Cristian,
You are getting there. Yet the DebugLogLevel is still not high enough.
Put it to 9and then you grep for the threshold variable in the logfile.
This will allow you to see which rule sets the threshold and in what order.
It is possible it's a phase issue. But when I looked over it in your
previous message the suspicion was not confirmed. But I am not ruling it out.
Ahoj,
Christian
On Mon, Dec 04, 2017 at 07:03:33PM +0100, Cristian Mammoli wrote:
> Ok, so this is my config:
> End of /etc/httpd/conf/httpd.conf:
> IncludeOptional conf.d/*.conf
> [root@waf01 ~]# ls -1 /etc/httpd/conf.d/
> 000_mod_evasive.conf
> 000_mod_security.conf
> 000_mod_ssl.conf
> 000_mod_status.conf
> vhost1.conf
> vhost2.conf
> ecc
> End of /etc/httpd/conf.d/000_mod_security.conf:
> IncludeOptional /etc/httpd/modsecurity.d/*.conf
> IncludeOptional /etc/httpd/crs/crs-setup.conf
> IncludeOptional /etc/httpd/crs/rules/*.conf
> [root@waf01 ~]# ls -1 /etc/httpd/modsecurity.d/
> 000_whitelist_rules.conf
> cutwail_zenobi.data
> local_rules.confnou
> runav.conf
> whitelist_ip.data
> In /etc/httpd/modsecurity.d/local_rules.conf I have:
> # Debug test
> SecRule REMOTE_ADDR "@ipMatch 217.133.31.142" \
> "msg:'Client IP in Test list',\
> severity:'CRITICAL',\
> id:10099,\
> phase:request,\
> pass,\
> t:none,\
> tag:'application-multi',\
> tag:'language-multi',\
> tag:'platform-multi',\
> tag:'attack-reputation-ip',\
> setvar:'tx.msg=%{rule.msg}',\
> setvar:tx.anomaly_score=+20,\
>
> setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched
> _var}"
> Then I did
> curl [1]https://www.vhost.com and the request got rejected (20/11
> score, 11 is my threshold)
> Now I have the full debug trace of the request but it's a huge amount
> of data.
> I think the culprit is this:
> [2]https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Proc
> essing_Phases
> Note : Keep in mind that rules are executed according to phases, so
> even if two rules are adjacent in a configuration file, but are set to
> execute in different phases, they would not happen one after the other.
> The order of rules in the configuration file is important only within
> the rules of each phase. This is especially important when using the
> skip and skipAfter actions.
> My rules use phase:request, which I suppose is equivalent to phase:2,
> while REQUEST-901-INITIALIZATION.conf are all phase:1
> Anyway this is the (mostly cleaned) log:
> Starting phase REQUEST_HEADERS.
> This phase consists of 159 rule(s).
> Recipe: Invoking rule 5589ef173f78; [file
> "/etc/httpd/conf.d/000_mod_security.conf"] [line "27"] [id "200000"].
> Recipe: Invoking rule 5589ef1d7ed0; [file
> "/etc/httpd/conf.d/000_mod_security.conf"] [line "34"] [id "200001"].
> Recipe: Invoking rule 5589ef278288; [file
> "/etc/httpd/modsecurity.d/000_whitelist_rules.conf"] [line "3"] [id
> "10050"]. <- This is my only phase:1 rule
> Recipe: Invoking rule 5589f629ba98; [file
> "/etc/httpd/crs/crs-setup.conf"] [line "263"] [id "900110"].
> Recipe: Invoking rule 5589f62813a0; [file
> "/etc/httpd/crs/crs-setup.conf"] [line "303"] [id "900130"].
> Recipe: Invoking rule 5589f62c4e70; [file
> "/etc/httpd/crs/crs-setup.conf"] [line "329"] [id "900200"].
> Recipe: Invoking rule 5589f62c65a0; [file
> "/etc/httpd/crs/crs-setup.conf"] [line "342"] [id "900220"].
> Recipe: Invoking rule 5589f62e8488; [file
> "/etc/httpd/crs/crs-setup.conf"] [line "542"] [id "900500"].
> Recipe: Invoking rule 5589f62e42d0; [file
> "/etc/httpd/crs/crs-setup.conf"] [line "622"] [id "900700"].
> Recipe: Invoking rule 5589f6329f58; [file
> "/etc/httpd/crs/crs-setup.conf"] [line "679"] [id "900960"].
> Recipe: Invoking rule 5589f63474d0; [file
> "/etc/httpd/crs/crs-setup.conf"] [line "774"] [id "900990"].
> Recipe: Invoking rule 5589f6366d28; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "61"] [id
> "901001"].
> Recipe: Invoking rule 5589f6351348; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "78"] [id
> "901100"].
> Recipe: Invoking rule 5589f63529d0; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "86"] [id
> "901110"].
> Recipe: Invoking rule 5589f637c180; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "94"] [id
> "901120"].
> Recipe: Invoking rule 5589f63c78d0; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "102"]
> [id "901130"].
> Recipe: Invoking rule 5589f639cd48; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "110"]
> [id "901140"].
> Recipe: Invoking rule 5589f639e2c8; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "117"]
> [id "901141"].
> Recipe: Invoking rule 5589f6405b38; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "124"]
> [id "901142"].
