1724 lines
73 KiB
Plaintext
1724 lines
73 KiB
Plaintext
# ------------------------------------------------------------------------
|
||
# OWASP ModSecurity Core Rule Set ver.3.2.0
|
||
# Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved.
|
||
#
|
||
# The OWASP ModSecurity Core Rule Set is distributed under
|
||
# Apache Software License (ASL) version 2
|
||
# Please see the enclosed LICENSE file for full details.
|
||
# ------------------------------------------------------------------------
|
||
|
||
#
|
||
# -= Paranoia Level 0 (empty) =- (apply unconditionally)
|
||
#
|
||
|
||
|
||
|
||
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:942011,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
|
||
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:942012,phase:2,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
|
||
#
|
||
# -= Paranoia Level 1 (default) =- (apply only when tx.executing_paranoia_level is sufficiently high: 1 or higher)
|
||
#
|
||
|
||
#
|
||
# References:
|
||
#
|
||
# SQL Injection Knowledgebase (via @LightOS) -
|
||
# http://websec.ca/kb/sql_injection
|
||
#
|
||
# SQLi Filter Evasion Cheat Sheet -
|
||
# http://websec.wordpress.com/2010/12/04/sqli-filter-evasion-cheat-sheet-mysql/
|
||
#
|
||
# SQL Injection Cheat Sheet -
|
||
# http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/
|
||
#
|
||
# SQLMap's Tamper Scripts (for evasions)
|
||
# https://svn.sqlmap.org/sqlmap/trunk/sqlmap/tamper/
|
||
#
|
||
|
||
#
|
||
# -=[ LibInjection Check ]=-
|
||
#
|
||
# There is a stricter sibling of this rule at 941101. It covers REQUEST_BASENAME.
|
||
#
|
||
# Ref: https://libinjection.client9.com/
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@detectSQLi" \
|
||
"id:942100,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,\
|
||
msg:'SQL Injection Attack Detected via libinjection',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
multiMatch,\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -=[ Detect DB Names ]=-
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942140.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942140.data
|
||
# Note that after assemble an outer bracket with an ignore case flag and a word boundary is added
|
||
# to the Regexp::Assemble output:
|
||
# Add ignore case flag and word boundary: "(?i:\bASSEMBLE_OUTPUT)"
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)|db)|aster\.\.sysdatabases|ysql\.db)|pg_(?:catalog|toast)|information_schema|northwind|tempdb)\b|s(?:(?:ys(?:\.database_name|aux)|qlite(?:_temp)?_master)\b|chema(?:_name\b|\W*\())|d(?:atabas|b_nam)e\W*\())" \
|
||
"id:942140,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQL Injection Attack: Common DB Names Detected',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ctl:auditLogParts=+E,\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -=[ PHPIDS - Converted SQLI Filters ]=-
|
||
#
|
||
# https://raw.github.com/PHPIDS/PHPIDS/master/lib/IDS/default_filter.xml
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:sleep\(\s*?\d*?\s*?\)|benchmark\(.*?\,.*?\))" \
|
||
"id:942160,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects blind sqli tests using sleep() or benchmark().',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942170.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942170.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:select|;)\s+(?:benchmark|sleep|if)\s*?\(\s*?\(?\s*?\w+)" \
|
||
"id:942170,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects SQL benchmark and sleep injection attempts including conditional queries',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942190.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942190.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:[\"'`](?:;?\s*?(?:having|select|union)\b\s*?[^\s]|\s*?!\s*?[\"'`\w])|(?:c(?:onnection_id|urrent_user)|database)\s*?\([^\)]*?|u(?:nion(?:[\w(\s]*?select| select @)|ser\s*?\([^\)]*?)|s(?:chema\s*?\([^\)]*?|elect.*?\w?user\()|into[\s+]+(?:dump|out)file\s*?[\"'`]|\s*?exec(?:ute)?.*?\Wxp_cmdshell|from\W+information_schema\W|exec(?:ute)?\s+master\.|\wiif\s*?\())" \
|
||
"id:942190,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects MSSQL code execution and information gathering attempts',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|3.0.00738585072007e-308|1e309)$" \
|
||
"id:942220,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Looking for integer overflow attacks, these are taken from skipfish, except 3.0.00738585072007e-308 is the \"magic number\" crash',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\s()]case\s*?\(|\)\s*?like\s*?\(|having\s*?[^\s]+\s*?[^\w\s]|if\s?\([\d\w]\s*?[=<>~])" \
|
||
"id:942230,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects conditional SQL injection attempts',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942240.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942240.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:[\"'`](?:;*?\s*?waitfor\s+(?:delay|time)\s+[\"'`]|;.*?:\s*?goto)|alter\s*?\w+.*?cha(?:racte)?r\s+set\s+\w+))" \
|
||
"id:942240,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects MySQL charset switch and MSSQL DoS attempts',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:merge.*?using\s*?\(|execute\s*?immediate\s*?[\"'`]|match\s*?[\w(),+-]+\s*?against\s*?\()" \
|
||
"id:942250,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)union.*?select.*?from" \
|
||
"id:942270,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Looking for basic sql injection. Common attack string for mysql, oracle and others.',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942280.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942280.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:;\s*?shutdown\s*?(?:[#;]|\/\*|--|\{)|waitfor\s*?delay\s?[\"'`]+\s?\d|select\s*?pg_sleep))" \
|
||
"id:942280,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:\[\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|x?or|div|like|between|and)\]))" \
|
||
"id:942290,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Finds basic MongoDB SQL injection attempts',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942320.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942320.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:create\s+(?:procedure|function)\s*?\w+\s*?\(\s*?\)\s*?-|;\s*?(?:declare|open)\s+[\w-]+|procedure\s+analyse\s*?\(|declare[^\w]+[@#]\s*?\w+|exec\s*?\(\s*?\@))" \
|
||
"id:942320,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects MySQL and PostgreSQL stored procedure/function injections',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942350.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942350.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:;\s*?(?:(?:(?:trunc|cre|upd)at|renam)e|(?:inser|selec)t|de(?:lete|sc)|alter|load)\s*?[\[(]?\w{2,}|create\s+function\s+.+\s+returns))" \
|
||
"id:942350,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects MySQL UDF injection and other data/structure manipulation attempts',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
