Input: CRS XSS Rule 941100: XSS Attack Detected via libinjection

Output:
id: safeline-941100
name: XSS Attack Detected via libinjection
description: 'Converted from CRS Rule 941100: XSS Attack Detected via libinjection'
rule_type: semantic
conditions:
- field: request.cookie
  operator: semantic_match
  semantic_type: xss
  threshold: 0.8
- field: request.header
  operator: semantic_match
  semantic_type: xss
  threshold: 0.8
- field: request.query
  operator: semantic_match
  semantic_type: xss
  threshold: 0.8
action: block
severity: critical
tags:
- xss
- injection
- web-attack
semantic_type: xss
targets:
- cookie
- header
- query


Input: CRS XSS Rule 941110: XSS Filter - Category 1: Script Tag Vector

Output:
id: safeline-941110
name: 'XSS Filter - Category 1: Script Tag Vector'
description: 'Converted from CRS Rule 941110: XSS Filter - Category 1: Script Tag
  Vector'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)<script[^>]*>[\s\S]*?
- field: request.header
  operator: regex_match
  value: (?i)<script[^>]*>[\s\S]*?
- field: request.path
  operator: regex_match
  value: (?i)<script[^>]*>[\s\S]*?
- field: request.query
  operator: regex_match
  value: (?i)<script[^>]*>[\s\S]*?
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- header
- path
- query


Input: CRS XSS Rule 941130: XSS Filter - Category 3: Attribute Vector

Output:
id: safeline-941130
name: 'XSS Filter - Category 3: Attribute Vector'
description: 'Converted from CRS Rule 941130: XSS Filter - Category 3: Attribute Vector'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i).(?:\b(?:(?:x(?:link:href|html|mlns)|data:text/html|formaction)\b|pattern[\s\x0b]*=)|(?:!ENTITY[\s\x0b]+(?:%[\s\x0b]+)?[^\s\x0b]+[\s\x0b]+(?:SYSTEM|PUBLIC)|@import|;base64)\b)
- field: request.header
  operator: regex_match
  value: (?i).(?:\b(?:(?:x(?:link:href|html|mlns)|data:text/html|formaction)\b|pattern[\s\x0b]*=)|(?:!ENTITY[\s\x0b]+(?:%[\s\x0b]+)?[^\s\x0b]+[\s\x0b]+(?:SYSTEM|PUBLIC)|@import|;base64)\b)
- field: request.path
  operator: regex_match
  value: (?i).(?:\b(?:(?:x(?:link:href|html|mlns)|data:text/html|formaction)\b|pattern[\s\x0b]*=)|(?:!ENTITY[\s\x0b]+(?:%[\s\x0b]+)?[^\s\x0b]+[\s\x0b]+(?:SYSTEM|PUBLIC)|@import|;base64)\b)
- field: request.query
  operator: regex_match
  value: (?i).(?:\b(?:(?:x(?:link:href|html|mlns)|data:text/html|formaction)\b|pattern[\s\x0b]*=)|(?:!ENTITY[\s\x0b]+(?:%[\s\x0b]+)?[^\s\x0b]+[\s\x0b]+(?:SYSTEM|PUBLIC)|@import|;base64)\b)
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- header
- path
- query


Input: CRS XSS Rule 941140: XSS Filter - Category 4: Javascript URI Vector

Output:
id: safeline-941140
name: 'XSS Filter - Category 4: Javascript URI Vector'
description: 'Converted from CRS Rule 941140: XSS Filter - Category 4: Javascript
  URI Vector'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url\(javascript
- field: request.header
  operator: regex_match
  value: (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url\(javascript
- field: request.path
  operator: regex_match
  value: (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url\(javascript
- field: request.query
  operator: regex_match
  value: (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url\(javascript
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- header
- path
- query


Input: CRS XSS Rule 941160: NoScript XSS InjectionChecker: HTML Injection

Output:
id: safeline-941160
name: 'NoScript XSS InjectionChecker: HTML Injection'
description: 'Converted from CRS Rule 941160: NoScript XSS InjectionChecker: HTML
  Injection'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)<[^0-9<>A-Z_a-z]*(?:[^\s\x0b\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A
- field: request.header
  operator: regex_match
  value: (?i)<[^0-9<>A-Z_a-z]*(?:[^\s\x0b\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A
- field: request.path
  operator: regex_match
  value: (?i)<[^0-9<>A-Z_a-z]*(?:[^\s\x0b\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A
- field: request.query
  operator: regex_match
  value: (?i)<[^0-9<>A-Z_a-z]*(?:[^\s\x0b\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- header
- path
- query


Input: CRS XSS Rule 941170: NoScript XSS InjectionChecker: Attribute Injection

Output:
id: safeline-941170
name: 'NoScript XSS InjectionChecker: Attribute Injection'
description: 'Converted from CRS Rule 941170: NoScript XSS InjectionChecker: Attribute
  Injection'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)<script[^>]*>
- field: request.header
  operator: regex_match
  value: (?i)<script[^>]*>
- field: request.path
  operator: regex_match
  value: (?i)<script[^>]*>
- field: request.query
  operator: regex_match
  value: (?i)<script[^>]*>
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- header
- path
- query


Input: CRS XSS Rule 941180: Node-Validator Deny List Keywords

Output:
id: safeline-941180
name: Node-Validator Deny List Keywords
description: 'Converted from CRS Rule 941180: Node-Validator Deny List Keywords'
rule_type: signature
conditions:
- field: request.cookie
  operator: contains
  value: <script|javascript:|onerror|onload
- field: request.path
  operator: contains
  value: <script|javascript:|onerror|onload
- field: request.query
  operator: contains
  value: <script|javascript:|onerror|onload
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941190: IE XSS Filters - Attack Detected

Output:
id: safeline-941190
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941190: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i:<style.*?>.*?(?:@[i\x5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(\x5c]|&#x?0*(?:40|28|92|5C);?)))
- field: request.path
  operator: regex_match
  value: (?i:<style.*?>.*?(?:@[i\x5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(\x5c]|&#x?0*(?:40|28|92|5C);?)))
- field: request.query
  operator: regex_match
  value: (?i:<style.*?>.*?(?:@[i\x5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(\x5c]|&#x?0*(?:40|28|92|5C);?)))
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941200: IE XSS Filters - Attack Detected

Output:
id: safeline-941200
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941200: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i:<.*[:]?vmlframe.*?[\s/+]*?src[\s/+]*=)
- field: request.path
  operator: regex_match
  value: (?i:<.*[:]?vmlframe.*?[\s/+]*?src[\s/+]*=)
- field: request.query
  operator: regex_match
  value: (?i:<.*[:]?vmlframe.*?[\s/+]*?src[\s/+]*=)
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941210: Javascript Word Detected

Output:
id: safeline-941210
name: Javascript Word Detected
description: 'Converted from CRS Rule 941210: Javascript Word Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(
- field: request.path
  operator: regex_match
  value: (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(
- field: request.query
  operator: regex_match
  value: (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941220: IE XSS Filters - Attack Detected

Output:
id: safeline-941220
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941220: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)(?:v|&#(?:0*(?:118|86)|x0*[57]6);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*(?:98|66)|x0*[46]2);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(
- field: request.path
  operator: regex_match
  value: (?i)(?:v|&#(?:0*(?:118|86)|x0*[57]6);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*(?:98|66)|x0*[46]2);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(
- field: request.query
  operator: regex_match
  value: (?i)(?:v|&#(?:0*(?:118|86)|x0*[57]6);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*(?:98|66)|x0*[46]2);)(?:[\t\n\r]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941230: IE XSS Filters - Attack Detected

Output:
id: safeline-941230
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941230: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)<EMBED[\s/+].*?(?:src|type).*?=
- field: request.path
  operator: regex_match
  value: (?i)<EMBED[\s/+].*?(?:src|type).*?=
- field: request.query
  operator: regex_match
  value: (?i)<EMBED[\s/+].*?(?:src|type).*?=
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941240: IE XSS Filters - Attack Detected

