# --------------------------------------------------------------- # Core ModSecurity Rule Set ver.2.2.0 # Copyright (C) 2006-2011 Trustwave All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under # Apache Software License (ASL) version 2 # Please see the enclosed LICENCE file for full details. # --------------------------------------------------------------- # # NOTE By default the status code sent is 501, which implies that the web # server does not support the required operation. This is a non standard # of this status code which normally refers to unsupported HTTP methods. # It is used in order to confuse automated clients and scanners. # Zope Information Leakage SecRule RESPONSE_BODY "

Site Error<\/h2>.{0,20}
An error was encountered while publishing this resource\." \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Zope Information Leakage',id:'970007',tag:'LEAKAGE/ERRORS_ZOPE',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" # CF Information Leakage SecRule RESPONSE_BODY "\bThe error occurred in\b.{0,100}: line\b.{0,1000}\bColdFusion\b.?\bStack Trace $click to expand$" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Cold Fusion Information Leakage',id:'970008',tag:'LEAKAGE/ERRORS_CF',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" # PHP Information Leakage SecRule RESPONSE_BODY "Warning<\/b>.{0,100}?:.{0,1000}?\bon line\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP Information Leakage',id:'970009',tag:'LEAKAGE/ERRORS_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" # ISA server existence revealed SecRule RESPONSE_BODY "\b403 Forbidden\b.?\bInternet Security and Acceleration Server\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ISA server existence revealed',id:'970010',tag:'MISCONFIGURATION',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-MISCONFIGURATION-%{matched_var_name}=%{tx.0}" # Microsoft Office document properties leakage SecRule RESPONSE_BODY "" \ "phase:4,rev:'2.2.0',t:none,capture,block,msg:'Microsoft Office document properties leakage',id:'970012',tag:'LEAKAGE/INFO_STATISTICS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\<\%" "phase:4,rev:'2.2.0',chain,t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'970903',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3'" SecRule RESPONSE_BODY "!(?:\b(?:(?:i(?:nterplay|hdr|d3)|m(?:ovi|thd)|r(?:ar!|iff)|(?:ex|jf)if|f(?:lv|ws)|varg|cws)\b|gif)|B(?:%pdf|\.ra)\b)" "t:none,capture,setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" # CF source code leakage SecRule RESPONSE_BODY ".{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| $0x80040e31$
Timeout expired
)|

internal server error<\/h1>.?
part of the server has crashed or it has a configuration error\.<\/h2>|cannot connect to the server: timed out)" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'The application is not available',id:'970118',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-AVAILABILITY/APP_NOT_AVAIL-%{matched_var_name}=%{tx.0}" # Weblogic information disclosure SecRule RESPONSE_STATUS "^500$" "phase:4,rev:'2.2.0',chain,t:none,capture,ctl:auditLogParts=+E,block,msg:'WebLogic information disclosure',id:'970021',severity:'3'" SecRule RESPONSE_BODY "JSP compile error<\/title>" "t:none,capture,setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" # File or Directory Names Leakage SecRule RESPONSE_BODY "href\s?=[\s\"\'][A-Za-z]\:\x5c([^\"\']+)" "phase:4,rev:'2.2.0',chain,capture,t:none,capture,ctl:auditLogParts=+E,block,msg:'File or Directory Names Leakage',id:'970011',tag:'LEAKAGE/INFO_FILE',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3'" SecRule TX:1 "!program files\x5cmicrosoft office\x5c(?:office|templates)" "t:none,capture,t:lowercase,setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" # # IFrame Injection # SecRule RESPONSE_BODY "!@pm iframe" \ "phase:4,rev:'2.2.0',id:'981177',t:none,capture,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,pass,nolog,skipAfter:END_IFRAME_CHECK" SecRule RESPONSE_BODY "<\Wiframe[^>]+?\b(?:width|height)\b\W?=\W?[\"']?[^\"'1-9]?(?:(?:20|1?\d(?:\.\d)?)(?![\d%.])|[0-3](?:\.\d)?%)" \ "t:replaceComments,phase:4,rev:'2.2.0',ctl:auditLogParts=+E,block,msg:'Possibly malicious iframe tag in output',id:'981000',tag:'MALICIOUS_IFRAME',severity:'4',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-MALICIOUS_IFRAME-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "<\Wiframe[^>]+?\bstyle\W?=\W?[\"']?\W?\bdisplay\b\W?:\W?\bnone\b" \ "t:replaceComments,phase:4,rev:'2.2.0',ctl:auditLogParts=+E,block,msg:'Possibly malicious iframe tag in output',id:'981001',tag:'MALICIOUS_IFRAME',severity:'4',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-MALICIOUS_IFRAME-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "(?i:<\sIFRAME\s?[^>]?src=\"javascript:)" \ "t:none,phase:4,rev:'2.2.0',ctl:auditLogParts=+E,block,msg:'Malicious iframe+javascript tag in output',id:'981003',tag:'MALICIOUS_IFRAME',tag:'bugtraq,13544',severity:'4',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-MALICIOUS_IFRAME-%{matched_var_name}=%{tx.0}" SecMarker END_IFRAME_CHECK # # Generic Malicious JS Detection # SecRule RESPONSE_BODY "(?i)(String\.fromCharCode\(.?){4,}" \ "t:none,phase:4,rev:'2.2.0',ctl:auditLogParts=+E,block,msg:'Potential Obfuscated Javascript in Output - Excessive fromCharCode',capture,logdata:'%{tx.0}',id:'981004',tag:'MALICIOUS_CODE',tag:'bugtraq,13544',severity:'4',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-MALICIOUS_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "(?i)(eval\(.{0,15}unescape\()" \ "t:none,phase:4,rev:'2.2.0',ctl:auditLogParts=+E,block,msg:'Potential Obfuscated Javascript in Output - Eval+Unescape',capture,logdata:'%{tx.0}',id:'981005',tag:'MALICIOUS_CODE',tag:'bugtraq,13544',severity:'4',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-MALICIOUS_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "(?i)(var[^=]+=\sunescape\s;)" \ "t:none,phase:4,rev:'2.2.0',ctl:auditLogParts=+E,block,msg:'Potential Obfuscated Javascript in Output - Unescape',capture,logdata:'%{tx.0}',id:'981006',tag:'MALICIOUS_CODE',tag:'bugtraq,13544',severity:'4',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-MALICIOUS_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "(?i:%u0c0c%u0c0c|%u9090%u9090|%u4141%u4141)" \ "t:none,phase:4,rev:'2.2.0',ctl:auditLogParts=+E,block,msg:'Potential Obfuscated Javascript in Output - Heap Spray',id:'981007',tag:'MALICIOUS_CODE',tag:'bugtraq,13544',severity:'4',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-MALICIOUS_CODE-%{matched_var_name}=%{tx.0}" # # Detect possible links to malware domains # SecRule RESPONSE_BODY "@pmFromFile modsecurity_50_outbound_malware.data" "phase:4,rev:'2.2.0',t:none,ctl:auditLogParts=+E,pass,nolog,auditlog,msg:'Possible link to malware domain in output',id:'981002',tag:'MALWARE_LINK',severity:'4',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-MALICIOUS_LINK-%{matched_var_name}=%{tx.0}" # # Detect Malicious JS code in resposne bodies # # # Run PM check against response body data before running any RegEx Checks # If nothing matches, then we skip the remainder of phase:4 # SecRule RESPONSE_BODY "!