# This rule has a stricter sibling: 942361.
|
||
# The keywords 'alter' and 'union' led to false positives.
|
||
# Therefore they have been moved to PL2 and the keywords have been extended on PL1.
|
||
#
|
||
# Sources for SQL ALTER statements:
|
||
# MySQL: https://dev.mysql.com/doc/refman/5.7/en/sql-syntax-data-definition.html
|
||
# Oracle/PLSQL: https://docs.oracle.com/apps/search/search.jsp?q=alter&size=60&category=database
|
||
# PostgreQSL: https://www.postgresql.org/search/?u=%2Fdocs&q=alter
|
||
# MSSQL: https://docs.microsoft.com/en-us/sql/t-sql/statements/statements
|
||
# DB2: https://www.ibm.com/support/knowledgecenter/en/search/alter?scope=SSEPGG_9.5.0
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942360.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942360.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:^[\W\d]+\s*?(?:alter\s*(?:a(?:(?:pplication\s*rol|ggregat)e|s(?:ymmetric\s*ke|sembl)y|u(?:thorization|dit)|vailability\s*group)|c(?:r(?:yptographic\s*provider|edential)|o(?:l(?:latio|um)|nversio)n|ertificate|luster)|s(?:e(?:rv(?:ice|er)|curity|quence|ssion|arch)|y(?:mmetric\s*key|nonym)|togroup|chema)|m(?:a(?:s(?:ter\s*key|k)|terialized)|e(?:ssage\s*type|thod)|odule)|l(?:o(?:g(?:file\s*group|in)|ckdown)|a(?:ngua|r)ge|ibrary)|t(?:(?:abl(?:espac)?|yp)e|r(?:igger|usted)|hreshold|ext)|p(?:a(?:rtition|ckage)|ro(?:cedur|fil)e|ermission)|d(?:i(?:mension|skgroup)|atabase|efault|omain)|r(?:o(?:l(?:lback|e)|ute)|e(?:sourc|mot)e)|f(?:u(?:lltext|nction)|lashback|oreign)|e(?:xte(?:nsion|rnal)|(?:ndpoi|ve)nt)|in(?:dex(?:type)?|memory|stance)|b(?:roker\s*priority|ufferpool)|x(?:ml\s*schema|srobject)|w(?:ork(?:load)?|rapper)|hi(?:erarchy|stogram)|o(?:perator|utline)|(?:nicknam|queu)e|us(?:age|er)|group|java|view)|u(?:nion\s*(?:(?:distin|sele)ct|all)|pdate)|(?:(?:trunc|cre)at|renam)e|(?:inser|selec)t|de(?:lete|sc)|load)\b|(?:(?:(?:trunc|cre|upd)at|renam)e|(?:inser|selec)t|de(?:lete|sc)|alter|load)\s+(?:group_concat|load_file|char)\s?\(?|[\d\W]\s+as\s*?[\"'`\w]+\s*?from|[\s(]load_file\s*?\(|[\"'`]\s+regexp\W|end\s*?\);))" \
|
||
"id:942360,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects concatenated basic SQL injection and SQLLFI attempts',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