Output:
id: safeline-941240
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941240: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: <[?]?import[\s/+\S]*?implementation[\s/+]*?=
- field: request.path
  operator: regex_match
  value: <[?]?import[\s/+\S]*?implementation[\s/+]*?=
- field: request.query
  operator: regex_match
  value: <[?]?import[\s/+\S]*?implementation[\s/+]*?=
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941250: IE XSS Filters - Attack Detected

Output:
id: safeline-941250
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941250: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i:<META[\s/+].*?http-equiv[\s/+]*=[\s/+]*[\"'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))
- field: request.path
  operator: regex_match
  value: (?i:<META[\s/+].*?http-equiv[\s/+]*=[\s/+]*[\"'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))
- field: request.query
  operator: regex_match
  value: (?i:<META[\s/+].*?http-equiv[\s/+]*=[\s/+]*[\"'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941260: IE XSS Filters - Attack Detected

Output:
id: safeline-941260
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941260: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i:<META[\s/+].*?charset[\s/+]*=)
- field: request.path
  operator: regex_match
  value: (?i:<META[\s/+].*?charset[\s/+]*=)
- field: request.query
  operator: regex_match
  value: (?i:<META[\s/+].*?charset[\s/+]*=)
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941270: IE XSS Filters - Attack Detected

Output:
id: safeline-941270
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941270: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)<LINK[\s/+].*?href[\s/+]*=
- field: request.path
  operator: regex_match
  value: (?i)<LINK[\s/+].*?href[\s/+]*=
- field: request.query
  operator: regex_match
  value: (?i)<LINK[\s/+].*?href[\s/+]*=
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941280: IE XSS Filters - Attack Detected

Output:
id: safeline-941280
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941280: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)<BASE[\s/+].*?href[\s/+]*=
- field: request.path
  operator: regex_match
  value: (?i)<BASE[\s/+].*?href[\s/+]*=
- field: request.query
  operator: regex_match
  value: (?i)<BASE[\s/+].*?href[\s/+]*=
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941290: IE XSS Filters - Attack Detected

Output:
id: safeline-941290
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941290: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)<APPLET[\s/+>]
- field: request.path
  operator: regex_match
  value: (?i)<APPLET[\s/+>]
- field: request.query
  operator: regex_match
  value: (?i)<APPLET[\s/+>]
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941300: IE XSS Filters - Attack Detected

Output:
id: safeline-941300
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941300: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)<OBJECT[\s/+].*?(?:type|codetype|classid|code|data)[\s/+]*=
- field: request.path
  operator: regex_match
  value: (?i)<OBJECT[\s/+].*?(?:type|codetype|classid|code|data)[\s/+]*=
- field: request.query
  operator: regex_match
  value: (?i)<OBJECT[\s/+].*?(?:type|codetype|classid|code|data)[\s/+]*=
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941310: US-ASCII Malformed Encoding XSS Filter - Attack Detected

Output:
id: safeline-941310
name: US-ASCII Malformed Encoding XSS Filter - Attack Detected
description: 'Converted from CRS Rule 941310: US-ASCII Malformed Encoding XSS Filter
  - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: \xbc[^\xbe>]*[\xbe>]|<[^\xbe]*\xbe
- field: request.path
  operator: regex_match
  value: \xbc[^\xbe>]*[\xbe>]|<[^\xbe]*\xbe
- field: request.query
  operator: regex_match
  value: \xbc[^\xbe>]*[\xbe>]|<[^\xbe]*\xbe
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941350: UTF-7 Encoding IE XSS - Attack Detected

Output:
id: safeline-941350
name: UTF-7 Encoding IE XSS - Attack Detected
description: 'Converted from CRS Rule 941350: UTF-7 Encoding IE XSS - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: \+ADw-.*(?:\+AD4-|>)|<.*\+AD4-
- field: request.path
  operator: regex_match
  value: \+ADw-.*(?:\+AD4-|>)|<.*\+AD4-
- field: request.query
  operator: regex_match
  value: \+ADw-.*(?:\+AD4-|>)|<.*\+AD4-
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941360: JSFuck / Hieroglyphy obfuscation detected

Output:
id: safeline-941360
name: JSFuck / Hieroglyphy obfuscation detected
description: 'Converted from CRS Rule 941360: JSFuck / Hieroglyphy obfuscation detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: '![!+ ]\[\]'
- field: request.path
  operator: regex_match
  value: '![!+ ]\[\]'
- field: request.query
  operator: regex_match
  value: '![!+ ]\[\]'
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941370: JavaScript global variable found

Output:
id: safeline-941370
name: JavaScript global variable found
description: 'Converted from CRS Rule 941370: JavaScript global variable found'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?:self|document|this|top|window)\s*(?:/\*|[\[)]).+?(?:\]|\*/)
- field: request.path
  operator: regex_match
  value: (?:self|document|this|top|window)\s*(?:/\*|[\[)]).+?(?:\]|\*/)
- field: request.query
  operator: regex_match
  value: (?:self|document|this|top|window)\s*(?:/\*|[\[)]).+?(?:\]|\*/)
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941390: Javascript method detected

Output:
id: safeline-941390
name: Javascript method detected
description: 'Converted from CRS Rule 941390: Javascript method detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:eval|set(?:timeout|interval)|new[\s\x0b]+Function|a(?:lert|tob)|btoa|(?:promp|impor)t|con(?:firm|sole\.(?:log|dir))|fetch)[\s\x0b]*[\(\{]
- field: request.path
  operator: regex_match
  value: (?i)\b(?:eval|set(?:timeout|interval)|new[\s\x0b]+Function|a(?:lert|tob)|btoa|(?:promp|impor)t|con(?:firm|sole\.(?:log|dir))|fetch)[\s\x0b]*[\(\{]
- field: request.query
  operator: regex_match
  value: (?i)\b(?:eval|set(?:timeout|interval)|new[\s\x0b]+Function|a(?:lert|tob)|btoa|(?:promp|impor)t|con(?:firm|sole\.(?:log|dir))|fetch)[\s\x0b]*[\(\{]
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941400: XSS JavaScript function without parentheses

Output:
id: safeline-941400
name: XSS JavaScript function without parentheses
description: 'Converted from CRS Rule 941400: XSS JavaScript function without parentheses'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: ((?:\[[^\]]*\][^.]*\.)|Reflect[^.]*\.).*(?:map|sort|apply)[^.]*\..*call[^`]*`.*`
- field: request.path
  operator: regex_match
  value: ((?:\[[^\]]*\][^.]*\.)|Reflect[^.]*\.).*(?:map|sort|apply)[^.]*\..*call[^`]*`.*`
- field: request.query
  operator: regex_match
  value: ((?:\[[^\]]*\][^.]*\.)|Reflect[^.]*\.).*(?:map|sort|apply)[^.]*\..*call[^`]*`.*`
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941101: XSS Attack Detected via libinjection

Output:
id: safeline-941101
name: XSS Attack Detected via libinjection
description: 'Converted from CRS Rule 941101: XSS Attack Detected via libinjection'
rule_type: semantic
conditions:
- field: request.header
  operator: semantic_match
  semantic_type: xss
  threshold: 0.8
- field: request.path
  operator: semantic_match
  semantic_type: xss
  threshold: 0.8
action: block
severity: critical
tags:
- xss
- injection
- web-attack
semantic_type: xss
targets:
- header
- path


