Skip to content

Commit 08f8e8b

Browse files
molu8bitsmolu8bits
authored
Merge pull request #30 from molu8bits/develop
Develop
2 parents 024aa17 + ba78704 commit 08f8e8b

16 files changed

Lines changed: 693 additions & 28 deletions

‎.github/workflows/ci.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: CI
2+
on:
3+
pull_request:
4+
branches: [develop, master]
5+
push:
6+
branches: [develop, master]
7+
8+
jobs:
9+
build:
10+
name: Build
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Check out the repo
14+
uses: actions/checkout@v2
15+
16+
- name: Set up Python 3.10
17+
uses: actions/setup-python@v4
18+
with:
19+
python-version: "3.10"
20+
21+
- name: Install dependencies
22+
run: |
23+
pip3 install -r requirements-dev.txt
24+
pip3 install -r requirements.txt
25+
26+
- name: Linting
27+
run: |
28+
make lint
29+
30+
- name: Unit Test
31+
run: |
32+
make test
33+
34+
- name: E2E Test
35+
run: |
36+
make test-e2e
37+
38+
- name: SonarCloud Scan
39+
# if: ${{ github.event_name == 'pull_request' }}
40+
# if: ${{ github.event_name == 'push' }}
41+
# if: github.event_name == 'push' && github.ref == 'refs/heads/master'
42+
uses: SonarSource/sonarcloud-github-action@v1.9.1
43+
env:
44+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
45+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
46+
47+
- name: Upload coverage reports to Codecov
48+
uses: codecov/codecov-action@v3

‎.github/workflows/docker-publish.yaml‎

Lines changed: 47 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,58 @@
11
name: Publish Docker Images
22
on:
3+
push:
4+
branches:
5+
- main
6+
- master
7+
- develop
8+
- "feature/ci-actions"
39
release:
4-
types: [published]
10+
types:
11+
- published
512
jobs:
613
push_to_registry:
714
name: Push Docker image to Docker Hub
815
runs-on: ubuntu-latest
916
steps:
1017
- name: Check out the repo
1118
uses: actions/checkout@v2
12-
- name: Push to Docker Hub
13-
uses: docker/build-push-action@v1
19+
20+
- name: Set up QEMU
21+
uses: docker/setup-qemu-action@v2
22+
23+
- name: Set up Docker Buildx
24+
uses: docker/setup-buildx-action@v1
25+
26+
- name: Login to Docker Hub
27+
uses: docker/login-action@v2
1428
with:
15-
username: ${{ secrets.DOCKER_USERNAME }}
16-
password: ${{ secrets.DOCKER_PASSWORD }}
17-
repository: molu8bits/modsecurity-parser
18-
tags: latest
19-
tag_with_ref: true
29+
username: ${{ secrets.DOCKERHUB_USERNAME }}
30+
password: ${{ secrets.DOCKERHUB_TOKEN }}
31+
32+
- name: Docker meta
33+
id: meta
34+
uses: docker/metadata-action@v4
35+
with:
36+
images: |
37+
molu8bits/modsecurity-parser
38+
39+
tags: |
40+
type=semver,pattern={{version}}
41+
42+
- name: Build and push
43+
uses: docker/build-push-action@v4
44+
with:
45+
context: .
46+
#push: ${{ github.event_name != 'pull_request' }}
47+
push: ${{ github.event_name == 'release' }}
48+
tags: ${{ steps.meta.outputs.tags }}
49+
labels: ${{ steps.meta.output.labels }}
50+
51+
# - name: Push to Docker Hub
52+
# uses: docker/build-push-action@v1
53+
# with:
54+
# username: ${{ secrets.DOCKER_USERNAME }}
55+
# password: ${{ secrets.DOCKER_PASSWORD }}
56+
# repository: molu8bits/modsecurity-parser
57+
# tags: latest
58+
# tag_with_ref: true

‎.gitignore‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ coverage.xml
7070
*.pot
7171