> Recipe: Invoking rule 5589f63f1038; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "131"]
> [id "901143"].
> Recipe: Invoking rule 5589f63f2788; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "139"]
> [id "901150"].
> Recipe: Invoking rule 5589f674f790; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "147"]
> [id "901152"].
> Recipe: Invoking rule 5589f640d368; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "155"]
> [id "901160"].
> Recipe: Invoking rule 5589f640ea10; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "163"]
> [id "901162"].
> Recipe: Invoking rule 5589f67a4688; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "171"]
> [id "901163"].
> Recipe: Invoking rule 5589f676be78; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "179"]
> [id "901164"].
> Recipe: Invoking rule 5589f6426d28; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "187"]
> [id "901165"].
> Recipe: Invoking rule 5589f67a61b8; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "195"]
> [id "901166"].
> Recipe: Invoking rule 5589f67c5c40; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "224"]
> [id "901200"].
> Recipe: Invoking rule 5589f67f3818; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "241"]
> [id "901318"].
> Recipe: Invoking rule 5589f679d090; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "251"]
> [id "901321"].
> Recipe: Invoking rule 5589f679eb68; [file
> "/etc/httpd/crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "287"]
> [id "901400"].
> Recipe: Invoking rule 5589f8a2b580; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "264"] [id "9001180"].
> Recipe: Invoking rule 5589f8a55168; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "277"] [id "9001182"].
> Recipe: Invoking rule 5589f8acb7f8; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "294"] [id "9001184"].
> Recipe: Invoking rule 5589f8be9998; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "25"] [id "9002000"].
> Recipe: Invoking rule 5589fb0fc038; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "163"] [id "9002200"].
> Recipe: Invoking rule 5589fabbce88; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "178"] [id "9002300"].
> Recipe: Invoking rule 5589fb2c1170; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "196"] [id "9002400"].
> Recipe: Invoking rule 5589fc513be8; [file
> "/etc/httpd/crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf"] [line "26"]
> [id "905100"].
> Recipe: Invoking rule 5589fc58b138; [file
> "/etc/httpd/crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf"] [line "45"]
> [id "905110"].
> Recipe: Invoking rule 5589fc9e5aa0; [file
> "/etc/httpd/crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "15"] [id
> "910011"].
> Recipe: Invoking rule 5589f687b798; [file
> "/etc/httpd/crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "279"] [id
> "910013"].
> Recipe: Invoking rule 5589f73c5f60; [file
> "/etc/httpd/crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "16"]
> [id "911011"].
> Recipe: Invoking rule 5589f749ca68; [file
> "/etc/httpd/crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "54"]
> [id "911013"].
> Recipe: Invoking rule 5589f74cc0c8; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "73"] [id
> "912100"].
> Recipe: Invoking rule 5589f75aaa60; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "89"] [id
> "912011"].
> Recipe: Invoking rule 5589f75d7460; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "111"]
> [id "912120"].
> Recipe: Invoking rule 5589f75af098; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "133"]
> [id "912130"].
> Recipe: Invoking rule 5589f77083d0; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "244"]
> [id "912013"].
> Recipe: Invoking rule 5589f787ea28; [file
> "/etc/httpd/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "16"]
> [id "913011"].
> Recipe: Invoking rule 5589f802eee0; [file
> "/etc/httpd/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "120"]
> [id "913013"].
> Recipe: Invoking rule 5589f81a6b70; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "25"] [id "920011"].
> Recipe: Invoking rule 5589f8892c00; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "235"] [id "920160"] [rev "1"].
> Recipe: Invoking rule 5589f98c0db8; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "1140"] [id "920013"].
> Recipe: Invoking rule 5589fa2e5048; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "16"]
> [id "921011"].
> Recipe: Invoking rule 5589fa56d9e0; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "245"]
> [id "921013"].
> Recipe: Invoking rule 5589fc9f6630; [file
> "/etc/httpd/crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line
> "16"] [id "930011"].
> Recipe: Invoking rule 5589f8cae6b0; [file
> "/etc/httpd/crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line
> "144"] [id "930013"].
> Recipe: Invoking rule 5589fbeaf2e8; [file
> "/etc/httpd/crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line
> "19"] [id "931011"].
> Recipe: Invoking rule 5589fbf60ef0; [file
> "/etc/httpd/crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line
> "110"] [id "931013"].
> Recipe: Invoking rule 5589fbfcbd08; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "16"] [id "932011"].
> Recipe: Invoking rule 5589fd76d648; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "516"] [id "932013"].
> Recipe: Invoking rule 5589fd7a2490; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "16"] [id "933011"].
> Recipe: Invoking rule 5589f4915b38; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "459"] [id "933013"].
> Recipe: Invoking rule 5589ee87f068; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "16"] [id "941011"].
> Recipe: Invoking rule 5589fe326418; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "742"] [id "941013"].
> Recipe: Invoking rule 5589fe3f8c08; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "16"] [id "942011"].
> Recipe: Invoking rule 5589fec4f398; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "455"] [id "942013"].
> Recipe: Invoking rule 5589ff2a7960; [file
> "/etc/httpd/crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.c
> onf"] [line "16"] [id "943011"].
> Recipe: Invoking rule 5589ff387890; [file
> "/etc/httpd/crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.c
> onf"] [line "120"] [id "943013"].
