<commit_before>---
  meta:
    author: csanders-git
    description: None
    enabled: false
    name: 931110.yaml
  tests:
  - 
    test_title: 931110-1
    desc: Remote File Inclusion Attack (931110) from old modsec regressions
    stages:
    - 
      stage:
        input:
          dest_addr: 127.0.0.1
          headers:
            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
              application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash,
              */*
            Accept-Encoding: gzip, deflate
            Accept-Language: zh-sg
            Host: localhost
            Keep-Alive: '300'
            Proxy-Connection: keep-alive
            Referer: http
            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
          method: GET
          port: 80
          uri: /plugins/spamx/BaseAdmin.class.php?_CONF[path]
          version: HTTP/1.1
        output:
          log_contains: id "931110"
  - 
    test_title: 931110-2
    desc: Remote File Inclusion Attack (931110) from old modsec regressions
    stages:
    - 
      stage:
        input:
          dest_addr: 127.0.0.1
          headers:
            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
              application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash,
              */*
            Accept-Encoding: gzip, deflate
            Accept-Language: zh-sg
            Host: localhost
            Keep-Alive: '300'
            Proxy-Connection: keep-alive
            Referer: http
            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
          method: GET
          port: 80
          uri: /components/com_virtuemart/show_image_in_imgtag.php?mosConfig_absolute_path
          version: HTTP/1.1
        output:
          log_contains: id "931110"
  - 
    test_title: 931110-3
    desc: Remote File Inclusion Attack (931110) from old modsec regressions
    stages:
    - 
      stage:
        input:
          dest_addr: 127.0.0.1
          headers:
            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
              application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash,
              */*
            Accept-Encoding: gzip, deflate
            Accept-Language: zh-sg
            Host: localhost
            Keep-Alive: '300'
            Proxy-Connection: keep-alive
            Referer: http
            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
          method: GET
          port: 80
          uri: /plugins/spamx/BaseAdmin.class.php?_CONF[path]
          version: HTTP/1.1
        output:
          log_contains: id "931110"
<commit_msg>Update regression tests for 931110.<commit_after>---
  meta:
    author: csanders-git
    description: None
    enabled: true
    name: 931110.yaml
  tests:
  - 
    test_title: 931110-1
    desc: Remote File Inclusion Attack (931110) from old modsec regressions
    stages:
    - 
      stage:
        input:
          dest_addr: 127.0.0.1
          headers:
            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
              application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash,
              */*
            Accept-Encoding: gzip, deflate
            Accept-Language: zh-sg
            Host: localhost
            Keep-Alive: '300'
            Proxy-Connection: keep-alive
            Referer: http
            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
          method: GET
          port: 80
          uri: /plugins/spamx/BaseAdmin.class.php?_CONF[path]=https://foo.bar
          version: HTTP/1.1
        output:
          log_contains: id "931110"
  - 
    test_title: 931110-2
    desc: Remote File Inclusion Attack (931110) from old modsec regressions
    stages:
    - 
      stage:
        input:
          dest_addr: 127.0.0.1
          headers:
            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
              application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash,
              */*
            Accept-Encoding: gzip, deflate
            Accept-Language: zh-sg
            Host: localhost
            Keep-Alive: '300'
            Proxy-Connection: keep-alive
            Referer: http
            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
          method: GET
          port: 80
          uri: /components/com_virtuemart/show_image_in_imgtag.php?mosConfig_absolute_path=https://foo.bar
          version: HTTP/1.1
        output:
          log_contains: id "931110"
  - 
    test_title: 931110-3
    desc: Remote File Inclusion Attack (931110) from old modsec regressions
    stages:
    - 
      stage:
        input:
          dest_addr: 127.0.0.1
          headers:
            Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
              application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash,
              */*
            Accept-Encoding: gzip, deflate
            Accept-Language: zh-sg
            Host: localhost
            Keep-Alive: '300'
            Proxy-Connection: keep-alive
            Referer: http
            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
          method: GET
          port: 80
          uri: /plugins/spamx/BaseAdmin.class.php?_CONF[path]=https://foo.bar
          version: HTTP/1.1
        output:
          log_contains: id "931110"

{'fraction_non_alphanumeric': 0.09734668775259181, 'fraction_numerical': 0.04428044280442804, 'mean_word_length': 1.6785882352941177, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 3, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 6, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6722705', 'n_tokens_mistral': 1936, 'n_tokens_neox': 1748, 'n_words': 392}