Input: CRS XSS Rule 941120: XSS Filter - Category 2: Event Handler Vector

Output:
id: safeline-941120
name: 'XSS Filter - Category 2: Event Handler Vector'
description: 'Converted from CRS Rule 941120: XSS Filter - Category 2: Event Handler
  Vector'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)[\s\"'`;/0-9=\x0B\x09\x0C\x3B\x2C\x28\x3B]on[a-zA-Z]{3,50}[\s\x0B\x09\x0C\x3B\x2C\x28\x3B]*?=[^=]
- field: request.header
  operator: regex_match
  value: (?i)[\s\"'`;/0-9=\x0B\x09\x0C\x3B\x2C\x28\x3B]on[a-zA-Z]{3,50}[\s\x0B\x09\x0C\x3B\x2C\x28\x3B]*?=[^=]
- field: request.path
  operator: regex_match
  value: (?i)[\s\"'`;/0-9=\x0B\x09\x0C\x3B\x2C\x28\x3B]on[a-zA-Z]{3,50}[\s\x0B\x09\x0C\x3B\x2C\x28\x3B]*?=[^=]
- field: request.query
  operator: regex_match
  value: (?i)[\s\"'`;/0-9=\x0B\x09\x0C\x3B\x2C\x28\x3B]on[a-zA-Z]{3,50}[\s\x0B\x09\x0C\x3B\x2C\x28\x3B]*?=[^=]
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- header
- path
- query


Input: CRS XSS Rule 941150: XSS Filter - Category 5: Disallowed HTML Attributes

Output:
id: safeline-941150
name: 'XSS Filter - Category 5: Disallowed HTML Attributes'
description: 'Converted from CRS Rule 941150: XSS Filter - Category 5: Disallowed
  HTML Attributes'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=
- field: request.header
  operator: regex_match
  value: (?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=
- field: request.path
  operator: regex_match
  value: (?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=
- field: request.query
  operator: regex_match
  value: (?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- header
- path
- query


Input: CRS XSS Rule 941181: Node-Validator Deny List Keywords

Output:
id: safeline-941181
name: Node-Validator Deny List Keywords
description: 'Converted from CRS Rule 941181: Node-Validator Deny List Keywords'
rule_type: signature
conditions:
- field: request.cookie
  operator: contains
  value: <script|javascript:|onerror|onload
- field: request.path
  operator: contains
  value: <script|javascript:|onerror|onload
- field: request.query
  operator: contains
  value: <script|javascript:|onerror|onload
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941320: Possible XSS Attack Detected - HTML Tag Handler

Output:
id: safeline-941320
name: Possible XSS Attack Detected - HTML Tag Handler
description: 'Converted from CRS Rule 941320: Possible XSS Attack Detected - HTML
  Tag Handler'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|e
- field: request.path
  operator: regex_match
  value: <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|e
- field: request.query
  operator: regex_match
  value: <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|e
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941330: IE XSS Filters - Attack Detected

Output:
id: safeline-941330
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941330: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i:[\"'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|\x5cu006C)(?:o|\x5cu006F)(?:c|\x5cu0063)(?:a|\x5cu0061)(?:t|\x5cu0074)(?:i|\x5cu0069)(?:o|\x5cu006F)(?:n|\x5cu006E)|(?:n|\x5cu006E)(?:a|\x5cu0061)(?:m|\x5c
- field: request.path
  operator: regex_match
  value: (?i:[\"'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|\x5cu006C)(?:o|\x5cu006F)(?:c|\x5cu0063)(?:a|\x5cu0061)(?:t|\x5cu0074)(?:i|\x5cu0069)(?:o|\x5cu006F)(?:n|\x5cu006E)|(?:n|\x5cu006E)(?:a|\x5cu0061)(?:m|\x5c
- field: request.query
  operator: regex_match
  value: (?i:[\"'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|\x5cu006C)(?:o|\x5cu006F)(?:c|\x5cu0063)(?:a|\x5cu0061)(?:t|\x5cu0074)(?:i|\x5cu0069)(?:o|\x5cu006F)(?:n|\x5cu006E)|(?:n|\x5cu006E)(?:a|\x5cu0061)(?:m|\x5c
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941340: IE XSS Filters - Attack Detected

Output:
id: safeline-941340
name: IE XSS Filters - Attack Detected
description: 'Converted from CRS Rule 941340: IE XSS Filters - Attack Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)[\"\'][ ]*(?:[^a-z0-9~_:\' ]|in).+?[.].+?=
- field: request.path
  operator: regex_match
  value: (?i)[\"\'][ ]*(?:[^a-z0-9~_:\' ]|in).+?[.].+?=
- field: request.query
  operator: regex_match
  value: (?i)[\"\'][ ]*(?:[^a-z0-9~_:\' ]|in).+?[.].+?=
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS XSS Rule 941380: AngularJS client side template injection detected

Output:
id: safeline-941380
name: AngularJS client side template injection detected
description: 'Converted from CRS Rule 941380: AngularJS client side template injection
  detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: '{{.*?}}'
- field: request.path
  operator: regex_match
  value: '{{.*?}}'
- field: request.query
  operator: regex_match
  value: '{{.*?}}'
action: block
severity: medium
tags:
- xss
- injection
- web-attack
targets:
- cookie
- path
- query


Input: CRS SQLi Rule 942100: SQL Injection Attack Detected via libinjection

Output:
id: safeline-942100
name: SQL Injection Attack Detected via libinjection
description: 'Converted from CRS Rule 942100: SQL Injection Attack Detected via libinjection'
rule_type: semantic
conditions:
- field: request.cookie
  operator: semantic_match
  semantic_type: sqli
  threshold: 0.8
- field: request.header
  operator: semantic_match
  semantic_type: sqli
  threshold: 0.8
- field: request.query
  operator: semantic_match
  semantic_type: sqli
  threshold: 0.8
action: block
severity: critical
tags:
- sqli
- injection
- database
semantic_type: sqli
targets:
- cookie
- header
- query


Input: CRS SQLi Rule 942140: SQL Injection Attack: Common DB Names Detected

Output:
id: safeline-942140
name: 'SQL Injection Attack: Common DB Names Detected'
description: 'Converted from CRS Rule 942140: SQL Injection Attack: Common DB Names
  Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:d(?:atabas|b_nam)e[^0-9A-Z_a-z]*\(|(?:information_schema|m(?:aster\.\.sysdatabases|s(?:db|ys(?:ac(?:cess(?:objects|storage|xml)|es)|modules2?|(?:object|querie|relationship)s))|ysql\.db)|north
- field: request.query
  operator: regex_match
  value: (?i)\b(?:d(?:atabas|b_nam)e[^0-9A-Z_a-z]*\(|(?:information_schema|m(?:aster\.\.sysdatabases|s(?:db|ys(?:ac(?:cess(?:objects|storage|xml)|es)|modules2?|(?:object|querie|relationship)s))|ysql\.db)|north
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942151: SQL Injection Attack: SQL function name detected

Output:
id: safeline-942151
name: 'SQL Injection Attack: SQL function name detected'
description: 'Converted from CRS Rule 942151: SQL Injection Attack: SQL function name
  detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|eil(?:ing)?|o(?:alesce|ercibility|llation|(?:m
- field: request.query
  operator: regex_match
  value: (?i)\b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|eil(?:ing)?|o(?:alesce|ercibility|llation|(?:m
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942160: Detects blind sqli tests using sleep() or benchmark()

Output:
id: safeline-942160
name: Detects blind sqli tests using sleep() or benchmark()
description: 'Converted from CRS Rule 942160: Detects blind sqli tests using sleep()
  or benchmark()'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i:sleep\s*?\(.*?\)|benchmark\s*?\(.*?\,.*?\))
- field: request.path
  operator: regex_match
  value: (?i:sleep\s*?\(.*?\)|benchmark\s*?\(.*?\,.*?\))
- field: request.query
  operator: regex_match
  value: (?i:sleep\s*?\(.*?\)|benchmark\s*?\(.*?\,.*?\))
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- path
- query


Input: CRS SQLi Rule 942170: Detects SQL benchmark and sleep injection attempts including conditional queries