7272
# Django stuff:
73-
*.log
73+
#*.log
7474
local_settings.py
7575
db.sqlite3
7676

@@ -136,4 +136,4 @@ venv.bak/
136136
########### molu ############
137137
################################
138138
.molu
139-
sample_audit_log/modsec_output
139+
sample_audit_log/modsec_output/**

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
FROM ubuntu:20.04
1+
FROM ubuntu:22.04
22

33
LABEL maintainer "molu8bits@gmail.com"
44
LABEL description "modsecurity parse and charts via Docker"
5-
LABEL version "2023.03 v0.4"
5+
LABEL version "2023.05 v0.5"
66

77
ENV DEBIAN_FRONTEND=noninteractive
88

‎Makefile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ lint:
3939
# test comments
4040
@echo "\n${BLUE}Running Pylint against source and test files...${NC}\n"
4141
# @pylint --rcfile=setup.cfg **/*.py *.py
42-
@pylint --rcfile=setup.cfg *.py
42+
# @pylint --rcfile=setup.cfg *.py
43+
@pylint --rcfile=setup.cfg *.py --output-format=parseable --output pylint-output.txt --exit-zero
4344
@echo "\n${BLUE}Running PyDocStyle against source files...${NC}\n"
4445
@pydocstyle --config=setup.cfg modsecurity_parser.py
4546
@echo "\n${BLUE}Running Flake8 against source and test files...${NC}\n"
@@ -50,8 +51,8 @@ lint:
5051
@echo "\n${BLUE}Running pycodestyle against source files...${NC}\n"
5152
@pycodestyle modsecurity_parser.py
5253
@echo "\n${BLUE}Running Code Coverage against source files...${NC}\n"
53-
@pytest --cov=modsecurity_parser tests --cov-report=html
54-
54+
# @pytest --cov=modsecurity_parser tests --cov-report=html
55+
# @pytest
5556

5657
clean:
5758
rm -rf .pytest_cache .coverage .pytest_cache coverage.xml sample_audit_log/modsec_output

‎README.md‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,24 @@
11
# modsecurity audit log parser, analyser and chart maker
22

3-
![Docker Build Status](https://img.shields.io/docker/automated/molu8bits/modsecurity-parser.svg)
4-
![Docker Cloud Build Status](https://img.shields.io/docker/cloud/build/molu8bits/modsecurity-parser.svg)
3+
![CI](https://github.com/molu8bits/modsecurity-parser/workflows/CI/badge.svg?branch=develop&event=push)
4+
[![codecov](https://codecov.io/gh/molu8bits/modsecurity-parser/branch/master/graph/badge.svg?token=BY0D5SNBR8)](https://codecov.io/gh/molu8bits/modsecurity-parser)
55
![Docker Image Size](https://img.shields.io/docker/image-size/molu8bits/modsecurity-parser.svg?sort=date)
66
![Docker Image Version (latest by date):](https://img.shields.io/docker/v/molu8bits/modsecurity-parser.svg?sort=date)
77
![Docker Pulls](https://img.shields.io/docker/pulls/molu8bits/modsecurity-parser.svg)
8+
[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=modsecurity-parser&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=modsecurity-parser)
9+
[![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=modsecurity-parser&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=modsecurity-parser)
810

911
## TL;DR
1012

1113
Get the overview of security incidents reported by modsecurity module from modsec_audit.log file.
1214

13-
## 2022.01.01 update
15+
## 2023.05.03 update
16+
17+
- fix showruleid #24
18+
- CI github actions
19+
- address vulnerabilities
20+
21+
## 2023.01.01 update
1422