#
|
||
# -=[ Detect MySQL in-line comments ]=-
|
||
#
|
||
# MySQL in-line comments can be used to bypass SQLi detection.
|
||
#
|
||
# Ref: https://dev.mysql.com/doc/refman/8.0/en/comments.html:
|
||
# SELECT /*! STRAIGHT_JOIN */ col1 FROM table1,table2 WHERE ...
|
||
# CREATE TABLE t1(a INT, KEY (a)) /*!50110 KEY_BLOCK_SIZE=1024 */;
|
||
# SELECT /*+ BKA(t1) */ FROM ... ;
|
||
#
|
||
# http://localhost/test.php?id=9999+or+{if+length((/*!5000select+username/*!50000from*/user+where+id=1))>0}
|
||
#
|
||
# The minimal string that triggers this regexp is: /*!*/ or /*+*/.
|
||
# The rule 942500 is related to 942440 which catches both /*! and */ independently.
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:/\*[!+](?:[\w\s=_\-()]+)?\*/)" \
|
||
"id:942500,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'MySQL in-line comment detected.',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:942013,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
|
||
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:942014,phase:2,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
|
||
#
|
||
# -= Paranoia Level 2 =- (apply only when tx.executing_paranoia_level is sufficiently high: 2 or higher)
|
||
#
|
||
|
||
|
||
#
|
||
# -=[ String Termination/Statement Ending Injection Testing ]=-
|
||
#
|
||
# Identifies common initial SQLi probing requests where attackers insert/append
|
||
# quote characters to the existing normal payload to see how the app/db responds.
|
||
#
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?:^\s*[\"'`;]+|[\"'`]+\s*$)" \
|
||
"id:942110,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:utf8toUnicode,t:urlDecodeUni,\
|
||
msg:'SQL Injection Attack: Common Injection Testing Detected',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'WARNING',\
|
||
setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.warning_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -=[ SQL Operators ]=-
|
||
#
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942120.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942120.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:^|\W)in[+\s]*\([\s\d\"]+[^()]*\)|\b(?:r(?:egexp|like)|isnull|xor)\b|<(?:>(?:\s+binary)?|=>?|<)|r(?:egexp|like)\s+binary|not\s+between\s+0\s+and|(?:like|is)\s+null|>[=>]|\|\||!=|&&))" \
|
||
"id:942120,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:utf8toUnicode,t:urlDecodeUni,\
|
||
msg:'SQL Injection Attack: SQL Operator Detected',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -=[ SQL Tautologies ]=-
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942130.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942130.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
# Not supported by re2 (++, ?!re).
|
||
#
|
||
SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\s'\"`()]*?([\d\w]++)[\s'\"`()]*?(?:<(?:=(?:[\s'\"`()]*?(?!\1)[\d\w]+|>[\s'\"`()]*?(?:\1))|>?[\s'\"`()]*?(?!\1)[\d\w]+)|(?:not\s+(?:regexp|like)|is\s+not|>=?|!=|\^)[\s'\"`()]*?(?!\1)[\d\w]+|(?:(?:sounds\s+)?like|r(?:egexp|like)|=)[\s'\"`()]*?(?:\1)))" \
|
||
"id:942130,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,t:replaceComments,\
|
||
msg:'SQL Injection Attack: SQL Tautology Detected.',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
multiMatch,\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -=[ SQL Function Names ]=-
|
||
#
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942150.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942150.data
|
||
# Note that after assemble an ignore case flag and a word boundary is added
|
||
# in front of the Regexp::Assemble output.
|
||
# And a non-word character and an opening bracket is added behind the Regexp::Assemble output:
|
||
# (?i)\bASSEMBLE_OUTPUT\W*\(
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\b(?:c(?:o(?:n(?:v(?:ert(?:_tz)?)?|cat(?:_ws)?|nection_id)|(?:mpres)?s|ercibility|(?:un)?t|llation|alesce)|ur(?:rent_(?:time(?:stamp)?|date|user)|(?:dat|tim)e)|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|ast|r32)|s(?:u(?:b(?:str(?:ing(?:_index)?)?|(?:dat|tim)e)|m)|t(?:d(?:dev_(?:sam|po)p)?|r(?:_to_date|cmp))|e(?:c(?:_to_time|ond)|ssion_user)|ys(?:tem_user|date)|ha[12]?|oundex|chema|ig?n|leep|pace|qrt)|i(?:s(?:_(?:ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|(?:free|used)_lock)|null)|n(?:et(?:6_(?:aton|ntoa)|_(?:aton|ntoa))|s(?:ert|tr)|terval)?|f(?:null)?)|d(?:a(?:t(?:e(?:_(?:format|add|sub)|diff)?|abase)|y(?:of(?:month|week|year)|name)?)|e(?:(?:s_(?:de|en)cryp|faul)t|grees|code)|count|ump)|l(?:o(?:ca(?:l(?:timestamp)?|te)|g(?:10|2)?|ad_file|wer)|ast(?:_(?:inser_id|day))?|e(?:(?:as|f)t|ngth)|case|trim|pad|n)|u(?:n(?:compress(?:ed_length)?|ix_timestamp|hex)|tc_(?:time(?:stamp)?|date)|p(?:datexml|per)|uid(?:_short)?|case|ser)|t(?:ime(?:_(?:format|to_sec)|stamp(?:diff|add)?|diff)?|o(?:(?:second|day)s|_base64|n?char)|r(?:uncate|im)|an)|m(?:a(?:ke(?:_set|date)|ster_pos_wait|x)|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:nth(?:name)?|d)|d5)|r(?:e(?:p(?:lace|eat)|lease_lock|verse)|a(?:wtohex|dians|nd)|o(?:w_count|und)|ight|trim|pad)|f(?:i(?:eld(?:_in_set)?|nd_in_set)|rom_(?:unixtime|base64|days)|o(?:und_rows|rmat)|loor)|p(?:o(?:w(?:er)?|sition)|eriod_(?:diff|add)|rocedure_analyse|assword|g_sleep|i)|a(?:s(?:cii(?:str)?|in)|es_(?:de|en)crypt|dd(?:dat|tim)e|(?:co|b)s|tan2?|vg)|b(?:i(?:t_(?:length|count|x?or|and)|n(?:_to_num)?)|enchmark)|e(?:x(?:tract(?:value)?|p(?:ort_set)?)|nc(?:rypt|ode)|lt)|g(?:r(?:oup_conca|eates)t|et_(?:format|lock))|v(?:a(?:r(?:_(?:sam|po)p|iance)|lues)|ersion)|o(?:(?:ld_passwo)?rd|ct(?:et_length)?)|we(?:ek(?:ofyear|day)?|ight_string)|n(?:o(?:t_in|w)|ame_const|ullif)|h(?:ex(?:toraw)?|our)|qu(?:arter|ote)|year(?:week)?|xmltype)\W*\(" \