Output:
id: safeline-942170
name: Detects SQL benchmark and sleep injection attempts including conditional queries
description: 'Converted from CRS Rule 942170: Detects SQL benchmark and sleep injection
  attempts including conditional queries'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)(?:select|;)[\s\x0b]+(?:benchmark|if|sleep)[\s\x0b]*?\([\s\x0b]*?\(?[\s\x0b]*?[0-9A-Z_a-z]+
- field: request.query
  operator: regex_match
  value: (?i)(?:select|;)[\s\x0b]+(?:benchmark|if|sleep)[\s\x0b]*?\([\s\x0b]*?\(?[\s\x0b]*?[0-9A-Z_a-z]+
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942190: Detects MSSQL code execution and information gathering attempts

Output:
id: safeline-942190
name: Detects MSSQL code execution and information gathering attempts
description: 'Converted from CRS Rule 942190: Detects MSSQL code execution and information
  gathering attempts'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)union.*select
- field: request.query
  operator: regex_match
  value: (?i)union.*select
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942220: Looking for integer overflow attacks, these are taken from skipfish, except 2.2.2250738585072011e-308 is the \"magic number\" crash

Output:
id: safeline-942220
name: Looking for integer overflow attacks, these are taken from skipfish, except
  2.2.2250738585072011e-308 is the \"magic number\" crash
description: 'Converted from CRS Rule 942220: Looking for integer overflow attacks,
  these are taken from skipfish, except 2.2.2250738585072011e-308 is the \"magic number\"
  crash'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$
- field: request.query
  operator: regex_match
  value: ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942230: Detects conditional SQL injection attempts

Output:
id: safeline-942230
name: Detects conditional SQL injection attempts
description: 'Converted from CRS Rule 942230: Detects conditional SQL injection attempts'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)[\s\x0b\(\)]case[\s\x0b]+when.*?then|\)[\s\x0b]*?like[\s\x0b]*?\(|select.*?having[\s\x0b]*?[^\s\x0b]+[\s\x0b]*?[^\s\x0b0-9A-Z_a-z]|if[\s\x0b]?\([0-9A-Z_a-z]+[\s\x0b]*?[<->~]
- field: request.query
  operator: regex_match
  value: (?i)[\s\x0b\(\)]case[\s\x0b]+when.*?then|\)[\s\x0b]*?like[\s\x0b]*?\(|select.*?having[\s\x0b]*?[^\s\x0b]+[\s\x0b]*?[^\s\x0b0-9A-Z_a-z]|if[\s\x0b]?\([0-9A-Z_a-z]+[\s\x0b]*?[<->~]
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942240: Detects MySQL charset switch and MSSQL DoS attempts

Output:
id: safeline-942240
name: Detects MySQL charset switch and MSSQL DoS attempts
description: 'Converted from CRS Rule 942240: Detects MySQL charset switch and MSSQL
  DoS attempts'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)alter[\s\x0b]*?[0-9A-Z_a-z]+.*?char(?:acter)?[\s\x0b]+set[\s\x0b]+[0-9A-Z_a-z]+|[\"'`](?:;*?[\s\x0b]*?waitfor[\s\x0b]+(?:time|delay)[\s\x0b]+[\"'`]|;.*?:[\s\x0b]*?goto)
- field: request.query
  operator: regex_match
  value: (?i)alter[\s\x0b]*?[0-9A-Z_a-z]+.*?char(?:acter)?[\s\x0b]+set[\s\x0b]+[0-9A-Z_a-z]+|[\"'`](?:;*?[\s\x0b]*?waitfor[\s\x0b]+(?:time|delay)[\s\x0b]+[\"'`]|;.*?:[\s\x0b]*?goto)
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942250: Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections

Output:
id: safeline-942250
name: Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections
description: 'Converted from CRS Rule 942250: Detects MATCH AGAINST, MERGE and EXECUTE
  IMMEDIATE injections'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i:merge.*?using\s*?\(|execute\s*?immediate\s*?[\"'`]|match\s*?[\w(),+-]+\s*?against\s*?\()
- field: request.query
  operator: regex_match
  value: (?i:merge.*?using\s*?\(|execute\s*?immediate\s*?[\"'`]|match\s*?[\w(),+-]+\s*?against\s*?\()
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942270: Looking for basic sql injection. Common attack string for mysql, oracle and others

Output:
id: safeline-942270
name: Looking for basic sql injection. Common attack string for mysql, oracle and
  others
description: 'Converted from CRS Rule 942270: Looking for basic sql injection. Common
  attack string for mysql, oracle and others'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)union.*?select.*?from
- field: request.query
  operator: regex_match
  value: (?i)union.*?select.*?from
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942280: Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts

Output:
id: safeline-942280
name: Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown
  attempts
description: 'Converted from CRS Rule 942280: Detects Postgres pg_sleep injection,
  waitfor delay attacks and database shutdown attempts'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)select[\s\x0b]*?pg_sleep|waitfor[\s\x0b]*?delay[\s\x0b]?[\"'`]+[\s\x0b]?[0-9]|;[\s\x0b]*?shutdown[\s\x0b]*?(?:[#;\{]|/\*|--)
- field: request.header
  operator: regex_match
  value: (?i)select[\s\x0b]*?pg_sleep|waitfor[\s\x0b]*?delay[\s\x0b]?[\"'`]+[\s\x0b]?[0-9]|;[\s\x0b]*?shutdown[\s\x0b]*?(?:[#;\{]|/\*|--)
- field: request.query
  operator: regex_match
  value: (?i)select[\s\x0b]*?pg_sleep|waitfor[\s\x0b]*?delay[\s\x0b]?[\"'`]+[\s\x0b]?[0-9]|;[\s\x0b]*?shutdown[\s\x0b]*?(?:[#;\{]|/\*|--)
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- header
- query


Input: CRS SQLi Rule 942290: Finds basic MongoDB SQL injection attempts

Output:
id: safeline-942290
name: Finds basic MongoDB SQL injection attempts
description: 'Converted from CRS Rule 942290: Finds basic MongoDB SQL injection attempts'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\[?\$(?:a(?:bs|c(?:cumulator|osh?)|dd(?:ToSet)?|ll(?:ElementsTrue)?|n(?:d|yElementTrue)|rray(?:ElemA|ToObjec)t|sinh?|tan[2h]?|vg)|b(?:etween|i(?:narySize|t(?:And|Not|(?:O|Xo)r)?)|ottomN?|sonSize|u
- field: request.query
  operator: regex_match
  value: (?i)\[?\$(?:a(?:bs|c(?:cumulator|osh?)|dd(?:ToSet)?|ll(?:ElementsTrue)?|n(?:d|yElementTrue)|rray(?:ElemA|ToObjec)t|sinh?|tan[2h]?|vg)|b(?:etween|i(?:narySize|t(?:And|Not|(?:O|Xo)r)?)|ottomN?|sonSize|u
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942320: Detects MySQL and PostgreSQL stored procedure/function injections

Output:
id: safeline-942320
name: Detects MySQL and PostgreSQL stored procedure/function injections
description: 'Converted from CRS Rule 942320: Detects MySQL and PostgreSQL stored
  procedure/function injections'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)create[\s\x0b]+(?:function|procedure)[\s\x0b]*?[0-9A-Z_a-z]+[\s\x0b]*?\([\s\x0b]*?\)[\s\x0b]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][\s\x0b]*?[0-9A-Z_a-z]+|iv[\s\x0b]*?\([\+\-]*[\s\x0b\.0-9]+,[\+\-]*[\s\x
- field: request.query
  operator: regex_match
  value: (?i)create[\s\x0b]+(?:function|procedure)[\s\x0b]*?[0-9A-Z_a-z]+[\s\x0b]*?\([\s\x0b]*?\)[\s\x0b]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][\s\x0b]*?[0-9A-Z_a-z]+|iv[\s\x0b]*?\([\+\-]*[\s\x0b\.0-9]+,[\+\-]*[\s\x
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942350: Detects MySQL UDF injection and other data/structure manipulation attempts

