---
meta:
  author: csanders-git
  description: None
  enabled: true
  name: 913120.yaml
tests:
  - test_title: 913120-1
    desc: Request Indicates a Security Scanner Scanned the Site (913120) from old modsec regressions
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
              Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
              Accept-Encoding: gzip,deflate
              Accept-Language: en-us,en;q=0.5
              Host: localhost
              Keep-Alive: '300'
              Proxy-Connection: keep-alive
              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
            method: GET
            port: 80
            uri: /nessustest
            version: HTTP/1.0
          output:
            log_contains: id "913120"
  - test_title: 913120-2
    desc: IBM fingerprint from (http://www-01.ibm.com/support/docview.wss?uid=swg21293132)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: localhost
            uri: /AppScan_fingerprint/MAC_ADDRESS_01234567890.html?9ABCDG1
            version: HTTP/1.0
          output:
            log_contains: id "913120"
  - test_title: 913120-3
    desc: "Scanner identification based on uri"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            method: "GET"
            port: 80
            headers:
              Host: "localhost"
              version: HTTP/1.0
            uri: "/nessus_is_probing_you_"
          output:
            log_contains: id "913120"