1523
- renamed to modsecurity_parser
1624
- fix for timezone with miliseconds

‎modsecurity_parser.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -558,7 +558,7 @@ def modsec_view_graphs(modsec_dict): # noqa: C901
558558
plt.text(0.5, 0.5, short_time_range_message, horizontalalignment='center', verticalalignment='center')
559559
plt.title(plot_title)
560560
else:
561-
ex = events_df.groupby(pd.Grouper(key='date', freq=periods)).sum()
561+
ex = events_df.groupby(pd.Grouper(key='date', freq=periods)).sum(numeric_only=True)
562562
ex.plot(ax=ax1, kind='bar', title=plot_title, stacked=True, color={'purple', 'red'}, fontsize=7, rot=45)
563563

564564
# Bar chart "TOP 10 IP addresses"
@@ -615,7 +615,7 @@ def modsec_view_graphs(modsec_dict): # noqa: C901
615615
# x_value = np.char.array(list(event_messages_ids_top20.keys()))
616616
y_value = np.array(list(event_messages_ids_top20.values()))
617617
labels = [
618-
'f{i} --> {j} hits' for i, j in zip(event_messages_ids_top20.keys(),
618+
f'{i} --> {j} hits' for i, j in zip(event_messages_ids_top20.keys(),
619619
event_messages_ids_top20.values())]
620620
if len(event_messages_ids_top20.keys()) >= 1:
621621
patches, labels, dummy = zip(*sorted(zip(patches, labels, y_value),

‎requirements-dev.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,4 @@ bandit
1010
pytest
1111
pytest-cov
1212
codecov
13+
pydocstyle

‎requirements.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#numpy==1.19.2
2-
numpy==1.22.4
2+
numpy==1.24.2
33
matplotlib==3.3.2
4-
pillow==9.2.0
5-
pandas==1.1.3
4+
pillow==9.3.0
5+
pandas==1.5.3
66
openpyxl==2.4.2

