Rules 950901, 960024, 981173,981211,973335
Get almost alway triggered by extended ascii characters like čžš (hope this
will come trough correctly, this are czs with scarons)
Se example bellow:
--1f07a55c-A--
[10/Sep/2011:10:57:51 +0200] Tmsmj1u5ziUAAG15Cb8AAAAC xxxx 3328 xxxx 80
--1f07a55c-B--
POST /index.php HTTP/1.1
Host: www.xxx.net
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: sl,en-gb;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7
Connection: keep-alive
Referer:
http://www.xxx.net/index.php?option=com_content&task=new§ionid=4&Itemid=0
Cookie: fboard_settings[current_view]=flat;
__utma=47285926.1656474622.1312483112.1315605425.1315645025.5;
__utmz=47285926.1312483112.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);
fboard_settings[member_id]=101;
56269b42eb162bb930fa4936a548dbaf=a167eb13da3c2f96df9fa5c974092a74;
__utmc=47285926; adp_partner=1; __utmb=47285926
Content-Type: application/x-www-form-urlencoded
Content-Length: 4319
--1f07a55c-C--
title=test&catid=69&introtext=Dokaj+je+peres+pisalo+o+dogodkih+njega+dni%2C%3Cbr+%2F%3E%0D%0Aa+poet+vsekdar+druga%C4%8De+videl%2C+%C4%8Dutil+je+stvari.%3Cbr+%2F%3E%0D%0ADa+je+svet+pokvarjen+vemo%3A+vidimo+in+sli%C5%A1imo%2C%3Cbr+%2F%3E%0D%0Akdaj+je+pesem+skrpucalo+pa+lahko+%C5%A1e+%C4%8Dutimo.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0AErvin+Fritz+je+pesnik+vrli%2C+ki+ostro+vihti+pero%2C%3Cbr+%2F%3E%0D%0Ada+z+umetni%C5%A1kim+vtisom%2C+me%C5%A1a+drek+in+seje+zlo.%3Cbr+%2F%3E%0D%0AV+te%C5%BEkih+%C4%8Dasih+komunizma+ritolizil+je+oblast%2C%3Cbr+%2F%3E%0D%0Aa+sedaj%2C+na+stara+leta%2C+na%C5%A1el+novo+si+je+strast.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0AMoritat+o+Jan%C5%BEi+Jan%C5%BEu%2C+njega+novi+umotvor%2C%3Cbr+%2F%3E%0D%0Az+domi%C5%A1lijsko+nam+satiro+slika+Jan%C5%A1e+samomor.%3Cbr+%2F%3E%0D%0AS+tem+pogro%C5%A1nim%2C+bednim+%C5%A1undom+se+pobrati+z+oblastjo%2C%3Cbr+%2F%3E%0D%0Avsem+ostalim+pa+nasuje+peska+%C5%BEgo%C4%8Dega+v+oko.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0ANa
jprej+s+cipo+Ur%C5%A1ko+zmerja%2C+%26quot%3Bza+prav+vsak+madrac%26quot%3B%2C+da+je%3Cbr+%2F%3E%0D%0Ain+nato%2C+nose%C4%8Di+-+z+vinom%2C+da+naliva+se.%3Cbr+%2F%3E%0D%0ANa+petrolu+mo%C5%BE+in+%C5%BEena+naj+bi+se+ustavila%2C%3Cbr+%2F%3E%0D%0As+fla%C5%A1o+vina+pod+pazduho+-+brez+pla%C4%8Dila+naj+bi+%C5%A1la.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0AJanezu+o%C4%8Dita+gore%2C+%C4%8De%C5%A1+da+%26quot%3Bosvajalec%26quot%3B+je%2C%3Cbr+%2F%3E%0D%0Apa+%C4%8Deprav+so+hribi+na%C5%A1i+le+sprehod+za+romarje.%3Cbr+%2F%3E%0D%0AHkrati+pljuva+po+desnici%2C+%C4%8De%C5%A1%2C+da+kraja+vle%C4%8De+jo%3Cbr+%2F%3E%0D%0Av+de%C5%BEelo+senc+in+greha+-+grobnico+politi%C4%8Dno.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0AOro%C5%BEarsko%2C+glej%2C+afero%2C+na%C5%A1+privle%C4%8De+Fritz+na+dan%2C%3Cbr+%2F%3E%0D%0Akuje+hladno+rad+%C5%BEelezo%2C+kot+kak+stari+partizan.%3Cbr+%2F%3E%0D%0APa+tajkune+rad+pograja+%28%C4%8De%C5%A1%2C+saj+vem%2C+prav+tak%C5%A1en+si%29%2C%3Cbr+%2F%3E%0D%0Ahkrati+pa+ga+v+zvezde
