---
meta:
  author: csanders-git
  description: None
  enabled: true
  name: 930120.yaml
tests:
  - test_title: 930120-1
    desc: Remote File Access Attempt (930120) from old modsec regressions
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
              Accept-Encoding: gzip, deflate
              Accept-Language: zh-sg
              Content-Type: application/x-www-form-urlencoded
              Host: localhost
              Keep-Alive: '300'
              Proxy-Connection: keep-alive
              User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
            method: GET
            port: 80
            uri: /index.php?file=News&op=../../../../../boot.ini%00
            version: HTTP/1.1
          output:
            log_contains: id "930120"
  - test_title: 930120-2
    desc: Remote File Access Attempt (930120) from old modsec regressions
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
              Accept-Encoding: gzip, deflate
              Accept-Language: zh-sg
              Content-Type: application/x-www-form-urlencoded
              Host: localhost
              Keep-Alive: '300'
              Proxy-Connection: keep-alive
              User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
            method: GET
            port: 80
            uri: /index.php?file=News&op=/etc/passwd%00
            version: HTTP/1.1
          output:
            log_contains: id "930120"
  - test_title: 930120-3
    desc: Remote File Access Attempt (930120) from old modsec regressions
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
              Accept-Encoding: gzip, deflate
              Accept-Language: zh-sg
              Content-Type: application/x-www-form-urlencoded
              Host: localhost
              Keep-Alive: '300'
              Proxy-Connection: keep-alive
              User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
            method: GET
            port: 80
            uri: /index.php?file=News&op=../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf%00
            version: HTTP/1.1
          output:
            log_contains: id "930120"
  - test_title: 930120-4
    desc: "OS File Access"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            method: "GET"
            port: 80
            headers:
              Host: "localhost"
            uri: "/?foo=arg&path_comp=.ssh/id_rsa"
          output:
            log_contains: "930120"
