958977 : PHP Injection Attack: Configurat..."

New page

''This page contains a proposal for a stricter rule-clone for [[OWASP_ModSec_CRS_Paranoia_Mode|ModSecurity CRS Paranoia Mode]].''

== 958977 : PHP Injection Attack: Configuration Directive Found ==

{|- class="wikitable"
| '''Original ID (2.2.x)'''
| '''Change'''
| '''Whitelisting'''
|-
| 958977
| Rule now triggers on it's own
| none
|}

#
# [ PHP Function Names ]
#
# This is a paranoid sibling to 2.2.x Rule 958977.
# The rule is no longer chained in order to trigger anomaly scoring.
# For chain-based scoring see 3.0.0 Rule 933110.
#
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf php-function-names.data" \
"msg:'PHP Injection Attack: Function Name Found',\
phase:request,\
rev:'2',\
ver:'OWASP_CRS/3.0.0',\
maturity:'1',\
accuracy:'8',\
capture,\
t:none,t:normalisePath,t:urldecode,\
ctl:auditLogParts=+E,\
block,\
id:'XXXXXX',\
tag:'application-multi',\
tag:'language-PHP',\
tag:'platform-multi',\
tag:'attack-PHP injection',\
tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\
tag:'OWASP_TOP_10/A1',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
severity:'CRITICAL',\
setvar:'tx.msg=%{rule.msg}',\
setvar:tx.php_injection_score=+%{tx.critical_anomaly_score},\
setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{matched_var_name}=%{tx.0}"

← Older revision		Revision as of 07:18, 8 March 2016
Line 43:		Line 43:
	setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\		setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
	setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{matched_var_name}=%{tx.0}"		setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{matched_var_name}=%{tx.0}"
		+
		+	[[Category:OWASP ModSecurity Core Rule Set Project]]

@@ Line 1: / Line 1: @@
 ''This page contains a proposal for a stricter rule-clone for [[OWASP_ModSec_CRS_Paranoia_Mode|ModSecurity CRS Paranoia Mode]].''
-== 958977 : PHP Injection Attack: Configuration Directive Found ==
+== 958977 : PHP Injection Attack: Function Name Found ==
 {|- class="wikitable"

@@ Line 4: / Line 4: @@
 {|- class="wikitable"
-  | '''Original ID (2.2.x)'''
+  | '''RuleID 2.2.x'''
   | '''Change'''
   | '''Whitelisting'''
 |-
   | 958977
   | Rule now triggers on it's own
   | none
@@ Line 18: / Line 22: @@
    # This is a paranoid sibling to 2.2.x Rule 958977.
    # The rule is no longer chained in order to trigger anomaly scoring.
-   # For chain-based scoring see 3.0.0 Rule 933110.
+   # For 3.0.0-rc1 rule, see 933110.
+   #
    SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf php-function-names.data" \

@@ Line 27: / Line 27: @@
          maturity:'1',\
          accuracy:'8',\
          t:none,t:normalisePath,t:urldecode,\
          ctl:auditLogParts=+E,\