|
||
"id:942150,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,t:lowercase,\
|
||
msg:'SQL Injection Attack',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ctl:auditLogParts=+E,\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942180.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942180.data
|
||
# Note that after assemble an ignore case flag is inserted in the
|
||
# first non-capturing group from the Regexp::Assemble output:
|
||
# ASSEMBLE_OUTPUT | s/^(?:/(?i:/
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"'`](?:\s*?(?:(?:between|x?or|and|div)[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]|like(?:[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]|\W+[\w\"'`(])|[!=|](?:[\d\s!=+-]+.*?[\"'`(].*?|[\d\s!=]+.*?\d+)$|[^\w\s]?=\s*?[\"'`])|(?:\W*?[+=]+\W*?|[<>~]+)[\"'`])|(?:/\*)+[\"'`]+\s?(?:\/\*|--|\{|#)?|\d[\"'`]\s+[\"'`]\s+\d|where\s[\s\w\.,-]+\s=|^admin\s*?[\"'`]|\sis\s*?0\W)" \
|
||
"id:942180,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects basic SQL authentication bypass attempts 1/3',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942200.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942200.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:(?:(?:trunc|cre|upd)at|renam)e|(?:inser|selec)t|de(?:lete|sc)|alter|load)\s*?\(\s*?space\s*?\(|,.*?[)\da-f\"'`][\"'`](?:[\"'`].*?[\"'`]|(?:\r?\n)?\z|[^\"'`]+)|\Wselect.+\W*?from))" \
|
||
"id:942200,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects MySQL comment-/space-obfuscated injections and backtick termination',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942210.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942210.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:n(?:and|ot)|(?:x?x)?or|between|\|\||like|and|div|&&)[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]|\/\w+;?\s+(?:between|having|select|like|x?or|and|div)\W|\d+\s*?(?:between|like|x?or|and|div)\s*?\d+\s*?[\-+]|--\s*?(?:(?:insert|update)\s*?\w{2,}|alter|drop)|#\s*?(?:(?:insert|update)\s*?\w{2,}|alter|drop)|;\s*?(?:(?:insert|update)\s*?\w{2,}|alter|drop)|\@.+=\s*?\(\s*?select|\d\s+group\s+by.+\(|[^\w]SET\s*?\@\w+))" \
|
||
"id:942210,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects chained SQL injection attempts 1/2',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942260.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble-v2.pl regexp-942260.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# ASSEMBLE_OUTPUT | s/^(?:/(?i:/
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"'`]\s*?(?:(?:n(?:and|ot)|(?:x?x)?or|between|\|\||and|div|&&)\s+[\s\w]+=\s*?\w+\s*?having\s+|like(?:\s+[\s\w]+=\s*?\w+\s*?having\s+|\W*?[\"'`\d])|[^?\w\s=.,;)(]++\s*?[(@\"'`]*?\s*?\w+\W+\w|\*\s*?\w+\W+[\"'`])|(?:union\s*?(?:distinct|[(!@]*?|all)?\s*?[([]*?\s*?select|select\s+?[\[\]()\s\w\.,\"'`-]+from)\s+|\w+\s+like\s+[\"'`]|find_in_set\s*?\(|like\s*?[\"'`]%)" \
|
||
"id:942260,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects basic SQL authentication bypass attempts 2/3',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942300.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942300.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:n(?:and|ot)|(?:x?x)?or|between|\|\||like|and|div|&&)\s+\s*?\w+\(|\)\s*?when\s*?\d+\s*?then|[\"'`]\s*?(?:--|\{|#)|cha?r\s*?\(\s*?\d|\/\*!\s?\d+))" \
|
||
"id:942300,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects MySQL comments, conditions and ch(a)r injections',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942310.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942310.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:[\"'`](?:;\s*?(?:begin|while|if)|[\s\d]+=\s*?\d|\s+and\s*?=\W)|(?:\(\s*?select\s*?\w+|order\s+by\s+if\w*?|coalesce)\s*?\(|\w[\"'`]\s*?(?:(?:[-+=|@]+\s+?)+|[-+=|@]+)[\d(]|[\s(]+case\d*?\W.+[tw]hen[\s(]|\+\s*?\d+\s*?\+\s*?\@|\@\@\w+\s*?[^\w\s]|\W!+[\"'`]\w|\*\/from))" \
|
||
"id:942310,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects chained SQL injection attempts 2/2',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
#
|
||
# -=[ SQL Injection Probings ]=-
|
||
#
|
||
# This is a group of three similar rules aiming to detect SQL injection probings.
|
||
#
|
||
# 942330 PL 2
|
||
# 942370 PL 2
|
||
# 942490 PL 3
|
||
# Regexp generated from util/regexp-assemble/regexp-942330.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942330.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+|(?:^[\"'`\\\\]*?[\d\"'`]+)+)\s*?(?:n(?:and|ot)|(?:x?x)?or|between|\|\||like|and|div|&&)\s*?[\w\"'`][+&!@(),.-]|\@(?:[\w-]+\s(?:between|like|x?or|and|div)\s*?[^\w\s]|\w+\s+(?:between|like|x?or|and|div)\s*?[\"'`\d]+)|[\"'`]\s*?(?:between|like|x?or|and|div)\s*?[\"'`]?\d|[^\w\s:]\s*?\d\W+[^\w\s]\s*?[\"'`].|[^\w\s]\w+\s*?[|-]\s*?[\"'`]\s*?\w|\Winformation_schema|\\\\x(?:23|27|3d)|table_name\W|^.?[\"'`]$))" \
|
||
"id:942330,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects classic SQL injection probings 1/3',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942340.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942340.data
