---
meta:
  author: studersi
  description: Try to send mime types in different part of Content-Type header
  enabled: true
  name: 921422.yaml
tests:
  - test_title: 921422-1
    desc: Bypass targeting recommended rules (rule 200000)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/x-www-form-urlencoded;boundary="application/json"
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            log_contains: id "921422"
  - test_title: 921422-2
    desc: Bypass targeting recommended rules (rule 200006)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/x-www-form-urlencoded;boundary="application/vnd.mycompany.myapp.customer-v2+json"
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            log_contains: id "921422"
  - test_title: 921422-3
    desc: Bypass targeting recommended rules (rule 200001)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/x-www-form-urlencoded;boundary="text/xml"
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            log_contains: id "921422"
  - test_title: 921422-4
    desc: Bypass targeting recommended rules (rule 200001)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/x-www-form-urlencoded;boundary="application/xml"
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            log_contains: id "921422"
  - test_title: 921422-5
    desc: Bypass targeting recommended rules (rule 200001)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/x-www-form-urlencoded;boundary="multipart/related"
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            log_contains: id "921422"
  - test_title: 921422-6
    desc: Bypass targeting recommended rules (rule 200001)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/x-www-form-urlencoded;boundary="text/html"
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            log_contains: id "921422"
  - test_title: 921422-7
    desc: Bypass targeting recommended rules (rule 200001)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/x-www-form-urlencoded;boundary="image/jpeg"
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            log_contains: id "921422"
  - test_title: 921422-8
    desc: Bypass targeting recommended rules (rule 200001)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/x-www-form-urlencoded;boundary="foobar/foobar"
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            log_contains: id "921422"
  - test_title: 921422-9
    desc: Negative test for 921422-1
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/json
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            no_log_contains: id "921422"
  - test_title: 921422-10
    desc: Negative test for 921422-2
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/vnd.mycompany.myapp.customer-v2+json
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            no_log_contains: id "921422"
  - test_title: 921422-11
    desc: Negative test for 921422-3
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: text/xml
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            no_log_contains: id "921422"
  - test_title: 921422-12
    desc: Negative test for 921422-4
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/xml
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            no_log_contains: id "921422"
  - test_title: 921422-13
    desc: Negative test for 921422-5
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: application/soap+xml
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            no_log_contains: id "921422"
  - test_title: 921422-14
    desc: Negative test for 921422-6
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: text/html
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            no_log_contains: id "921422"
  - test_title: 921422-15
    desc: Negative test for rule 921422-7
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: text/html; charset=UTF-8
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            no_log_contains: id "921422"
  - test_title: 921422-16
    desc: Negative test for rule 921422-8
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: multipart/form-data; boundary=something
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            no_log_contains: id "921422"
  - test_title: 921422-17
    desc: Negative test for rule 921422-9
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: multipart/form-data; boundary=----webkitformboundary12w4lszoxn26vnd
            method: POST
            port: 80
            uri: /post
            version: HTTP/1.1
          output:
            no_log_contains: id "921422"