> Recipe: Invoking rule 5589ff40b230; [file
> "/etc/httpd/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line
> "61"] [id "949011"].
> Recipe: Invoking rule 5589ff43f680; [file
> "/etc/httpd/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line
> "69"] [id "949013"].
> Recipe: Invoking rule 558a008efda8; [file
> "/etc/httpd/crs/rules/RESPONSE-980-CORRELATION.conf"] [line "87"] [id
> "980011"].
> Recipe: Invoking rule 558a00911968; [file
> "/etc/httpd/crs/rules/RESPONSE-980-CORRELATION.conf"] [line "95"] [id
> "980013"].
> Starting phase REQUEST_BODY.
> This phase consists of 410 rule(s).
> Recipe: Invoking rule 5589ef1d97a0; [file
> "/etc/httpd/conf.d/000_mod_security.conf"] [line "65"] [id "200002"].
> Recipe: Invoking rule 5589ef20b628; [file
> "/etc/httpd/conf.d/000_mod_security.conf"] [line "86"] [id "200003"].
> Recipe: Invoking rule 5589ef22ca10; [file
> "/etc/httpd/conf.d/000_mod_security.conf"] [line "91"] [id "200004"].
> Recipe: Invoking rule 5589ef1c9b08; [file
> "/etc/httpd/conf.d/000_mod_security.conf"] [line "107"] [id "200005"].
> Recipe: Invoking rule 5589ef1e24f0; [file
> "/etc/httpd/modsecurity.d/000_whitelist_rules.conf"] [line "7"] [id
> "10051"].
> Recipe: Invoking rule 5589ef2890a8; [file
> "/etc/httpd/modsecurity.d/local_rules.conf"] [line "21"] [id "10002"].
> Recipe: Invoking rule 5589ef2eff10; [file
> "/etc/httpd/modsecurity.d/local_rules.conf"] [line "37"] [id "10003"].
> Recipe: Invoking rule 5589ef2dcf80; [file
> "/etc/httpd/modsecurity.d/local_rules.conf"] [line "56"] [id "10011"].
> Recipe: Invoking rule 5589f61afbe0; [file
> "/etc/httpd/modsecurity.d/local_rules.conf"] [line "67"] [id "10004"].
> Recipe: Invoking rule 5589f61f0e60; [file
> "/etc/httpd/modsecurity.d/local_rules.conf"] [line "82"] [id "10005"].
> Recipe: Invoking rule 5589f61fd840; [file
> "/etc/httpd/modsecurity.d/local_rules.conf"] [line "86"].
> Recipe: Invoking rule 5589f617b248; [file
> "/etc/httpd/modsecurity.d/local_rules.conf"] [line "102"] [id "10099"].
> Recipe: Invoking rule 5589f622aa00; [file
> "/etc/httpd/modsecurity.d/runav.conf"] [line "13"] [id "10001"].
> Recipe: Invoking rule 5589f7320570; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "71"] [id "9001000"].
> Recipe: Invoking rule 5589f71ef4c8; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "107"] [id "9001100"].
> Recipe: Invoking rule 5589f6f91b00; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "121"] [id "9001110"].
> Recipe: Invoking rule 5589f7481eb0; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "129"] [id "9001112"].
> Recipe: Invoking rule 5589f7843590; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "137"] [id "9001114"].
> Recipe: Invoking rule 5589f7845138; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "146"] [id "9001116"].
> Recipe: Invoking rule 5589f7be4cb0; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "165"] [id "9001122"].
> Recipe: Invoking rule 5589f7a599d8; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "181"] [id "9001124"].
> Recipe: Invoking rule 5589f89d6d28; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "189"] [id "9001126"].
> Recipe: Invoking rule 5589f8015880; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "196"] [id "9001128"].
> Recipe: Invoking rule 5589f8016f68; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "212"] [id "9001140"].
> Recipe: Invoking rule 5589f89c3430; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "230"] [id "9001160"].
> Recipe: Invoking rule 5589f8a81858; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "246"] [id "9001170"].
> Recipe: Invoking rule 5589f8b1dcf0; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "321"] [id "9001200"].
> Recipe: Invoking rule 5589f8b37978; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "329"] [id "9001202"].
> Recipe: Invoking rule 5589f8b69740; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "338"] [id "9001204"].
> Recipe: Invoking rule 5589f8b4f600; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "345"] [id "9001206"].
> Recipe: Invoking rule 5589f8bb7138; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "352"] [id "9001208"].
> Recipe: Invoking rule 5589f8bb8a18; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "359"] [id "9001210"].
> Recipe: Invoking rule 5589f8ba0210; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "366"] [id "9001212"].
> Recipe: Invoking rule 5589f8b95970; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "373"] [id "9001214"].
> Recipe: Invoking rule 5589f8ba5478; [file
> "/etc/httpd/crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf"]
> [line "380"] [id "9001216"].
> Recipe: Invoking rule 5589f8c031e0; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "33"] [id "9002001"].
> Recipe: Invoking rule 5589f8c04938; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "52"] [id "9002100"].
> Recipe: Invoking rule 5589f8c36328; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "61"] [id "9002120"].
> Recipe: Invoking rule 5589f8c0c400; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "83"] [id "9002130"].
> Recipe: Invoking rule 5589f8cabea0; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "104"] [id "9002150"].