Output:
id: safeline-942350
name: Detects MySQL UDF injection and other data/structure manipulation attempts
description: 'Converted from CRS Rule 942350: Detects MySQL UDF injection and other
  data/structure manipulation attempts'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)create[\s\x0b]+function[\s\x0b].+[\s\x0b]returns|;[\s\x0b]*?(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)\b[\s\x0b]*?[\(\[]?[0-9A-Z_a-z]{2,}
- field: request.query
  operator: regex_match
  value: (?i)create[\s\x0b]+function[\s\x0b].+[\s\x0b]returns|;[\s\x0b]*?(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)\b[\s\x0b]*?[\(\[]?[0-9A-Z_a-z]{2,}
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942360: Detects concatenated basic SQL injection and SQLLFI attempts

Output:
id: safeline-942360
name: Detects concatenated basic SQL injection and SQLLFI attempts
description: 'Converted from CRS Rule 942360: Detects concatenated basic SQL injection
  and SQLLFI attempts'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[\s\x0b]+(?:char|group_concat|load_file)\b[\s\x0b]*\(?|end[\s\x0b]*?\);)|[\s\x0b\(]load_file[\s\x0b]*?\(|[\"'`][\s\
- field: request.query
  operator: regex_match
  value: (?i)\b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[\s\x0b]+(?:char|group_concat|load_file)\b[\s\x0b]*\(?|end[\s\x0b]*?\);)|[\s\x0b\(]load_file[\s\x0b]*?\(|[\"'`][\s\
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942500: MySQL in-line comment detected

Output:
id: safeline-942500
name: MySQL in-line comment detected
description: 'Converted from CRS Rule 942500: MySQL in-line comment detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)/\*[\s\x0b]*?[!\+](?:[\s\x0b\(\)\-0-9=A-Z_a-z]+)?\*/
- field: request.query
  operator: regex_match
  value: (?i)/\*[\s\x0b]*?[!\+](?:[\s\x0b\(\)\-0-9=A-Z_a-z]+)?\*/
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942540: SQL Authentication bypass (split query)

Output:
id: safeline-942540
name: SQL Authentication bypass (split query)
description: 'Converted from CRS Rule 942540: SQL Authentication bypass (split query)'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: ^(?:[^']*'|[^\"]*\"|[^`]*`)[\s\x0b]*;
- field: request.query
  operator: regex_match
  value: ^(?:[^']*'|[^\"]*\"|[^`]*`)[\s\x0b]*;
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942560: MySQL Scientific Notation payload detected

Output:
id: safeline-942560
name: MySQL Scientific Notation payload detected
description: 'Converted from CRS Rule 942560: MySQL Scientific Notation payload detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)1\.e(?:[\(\),]|\.[\$0-9A-Z_a-z])
- field: request.query
  operator: regex_match
  value: (?i)1\.e(?:[\(\),]|\.[\$0-9A-Z_a-z])
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942550: JSON-Based SQL Injection

Output:
id: safeline-942550
name: JSON-Based SQL Injection
description: 'Converted from CRS Rule 942550: JSON-Based SQL Injection'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)[\"'`][\[\{][^#\]\}]*[\]\}]+[\"'`]|(?:[\-@]>?|<@|@[\?@]|\?(?:(?:)|&|\|#>)|#(?:>>|-)|->>|[<>])[\"'`](?:[\[\{][^#\]\}]*[\]\}]+[\"'`]|\$[\.\[])|\bjson_extract\b[^\(]*\([^\)]*\)
- field: request.path
  operator: regex_match
  value: (?i)[\"'`][\[\{][^#\]\}]*[\]\}]+[\"'`]|(?:[\-@]>?|<@|@[\?@]|\?(?:(?:)|&|\|#>)|#(?:>>|-)|->>|[<>])[\"'`](?:[\[\{][^#\]\}]*[\]\}]+[\"'`]|\$[\.\[])|\bjson_extract\b[^\(]*\([^\)]*\)
- field: request.query
  operator: regex_match
  value: (?i)[\"'`][\[\{][^#\]\}]*[\]\}]+[\"'`]|(?:[\-@]>?|<@|@[\?@]|\?(?:(?:)|&|\|#>)|#(?:>>|-)|->>|[<>])[\"'`](?:[\[\{][^#\]\}]*[\]\}]+[\"'`]|\$[\.\[])|\bjson_extract\b[^\(]*\([^\)]*\)
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- path
- query


Input: CRS SQLi Rule 942120: SQL Injection Attack: SQL Operator Detected

Output:
id: safeline-942120
name: 'SQL Injection Attack: SQL Operator Detected'
description: 'Converted from CRS Rule 942120: SQL Injection Attack: SQL Operator Detected'
rule_type: regex
conditions:
- field: request.path
  operator: regex_match
  value: (?i)[!=]=|&&|\|\||->|>[=>]|<(?:[<=]|>(?:[\s\x0b]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9
- field: request.query
  operator: regex_match
  value: (?i)[!=]=|&&|\|\||->|>[=>]|<(?:[<=]|>(?:[\s\x0b]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- path
- query


Input: CRS SQLi Rule 942130: SQL Injection Attack: SQL Boolean-based attack detected

Output:
id: safeline-942130
name: 'SQL Injection Attack: SQL Boolean-based attack detected'
description: 'Converted from CRS Rule 942130: SQL Injection Attack: SQL Boolean-based
  attack detected'
rule_type: regex
conditions:
- field: request.query
  operator: regex_match
  value: (?i)[\s\x0b\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\x0b\"'-\)`]*?(?:=|<=>|(?:sounds[\s\x0b]+)?like|glob|r(?:like|egexp))[\s\x0b\"'-\)`]*?\b([0-9A-Z_a-z]+)\b
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- query


Input: CRS SQLi Rule 942131: SQL Injection Attack: SQL Boolean-based attack detected

Output:
id: safeline-942131
name: 'SQL Injection Attack: SQL Boolean-based attack detected'
description: 'Converted from CRS Rule 942131: SQL Injection Attack: SQL Boolean-based
  attack detected'
rule_type: regex
conditions:
- field: request.query
  operator: regex_match
  value: (?i)[\s\x0b\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\x0b\"'-\)`]*?(?:![<->]|<[=>]?|>=?|\^|is[\s\x0b]+not|not[\s\x0b]+(?:like|r(?:like|egexp)))[\s\x0b\"'-\)`]*?\b([0-9A-Z_a-z]+)\b
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- query


Input: CRS SQLi Rule 942150: SQL Injection Attack: SQL function name detected

Output:
id: safeline-942150
name: 'SQL Injection Attack: SQL function name detected'
description: 'Converted from CRS Rule 942150: SQL Injection Attack: SQL function name
  detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|
- field: request.query
  operator: regex_match
  value: (?i)\b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942180: Detects basic SQL authentication bypass attempts 1/3

Output:
id: safeline-942180
name: Detects basic SQL authentication bypass attempts 1/3
description: 'Converted from CRS Rule 942180: Detects basic SQL authentication bypass
  attempts 1/3'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)(?:/\*)+[\"'`]+[\s\x0b]?(?:--|[#\{]|/\*)?|[\"'`](?:[\s\x0b]*(?:(?:x?or|and|div|like|between)[\s\x0b\-0-9A-Z_a-z]+[\(\)\+-\-<->][\s\x0b]*[\"'0-9`]|[!=\|](?:[\s\x0b!\+\-0-9=]+[^\[]*[\"'\(`].*|[\s\x0
- field: request.query
  operator: regex_match
  value: (?i)(?:/\*)+[\"'`]+[\s\x0b]?(?:--|[#\{]|/\*)?|[\"'`](?:[\s\x0b]*(?:(?:x?or|and|div|like|between)[\s\x0b\-0-9A-Z_a-z]+[\(\)\+-\-<->][\s\x0b]*[\"'0-9`]|[!=\|](?:[\s\x0b!\+\-0-9=]+[^\[]*[\"'\(`].*|[\s\x0
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942200: Detects MySQL comment-/space-obfuscated injections and backtick termination