+kuje%2C+ker+je+%26quot%3Bcvet+nedol%C5%BEnosti%26quot%3B.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0AZliva+gnev+in+bes+in+%C5%BEveplo%2C+la%C5%BE+v+satiro+prelevi%2C%3Cbr+%2F%3E%0D%0Av+resnici+-+glava+prazna+-+le+sovra%C5%A1tvo+vzbudi.%3Cbr+%2F%3E%0D%0APrav+na+koncu+pa+%C5%A1e+enkrat%2C+malo+norca+brije+se%3Cbr+%2F%3E%0D%0Aiz+premajhne+mu+de%C5%BEele%2C+Liliput-Slovenije.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0AVsako+teslo+z+doktoratom%2C+vsak+politik%2C+liberal%2C%3Cbr+%2F%3E%0D%0Afilozofski+pesnik%2C+dohtar%2C+vsak+boskur%2C+psoljub+in+far%2C%3Cbr+%2F%3E%0D%0Avsa+golazen+zarotila+se+je+drug+prot%27+drugemu%2C%3Cbr+%2F%3E%0D%0Aen+%C4%8Dez+drugega+udriha%2C+le+dr%C5%BEava+gre+po+zlu.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0ABrez+srca+so+vsi+po+vrsti%2C+pravega+duha+nikjer%3Cbr+%2F%3E%0D%0Aa+le+eno+je+pomembno%3A+to%2C+da+netimo+prepir.%3Cbr+%2F%3E%0D%0ATo+so+misli+na%C5%A1e+klene%2C+to+Slovenca+je+srce%2C%3Cbr+%2F%3E%0D%0Asaj+ni+%C4%8Dudno%2C+da+de%C5%BEela+prav+zares+k+
Hudi%C4%8Du+gre.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0A%C4%8Ce+pred+nekaj+desetletji+rde%C4%8Di+vrag+bi+ne+pri%C5%A1el%3Cbr+%2F%3E%0D%0Aiz+ledenega+oklepa+carstva+kjer+porodil+ga+je+gnev%2C%3Cbr+%2F%3E%0D%0Ana%C5%A1+kavarni%C5%A1ki+brezdelne%C5%BE%2C+grob%2C+neuk%2C+nasilen%2C+len%2C%3Cbr+%2F%3E%0D%0Abi+ne+menjal+vr%C4%8Dka+piva+za+gevir+in+pas+in+%C5%A1lem%2C%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0Abratomorno+vojno+netil%2C+klal%2C+pobijal+ustrahoval%2C%3Cbr+%2F%3E%0D%0Apotlej+barvo+hitro+menjal+in+zasluge+vse+pobral.%3Cbr+%2F%3E%0D%0AIn+%C5%A1e+danes+bi+po+zemlji+na%C5%A1i+zdrav+in+klen+slovenski+rod%3Cbr+%2F%3E%0D%0Ahodil%2C+delal%2C+%C5%BEivel%2C+ljubil%2C+korenine+vra%C5%A1%C4%8Dal+tod.%3Cbr+%2F%3E%0D%0A%3Cbr+%2F%3E%0D%0AA+tako+ostaja+zmeda%3A+kup+ljudi+brez+cilja+je%2C%3Cbr+%2F%3E%0D%0Abrez+prepri%C4%8Danj%2C+smisla%2C+vere%2C+brez+zavesti+narodne.%3Cbr+%2F%3E%0D%0AVrli+Fritz+se+temu+roga%2C+olja+v+ogenj+vliva+rad%2C%3Cbr+%2F%3E%0D%0Ako+prodaja+la%C5%BE+-
+satiro%2C+kosti+gloda+bratu+brat.%0D%0A&fulltext=&folders=%2F&_source=&_align=&_alt=&_border=&_caption=&_caption_position=bottom&_caption_align=&_width=&state=0&access=0&created_by_alias=&ordering=0&publish_up=2011-09-10+10%3A57%3A26&publish_down=Never&metadesc=&metakey=&images=&goodexit=1&option=com_content&Returnid=99999999&id=&version=0§ionid=4&created_by=&referer=http%3A%2F%2Fwww.xxx.net%2F&task=save&jdfe3107b33382501410e7fa2f8ad8291=1
--1f07a55c-F--
HTTP/1.1 403 Forbidden
Content-Length: 328
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
--1f07a55c-H--
Message: Rule execution error - PCRE limits exceeded (-8): (null).