‎sample_audit_log/modsec_audit_v2.log‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
--622ca252-A--
2+
[01/May/2018:08:05:00 +0200] WugN3pjbflCiqw4yEJ3nggAAAAk 172.16.0.2 22387 192.168.0.1 80
3+
--622ca252-B--
4+
GET /phpmyadmin/index.php HTTP/1.1
5+
User-Agent: Mozilla/5.0
6+
Host: 192.168.0.1
7+
Connection: Keep-Alive
8+
Cache-Control: no-cache
9+
10+
--622ca252-F--
11+
HTTP/1.1 403 Forbidden
12+
Content-Length: 222
13+
Keep-Alive: timeout=5, max=99
14+
Connection: Keep-Alive
15+
Content-Type: text/html; charset=iso-8859-1
16+
17+
--622ca252-E--
18+
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
19+
<html><head>
20+
<title>403 Forbidden</title>
21+
</head><body>
22+
<h1>Forbidden</h1>
23+
<p>You don't have permission to access /phpmyadmin/index.php
24+
on this server.</p>
25+
</body></html>
26+
27+
--622ca252-H--
28+
Message: Access denied with code 403 (phase 1). Pattern match "/phpmyadmin" at REQUEST_FILENAME. [file "/etc/httpd/conf.d/mod_security.conf"] [line "94"] [id "10000"] [msg "Blocking access to /phpmyadmin/index.php."] [tag "Blacklist Rules"]
29+
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 172.16.0.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "/phpmyadmin" at REQUEST_FILENAME. [file "/etc/httpd/conf.d/mod_security.conf"] [line "94"] [id "10000"] [msg "Blocking access to /phpmyadmin/index.php."] [tag "Blacklist Rules"] [hostname "192.168.0.1"] [uri "/phpmyadmin/index.php"] [unique_id "WugN3pjbflCiqw4yEJ3nggAAAAk"]
30+
Action: Intercepted (phase 1)
31+
Stopwatch: 1525157342927546 578 (- - -)
32+
Stopwatch2: 1525157342927546 578; combined=125, p1=53, p2=0, p3=0, p4=0, p5=72, sr=0, sw=0, l=0, gc=0
33+
Response-Body-Transformed: Dechunked
34+
Producer: ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.2.
35+
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
36+
Engine-Mode: "ENABLED"
37+
38+
--622ca252-Z--
39+
40+
--68a39c63-A--
41+
[01/May/2018:08:10:20 +0200] WvGgdU9AURJlp7Ta7HNRzAAAAAE 10.5.6.7 37346 192.168.0.1 443
42+
--68a39c63-B--
43+
GET /favicon.ico HTTP/1.1
44+
Host: 192.168.0.1
45+
Connection: keep-alive
46+
Accept-Encoding: gzip, deflate
47+
Accept: */*
48+
User-Agent: python-requests/2.13.0
49+
50+
--68a39c63-F--
51+
HTTP/1.1 404 Not Found
52+
Content-Length: 209
53+
Keep-Alive: timeout=5, max=100
54+
Connection: Keep-Alive
55+
Content-Type: text/html; charset=iso-8859-1
56+
57+
--68a39c63-E--
58+
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
59+
<html><head>
60+
<title>404 Not Found</title>
61+
</head><body>
62+
<h1>Not Found</h1>
63+
<p>The requested URL /favicon.ico was not found on this server.</p>
64+
</body></html>
65+
66+
--68a39c63-H--
67+
Message: Warning. Matched phrase "python-requests" at REQUEST_HEADERS:User-Agent. [file "/etc/httpd/conf.d/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "164"] [id "913101"] [rev "1"] [msg "Found User-Agent associated with scripting/generic HTTP client"] [data "Matched Data: python-requests found within REQUEST_HEADERS:User-Agent: python-requests/2.13.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scripting"] [tag "OWASP_CRS/AUTOMATION/SCRIPTING"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"]
68+
Message: Warning. Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/conf.d/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "810"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "192.168.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
69+
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 10.5.6.7] ModSecurity: Warning. Matched phrase "python-requests" at REQUEST_HEADERS:User-Agent. [file "/etc/httpd/conf.d/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "164"] [id "913101"] [rev "1"] [msg "Found User-Agent associated with scripting/generic HTTP client"] [data "Matched Data: python-requests found within REQUEST_HEADERS:User-Agent: python-requests/2.13.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scripting"] [tag "OWASP_CRS/AUTOMATION/SCRIPTING"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "192.168.0.1"] [uri "/favicon.ico"] [unique_id "WvGgdU9AURJlp7Ta7HNRzAAAAAE"]
70+
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 10.5.6.7] ModSecurity: Warning. Pattern match "^[\\\\\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/conf.d/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "810"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "192.168.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "192.168.0.1"] [uri "/favicon.ico"] [unique_id "WvGgdU9AURJlp7Ta7HNRzAAAAAE"]
71+
Stopwatch: 1525784693307805 2777 (- - -)
72+
Stopwatch2: 1525784693307805 2777; combined=2021, p1=694, p2=748, p3=58, p4=209, p5=224, sr=328, sw=88, l=0, gc=0
73+
Response-Body-Transformed: Dechunked
74+
Producer: ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.2.
75+
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
76+
Engine-Mode: "ENABLED"
77+
78+