> Recipe: Invoking rule 5589f8cb0d58; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "124"] [id "9002160"].
> Recipe: Invoking rule 5589fb159d20; [file
> "/etc/httpd/crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf"]
> [line "204"] [id "9002401"].
> Recipe: Invoking rule 5589fd520960; [file
> "/etc/httpd/crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "16"] [id
> "910012"].
> Recipe: Invoking rule 5589fd57e2d0; [file
> "/etc/httpd/crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "45"] [id
> "910000"].
> Recipe: Invoking rule 5589fd5a8540; [file
> "/etc/httpd/crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "48"].
> Recipe: Invoking rule 5589fd5c7e90; [file
> "/etc/httpd/crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "71"] [id
> "910100"].
> Recipe: Invoking rule 5589fd6284e8; [file
> "/etc/httpd/crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "125"] [id
> "910120"].
> Recipe: Invoking rule 5589f687cc80; [file
> "/etc/httpd/crs/rules/REQUEST-910-IP-REPUTATION.conf"] [line "280"] [id
> "910014"].
> Recipe: Invoking rule 5589f7427718; [file
> "/etc/httpd/crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "17"]
> [id "911012"].
> Recipe: Invoking rule 5589f7428e78; [file
> "/etc/httpd/crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "49"]
> [id "911100"] [rev "2"].
> Recipe: Invoking rule 5589f74e61b0; [file
> "/etc/httpd/crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "55"]
> [id "911014"].
> Recipe: Invoking rule 5589f75d5ec8; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "90"] [id
> "912012"].
> Recipe: Invoking rule 5589f76e9878; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "245"]
> [id "912014"].
> Recipe: Invoking rule 5589f77f9bf0; [file
> "/etc/httpd/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "17"]
> [id "913012"].
> Recipe: Invoking rule 5589f789ba80; [file
> "/etc/httpd/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "60"]
> [id "913100"] [rev "2"].
> Recipe: Invoking rule 5589f7b1fca8; [file
> "/etc/httpd/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "88"]
> [id "913110"] [rev "3"].
> Recipe: Invoking rule 5589f7bf6630; [file
> "/etc/httpd/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "117"]
> [id "913120"] [rev "3"].
> Recipe: Invoking rule 5589f80704c8; [file
> "/etc/httpd/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "121"]
> [id "913014"].
> Recipe: Invoking rule 5589f81e24c0; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "26"] [id "920012"].
> Recipe: Invoking rule 5589f81e3ca0; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "67"] [id "920100"] [rev "2"].
> Recipe: Invoking rule 5589f81bb068; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "120"] [id "920120"] [rev "1"].
> Recipe: Invoking rule 5589f820f018; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "157"] [id "920130"] [rev "1"].
> Recipe: Invoking rule 5589f8231e80; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "202"] [id "920140"] [rev "1"].
> Recipe: Invoking rule 5589f88e0310; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "271"] [id "920170"] [rev "1"].
> Recipe: Invoking rule 5589f88ee0b0; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "276"].
> Recipe: Invoking rule 5589f893a070; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "307"] [id "920180"] [rev "1"].
> Recipe: Invoking rule 5589f891da78; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "355"] [id "920190"] [rev "2"].
> Recipe: Invoking rule 5589f8993498; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "392"] [id "920210"] [rev "2"].
> Recipe: Invoking rule 5589f89f0c28; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "421"] [id "920220"] [rev "2"].
> Recipe: Invoking rule 5589f8e863e8; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "425"].
> Recipe: Invoking rule 5589f8e87f90; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "443"] [id "920240"] [rev "2"].
> Recipe: Invoking rule 5589f8f37938; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "476"] [id "920250"] [rev "2"].
> Recipe: Invoking rule 5589f8f5cb88; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "518"] [id "920260"] [rev "2"].
> Recipe: Invoking rule 5589f8f651d8; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "574"] [id "920270"] [rev "2"].
> Recipe: Invoking rule 5589f8fd4188; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "612"] [id "920280"] [rev "2"].
> Recipe: Invoking rule 5589f9009950; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "633"] [id "920290"] [rev "2"].
> Recipe: Invoking rule 5589f919d310; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "674"] [id "920310"] [rev "2"].
> Recipe: Invoking rule 5589f9316340; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "702"] [id "920311"] [rev "2"].
> Recipe: Invoking rule 5589f93307f0; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "740"] [id "920330"] [rev "1"].
> Recipe: Invoking rule 5589f9360978; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "770"] [id "920340"] [rev "3"].
> Recipe: Invoking rule 5589f93adde0; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "810"] [id "920350"] [rev "2"].
> Recipe: Invoking rule 5589f93c74f0; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "842"] [id "920380"] [rev "2"].
> Recipe: Invoking rule 5589f93ca1c8; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "869"] [id "920360"] [rev "2"].
> Recipe: Invoking rule 5589f9417060; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "896"] [id "920370"] [rev "2"].
> Recipe: Invoking rule 5589f9415ce8; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "923"] [id "920390"] [rev "2"].
> Recipe: Invoking rule 5589f9478df8; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "951"] [id "920400"] [rev "2"].
> Recipe: Invoking rule 5589f9468cb0; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "979"] [id "920410"] [rev "2"].
> Recipe: Invoking rule 5589f94effe0; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "1012"] [id "920420"] [rev "2"].