|
||
# Note that part of regexp-942340.data is already optimized, to avoid a
|
||
# Regexp::Assemble behaviour, where the regex is not optimized very nicely.
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:[\"'`](?:\s*?(?:is\s*?(?:[\d.]+\s*?\W.*?[\"'`]|\d.+[\"'`]?\w)|\d\s*?(?:--|#))|(?:\W+[\w+-]+\s*?=\s*?\d\W+|\|?[\w-]{3,}[^\w\s.,]+)[\"'`]|[\%&<>^=]+\d\s*?(?:between|like|x?or|and|div|=))|(?i:n?and|x?x?or|div|like|between|not|\|\||\&\&)\s+[\s\w+]+(?:sounds\s+like\s*?[\"'`]|regexp\s*?\(|[=\d]+x)|in\s*?\(+\s*?select))" \
|
||
"id:942340,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects basic SQL authentication bypass attempts 3/3',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# This rule is a stricter sibling of 942360.
|
||
# The keywords 'alter' and 'union' led to false positives.
|
||
# Therefore they have been moved to PL2 and the keywords have been extended on PL1.
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:^[\W\d]+\s*?(?:alter|union)\b)" \
|
||
"id:942361,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects basic SQL injection based on keyword alter or union',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# This rule is a sibling of 942330. See that rule for a description and overview.
|
||
#
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942370.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942370.data
|
||
# Note that after assemble an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"'`](?:\s*?(?:(?:\*.+(?:(?:an|i)d|between|like|x?or|div)\W*?[\"'`]|(?:between|like|x?or|and|div)\s[^\d]+[\w-]+.*?)\d|[^\w\s?]+\s*?[^\w\s]+\s*?[\"'`]|[^\w\s]+\s*?[\W\d].*?(?:--|#))|.*?\*\s*?\d)|[()\*<>%+-][\w-]+[^\w\s]+[\"'`][^,]|\^[\"'`])" \
|
||
"id:942370,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects classic SQL injection probings 2/3',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942380.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942380.data
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:\b(?:having\b ?(?:[\'\"][^=]{1,10}[\'\" ?[=<>]+|\d{1,10} ?[=<>]+)|(?i:having)\b\s+(?:'[^=]{1,10}'|\d{1,10})\s*?[=<>])|exists\s(?:s(?:elect\S(?:if(?:null)?\s\(|concat|top)|ystem\s\()|\b(?i:having)\b\s+\d{1,10}|'[^=]{1,10}'|\sselect)|(?i:\bexecute\s{1,5}[\w\.$]{1,5}\s{0,3})|(?i:\bcreate\s+?table.{0,20}?\()|(?i:\blike\W*?char\W*?\()|(?i:select.*?case)|(?i:from.*?limit)|(?i:\bexecute\()|(?i:order\sby))" \
|
||
"id:942380,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQL Injection Attack',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ctl:auditLogParts=+E,\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942390.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942390.data
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:\b(?:(?i:xor)\b\s+(?:'[^=]{1,10}'(?:\s*?[=<>])?|\d{1,10}(?:\s*?[=<>])?)|(?i:or)\b\s+(?:'[^=]{1,10}'(?:\s*?[=<>])?|\d{1,10}(?:\s*?[=<>])?))|(?i:\bor\b ?[\'\"][^=]{1,10}[\'\"] ?[=<>]+)|(?i:'\s+xor\s+.{1,20}[+\-!<>=])|(?i:'\s+or\s+.{1,20}[+\-!<>=])|(?i:\bor\b ?\d{1,10} ?[=<>]+))" \
|
||
"id:942390,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQL Injection Attack',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ctl:auditLogParts=+E,\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# Regexp generated from util/regexp-assemble/regexp-942400.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942400.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:\band\b(?:\s+(?:'[^=]{1,10}'(?:\s*?[=<>])?|\d{1,10}(?:\s*?[=<>])?)| ?(?:[\'\"][^=]{1,10}[\'\"]|\d{1,10}) ?[=<>]+))" \
|
||
"id:942400,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQL Injection Attack',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ctl:auditLogParts=+E,\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
# The former rule id 942410 was split into three new rules: 942410, 942470, 942480
|
||
#
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942410.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942410.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output.