--68a39c63-Z--
79+
80+
81+
--c2578d7b-A--
82+
[05/May/2018:03:30:12 +0200] WvTyJHKtCFt-nNhJ4VGG9QAAAAg 172.16.0.2 45736 192.168.0.1 443
83+
--c2578d7b-B--
84+
HEAD /index.php HTTP/1.1
85+
Host: 192.168.0.1
86+
Accept: */*
87+
Accept-Encoding: gzip, deflate
88+
User-Agent: python-requests/2.18.4
89+
Connection: keep-alive
90+
91+
--c2578d7b-F--
92+
HTTP/1.1 404 Not Found
93+
Keep-Alive: timeout=5, max=100
94+
Connection: Keep-Alive
95+
Content-Type: text/html; charset=iso-8859-1
96+
97+
--c2578d7b-E--
98+
99+
--c2578d7b-H--
100+
Message: Warning. Matched phrase "python-requests" at REQUEST_HEADERS:User-Agent. [file "/etc/httpd/conf.d/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "164"] [id "913101"] [rev "1"] [msg "Found User-Agent associated with scripting/generic HTTP client"] [data "Matched Data: python-requests found within REQUEST_HEADERS:User-Agent: python-requests/2.18.4"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scripting"] [tag "OWASP_CRS/AUTOMATION/SCRIPTING"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"]
101+
Message: Warning. Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/conf.d/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "810"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "192.168.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
102+
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 172.16.0.2] ModSecurity: Warning. Matched phrase "python-requests" at REQUEST_HEADERS:User-Agent. [file "/etc/httpd/conf.d/crs/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "164"] [id "913101"] [rev "1"] [msg "Found User-Agent associated with scripting/generic HTTP client"] [data "Matched Data: python-requests found within REQUEST_HEADERS:User-Agent: python-requests/2.18.4"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scripting"] [tag "OWASP_CRS/AUTOMATION/SCRIPTING"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "192.168.0.1"] [uri "/index.php"] [unique_id "WvTyJHKtCFt-nNhJ4VGG9QAAAAg"]
103+
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 172.16.0.2] ModSecurity: Warning. Pattern match "^[\\\\\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/conf.d/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "810"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "192.168.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "192.168.0.1"] [uri "/index.php"] [unique_id "WvTyJHKtCFt-nNhJ4VGG9QAAAAg"]
104+
Stopwatch: 1526002212715379 3565 (- - -)
105+
Stopwatch2: 1526002212715379 3565; combined=2244, p1=885, p2=860, p3=66, p4=119, p5=214, sr=539, sw=100, l=0, gc=0
106+
Response-Body-Transformed: Dechunked
107+
Producer: ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.2.
108+
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
109+
Engine-Mode: "ENABLED"
110+
111+
--c2578d7b-Z--
112+
113+
--7b0b0a73-A--
114+
[09/May/2018:09:09:53 +0200] Wu0TYfl141Zko07xKZQLRwAAAAI 10.9.8.7 54171 192.168.0.1 443
115+
--7b0b0a73-B--
116+
GET /verifylogin.do HTTP/1.1
117+
Connection: Keep-Alive
118+
Content-Type: %{(#test='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(#ros.println(55*55+1)).(#ros.flush())}
119+
Accept: */*
120+
Accept-Language: zh-cn
121+
Referer: https://192.168.0.1:443/verifylogin.do
122+
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
123+
Host: 192.168.0.1
124+
125+
--7b0b0a73-F--
126+
HTTP/1.1 404 Not Found
127+
Content-Length: 212
128+
Keep-Alive: timeout=5, max=100
129+
Connection: Keep-Alive
130+
Content-Type: text/html; charset=iso-8859-1
131+
132+
--7b0b0a73-E--
133+
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
134+
<html><head>
135+
<title>404 Not Found</title>
136+
</head><body>
137+
<h1>Not Found</h1>
138+
<p>The requested URL /verifylogin.do was not found on this server.</p>
139+
</body></html>
140+
141+
--7b0b0a73-H--
142+
Message: Warning. Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/conf.d/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "810"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "192.168.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
143+
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 10.9.8.7] ModSecurity: Warning. Pattern match "^[\\\\\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/conf.d/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "810"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "192.168.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "192.168.0.1"] [uri "/verifylogin.do"] [unique_id "Wu0TYfl141Zko07xKZQLRwAAAAI"]
144+
Stopwatch: 1525486433569262 3185 (- - -)
145+
Stopwatch2: 1525486433569262 3185; combined=1985, p1=810, p2=812, p3=56, p4=191, p5=115, sr=399, sw=1, l=0, gc=0
146+
Response-Body-Transformed: Dechunked
147+
Producer: ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.2.
148+
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
149+
Engine-Mode: "ENABLED"
150+
151+
152+
--7b0b0a73-Z--

0 commit comments

Comments
 (0)