> Recipe: Invoking rule 5589f9518ec8; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "1048"] [id "920430"] [rev "2"].
> Recipe: Invoking rule 5589f953cc88; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "1075"] [id "920440"] [rev "2"].
> Recipe: Invoking rule 5589f9863908; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "1133"] [id "920450"] [rev "2"].
> Recipe: Invoking rule 5589f98b5188; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "1137"].
> Recipe: Invoking rule 5589f98c2310; [file
> "/etc/httpd/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line
> "1141"] [id "920014"].
> Recipe: Invoking rule 5589fa2e2838; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "17"]
> [id "921012"].
> Recipe: Invoking rule 5589fa2de0c8; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "59"]
> [id "921100"] [rev "2"].
> Recipe: Invoking rule 5589fa337440; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "93"]
> [id "921110"] [rev "1"].
> Recipe: Invoking rule 5589fa392c50; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "128"]
> [id "921120"] [rev "2"].
> Recipe: Invoking rule 5589fa38d070; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "152"]
> [id "921130"] [rev "2"].
> Recipe: Invoking rule 5589fa43c6d0; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "189"]
> [id "921140"] [rev "1"].
> Recipe: Invoking rule 5589fa420e88; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "217"]
> [id "921150"] [rev "1"].
> Recipe: Invoking rule 5589fa4d7740; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "241"]
> [id "921160"] [rev "1"].
> Recipe: Invoking rule 5589fa592a68; [file
> "/etc/httpd/crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "246"]
> [id "921014"].
> Recipe: Invoking rule 5589fca07c88; [file
> "/etc/httpd/crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line
> "17"] [id "930012"].
> Recipe: Invoking rule 5589fca096a0; [file
> "/etc/httpd/crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line
> "50"] [id "930100"] [rev "3"].
> Recipe: Invoking rule 5589fca99d40; [file
> "/etc/httpd/crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line
> "77"] [id "930110"] [rev "1"].
> Recipe: Invoking rule 5589fcae7520; [file
> "/etc/httpd/crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line
> "108"] [id "930120"] [rev "4"].
> Recipe: Invoking rule 5589fba86438; [file
> "/etc/httpd/crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line
> "140"] [id "930130"] [rev "1"].
> Recipe: Invoking rule 5589fbb49f68; [file
> "/etc/httpd/crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line
> "145"] [id "930014"].
> Recipe: Invoking rule 5589fbeb0860; [file
> "/etc/httpd/crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line
> "20"] [id "931012"].
> Recipe: Invoking rule 5589fbee2200; [file
> "/etc/httpd/crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line
> "58"] [id "931100"] [rev "2"].
> Recipe: Invoking rule 5589fbf07230; [file
> "/etc/httpd/crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line
> "82"] [id "931110"] [rev "3"].
> Recipe: Invoking rule 5589fbf22a70; [file
> "/etc/httpd/crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line
> "106"] [id "931120"] [rev "2"].
> Recipe: Invoking rule 5589fbf644d8; [file
> "/etc/httpd/crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line
> "111"] [id "931014"].
> Recipe: Invoking rule 5589fbfcd280; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "17"] [id "932012"].
> Recipe: Invoking rule 5589fbfc7388; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "81"] [id "932100"] [rev "4"].
> Recipe: Invoking rule 5589fc054a88; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "122"] [id "932105"] [rev "4"].
> Recipe: Invoking rule 5589fc09c858; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "185"] [id "932110"] [rev "4"].
> Recipe: Invoking rule 5589fc26b1b8; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "226"] [id "932115"] [rev "4"].
> Recipe: Invoking rule 558a07e80628; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "266"] [id "932120"] [rev "1"].
> Recipe: Invoking rule 5589fd31d930; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "308"] [id "932130"] [rev "1"].
> Recipe: Invoking rule 5589fd567078; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "359"] [id "932140"] [rev "1"].
> Recipe: Invoking rule 5589fd5599a8; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "412"] [id "932150"] [rev "1"].
> Recipe: Invoking rule 558a07f200d0; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "448"] [id "932160"] [rev "1"].
> Recipe: Invoking rule 5589fd707740; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "485"] [id "932170"] [rev "1"].
> Recipe: Invoking rule 5589fd75f830; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "512"] [id "932171"] [rev "1"].
> Recipe: Invoking rule 5589fd7a2a10; [file
> "/etc/httpd/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line
> "517"] [id "932014"].
> Recipe: Invoking rule 5589fd7bf9d8; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "17"] [id "933012"].
> Recipe: Invoking rule 5589fd7cb328; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "63"] [id "933100"].
> Recipe: Invoking rule 5589fd808f98; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "109"] [id "933110"].
> Recipe: Invoking rule 5589fd8000c0; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "135"] [id "933120"] [rev "1"].
> Recipe: Invoking rule 5589fdbf7fc8; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "170"] [id "933130"] [rev "2"].
> Recipe: Invoking rule 5589fdc360f0; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "211"] [id "933140"].
> Recipe: Invoking rule 5589fdc6e750; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "283"] [id "933150"] [rev "1"].
> Recipe: Invoking rule 5589f49226d0; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "335"] [id "933160"] [rev "1"].
> Recipe: Invoking rule 5589f4a181d0; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "396"] [id "933170"] [rev "1"].