|
||
# And a word boundary is added before and a non-word character with an opening bracket
|
||
# is added after the Regexp::Assemble output:
|
||
# (?i:\bASSEMBLE_OUTPUT\W*?\()
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:\b(?:c(?:o(?:n(?:v(?:ert(?:_tz)?)?|cat(?:_ws)?|nection_id)|(?:mpres)?s|ercibility|(?:un)?t|alesce)|ur(?:rent_(?:time(?:stamp)?|date|user)|(?:dat|tim)e)|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|ast|r32)|s(?:t(?:d(?:dev(?:_(?:sam|po)p)?)?|r(?:_to_date|cmp))|u(?:b(?:str(?:ing(?:_index)?)?|(?:dat|tim)e)|m)|e(?:c(?:_to_time|ond)|ssion_user)|ys(?:tem_user|date)|ha[12]?|oundex|chema|ig?n|leep|pace|qrt)|i(?:s(?:_(?:ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|(?:free|used)_lock)|null)?|n(?:et(?:6_(?:aton|ntoa)|_(?:aton|ntoa))|s(?:ert|tr)|terval)?|f(?:null)?)|d(?:a(?:t(?:e(?:_(?:format|add|sub)|diff)?|abase)|y(?:of(?:month|week|year)|name)?)|e(?:(?:s_(?:de|en)cryp|faul)t|grees|code)|count|ump)|l(?:o(?:ca(?:l(?:timestamp)?|te)|g(?:10|2)?|ad_file|wer)|ast(?:_(?:insert_id|day))?|e(?:(?:as|f)t|ngth)|case|trim|pad|n)|u(?:n(?:compress(?:ed_length)?|ix_timestamp|hex)|tc_(?:time(?:stamp)?|date)|p(?:datexml|per)|uid(?:_short)?|case|ser)|r(?:a(?:wto(?:nhex(?:toraw)?|hex)|dians|nd)|e(?:p(?:lace|eat)|lease_lock|verse)|o(?:w_count|und)|ight|trim|pad)|t(?:ime(?:_(?:format|to_sec)|stamp(?:diff|add)?|diff)?|o_(?:(?:second|day)s|base64|n?char)|r(?:uncate|im)|an)|m(?:a(?:ke(?:_set|date)|ster_pos_wait|x)|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:nth(?:name)?|d)|d5)|f(?:i(?:eld(?:_in_set)?|nd_in_set)|rom_(?:unixtime|base64|days)|o(?:und_rows|rmat)|loor)|p(?:o(?:w(?:er)?|sition)|eriod_(?:diff|add)|rocedure_analyse|assword|g_sleep|i)|a(?:s(?:cii(?:str)?|in)|es_(?:de|en)crypt|dd(?:dat|tim)e|(?:co|b)s|tan2?|vg)|b(?:i(?:t_(?:length|count|x?or|and)|n(?:_to_num)?)|enchmark)|e(?:x(?:tract(?:value)?|p(?:ort_set)?)|nc(?:rypt|ode)|lt)|g(?:r(?:oup_conca|eates)t|et_(?:format|lock))|v(?:a(?:r(?:_(?:sam|po)p|iance)|lues)|ersion)|o(?:(?:ld_passwo)?rd|ct(?:et_length)?)|we(?:ek(?:ofyear|day)?|ight_string)|n(?:o(?:t_in|w)|ame_const|ullif)|h(?:ex(?:toraw)?|our)|qu(?:arter|ote)|year(?:week)?|xmltype)\W*?\()" \
|
||
"id:942410,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQL Injection Attack',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ctl:auditLogParts=+E,\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
# The former rule id 942410 was split into three new rules: 942410, 942470, 942480
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942470.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942470.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:xp_(?:reg(?:re(?:movemultistring|ad)|delete(?:value|key)|enum(?:value|key)s|addmultistring|write)|(?:servicecontro|cmdshel)l|e(?:xecresultset|numdsn)|ntsec(?:_enumdomains)?|terminate(?:_process)?|availablemedia|loginconfig|filelist|dirtree|makecab)|s(?:p_(?:(?:addextendedpro|sqlexe)c|p(?:assword|repare)|replwritetovarbin|is_srvrolemember|execute(?:sql)?|makewebtask|oacreate|help)|ql_(?:longvarchar|variant))|open(?:owa_util|rowset|query)|(?:n?varcha|tbcreato)r|autonomous_transaction|db(?:a_users|ms_java)|utl_(?:file|http)))" \
|
||
"id:942470,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQL Injection Attack',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ctl:auditLogParts=+E,\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
# The former rule id 942410 was split into three new rules: 942410, 942470, 942480
|
||
#
|
||
# Regexp generated from util/regexp-assemble/regexp-942480.data using Regexp::Assemble.
|
||
# To rebuild the regexp:
|
||
# cd util/regexp-assemble
|
||
# ./regexp-assemble.pl regexp-942480.data
|
||
# Note that after assemble an outer bracket with an ignore case flag is added
|
||
# to the Regexp::Assemble output:
|
||
# (?i:ASSEMBLE_OUTPUT)
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:\b(?:(?:s(?:elect\b.{1,100}?\b(?:(?:(?:length|count)\b.{1,100}?|.*?\bdump\b.*)\bfrom|to(?:p\b.{1,100}?\bfrom|_(?:numbe|cha)r)|(?:from\b.{1,100}?\bwher|data_typ)e|instr)|ys_context)|in(?:to\b\W*?\b(?:dump|out)file|sert\b\W*?\binto|ner\b\W*?\bjoin)|u(?:nion\b.{1,100}?\bselect|tl_inaddr)|group\b.*?\bby\b.{1,100}?\bhaving|d(?:elete\b\W*?\bfrom|bms_\w+\.)|load\b\W*?\bdata\b.*?\binfile)\b|print\b\W*?\@\@)|(?:;\W*?\b(?:shutdown|drop)|collation\W*?\(a|\@\@version)\b|'(?:s(?:qloledb|a)|msdasql|dbo)'))" \
|
||
"id:942480,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQL Injection Attack',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ctl:auditLogParts=+E,\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# [ SQL Injection Character Anomaly Usage ]