Output:
id: safeline-942200
name: Detects MySQL comment-/space-obfuscated injections and backtick termination
description: 'Converted from CRS Rule 942200: Detects MySQL comment-/space-obfuscated
  injections and backtick termination'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i),.*?[\"'\)0-9`-f][\"'`](?:[\"'`].*?[\"'`]|(?:\r?\n)?\z|[^\"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[\s\x0
- field: request.header
  operator: regex_match
  value: (?i),.*?[\"'\)0-9`-f][\"'`](?:[\"'`].*?[\"'`]|(?:\r?\n)?\z|[^\"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[\s\x0
- field: request.query
  operator: regex_match
  value: (?i),.*?[\"'\)0-9`-f][\"'`](?:[\"'`].*?[\"'`]|(?:\r?\n)?\z|[^\"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[\s\x0
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- header
- query


Input: CRS SQLi Rule 942210: Detects chained SQL injection attempts 1/2

Output:
id: safeline-942210
name: Detects chained SQL injection attempts 1/2
description: 'Converted from CRS Rule 942210: Detects chained SQL injection attempts
  1/2'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)(?:&&|\|\||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[\s\x0b\(]+[0-9A-Z_a-z]+[\s\x0b\)]*?[!\+=]+[\s\x0b0-9]*?[\"'-\)=`]|[0-9](?:[\s\x0b]*?(?:and|between|div|like|x?or)[\s\x0b]*?[0-9]+[\s\x0b]*?[
- field: request.query
  operator: regex_match
  value: (?i)(?:&&|\|\||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[\s\x0b\(]+[0-9A-Z_a-z]+[\s\x0b\)]*?[!\+=]+[\s\x0b0-9]*?[\"'-\)=`]|[0-9](?:[\s\x0b]*?(?:and|between|div|like|x?or)[\s\x0b]*?[0-9]+[\s\x0b]*?[
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942260: Detects basic SQL authentication bypass attempts 2/3

Output:
id: safeline-942260
name: Detects basic SQL authentication bypass attempts 2/3
description: 'Converted from CRS Rule 942260: Detects basic SQL authentication bypass
  attempts 2/3'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)[\"'`][\s\x0b]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|\|\||&&)[\s\x0b]+[\s\x0b0-9A-Z_a-z]+=[\s\x0b]*?[0-9A-Z_a-z]+[\s\x0b]*?having[\s\x0b]+|like[^0-9A-Z_a-z]*?[\"'0-9`])|[0-9A-Z_a-z][\
- field: request.query
  operator: regex_match
  value: (?i)[\"'`][\s\x0b]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|\|\||&&)[\s\x0b]+[\s\x0b0-9A-Z_a-z]+=[\s\x0b]*?[0-9A-Z_a-z]+[\s\x0b]*?having[\s\x0b]+|like[^0-9A-Z_a-z]*?[\"'0-9`])|[0-9A-Z_a-z][\
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942300: Detects MySQL comments, conditions and ch(a)r injections

Output:
id: safeline-942300
name: Detects MySQL comments, conditions and ch(a)r injections
description: 'Converted from CRS Rule 942300: Detects MySQL comments, conditions and
  ch(a)r injections'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: '(?i)\)[\s\x0b]*?when[\s\x0b]*?[0-9]+[\s\x0b]*?then|[\"''`][\s\x0b]*?(?:[#\{]|--)|/\*![\s\x0b]?[0-9]+|\b(?:(?:binary|cha?r)[\s\x0b]*?\([\s\x0b]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:'
- field: request.query
  operator: regex_match
  value: '(?i)\)[\s\x0b]*?when[\s\x0b]*?[0-9]+[\s\x0b]*?then|[\"''`][\s\x0b]*?(?:[#\{]|--)|/\*![\s\x0b]?[0-9]+|\b(?:(?:binary|cha?r)[\s\x0b]*?\([\s\x0b]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:'
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942310: Detects chained SQL injection attempts 2/2

Output:
id: safeline-942310
name: Detects chained SQL injection attempts 2/2
description: 'Converted from CRS Rule 942310: Detects chained SQL injection attempts
  2/2'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)(?:\([\s\x0b]*?select[\s\x0b]*?[0-9A-Z_a-z]+|coalesce|order[\s\x0b]+by[\s\x0b]+if[0-9A-Z_a-z]*?)[\s\x0b]*?\(|\*/from|\+[\s\x0b]*?[0-9]+[\s\x0b]*?\+[\s\x0b]*?@|[0-9A-Z_a-z][\"'`][\s\x0b]*?(?:(?:[\+
- field: request.query
  operator: regex_match
  value: (?i)(?:\([\s\x0b]*?select[\s\x0b]*?[0-9A-Z_a-z]+|coalesce|order[\s\x0b]+by[\s\x0b]+if[0-9A-Z_a-z]*?)[\s\x0b]*?\(|\*/from|\+[\s\x0b]*?[0-9]+[\s\x0b]*?\+[\s\x0b]*?@|[0-9A-Z_a-z][\"'`][\s\x0b]*?(?:(?:[\+
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942330: Detects classic SQL injection probings 1/3

Output:
id: safeline-942330
name: Detects classic SQL injection probings 1/3
description: 'Converted from CRS Rule 942330: Detects classic SQL injection probings
  1/3'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)[\"'`][\s\x0b]*?\b(?:x?or|div|like|between|and)\b[\s\x0b]*?[\"'`]?[0-9]|\x5cx(?:2[37]|3d)|^(?:.?[\"'`]$|[\"'\x5c`]*?(?:[\"'0-9`]+|[^\"'`]+[\"'`])[\s\x0b]*?\b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|
- field: request.query
  operator: regex_match
  value: (?i)[\"'`][\s\x0b]*?\b(?:x?or|div|like|between|and)\b[\s\x0b]*?[\"'`]?[0-9]|\x5cx(?:2[37]|3d)|^(?:.?[\"'`]$|[\"'\x5c`]*?(?:[\"'0-9`]+|[^\"'`]+[\"'`])[\s\x0b]*?\b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942340: Detects basic SQL authentication bypass attempts 3/3

Output:
id: safeline-942340
name: Detects basic SQL authentication bypass attempts 3/3
description: 'Converted from CRS Rule 942340: Detects basic SQL authentication bypass
  attempts 3/3'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)in[\s\x0b]*?\(+[\s\x0b]*?select|(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between)[\s\x0b]+|(?:\|\||&&)[\s\x0b]*?)[\s\x0b\+0-9A-Z_a-z]+(?:regexp[\s\x0b]*?\(|sounds[\s\x0b]+like[\s\x0b]*?[\"'`]|[0-
- field: request.query
  operator: regex_match
  value: (?i)in[\s\x0b]*?\(+[\s\x0b]*?select|(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between)[\s\x0b]+|(?:\|\||&&)[\s\x0b]*?)[\s\x0b\+0-9A-Z_a-z]+(?:regexp[\s\x0b]*?\(|sounds[\s\x0b]+like[\s\x0b]*?[\"'`]|[0-
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942361: Detects basic SQL injection based on keyword alter or union

Output:
id: safeline-942361
name: Detects basic SQL injection based on keyword alter or union
description: 'Converted from CRS Rule 942361: Detects basic SQL injection based on
  keyword alter or union'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i:^[\W\d]+\s*?(?:alter|union)\b)
- field: request.query
  operator: regex_match
  value: (?i:^[\W\d]+\s*?(?:alter|union)\b)
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942362: Detects concatenated basic SQL injection and SQLLFI attempts