Message: Pattern match "(?i:["\'][ ]*(([^a-z0-9~_:\'" ])|(in)).+?\(.*?\))" at
ARGS:introtext. [file
"/usr/local/etc/apache22/Includes/mod_security2/base_rules/modsecurity_crs_41_xss_attacks.conf"]
[line "765"] [id "973335"] [rev "2.2.1"] [msg "IE XSS Filters - Attack
Detected"] [data "\x22, da je<br /> in nato, nose\xc4\x8di - z vinom, da naliva
se.<br /> Na petrolu mo\xc5\xbe in \xc5\xbeena naj bi se ustavila,<br /> s
fla\xc5\xa1o vina pod pazduho - brez pla\xc4\x8dila naj bi \xc5\xa1la.<br />
<br /> Janezu o\xc4\x8dita gore, \xc4\x8de\xc5\xa1 da \x22osvajalec\x22 je,<br
/> pa \xc4\x8deprav so hribi na\xc5\xa1i le sprehod za romarje.<br /> Hkrati
pljuva po desnici, \xc4\x8de\xc5\xa1, da kraja vle\xc4\x8de jo<br /> v
de\xc5\xbeelo senc in greha - grobnico politi\xc4\x8dno.<br /> <br /..."]
Message: Access denied with code 403 (phase 2). Pattern match "(.*)" at TX:0.
[file
"/usr/local/etc/apache22/Includes/mod_security2/base_rules/modsecurity_crs_49_inbound_blocking.conf"]
[line "26"] [id "981176"] [msg "Inbound Anomaly Score Exceeded (Total Score:
5, SQLi=, XSS=5): Last Matched Message: IE XSS Filters - Attack Detected"]
[data "Last Matched Data: \x22, da je<br /> in nato, nose\xc4\x8di - z vinom,
da naliva se.<br /> Na petrolu mo\xc5\xbe in \xc5\xbeena naj bi se ustavila,<br
/> s fla\xc5\xa1o vina pod pazduho - brez pla\xc4\x8dila naj bi \xc5\xa1la.<br
/> <br /> Janezu o\xc4\x8dita gore, \xc4\x8de\xc5\xa1 da \x22osvajalec\x22
je,<br /> pa \xc4\x8deprav so hribi na\xc5\xa1i le sprehod za romarje.<br />
Hkrati pljuva po desnici, \xc4\x8de\xc5\xa1, da kraja vle\xc4\x8de jo<br /> v
de\xc5\xbeelo senc in greha - grobnico politi\xc4..."]
Action: Intercepted (phase 2)
Stopwatch: 1315645071738117 241365 (24013* 198293 -)
Producer: ModSecurity for Apache/2.5.12 (http://www.modsecurity.org/); core
ruleset/2.2.0.
Server: Apache/2.2.14 (FreeBSD) DAV/2 PHP/5.2.17 with Suhosin-Patch
_______________________________________________
Owasp-modsecurity-core-rule-set mailing list
[email protected]
https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