|
||
#
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
# This rules attempts to gauge when there is an excessive use of
|
||
# meta-characters within a single parameter payload.
|
||
#
|
||
# Expect a lot of false positives with this rule.
|
||
# The most likely false positive instances will be free-form text fields.
|
||
# This will make it necessary to disable the rule for certain known parameters.
|
||
# The following directive is an example to switch off the rule globally for
|
||
# the parameter foo. Place this instruction in your configuration after
|
||
# the include directive for the Core Rules Set.
|
||
#
|
||
# SecRuleUpdateTargetById 942430 "!ARGS:foo"
|
||
#
|
||
|
||
SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){12})" \
|
||
"id:942430,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)',\
|
||
logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'WARNING',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.warning_anomaly_score}',\
|
||
setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -=[ Detect SQL Comment Sequences ]=-
|
||
#
|
||
# Example Payloads Detected:
|
||
# -------------------------
|
||
# OR 1#
|
||
# DROP sampletable;--
|
||
# admin'--
|
||
# DROP/*comment*/sampletable
|
||
# DR/**/OP/*bypass blacklisting*/sampletable
|
||
# SELECT/*avoid-spaces*/password/**/FROM/**/Members
|
||
# SELECT /*!32302 1/0, */ 1 FROM tablename
|
||
# ‘ or 1=1#
|
||
# ‘ or 1=1-- -
|
||
# ‘ or 1=1/*
|
||
# ' or 1=1;\x00
|
||
# 1='1' or-- -
|
||
# ' /*!50000or*/1='1
|
||
# ' /*!or*/1='1
|
||
# 0/**/union/*!50000select*/table_name`foo`/**/
|
||
# -------------------------
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:/\*!?|\*/|[';]--|--[\s\r\n\v\f]|--[^-]*?-|[^&-]#.*?[\s\r\n\v\f]|;?\\x00)" \
|
||
"id:942440,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQL Comment Sequence Detected.',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -=[ SQL Hex Evasion Methods ]=-
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:\A|[^\d])0x[a-f\d]{3,})" \
|
||
"id:942450,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQL Hex Encoding Identified',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -=[ Detect SQLi bypass: backticks ]=-
|
||
#
|
||
# Quotes and backticks can be used to bypass SQLi detection.
|
||
#
|
||
# Example:
|
||
# GET http://localhost/test.php?id=9999%20or+{`if`(2=(select+2+from+wp_users+where+user_login='admin'))}
|
||
#
|
||
# The minimum text between the ticks or backticks must be 2 (if, for example) and a maximum of 29.
|
||
# 29 is a compromise: The lower this number (29), the lower the probability of FP and the higher the probability of false negatives.
|
||
# In tests we got a minimum number of FP with {2,29}.
|
||
#
|
||
# Base64 encoding detection:
|
||
# (?:[A-Za-z0-9+/]{4})+ #match any number of 4-letter blocks of the base64 char set
|
||
# (?:[A-Za-z0-9+/]{2}== #match 2-letter block of the base64 char set followed by "==", together forming a 4-letter block
|
||
# | # or
|
||
# [A-Za-z0-9+/]{3}= #match 3-letter block of the base64 char set followed by "=", together forming a 4-letter block
|
||
# )?
|
||
#
|
||
# The minimal string that triggers this regexp is: `if`
|
||
#
|
||
# The rule 942510 is related to 942110 which catches a single ' or `
|
||
#
|
||
# The rule 942511 is similar to this rule, but triggers on normal quotes
|
||
# ('if'). That rule runs in paranoia level 3 or higher since it is prone to
|
||
# false positives in natural text.
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:`((?:[\w\s=_\-+{}()<@]){2,29}|(?:[A-Za-z0-9+\/]{4})+(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?)`)" \
|
||
"id:942510,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQLi bypass attempt by ticks or backticks detected.',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/2',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:942015,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
|
||
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:942016,phase:2,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
|
||
#
|
||
# -= Paranoia Level 3 =- (apply only when tx.executing_paranoia_level is sufficiently high: 3 or higher)
|
||
#
|
||
|
||
|
||
#
|
||
# [ SQL HAVING queries ]
|
||
#
|
||
# This pattern was split off from rule 942250 due to frequent
|
||
# false positives in English text. Testing showed that SQL
|
||
# injections with HAVING should be detected by libinjection
|
||
# (rule 942100).
|
||
#
|
||
# This is a stricter sibling of rule 942250.
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\W+\d*?\s*?having\s*?[^\s\-]" \
|
||
"id:942251,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects HAVING injections',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/3',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
|
||
|
||
# This rule is a stricter sibling of 942330. See that rule for a
|
||
# description and overview.
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx [\"'`][\s\d]*?[^\w\s]\W*?\d\W*?.*?[\"'`\d]" \
|
||
"id:942490,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Detects classic SQL injection probings 3/3',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/3',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
|
||
|
||
#
|
||
# [ SQL Injection Character Anomaly Usage ]
|
||
#
|
||
# This rule attempts to gauge when there is an excessive use of
|
||
# meta-characters within a single parameter payload.
|
||
#
|
||
# It is similar to 942430, but focuses on Cookies instead of
|
||
# GET/POST parameters.
|
||
#
|
||
# Expect a lot of false positives with this rule.
|
||
# The most likely false positive instances will be complex session ids.
|
||
# This will make it necessary to disable the rule for certain known cookies.
|
||
# The following directive is an example to switch off the rule globally for
|
||
# the cookie foo_id. Place this instruction in your configuration after
|
||
# the include directive for the Core Rules Set.
|
||
#
|
||
# SecRuleUpdateTargetById 942420 "!REQUEST_COOKIES:foo_id"
|
||
#
|
||
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){8})" \
|
||
"id:942420,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)',\
|
||
logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/3',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'WARNING',\
|
||
setvar:'tx.anomaly_score_pl3=+%{tx.warning_anomaly_score}',\
|
||
setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# This is a stricter sibling of rule 942430.
