Skip to content

Commit d2cef41

Browse files
author
jens
committed
Update regression tests for libinjection v4 compatibility
1 parent e1a527e commit d2cef41

File tree

2 files changed

+608
-8
lines changed

2 files changed

+608
-8
lines changed

‎test/test-cases/regression/operator-detectsqli.json‎

Lines changed: 327 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
{
33
"enabled": 1,
44
"version_min": 300000,
5-
"title": "Testing Operator :: @detectSQLi",
65
"client": {
76
"ip": "200.249.12.31",
87
"port": 123
@@ -11,6 +10,18 @@
1110
"ip": "200.249.12.31",
1211
"port": 80
1312
},
13+
"response": {
14+
"headers": {
15+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
16+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
17+
"Content-Type": "text/html",
18+
"Content-Length": "8"
19+
},
20+
"body": [
21+
"no need."
22+
]
23+
},
24+
"title": "Testing Operator :: @detectSQLi :: known stable fingerprint ascii substring",
1425
"request": {
1526
"headers": {
1627
"Host": "localhost",
@@ -25,6 +36,212 @@
2536
"param1=ascii(substring(version() from 1 for 1))&param2=value2"
2637
]
2738
},
39+
"expected": {
40+
"http_code": 403,
41+
"debug_log": "Added DetectSQLi match TX.0: f\\(f\\(f"
42+
},
43+
"rules": [
44+
"SecRuleEngine On",
45+
"SecRule ARGS \"@detectSQLi\" \"id:1201,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
46+
"SecRule TX:sqli_hit \"@eq 1\" \"id:2201,phase:2,deny,status:403\""
47+
]
48+
},
49+
{
50+
"enabled": 1,
51+
"version_min": 300000,
52+
"client": {
53+
"ip": "200.249.12.31",
54+
"port": 123
55+
},
56+
"server": {
57+
"ip": "200.249.12.31",
58+
"port": 80
59+
},
60+
"response": {
61+
"headers": {
62+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
63+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
64+
"Content-Type": "text/html",
65+
"Content-Length": "8"
66+
},
67+
"body": [
68+
"no need."
69+
]
70+
},
71+
"title": "Testing Operator :: @detectSQLi :: trim still detects stable fingerprint",
72+
"request": {
73+
"headers": {
74+
"Host": "localhost",
75+
"User-Agent": "curl/7.38.0",
76+
"Accept": "*/*",
77+
"Content-Length": "67",
78+
"Content-Type": "application/x-www-form-urlencoded"
79+
},
80+
"uri": "/",
81+
"method": "POST",
82+
"body": [
83+
"param1= ascii(substring(version() from 1 for 1)) &param2=value2"
84+
]
85+
},
86+
"expected": {
87+
"http_code": 403,
88+
"debug_log": "Added DetectSQLi match TX.0: f\\(f\\(f"
89+
},
90+
"rules": [
91+
"SecRuleEngine On",
92+
"SecRule ARGS \"@detectSQLi\" \"id:1202,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
93+
"SecRule TX:sqli_hit \"@eq 1\" \"id:2202,phase:2,deny,status:403\""
94+
]
95+
},
96+
{
97+
"enabled": 1,
98+
"version_min": 300000,
99+
"client": {
100+
"ip": "200.249.12.31",
101+
"port": 123
102+
},
103+
"server": {
104+
"ip": "200.249.12.31",
105+
"port": 80
106+
},
107+
"response": {
108+
"headers": {
109+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
110+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
111+
"Content-Type": "text/html",
112+
"Content-Length": "8"
113+
},
114+
"body": [
115+
"no need."
116+
]
117+
},
118+
"title": "Testing Operator :: @detectSQLi :: boolean based payload",
119+
"request": {
120+
"headers": {
121+
"Host": "localhost",
122+
"User-Agent": "curl/7.38.0",
123+
"Accept": "*/*",
124+
"Content-Length": "33",
125+
"Content-Type": "application/x-www-form-urlencoded"
126+
},
127+
"uri": "/",
128+
"method": "POST",
129+
"body": [
130+
"param1=' or 1=1 -- &param2=value2"
131+
]
132+
},
133+
"expected": {
134+
"http_code": 403
135+
},
136+
"rules": [
137+
"SecRuleEngine On",
138+
"SecRule ARGS \"@detectSQLi\" \"id:1203,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
139+
"SecRule TX:sqli_hit \"@eq 1\" \"id:2203,phase:2,deny,status:403\""
140+
]
141+
},
142+
{
143+
"enabled": 1,
144+
"version_min": 300000,
145+
"client": {
146+
"ip": "200.249.12.31",
147+
"port": 123
148+
},
149+
"server": {
150+
"ip": "200.249.12.31",
151+
"port": 80
152+
},
153+
"response": {
154+
"headers": {
155+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
156+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
157+
"Content-Type": "text/html",
158+
"Content-Length": "8"
159+
},
160+
"body": [
161+
"no need."
162+
]
163+
},
164+
"title": "Testing Operator :: @detectSQLi :: union select variation",
165+
"request": {
166+
"headers": {
167+
"Host": "localhost",
168+
"User-Agent": "curl/7.38.0",
169+
"Accept": "*/*",
170+
"Content-Length": "46",
171+
"Content-Type": "application/x-www-form-urlencoded"
172+
},
173+
"uri": "/",
174+
"method": "POST",
175+
"body": [
176+
"param1=-1 union select 1,2,3 -- &param2=value2"
177+
]
178+
},
179+
"expected": {
180+
"http_code": 403
181+
},
182+
"rules": [
183+
"SecRuleEngine On",
184+