Output:
id: safeline-942362
name: Detects concatenated basic SQL injection and SQLLFI attempts
description: 'Converted from CRS Rule 942362: Detects concatenated basic SQL injection
  and SQLLFI attempts'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[\s\x0b]+(?:char|group_concat|load_file)[\s\x0b]?\(?|end[\s\x0b]*?\);|[\s\x0b\(]load_file[\s\x0b]*?\(|[\"'`][\s\x0b]+reg
- field: request.query
  operator: regex_match
  value: (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[\s\x0b]+(?:char|group_concat|load_file)[\s\x0b]?\(?|end[\s\x0b]*?\);|[\s\x0b\(]load_file[\s\x0b]*?\(|[\"'`][\s\x0b]+reg
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942370: Detects classic SQL injection probings 2/3

Output:
id: safeline-942370
name: Detects classic SQL injection probings 2/3
description: 'Converted from CRS Rule 942370: Detects classic SQL injection probings
  2/3'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)[\"'`](?:[\s\x0b]*?(?:(?:\*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?[\"'`]|(?:x?or|div|like|between|and)[\s\x0b][^0-9]+[\-0-9A-Z_a-z]+[^0-9]*)[0-9]|[^\s\x0b0-9\?A-Z_a-z]+[\s\x0b]*?[^\s\
- field: request.header
  operator: regex_match
  value: (?i)[\"'`](?:[\s\x0b]*?(?:(?:\*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?[\"'`]|(?:x?or|div|like|between|and)[\s\x0b][^0-9]+[\-0-9A-Z_a-z]+[^0-9]*)[0-9]|[^\s\x0b0-9\?A-Z_a-z]+[\s\x0b]*?[^\s\
- field: request.query
  operator: regex_match
  value: (?i)[\"'`](?:[\s\x0b]*?(?:(?:\*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?[\"'`]|(?:x?or|div|like|between|and)[\s\x0b][^0-9]+[\-0-9A-Z_a-z]+[^0-9]*)[0-9]|[^\s\x0b0-9\?A-Z_a-z]+[\s\x0b]*?[^\s\
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- header
- query


Input: CRS SQLi Rule 942380: SQL Injection Attack

Output:
id: safeline-942380
name: SQL Injection Attack
description: 'Converted from CRS Rule 942380: SQL Injection Attack'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:having\b(?:[\s\x0b]+(?:[0-9]{1,10}|'[^=]{1,10}')[\s\x0b]*?[<->]|
    ?(?:[0-9]{1,10} ?[<->]+|[\"'][^=]{1,10}[ \"'<-\?\[]+))|ex(?:ecute(?:\(|[\s\x0b]{1,5}[\$\.0-9A-Z_a-z]{1,5}[\s\x0b]{0,3})|ists[\
- field: request.query
  operator: regex_match
  value: (?i)\b(?:having\b(?:[\s\x0b]+(?:[0-9]{1,10}|'[^=]{1,10}')[\s\x0b]*?[<->]|
    ?(?:[0-9]{1,10} ?[<->]+|[\"'][^=]{1,10}[ \"'<-\?\[]+))|ex(?:ecute(?:\(|[\s\x0b]{1,5}[\$\.0-9A-Z_a-z]{1,5}[\s\x0b]{0,3})|ists[\
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942390: SQL Injection Attack

Output:
id: safeline-942390
name: SQL Injection Attack
description: 'Converted from CRS Rule 942390: SQL Injection Attack'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:or\b(?:[\s\x0b]?(?:[0-9]{1,10}|[\"'][^=]{1,10}[\"'])[\s\x0b]?[<->]+|[\s\x0b]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[\s\x0b]*?[<->])?)|xor\b[\s\x0b]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[\s\x0b]*?[<->])?)|
- field: request.query
  operator: regex_match
  value: (?i)\b(?:or\b(?:[\s\x0b]?(?:[0-9]{1,10}|[\"'][^=]{1,10}[\"'])[\s\x0b]?[<->]+|[\s\x0b]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[\s\x0b]*?[<->])?)|xor\b[\s\x0b]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[\s\x0b]*?[<->])?)|
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942400: SQL Injection Attack

Output:
id: safeline-942400
name: SQL Injection Attack
description: 'Converted from CRS Rule 942400: SQL Injection Attack'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\band\b(?:[\s\x0b]+(?:[0-9]{1,10}[\s\x0b]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|[\"'][^=]{1,10}[\"'])
    ?[<->]+)
- field: request.query
  operator: regex_match
  value: (?i)\band\b(?:[\s\x0b]+(?:[0-9]{1,10}[\s\x0b]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|[\"'][^=]{1,10}[\"'])
    ?[<->]+)
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942410: SQL Injection Attack

Output:
id: safeline-942410
name: SQL Injection Attack
description: 'Converted from CRS Rule 942410: SQL Injection Attack'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing
- field: request.query
  operator: regex_match
  value: (?i)\b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942470: SQL Injection Attack

Output:
id: safeline-942470
name: SQL Injection Attack
description: 'Converted from CRS Rule 942470: SQL Injection Attack'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|
- field: request.query
  operator: regex_match
  value: (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942480: SQL Injection Attack

Output:
id: safeline-942480
name: SQL Injection Attack
description: 'Converted from CRS Rule 942480: SQL Injection Attack'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\b(?:(?:d(?:bms_[0-9A-Z_a-z]+\.|elete\b[^0-9A-Z_a-z]*?\bfrom)|(?:group\b.*?\bby\b.{1,100}?\bhav|overlay\b[^0-9A-Z_a-z]*?\(.*?\b[^0-9A-Z_a-z]*?plac)ing|in(?:ner\b[^0-9A-Z_a-z]*?\bjoin|sert\b[^0-9A-
- field: request.header
  operator: regex_match
  value: (?i)\b(?:(?:d(?:bms_[0-9A-Z_a-z]+\.|elete\b[^0-9A-Z_a-z]*?\bfrom)|(?:group\b.*?\bby\b.{1,100}?\bhav|overlay\b[^0-9A-Z_a-z]*?\(.*?\b[^0-9A-Z_a-z]*?plac)ing|in(?:ner\b[^0-9A-Z_a-z]*?\bjoin|sert\b[^0-9A-
- field: request.query
  operator: regex_match
  value: (?i)\b(?:(?:d(?:bms_[0-9A-Z_a-z]+\.|elete\b[^0-9A-Z_a-z]*?\bfrom)|(?:group\b.*?\bby\b.{1,100}?\bhav|overlay\b[^0-9A-Z_a-z]*?\(.*?\b[^0-9A-Z_a-z]*?plac)ing|in(?:ner\b[^0-9A-Z_a-z]*?\bjoin|sert\b[^0-9A-
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- header
- query


Input: CRS SQLi Rule 942430: Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)

Output:
id: safeline-942430
name: 'Restricted SQL Character Anomaly Detection (args): # of special characters
  exceeded (12)'
description: 'Converted from CRS Rule 942430: Restricted SQL Character Anomaly Detection
  (args): # of special characters exceeded (12)'
rule_type: regex
conditions:
- field: request.query
  operator: regex_match
  value: ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){12})
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- query


Input: CRS SQLi Rule 942440: SQL Comment Sequence Detected

Output:
id: safeline-942440
name: SQL Comment Sequence Detected
description: 'Converted from CRS Rule 942440: SQL Comment Sequence Detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: /\*!?|\*/|[';]--|--(?:[\s\x0b]|[^\-]*?-)|[^&\-]#.*?[\s\x0b]|;?\x00
- field: request.query
  operator: regex_match
  value: /\*!?|\*/|[';]--|--(?:[\s\x0b]|[^\-]*?-)|[^&\-]#.*?[\s\x0b]|;?\x00
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942450: SQL Hex Encoding Identified

