---
meta:
  author: "fzipi"
  enabled: true
  name: "920121.yaml"
  description: "Tests to trigger rule 920121"
tests:
  - test_title: 920121-1
    desc: 'Attempted multipart/form-data bypass (920121). Match \ in FILES.'
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "OWASP CRS test agent"
              Host: "localhost"
              Content-Type: multipart/form-data; boundary=---------------------------265001916915724
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
            method: POST
            port: 80
            uri: /
            data: |
              -----------------------------265001916915724
              Content-Disposition: form-data; name="test"; filename="1.j\s\p"
              Content-Type: application/octet-stream

              helloworld
              -----------------------------265001916915724--
            version: "HTTP/1.1"
          output:
            log_contains: id "920121"
  - test_title: 920121-2
    desc: 'Attempted multipart/form-data bypass (920121). Match \ in FILES_NAMES.'
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "OWASP CRS test agent"
              Host: "localhost"
              Content-Type: multipart/form-data; boundary=---------------------------265001916915724
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
            method: POST
            port: 80
            uri: /
            data: |
              -----------------------------265001916915724
              Content-Disposition: form-data; name="cv.j\s\p"; filename="cv.jsp"
              Content-Type: application/octet-stream

              helloworld
              -----------------------------265001916915724--
            version: "HTTP/1.1"
          output:
            log_contains: id "920121"