> Recipe: Invoking rule 5589f4a9ae30; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "456"] [id "933180"] [rev "1"].
> Recipe: Invoking rule 5589f4aa9348; [file
> "/etc/httpd/crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line
> "460"] [id "933014"].
> Recipe: Invoking rule 5589ee89a708; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "17"] [id "941012"].
> Recipe: Invoking rule 5589ee891fd8; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "64"] [id "941100"] [rev "2"].
> Recipe: Invoking rule 5589ee962e48; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "99"] [id "941110"] [rev "2"].
> Recipe: Invoking rule 5589fdca27e8; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "133"] [id "941120"] [rev "2"].
> Recipe: Invoking rule 5589fdcd2d78; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "166"] [id "941130"] [rev "2"].
> Recipe: Invoking rule 5589fdd137c8; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "200"] [id "941140"] [rev "3"].
> Recipe: Invoking rule 5589fdd406a0; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "236"] [id "941160"] [rev "2"].
> Recipe: Invoking rule 5589fdd5cdb0; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "269"] [id "941170"] [rev "3"].
> Recipe: Invoking rule 5589fddb4300; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "303"] [id "941180"] [rev "2"].
> Recipe: Invoking rule 5589fddef228; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "337"] [id "941190"] [rev "3"].
> Recipe: Invoking rule 5589fde319d0; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "367"] [id "941200"] [rev "3"].
> Recipe: Invoking rule 5589fde59960; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "397"] [id "941210"] [rev "3"].
> Recipe: Invoking rule 5589fde6bb00; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "427"] [id "941220"] [rev "3"].
> Recipe: Invoking rule 5589fdebb730; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "457"] [id "941230"] [rev "3"].
> Recipe: Invoking rule 5589fdeeafa0; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "487"] [id "941240"] [rev "3"].
> Recipe: Invoking rule 5589fe230588; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "517"] [id "941250"] [rev "3"].
> Recipe: Invoking rule 5589fe24e1f0; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "547"] [id "941260"] [rev "3"].
> Recipe: Invoking rule 5589fe2668d8; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "577"] [id "941270"] [rev "3"].
> Recipe: Invoking rule 5589fe29c4d8; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "607"] [id "941280"] [rev "3"].
> Recipe: Invoking rule 5589fe2a4d28; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "637"] [id "941290"] [rev "3"].
> Recipe: Invoking rule 5589fe2bf910; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "667"] [id "941300"] [rev "3"].
> Recipe: Invoking rule 5589fe2e6fe0; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "702"] [id "941310"] [rev "2"].
> Recipe: Invoking rule 5589fe30e4f0; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "737"] [id "941350"] [rev "1"].
> Recipe: Invoking rule 5589fe322fd8; [file
> "/etc/httpd/crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line
> "743"] [id "941014"].
> Recipe: Invoking rule 5589fe3ccdd0; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "17"] [id "942012"].
> Recipe: Invoking rule 5589fe3eb3b0; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "68"] [id "942100"] [rev "1"].
> Recipe: Invoking rule 5589fe422b80; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "100"] [id "942140"] [rev "3"].
> Recipe: Invoking rule 5589fe432ab8; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "127"] [id "942160"] [rev "2"].
> Recipe: Invoking rule 5589fe4688c0; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "154"] [id "942170"] [rev "2"].
> Recipe: Invoking rule 5589fe475620; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "181"] [id "942190"] [rev "2"].
> Recipe: Invoking rule 5589fea7f200; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "208"] [id "942220"] [rev "2"].
> Recipe: Invoking rule 5589fea94cc8; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "235"] [id "942230"] [rev "2"].
> Recipe: Invoking rule 5589feaa36f8; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "262"] [id "942240"] [rev "2"].
> Recipe: Invoking rule 5589feb3b2c8; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "289"] [id "942250"] [rev "2"].
> Recipe: Invoking rule 5589feb1a398; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "316"] [id "942270"] [rev "2"].
> Recipe: Invoking rule 5589feb8e3d0; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "343"] [id "942280"] [rev "2"].
> Recipe: Invoking rule 5589feb931f0; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "370"] [id "942290"] [rev "2"].
> Recipe: Invoking rule 5589febe1be0; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "397"] [id "942320"] [rev "2"].
> Recipe: Invoking rule 5589fec09ab8; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "424"] [id "942350"] [rev "2"].
> Recipe: Invoking rule 5589fec0c270; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "451"] [id "942360"] [rev "2"].
> Recipe: Invoking rule 5589fec336f0; [file
> "/etc/httpd/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line
> "456"] [id "942014"].
> Recipe: Invoking rule 5589ff2a8fb0; [file
> "/etc/httpd/crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.c
> onf"] [line "17"] [id "943012"].
> Recipe: Invoking rule 5589ff2c56a0; [file
> "/etc/httpd/crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.c
> onf"] [line "54"] [id "943100"] [rev "2"].
> Recipe: Invoking rule 5589ff31c488; [file
> "/etc/httpd/crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.c
> onf"] [line "78"] [id "943110"] [rev "2"].
> Recipe: Invoking rule 5589ff34b710; [file
> "/etc/httpd/crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.c
> onf"] [line "110"] [id "943120"] [rev "2"].
