---
meta:
  author: lifeforms
  description: None
  enabled: true
  name: 933110.yaml
tests:
  - test_title: 933110-1
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /
          output:
            no_log_contains: id "933110"
  - test_title: 933110-2
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-Filename: a.php
            port: 80
            uri: /upload1
          output:
            log_contains: id "933110"
  - test_title: 933110-3
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X_Filename: a.php
            port: 80
            uri: /upload2
          output:
            log_contains: id "933110"
  - test_title: 933110-4
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-File-Name: a.php
            port: 80
            uri: /upload3
          output:
            log_contains: id "933110"
  - test_title: 933110-5
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-Filename: a.php..
            port: 80
            uri: /upload4
          output:
            log_contains: id "933110"
  - test_title: 933110-6
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-Filename: a.phtml
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-7
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-File-Name: fda.phtml......
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-8
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-File-Name: fda.php5
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-9
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-File-Name: fda.php5
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-10
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-File-Name: fda.php7
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-11
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /
          output:
            no_log_contains: id "933110"
  - test_title: 933110-12
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-Filename: fda.php5...
            port: 80
            uri: /upload5
          output:
            log_contains: id "933110"
  - test_title: 933110-13
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X_Filename: fda.php5...
            port: 80
            uri: /upload6
          output:
            log_contains: id "933110"
  - test_title: 933110-14
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X_Filename: fthisfewfda.php.
            port: 80
            uri: /upload7
          output:
            log_contains: id "933110"
  - test_title: 933110-15
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-File-Name: fthi/sfewfda.php.............
            port: 80
            uri: /upload8
          output:
            log_contains: id "933110"
  - test_title: 933110-16
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-File-Name: fthi/sfewfda.php.............
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-17
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-File-Name: fthi/sfewfda.php907.............
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-18
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-Filename: fthi/sfewfda.phtml
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-19
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X_Filename: fthi/sfewfda.phtml987...
            port: 80
            uri: /
          output:
            no_log_contains: id "933110"
  - test_title: 933110-20
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X.Filename: a.php
            port: 80
            uri: /upload2
          output:
            log_contains: id "933110"
  - test_title: 933110-21
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X.Filename: fda.php5...
            port: 80
            uri: /upload6
          output:
            log_contains: id "933110"
  - test_title: 933110-22
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X.Filename: fthisfewfda.php.
            port: 80
            uri: /upload7
          output:
            log_contains: id "933110"
  - test_title: 933110-23
    desc: PHP script uploads
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X.Filename: fthi/sfewfda.phtml987...
            port: 80
            uri: /
          output:
            no_log_contains: id "933110"
  - test_title: 933110-24
    desc: "PHP .php upload with leading whitespace before extension via header"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-Filename: "photo. php"
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-25
    desc: "PHP .php upload with trailing whitespace via header"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-Filename: "photo.php "
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-26
    desc: "PHP .php upload with whitespace padding via multipart"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: POST
            port: 80
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
              Content-Type: "multipart/form-data; boundary=--------397236876"
            uri: "/post"
            data: |
              ----------397236876
              Content-Disposition: form-data; name="fileRap"; filename="photo. php"
              Content-Type: text/plain

              please block me
              ----------397236876--
          output:
            log_contains: id "933110"
  - test_title: 933110-27
    desc: "PHP .phtml upload with whitespace before extension via header"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-Filename: "dangerous. phtml"
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-28
    desc: "PHP .phar upload with trailing whitespace via header"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
              X-Filename: "dangerous.phar "
            port: 80
            uri: /upload
          output:
            log_contains: id "933110"
  - test_title: 933110-29
    desc: "PHP .php upload with multiple spaces in filename via multipart"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: POST
            port: 80
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
              Content-Type: "multipart/form-data; boundary=--------397236876"
            uri: "/post"
            data: |
              ----------397236876
              Content-Disposition: form-data; name="fileRap"; filename="photo.php  "
              Content-Type: application/x-httpd-php

              <?php echo 'test'; ?>
              ----------397236876--
          output:
            log_contains: id "933110"