@pmFromFile modsecurity_50_outbound.data" \ "phase:4,rev:'2.2.0',pass,id:'981178',t:none,capture,t:urlDecodeUni,t:htmlEntityDecode,nolog,skipAfter:END_OUTBOUND_CHECK" # ASP/JSP source code leakage SecRule RESPONSE_BODY "\bwscript\.shell\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971379',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "<jsp:" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971300',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\.addheader\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971360',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bserver\.execute\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971373',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bserver\.mappath\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971375',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bresponse\.binarywrite\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971369',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bserver\.createobject\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971372',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\.createtextfile\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971361',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bwscript\.network\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971378',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bvbscript\.encode\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971377',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bserver\.htmlencode\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971374',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bjavax\.servlet" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971301',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bscripting\.filesystemobject\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971371',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bserver\.urlencode\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971376',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\.getfile\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971362',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\.loadfromfile\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971363',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bresponse\.write\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'ASP/JSP source code leakage',id:'971370',tag:'LEAKAGE/SOURCE_CODE_ASP_JSP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" # PHP source code leakage SecRule RESPONSE_BODY "\bproc_open\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958976',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bgzread\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958972',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bftp_nb_fget\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958963',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bftp_nb_get\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958965',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bfscanf\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958959',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\breadfile\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958978',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bfgetss\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958955',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\$_post\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958941',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bsession_start\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958982',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\breaddir\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958977',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bgzwrite\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958973',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bscandir\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958981',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bftp_get\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958962',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bfread\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958958',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\breadgzfile\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958979',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bftp_put\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958967',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bfwrite\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958968',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bgzencode\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958970',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bfopen\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958957',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\$_session\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958942',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bftp_nb_fput\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958964',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bftp_fput\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958961',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bgzcompress\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958969',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bbzopen\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958946',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bgzopen\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958971',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bfgetc\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958953',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bmove_uploaded_file\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958975',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bftp_nb_put\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958966',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bcall_user_func\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958983',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\$_get\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958940',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bfgets\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958954',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bftp_fget\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'958960',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "<\?(?!xml)" \ "phase:4,rev:'2.2.0',chain,t:none,capture,ctl:auditLogParts=+E,block,msg:'PHP source code leakage',id:'970902',tag:'LEAKAGE/SOURCE_CODE_PHP',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3'" SecRule RESPONSE_BODY "!(?:\b(?:(?:i(?:nterplay|hdr|d3)|m(?:ovi|thd)|r(?:ar!|iff)|(?:ex|jf)if|f(?:lv|ws)|varg|cws)\b|gif)|B(?:%pdf|\.ra)\b)" "t:none,capture,setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/SOURCE_CODE-%{matched_var_name}=%{tx.0}" # Statistics pages revealed SecRule RESPONSE_BODY "\bThis summary was generated by.{0,100}?webcruncher\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971019',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThese statistics were produced by PeLAB\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971011',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThis summary was generated by.{0,100}?analog\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971020',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThis summary was generated by.{0,100}?Jware\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971018',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThis summary was generated by.{0,100}?wwwstat\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971014',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThis analysis was produced by.{0,100}?calamaris\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971022',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThis report was generated by WebLog\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971013',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\b[gG]enerated by.{0,100}?[Ww]ebalizer\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971024',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThese statistics were produced by getstats\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971010',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThis analysis was produced by.{0,100}?EasyStat\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971023',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThis analysis was produced by.