> Recipe: Invoking rule 5589ff38f2f8; [file
> "/etc/httpd/crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.c
> onf"] [line "121"] [id "943014"].
> Recipe: Invoking rule 5589ff3e2450; [file
> "/etc/httpd/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line
> "35"] [id "949100"].
> Recipe: Invoking rule 5589ff3eefc8; [file
> "/etc/httpd/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line
> "57"] [id "949110"].
> Recipe: Invoking rule 5589ff43e130; [file
> "/etc/httpd/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line
> "62"] [id "949012"].
> Recipe: Invoking rule 5589ff44b3b0; [file
> "/etc/httpd/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line
> "70"] [id "949014"].
> Recipe: Invoking rule 558a00910490; [file
> "/etc/httpd/crs/rules/RESPONSE-980-CORRELATION.conf"] [line "88"] [id
> "980012"].
> Recipe: Invoking rule 558a009152a8; [file
> "/etc/httpd/crs/rules/RESPONSE-980-CORRELATION.conf"] [line "96"] [id
> "980014"].
> Starting phase RESPONSE_HEADERS.
> This phase consists of 56 rule(s).
> Recipe: Invoking rule 5589ff47e728; [file
> "/etc/httpd/crs/rules/RESPONSE-950-DATA-LEAKAGES.conf"] [line "21"] [id
> "950020"].
> Recipe: Invoking rule 5589ff4c4768; [file
> "/etc/httpd/crs/rules/RESPONSE-950-DATA-LEAKAGES.conf"] [line "59"] [id
> "950013"].
> Recipe: Invoking rule 5589ff502aa0; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line "16"]
> [id "951011"].
> Recipe: Invoking rule 5589ffb8ff30; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "510"] [id "951013"].
> Recipe: Invoking rule 5589ffbbc560; [file
> "/etc/httpd/crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf"] [line
> "16"] [id "952011"].
> Recipe: Invoking rule 5589ffc209c8; [file
> "/etc/httpd/crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf"] [line
> "86"] [id "952013"].
> Recipe: Invoking rule 5589ffc70ea8; [file
> "/etc/httpd/crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line "16"]
> [id "953011"].
> Recipe: Invoking rule 558a007887c8; [file
> "/etc/httpd/crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line
> "121"] [id "953013"].
> Recipe: Invoking rule 558a00793610; [file
> "/etc/httpd/crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf"] [line "16"]
> [id "954011"].
> Recipe: Invoking rule 558a00831a20; [file
> "/etc/httpd/crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf"] [line
> "144"] [id "954013"].
> Recipe: Invoking rule 558a00867d90; [file
> "/etc/httpd/crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf"] [line
> "36"] [id "959011"].
> Recipe: Invoking rule 558a00879088; [file
> "/etc/httpd/crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf"] [line
> "44"] [id "959013"].
> Starting phase RESPONSE_BODY.
> This phase consists of 100 rule(s).
> Recipe: Invoking rule 5589ff47fc20; [file
> "/etc/httpd/crs/rules/RESPONSE-950-DATA-LEAKAGES.conf"] [line "22"] [id
> "950021"].
> Recipe: Invoking rule 5589ff481340; [file
> "/etc/httpd/crs/rules/RESPONSE-950-DATA-LEAKAGES.conf"] [line "55"] [id
> "950130"] [rev "2"].
> Recipe: Invoking rule 5589ff4c5df0; [file
> "/etc/httpd/crs/rules/RESPONSE-950-DATA-LEAKAGES.conf"] [line "60"] [id
> "950014"].
> Recipe: Invoking rule 5589ff503fe8; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line "17"]
> [id "951012"].
> Recipe: Invoking rule 5589ff50fcf8; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line "40"]
> [id "951100"] [rev "5"].
> Recipe: Invoking rule 5589ff691758; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line "62"]
> [id "951110"] [rev "1"].
> Recipe: Invoking rule 5589ff6d9e80; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "120"] [id "951130"] [rev "1"].
> Recipe: Invoking rule 5589ff706198; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "149"] [id "951140"] [rev "1"].
> Recipe: Invoking rule 5589ff6f6be0; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "178"] [id "951150"] [rev "1"].
> Recipe: Invoking rule 5589ff7312f0; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "207"] [id "951160"] [rev "1"].
> Recipe: Invoking rule 5589ff761948; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "236"] [id "951170"] [rev "1"].
> Recipe: Invoking rule 5589ff7791b0; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "265"] [id "951180"] [rev "1"].
> Recipe: Invoking rule 5589ff792f40; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "295"] [id "951190"] [rev "1"].
> Recipe: Invoking rule 5589ff7a8a00; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "325"] [id "951200"] [rev "1"].
> Recipe: Invoking rule 5589ff7dd1e8; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "354"] [id "951210"] [rev "1"].
> Recipe: Invoking rule 5589ffb2c828; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "412"] [id "951230"] [rev "1"].
> Recipe: Invoking rule 5589ffb34330; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "441"] [id "951240"] [rev "1"].
> Recipe: Invoking rule 5589ffb64cd8; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "470"] [id "951250"] [rev "1"].
> Recipe: Invoking rule 5589ffb870a8; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "499"] [id "951260"] [rev "1"].
> Recipe: Invoking rule 5589ffba1f80; [file
> "/etc/httpd/crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line
> "511"] [id "951014"].