|
||
#
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
|
||
SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){6})" \
|
||
"id:942431,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)',\
|
||
logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/3',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'WARNING',\
|
||
setvar:'tx.anomaly_score_pl3=+%{tx.warning_anomaly_score}',\
|
||
setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# [ Repetitive Non-Word Characters ]
|
||
#
|
||
# This rule attempts to identify when multiple (4 or more) non-word characters
|
||
# are repeated in sequence.
|
||
#
|
||
# The pattern may occur in some normal texts, e.g. "foo...." will match.
|
||
#
|
||
SecRule ARGS "@rx \W{4}" \
|
||
"id:942460,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/3',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'WARNING',\
|
||
setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl3=+%{tx.warning_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# This is a sibling of rule 942100 that adds checking of the last path segment.
|
||
#
|
||
# libinjection is more likely to fail when passing the full path. E.g. the following
|
||
# string produces a match:
|
||
# 999999.1 union select unhex(hex(version())) -- and 1=1
|
||
# while this doesn't:
|
||
# /999999.1 union select unhex(hex(version())) -- and 1=1\.
|
||
# Therefore, we capture the last segment of the path and only match that with
|
||
# libinjection. Incidentally, the last path segment is also the most likely
|
||
# to be used for injection, other segments will most likely not be affected.
|
||
#
|
||
SecRule REQUEST_BASENAME "@detectSQLi" \
|
||
"id:942101,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,\
|
||
msg:'SQL Injection Attack Detected via libinjection',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/3',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -=[ Detect SQLi bypass: quotes ]=-
|
||
#
|
||
# Quotes and backticks can be used to bypass SQLi detection.
|
||
#
|
||
# Example:
|
||
# GET http://localhost/test.php?id=9999%20or+{`if`(2=(select+2+from+wp_users+where+user_login='admin'))}
|
||
#
|
||
# The minimum text between the ticks or backticks must be 2 (if, for example) and a maximum of 29.
|
||
# 29 is a compromise: The lower this number (29), the lower the probability of FP and the higher the probability of false negatives.
|
||
# In tests we got a minimum number of FP with {2,29}.
|
||
#
|
||
# Base64 encoding detection:
|
||
# (?:[A-Za-z0-9+/]{4})+ #match any number of 4-letter blocks of the base64 char set
|
||
# (?:[A-Za-z0-9+/]{2}== #match 2-letter block of the base64 char set followed by "==", together forming a 4-letter block
|
||
# | # or
|
||
# [A-Za-z0-9+/]{3}= #match 3-letter block of the base64 char set followed by "=", together forming a 4-letter block
|
||
# )?
|
||
#
|
||
# The minimal string that triggers this regexp is: 'if'
|
||
#
|
||
# The rule 942511 is related to 942110 which catches a single ' or `
|
||
#
|
||
# The rule 942510 is similar to this rule, but triggers on backticks
|
||
# (`if`). That rule runs in paranoia level 2 or higher since the risk of
|
||
# false positives in natural text is still present but lower than this
|
||
# rule.
|
||
#
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:'((?:[\w\s=_\-+{}()<@]){2,29}|(?:[A-Za-z0-9+\/]{4})+(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?)')" \
|
||
"id:942511,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'SQLi bypass attempt by ticks detected.',\
|
||
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/3',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'CRITICAL',\
|
||
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
|
||
setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
|
||
|
||
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:942017,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
|
||
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:942018,phase:2,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
|
||
#
|
||
# -= Paranoia Level 4 =- (apply only when tx.executing_paranoia_level is sufficiently high: 4 or higher)
|
||
#
|
||
|
||
#
|
||
# [ SQL Injection Character Anomaly Usage ]
|
||
#
|
||
# This is a stricter sibling of rule 942420.
|
||
#
|
||
|
||
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){3})" \
|
||
"id:942421,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)',\
|
||
logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/4',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'WARNING',\
|
||
setvar:'tx.anomaly_score_pl4=+%{tx.warning_anomaly_score}',\
|
||
setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# This is a stricter sibling of rule 942430.
|
||
#
|
||
# This rule is also triggered by the following exploit(s):
|
||
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
||
#
|
||
|
||
SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){2})" \
|
||
"id:942432,\
|
||
phase:2,\
|
||
block,\
|
||
capture,\
|
||
t:none,t:urlDecodeUni,\
|
||
msg:'Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)',\
|
||
logdata:'Matched Data: %{TX.1} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
||
tag:'application-multi',\
|
||
tag:'language-multi',\
|
||
tag:'platform-multi',\
|
||
tag:'attack-sqli',\
|
||
tag:'OWASP_CRS',\
|
||
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
|
||
tag:'WASCTC/WASC-19',\
|
||
tag:'OWASP_TOP_10/A1',\
|
||
tag:'OWASP_AppSensor/CIE1',\
|
||
tag:'PCI/6.5.2',\
|
||
tag:'paranoia-level/4',\
|
||
ver:'OWASP_CRS/3.2.0',\
|
||
severity:'WARNING',\
|
||
setvar:'tx.anomaly_score_pl4=+%{tx.warning_anomaly_score}',\
|
||
setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'"
|
||
|
||
|
||
#
|
||
# -= Paranoia Levels Finished =-
|
||
#
|
||
SecMarker "END-REQUEST-942-APPLICATION-ATTACK-SQLI"
|