---
meta:
  author: "csanders-git"
  enabled: true
  name: "941110.yaml"
  description: "Tests to trigger, or not trigger 941110"
tests:
  - test_title: 941110-1
    desc: Test as described in http://www.client9.com/article/five-interesting-injection-attacks/
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: '/'
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
              Cookie: xyz=<script >alert(1);</script>
          output:
            log_contains: id "941110"
  - test_title: 941110-2
    desc: Test as described in http://www.client9.com/article/five-interesting-injection-attacks/
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: "/?x=<script+>alert(1);</script>"
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
          output:
            log_contains: id "941110"
  - test_title: 941110-3
    desc: Test as described in http://www.client9.com/article/five-interesting-injection-attacks/
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: '/'
            headers:
              User-Agent: "&#60;script+&#62;alert(1);&#60;/script&#62;=value"
              Host: localhost
          output:
            log_contains: id "941110"
  - test_title: 941110-4
    desc: Test as described in http://www.client9.com/article/five-interesting-injection-attacks/
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: '/'
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
              Referer: "<script >alert(1);</script>"
          output:
            log_contains: id "941110"
  - test_title: 941110-5
    desc: XSS in URI / PATH_INFO going undetected - GH issue 1022
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: "/foo/bar%3C/script%3E%3Cscript%3Ealert(1)%3C/script%3E/"
            headers:
              Host: localhost
              Accept: "*/*"
              User-Agent: ModSecurity CRS 3 Tests
          output:
            log_contains: id "941110"
  - test_title: 941110-6
    desc: XSS in payload using %uNNNN
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: POST
            port: 80
            uri: /
            headers:
              Host: localhost
              Accept: "*/*"
              User-Agent: ModSecurity CRS 3 Tests
              Content-Type: application/x-www-form-urlencoded
            data: |
              var=%uff1cscript%u0020%uff1ealert%281%29%uff1c/script%uff1e
          output:
            log_contains: id "941110"
  - test_title: 941110-7
    desc: XSS in payload with individual code points urlencoded
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: POST
            port: 80
            uri: /
            headers:
              Host: localhost
              Accept: "*/*"
              User-Agent: ModSecurity CRS 3 Tests
              Content-Type: application/x-www-form-urlencoded
            data: |
              var=%ef%bc%9cscript%20%ef%bc%9ealert%281%29%ef%bc%9c/script%ef%bc%9e
          output:
            log_contains: id "941110"
  - test_title: 941110-8
    desc: XSS in cookie name using unicode
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: /
            headers:
              Host: localhost
              Accept: "*/*"
              User-Agent: ModSecurity CRS 3 Tests
              Cookie: ＜script ＞alert(1)＜/script＞=value
          output:
            log_contains: id "941110"
  - test_title: 941110-9
    desc: XSS in Referer using html entities
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            headers:
              Host: localhost
              Accept: "*/*"
              Referer: "&lt;script+&gt;alert(1);&lt;/script&gt"
          output:
            log_contains: id "941110"
  - test_title: 941110-10
    desc: GH issue 1481
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: "/?%9cscript+%bcalert(1);%bc/script%9e=value"
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
          output:
            no_log_contains: id "941110"
