---
meta:
  author: studersi
  description: None
  enabled: true
  name: 931120.yaml
tests:
  - test_title: 931120-1
    desc: Remote File Inclusion Attack (931120)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: localhost
            method: GET
            port: 80
            uri: /?x=file?
            version: HTTP/1.1
          output:
            log_contains: id "931120"
  - test_title: 931120-2
    desc: Remote File Inclusion Attack (931120)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: localhost
            method: GET
            port: 80
            uri: /?x=ftp?
            version: HTTP/1.1
          output:
            log_contains: id "931120"
  - test_title: 931120-3
    desc: Remote File Inclusion Attack (931120)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: localhost
            method: GET
            port: 80
            uri: /?x=ftps?
            version: HTTP/1.1
          output:
            log_contains: id "931120"
  - test_title: 931120-4
    desc: Remote File Inclusion Attack (931120)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: localhost
            method: GET
            port: 80
            uri: /?x=http?
            version: HTTP/1.1
          output:
            log_contains: id "931120"
  - test_title: 931120-5
    desc: Remote File Inclusion Attack (931120)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: localhost
            method: GET
            port: 80
            uri: /?x=https?
            version: HTTP/1.1
          output:
            log_contains: id "931120"
  - test_title: 931120-6
    desc: Remote File Inclusion Attack (931120)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: localhost
            method: GET
            port: 80
            uri: /?x=https://foo.bar?
            version: HTTP/1.1
          output:
            log_contains: id "931120"
  - test_title: 931120-7
    desc: Remote File Inclusion Attack (931120)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: localhost
            method: GET
            port: 80
            uri: /?x=https://foo.bar?foo=bar
            version: HTTP/1.1
          output:
            no_log_contains: id "931120"
  - test_title: 931120-8
    desc: Remote File Inclusion Attack (931120)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: localhost
            method: GET
            port: 80
            uri: /?x=https://foo.bar&foo=bar
            version: HTTP/1.1
          output:
            no_log_contains: id "931120"