> Recipe: Invoking rule 5589ffbbdab0; [file
> "/etc/httpd/crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf"] [line
> "17"] [id "952012"].
> Recipe: Invoking rule 5589ffbb0c78; [file
> "/etc/httpd/crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf"] [line
> "50"] [id "952100"] [rev "3"].
> Recipe: Invoking rule 5589ffc01ae0; [file
> "/etc/httpd/crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf"] [line
> "82"] [id "952110"] [rev "3"].
> Recipe: Invoking rule 5589ffc3ee68; [file
> "/etc/httpd/crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf"] [line
> "87"] [id "952014"].
> Recipe: Invoking rule 5589ffc37168; [file
> "/etc/httpd/crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line "17"]
> [id "953012"].
> Recipe: Invoking rule 5589ffc5fff0; [file
> "/etc/httpd/crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line "49"]
> [id "953100"] [rev "3"].
> Recipe: Invoking rule 558a00740e48; [file
> "/etc/httpd/crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line "81"]
> [id "953110"] [rev "2"].
> Recipe: Invoking rule 558a00757a90; [file
> "/etc/httpd/crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line
> "111"] [id "953120"] [rev "2"].
> Recipe: Invoking rule 558a00789d10; [file
> "/etc/httpd/crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line
> "122"] [id "953014"].
> Recipe: Invoking rule 558a007b3d50; [file
> "/etc/httpd/crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf"] [line "17"]
> [id "954012"].
> Recipe: Invoking rule 558a007b53e8; [file
> "/etc/httpd/crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf"] [line "43"]
> [id "954100"] [rev "3"].
> Recipe: Invoking rule 558a007c9ee8; [file
> "/etc/httpd/crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf"] [line "76"]
> [id "954110"] [rev "3"].
> Recipe: Invoking rule 558a007e49d8; [file
> "/etc/httpd/crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf"] [line
> "107"] [id "954120"] [rev "2"].
> Recipe: Invoking rule 558a0081b868; [file
> "/etc/httpd/crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf"] [line
> "133"] [id "954130"] [rev "2"].
> Recipe: Invoking rule 558a00837ac8; [file
> "/etc/httpd/crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf"] [line
> "140"].
> Recipe: Invoking rule 558a00832f68; [file
> "/etc/httpd/crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf"] [line
> "145"] [id "954014"].
> Recipe: Invoking rule 558a00888fb8; [file
> "/etc/httpd/crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf"] [line
> "32"] [id "959100"].
> Recipe: Invoking rule 558a00877b30; [file
> "/etc/httpd/crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf"] [line
> "37"] [id "959012"].
> Recipe: Invoking rule 558a00884f78; [file
> "/etc/httpd/crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf"] [line
> "45"] [id "959014"].
> Starting phase LOGGING.
> This phase consists of 53 rule(s).
> Recipe: Invoking rule 5589f75172c0; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "84"] [id
> "912110"].
> Recipe: Invoking rule 5589f760d0c8; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "153"]
> [id "912140"].
> Recipe: Invoking rule 5589f75e6df8; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "172"]
> [id "912150"].
> Recipe: Invoking rule 5589f764b5d0; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "174"].
> Recipe: Invoking rule 5589f7646848; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "199"]
> [id "912160"].
> Recipe: Invoking rule 5589f7629ca8; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "216"]
> [id "912161"].
> Recipe: Invoking rule 5589f76eb9a0; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "240"]
> [id "912170"].
> Recipe: Invoking rule 5589f7735078; [file
> "/etc/httpd/crs/rules/REQUEST-912-DOS-PROTECTION.conf"] [line "246"]
> [id "912019"].
> Recipe: Invoking rule 558a008b4918; [file
> "/etc/httpd/crs/rules/RESPONSE-980-CORRELATION.conf"] [line "34"] [id
> "980100"].
> Recipe: Invoking rule 558a008c6b68; [file
> "/etc/httpd/crs/rules/RESPONSE-980-CORRELATION.conf"] [line "51"] [id
> "980110"].
> Recipe: Invoking rule 558a008edb48; [file
> "/etc/httpd/crs/rules/RESPONSE-980-CORRELATION.conf"] [line "63"] [id
> "980120"].
> Recipe: Invoking rule 558a008ddf38; [file
> "/etc/httpd/crs/rules/RESPONSE-980-CORRELATION.conf"] [line "73"] [id
> "980130"].
> Recipe: Invoking rule 558a008f54a8; [file
> "/etc/httpd/crs/rules/RESPONSE-980-CORRELATION.conf"] [line "82"] [id
> "980140"].
>
> The problem sounds as if you would have to raise the debug log level and
> work your way through the file to see which rule sets which value and in
> what order.
>
> Ahoj,
>
> Christian
>
> References
>
> 1. https://www.vhost.com/
> 2.
> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#Processing_Phases
>
> [USEMAP]
> file://localhost/home/dune73/var/mutt/mutt-leander-1000-14683-5271294304542971673.html#Map
> 1. https://www.facebook.com/aprainformatica
--
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:christian.fol...@netnea.com
twitter: @ChrFolini
_______________________________________________
Owasp-modsecurity-core-rule-set mailing list
Owasp-modsecurity-core-rule-set@lists.owasp.org
https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