{0,100}?analog\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Statistics Information Leakage',id:'971021',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" # SQL Errors leakage SecRule RESPONSE_BODY "\bCould not find server \'\w+\' in sysservers\. execute sp_addlinkedserver\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971154',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bSyntax error converting the \w+ value .? to a column of data type\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971153',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bORA-\d{5}\: " \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971198',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bUnclosed quotation mark before the character string\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971092',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\[Microsoft\]\[ODBC " \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971197',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\berror \'800a01b8\'" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971069',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bYou have an error in your SQL syntax near \'" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971094',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bmicrosoft jet database engine error \'8" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971072',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bselect list because it is not contained in an aggregate function and there is no GROUP BY clause\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971086',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bUnable to connect to PostgreSQL server\:" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971091',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bPostgreSQL query failed\:" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971068',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bsupplied argument is not a valid MS SQL\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971158',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bsupplied argument is not a valid Oracle\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971157',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bWarning: mysql_connect\:" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971093',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bsupplied argument is not a valid ODBC\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971159',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bMicrosoft OLE DB Provider for .{0,30} [eE]rror '" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971076',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bSQL Server does not exist or access denied\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971096',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bEither BOF or EOF is True, or the current record has been deleted; the operation\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971099',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bcannot take a \w+ data type as an argument\." \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971060',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bselect list because it is not contained in either an aggregate function or the GROUP BY clause\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971087',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bThe column prefix .{0,50}? does not match with a table name or alias name used in the query\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971155',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bsupplied argument is not a valid PostgreSQL result\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971088',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bYou have an error in your SQL syntax;" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971150',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bsupplied argument is not a valid MySQL\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971156',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bEither BOF or EOF is True, or the current record has been deleted. Requested\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971067',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bincorrect syntax near (?:\'|the\b|\@\@error\b)" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'SQL Information Leakage',id:'971152',tag:'LEAKAGE/ERRORS_SQL',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" # IIS Errors leakage SecRule RESPONSE_BODY "\<b\>Version Information\:\<\/b\>(?: |\s)Microsoft \.NET Framework Version\:" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971123',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY ">error \'ASP\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971111',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\berror \'800" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971116',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\<b\>Version Information\:\<\/b\>(?: |\s)ASP\.NET Version\:" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971124',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bA trappable error occurred in an external object\. The script cannot continue running\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971122',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bMicrosoft VBScript runtime Error\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971125',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bMicrosoft VBScript compilation \(0x8\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971121',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "/[Ee]rror[Mm]essage\.aspx\?[Ee]rror\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971113',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bMicrosoft VBScript runtime \(0x8\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971126',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bObject required\: \'" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971112',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bADODB\.Command\b.{0,100}?\bApplication uses a value of the wrong type for the current operation\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971115',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "/[Ee]rror[Mm]essage\.asp\?[Ee]rror\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971127',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bADODB\.Command\b.{0,100}?\berror\'" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971114',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bMicrosoft VBScript compilation error\b" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'971119',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "\bServer Error in.{0,50}?\bApplication\b" \ "phase:4,rev:'2.2.0',chain,t:none,capture,ctl:auditLogParts=+E,block,msg:'IIS Information Leakage',id:'970904',tag:'LEAKAGE/ERRORS_IIS',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3'" SecRule RESPONSE_STATUS "!^404$" "t:none,capture,setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" # Directory Listing SecRule RESPONSE_BODY ">[To Parent Directory]</[Aa]><br>" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Directory Listing',id:'971202',tag:'LEAKAGE/INFO_DIRECTORY_LISTING',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "<TITLE>Index of.?<H1>Index of" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Directory Listing',id:'971201',tag:'LEAKAGE/INFO_DIRECTORY_LISTING',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_BODY "<title>Index of.*?<h1>Index of" \ "phase:4,rev:'2.2.0',t:none,capture,ctl:auditLogParts=+E,block,msg:'Directory Listing',id:'971200',tag:'LEAKAGE/INFO_DIRECTORY_LISTING',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=%{rule.msg}',setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-LEAKAGE/INFO-%{matched_var_name}=%{tx.0}" SecMarker END_OUTBOUND_CHECK