---
meta:
  author: lifeforms
  description: None
  enabled: true
  name: 933150.yaml
tests:
  - test_title: 933150-1
    desc: pmf
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /base64_decode
          output:
            log_contains: id "933150"
  - test_title: 933150-2
    desc: base64_decode
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /base64_decode
          output:
            log_contains: id "933150"
  - test_title: 933150-3
    desc: base64_decode
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?base64_deCOde
          output:
            log_contains: id "933150"
  - test_title: 933150-4
    desc: base64_decode
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?foo=bzdecomprEss
          output:
            log_contains: id "933150"
  - test_title: 933150-5
    desc: base64_decode
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?foo=FOOcall_user_func
          output:
            log_contains: id "933150"
  - test_title: 933150-6
    desc: fsockopen
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?foo=FOOcall_user_func
          output:
            log_contains: id "933150"
  - test_title: 933150-7
    desc: gzdecode
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?foo=FOOcall_user_func
          output:
            log_contains: id "933150"
  - test_title: 933150-8
    desc: GzInFlAtE
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?foo=FOOcall_user_func
          output:
            log_contains: id "933150"
  - test_title: 933150-9
    desc: GzInFlAtE
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?foo=FOOcall_user_func
          output:
            log_contains: id "933150"
  - test_title: 933150-10
    desc: GzInFlAtE
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?I%20don%27t%20like%20gzuncompress
          output:
            log_contains: id "933150"
  - test_title: 933150-11
    desc: GzInFlAtE
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?bar=pfsockopen%28%27foo%27%2C%2025%29
          output:
            log_contains: id "933150"
  - test_title: 933150-12
    desc: posix_getpwuiD
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            port: 80
            uri: /?bar=pfsockopen%28%27foo%27%2C%2025%29
          output:
            log_contains: id "933150"
  - test_title: 933150-13
    desc: posix_getpwuiD
    stages:
      - stage:
          input:
            data: Shell%5fexec=bla
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            method: POST
            port: 80
            uri: /
          output:
            log_contains: id "933150"
  - test_title: 933150-14
    desc: ZlIb_DeCoDe
    stages:
      - stage:
          input:
            data: Shell%5fexec=bla
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            method: POST
            port: 80
            uri: /
          output:
            log_contains: id "933150"
  - test_title: 933150-15
    desc: get_defined_functions
    stages:
      - stage:
          input:
            data: foo=get_defined_functions%28%29%5B0%5D
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            method: POST
            port: 80
            uri: /
          output:
            log_contains: id "933150"
  - test_title: 933150-16
    desc: get_defined_vars
    stages:
      - stage:
          input:
            data: foo=get_defined_vars%28%29%5B0%5D
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: ModSecurity CRS 3 Tests
            method: POST
            port: 80
            uri: /
          output:
            log_contains: id "933150"