Output:
id: safeline-942450
name: SQL Hex Encoding Identified
description: 'Converted from CRS Rule 942450: SQL Hex Encoding Identified'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i:\b0x[a-f\d]{3,})
- field: request.query
  operator: regex_match
  value: (?i:\b0x[a-f\d]{3,})
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942510: SQLi bypass attempt by ticks or backticks detected

Output:
id: safeline-942510
name: SQLi bypass attempt by ticks or backticks detected
description: 'Converted from CRS Rule 942510: SQLi bypass attempt by ticks or backticks
  detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?:`(?:(?:[\w\s=_\-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)
- field: request.query
  operator: regex_match
  value: (?:`(?:(?:[\w\s=_\-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942520: Detects basic SQL authentication bypass attempts 4.0/4

Output:
id: safeline-942520
name: Detects basic SQL authentication bypass attempts 4.0/4
description: 'Converted from CRS Rule 942520: Detects basic SQL authentication bypass
  attempts 4.0/4'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)[\"'`][\s\x0b]*?(?:(?:is[\s\x0b]+not|not[\s\x0b]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[\s\x0b]+like)\b|[%&\*\+\-/<->\^\|]{1,3})
- field: request.query
  operator: regex_match
  value: (?i)[\"'`][\s\x0b]*?(?:(?:is[\s\x0b]+not|not[\s\x0b]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[\s\x0b]+like)\b|[%&\*\+\-/<->\^\|]{1,3})
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942521: Detects basic SQL authentication bypass attempts 4.1/4

Output:
id: safeline-942521
name: Detects basic SQL authentication bypass attempts 4.1/4
description: 'Converted from CRS Rule 942521: Detects basic SQL authentication bypass
  attempts 4.1/4'
rule_type: regex
conditions:
- field: request.header
  operator: regex_match
  value: (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^\"]*?(?:\"[^\"]*?\"[^\"]*?)*?\"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[\s\x0b]*([0-9A-Z_a-z]+)\b
- field: request.query
  operator: regex_match
  value: (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^\"]*?(?:\"[^\"]*?\"[^\"]*?)*?\"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[\s\x0b]*([0-9A-Z_a-z]+)\b
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- header
- query


Input: CRS SQLi Rule 942522: Detects basic SQL authentication bypass attempts 4.1/4

Output:
id: safeline-942522
name: Detects basic SQL authentication bypass attempts 4.1/4
description: 'Converted from CRS Rule 942522: Detects basic SQL authentication bypass
  attempts 4.1/4'
rule_type: regex
conditions:
- field: request.query
  operator: regex_match
  value: ^.*?\x5c['\"`](?:.*?['\"`])?\s*(?:and|or)\b
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- query


Input: CRS SQLi Rule 942101: SQL Injection Attack Detected via libinjection

Output:
id: safeline-942101
name: SQL Injection Attack Detected via libinjection
description: 'Converted from CRS Rule 942101: SQL Injection Attack Detected via libinjection'
rule_type: semantic
conditions:
- field: request.path
  operator: semantic_match
  semantic_type: sqli
  threshold: 0.8
action: block
severity: critical
tags:
- sqli
- injection
- database
semantic_type: sqli
targets:
- path


Input: CRS SQLi Rule 942152: SQL Injection Attack: SQL function name detected

Output:
id: safeline-942152
name: 'SQL Injection Attack: SQL function name detected'
description: 'Converted from CRS Rule 942152: SQL Injection Attack: SQL function name
  detected'
rule_type: regex
conditions:
- field: request.header
  operator: regex_match
  value: (?i)\b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|eil(?:ing)?|o(?:alesce|ercibility|llation|(?:m
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- header


Input: CRS SQLi Rule 942321: Detects MySQL and PostgreSQL stored procedure/function injections

Output:
id: safeline-942321
name: Detects MySQL and PostgreSQL stored procedure/function injections
description: 'Converted from CRS Rule 942321: Detects MySQL and PostgreSQL stored
  procedure/function injections'
rule_type: regex
conditions:
- field: request.header
  operator: regex_match
  value: (?i)create[\s\x0b]+(?:function|procedure)[\s\x0b]*?[0-9A-Z_a-z]+[\s\x0b]*?\([\s\x0b]*?\)[\s\x0b]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][\s\x0b]*?[0-9A-Z_a-z]+|iv[\s\x0b]*?\([\+\-]*[\s\x0b\.0-9]+,[\+\-]*[\s\x
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- header


Input: CRS SQLi Rule 942251: Detects HAVING injections

Output:
id: safeline-942251
name: Detects HAVING injections
description: 'Converted from CRS Rule 942251: Detects HAVING injections'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?i)\W+\d*?\s*?\bhaving\b\s*?[^\s\-]
- field: request.query
  operator: regex_match
  value: (?i)\W+\d*?\s*?\bhaving\b\s*?[^\s\-]
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942490: Detects classic SQL injection probings 3/3

Output:
id: safeline-942490
name: Detects classic SQL injection probings 3/3
description: 'Converted from CRS Rule 942490: Detects classic SQL injection probings
  3/3'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: '[\"''`][\s\d]*?[^\w\s]\W*?\d\W*?.*?[\"''`\d]'
- field: request.query
  operator: regex_match
  value: '[\"''`][\s\d]*?[^\w\s]\W*?\d\W*?.*?[\"''`\d]'
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942420: Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)

Output:
id: safeline-942420
name: 'Restricted SQL Character Anomaly Detection (cookies): # of special characters
  exceeded (8)'
description: 'Converted from CRS Rule 942420: Restricted SQL Character Anomaly Detection
  (cookies): # of special characters exceeded (8)'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){8})
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie


Input: CRS SQLi Rule 942431: Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)

Output:
id: safeline-942431
name: 'Restricted SQL Character Anomaly Detection (args): # of special characters
  exceeded (6)'
description: 'Converted from CRS Rule 942431: Restricted SQL Character Anomaly Detection
  (args): # of special characters exceeded (6)'
rule_type: regex
conditions:
- field: request.query
  operator: regex_match
  value: ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){6})
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- query


Input: CRS SQLi Rule 942460: Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters

Output:
id: safeline-942460
name: Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters
description: 'Converted from CRS Rule 942460: Meta-Character Anomaly Detection Alert
  - Repetitive Non-Word Characters'
rule_type: regex
conditions:
- field: request.query
  operator: regex_match
  value: \W{4}
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- query


Input: CRS SQLi Rule 942511: SQLi bypass attempt by ticks detected

Output:
id: safeline-942511
name: SQLi bypass attempt by ticks detected
description: 'Converted from CRS Rule 942511: SQLi bypass attempt by ticks detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: (?:'(?:(?:[\w\s=_\-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')
- field: request.query
  operator: regex_match
  value: (?:'(?:(?:[\w\s=_\-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942530: SQLi query termination detected

Output:
id: safeline-942530
name: SQLi query termination detected
description: 'Converted from CRS Rule 942530: SQLi query termination detected'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: ''';'
- field: request.query
  operator: regex_match
  value: ''';'
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie
- query


Input: CRS SQLi Rule 942421: Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)

Output:
id: safeline-942421
name: 'Restricted SQL Character Anomaly Detection (cookies): # of special characters
  exceeded (3)'
description: 'Converted from CRS Rule 942421: Restricted SQL Character Anomaly Detection
  (cookies): # of special characters exceeded (3)'
rule_type: regex
conditions:
- field: request.cookie
  operator: regex_match
  value: ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){3})
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- cookie


Input: CRS SQLi Rule 942432: Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)

Output:
id: safeline-942432
name: 'Restricted SQL Character Anomaly Detection (args): # of special characters
  exceeded (2)'
description: 'Converted from CRS Rule 942432: Restricted SQL Character Anomaly Detection
  (args): # of special characters exceeded (2)'
rule_type: regex
conditions:
- field: request.query
  operator: regex_match
  value: ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){2})
action: block
severity: medium
tags:
- sqli
- injection
- database
targets:
- query