"SecRule ARGS \"@detectSQLi\" \"id:1204,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
185+
"SecRule TX:sqli_hit \"@eq 1\" \"id:2204,phase:2,deny,status:403\""
186+
]
187+
},
188+
{
189+
"enabled": 1,
190+
"version_min": 300000,
191+
"client": {
192+
"ip": "200.249.12.31",
193+
"port": 123
194+
},
195+
"server": {
196+
"ip": "200.249.12.31",
197+
"port": 80
198+
},
199+
"response": {
200+
"headers": {
201+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
202+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
203+
"Content-Type": "text/html",
204+
"Content-Length": "8"
205+
},
206+
"body": [
207+
"no need."
208+
]
209+
},
210+
"title": "Testing Operator :: @detectSQLi :: time function payload",
211+
"request": {
212+
"headers": {
213+
"Host": "localhost",
214+
"User-Agent": "curl/7.38.0",
215+
"Accept": "*/*",
216+
"Content-Length": "38",
217+
"Content-Type": "application/x-www-form-urlencoded"
218+
},
219+
"uri": "/",
220+
"method": "POST",
221+
"body": [
222+
"param1=1;select sleep(1)&param2=value2"
223+
]
224+
},
225+
"expected": {
226+
"http_code": 403
227+
},
228+
"rules": [
229+
"SecRuleEngine On",
230+
"SecRule ARGS \"@detectSQLi\" \"id:1205,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
231+
"SecRule TX:sqli_hit \"@eq 1\" \"id:2205,phase:2,deny,status:403\""
232+
]
233+
},
234+
{
235+
"enabled": 1,
236+
"version_min": 300000,
237+
"client": {
238+
"ip": "200.249.12.31",
239+
"port": 123
240+
},
241+
"server": {
242+
"ip": "200.249.12.31",
243+
"port": 80
244+
},
28245
"response": {
29246
"headers": {
30247
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
@@ -36,13 +253,120 @@
36253
"no need."
37254
]
38255
},
256+
"title": "Testing Operator :: @detectSQLi :: inline comment obfuscation",
257+
"request": {
258+
"headers": {
259+
"Host": "localhost",
260+
"User-Agent": "curl/7.38.0",
261+
"Accept": "*/*",
262+
"Content-Length": "35",
263+
"Content-Type": "application/x-www-form-urlencoded"
264+
},
265+
"uri": "/",
266+
"method": "POST",
267+
"body": [
268+
"param1=1/**/or/**/1=1&param2=value2"
269+
]
270+
},
271+
"expected": {
272+
"http_code": 403
273+
},
274+
"rules": [
275+
"SecRuleEngine On",
276+
"SecRule ARGS \"@detectSQLi\" \"id:1206,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
277+
"SecRule TX:sqli_hit \"@eq 1\" \"id:2206,phase:2,deny,status:403\""
278+
]
279+
},
280+
{
281+
"enabled": 1,
282+
"version_min": 300000,
283+
"client": {
284+
"ip": "200.249.12.31",
285+
"port": 123
286+
},
287+
"server": {
288+
"ip": "200.249.12.31",
289+
"port": 80
290+
},
291+
"response": {
292+
"headers": {
293+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
294+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
295+
"Content-Type": "text/html",
296+
"Content-Length": "8"
297+
},
298+
"body": [
299+
"no need."
300+
]
301+
},
302+
"title": "Testing Operator :: @detectSQLi :: benign identifier with sql words",
303+
"request": {
304+
"headers": {
305+
"Host": "localhost",
306+
"User-Agent": "curl/7.38.0",
307+
"Accept": "*/*",
308+
"Content-Length": "38",
309+
"Content-Type": "application/x-www-form-urlencoded"
310+
},
311+
"uri": "/",
312+
"method": "POST",
313+
"body": [
314+
"param1=selective_catalog&param2=normal"
315+
]
316+
},
317+
"expected": {
318+
"http_code": 200
319+
},
320+
"rules": [
321+
"SecRuleEngine On",
322+
"SecRule ARGS \"@detectSQLi\" \"id:1207,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
323+
"SecRule TX:sqli_hit \"@eq 1\" \"id:2207,phase:2,deny,status:403\""
324+
]
325+
},
326+
{
327+
"enabled": 1,
328+
"version_min": 300000,
329+
"client": {
330+
"ip": "200.249.12.31",
331+
"port": 123
332+
},
333+
"server": {
334+
"ip": "200.249.12.31",
335+
"port": 80
336+
},
337+
"response": {
338+
"headers": {
339+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
340+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
341+
"Content-Type": "text/html",
342+
"Content-Length": "8"
343+
},
344+
"body": [
345+
"no need."
346+
]
347+
},
348+
"title": "Testing Operator :: @detectSQLi :: numeric edge case should not match",
349+
"request": {
350+
"headers": {
351+
"Host": "localhost",
352+
"User-Agent": "curl/7.38.0",
353+
"Accept": "*/*",
354+
"Content-Length": "23",
355+
"Content-Type": "application/x-www-form-urlencoded"
356+
},
357+
"uri": "/",
358+
"method": "POST",
359+
"body": [
360+
"param1=100001&param2=42"
361+
]
362+
},
39363
"expected": {
40-
"debug_log": "Added DetectSQLi match TX.0: f\\(f\\(f",
41364
"http_code": 200
42365
},
43366
"rules": [
44367
"SecRuleEngine On",
45-
"SecRule ARGS \"@detectSQLi\" \"id:1,phase:2,capture,pass,t:trim\""
368+
"SecRule ARGS \"@detectSQLi\" \"id:1208,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
369+
"SecRule TX:sqli_hit \"@eq 1\" \"id:2208,phase:2,deny,status:403\""
46370
]
47371
}
48372
]

0 commit comments

Comments
 (0)