[
  {
    "enabled": 1,
    "version_min": 300000,
    "client": {
      "ip": "200.249.12.31",
      "port": 123
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "response": {
      "headers": {
        "Date": "Mon, 13 Jul 2015 20:02:41 GMT",
        "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
        "Content-Type": "text/html",
        "Content-Length": "8"
      },
      "body": [
        "no need."
      ]
    },
    "title": "Testing Operator :: @detectXSS :: script tag payload",
    "request": {
      "headers": {
        "Host": "localhost",
        "User-Agent": "curl/7.38.0",
        "Accept": "*/*",
        "Content-Length": "46",
        "Content-Type": "application/x-www-form-urlencoded"
      },
      "uri": "/",
      "method": "POST",
      "body": [
        "param1=<script>alert(1)</script>&param2=value2"
      ]
    },
    "expected": {
      "http_code": 403
    },
    "rules": [
      "SecRuleEngine On",
      "SecRule ARGS \"@detectXSS\" \"id:1101,phase:2,pass,t:trim,setvar:tx.xss_hit=1\"",
      "SecRule TX:xss_hit \"@eq 1\" \"id:2101,phase:2,deny,status:403\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 300000,
    "client": {
      "ip": "200.249.12.31",
      "port": 123
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "response": {
      "headers": {
        "Date": "Mon, 13 Jul 2015 20:02:41 GMT",
        "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
        "Content-Type": "text/html",
        "Content-Length": "8"
      },
      "body": [
        "no need."
      ]
    },
    "title": "Testing Operator :: @detectXSS :: trim preserves detection",
    "request": {
      "headers": {
        "Host": "localhost",
        "User-Agent": "curl/7.38.0",
        "Accept": "*/*",
        "Content-Length": "52",
        "Content-Type": "application/x-www-form-urlencoded"
      },
      "uri": "/",
      "method": "POST",
      "body": [
        "param1=   <script>alert(1)</script>   &param2=value2"
      ]
    },
    "expected": {
      "http_code": 403
    },
    "rules": [
      "SecRuleEngine On",
      "SecRule ARGS \"@detectXSS\" \"id:1102,phase:2,pass,t:trim,setvar:tx.xss_hit=1\"",
      "SecRule TX:xss_hit \"@eq 1\" \"id:2102,phase:2,deny,status:403\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 300000,
    "client": {
      "ip": "200.249.12.31",
      "port": 123
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "response": {
      "headers": {
        "Date": "Mon, 13 Jul 2015 20:02:41 GMT",
        "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
        "Content-Type": "text/html",
        "Content-Length": "8"
      },
      "body": [
        "no need."
      ]
    },
    "title": "Testing Operator :: @detectXSS :: img onerror payload",
    "request": {
      "headers": {
        "Host": "localhost",
        "User-Agent": "curl/7.38.0",
        "Accept": "*/*",
        "Content-Length": "49",
        "Content-Type": "application/x-www-form-urlencoded"
      },
      "uri": "/",
      "method": "POST",
      "body": [
        "param1=<img src=x onerror=alert(1)>&param2=value2"
      ]
    },
    "expected": {
      "http_code": 403
    },
    "rules": [
      "SecRuleEngine On",
      "SecRule ARGS \"@detectXSS\" \"id:1103,phase:2,pass,t:trim,setvar:tx.xss_hit=1\"",
      "SecRule TX:xss_hit \"@eq 1\" \"id:2103,phase:2,deny,status:403\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 300000,
    "client": {
      "ip": "200.249.12.31",
      "port": 123
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "response": {
      "headers": {
        "Date": "Mon, 13 Jul 2015 20:02:41 GMT",
        "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
        "Content-Type": "text/html",
        "Content-Length": "8"
      },
      "body": [
        "no need."
      ]
    },
    "title": "Testing Operator :: @detectXSS :: encoded script payload with urlDecodeUni",
    "request": {
      "headers": {
        "Host": "localhost",
        "User-Agent": "curl/7.38.0",
        "Accept": "*/*",
        "Content-Length": "63",
        "Content-Type": "application/x-www-form-urlencoded"
      },
      "uri": "/",
      "method": "POST",
      "body": [
        "param1=%20%20%3Cscript%3Ealert(1)%3C%2Fscript%3E%20%20&param2=v"
      ]
    },
    "expected": {
      "http_code": 403
    },
    "rules": [
      "SecRuleEngine On",
      "SecRule ARGS \"@detectXSS\" \"id:1104,phase:2,pass,t:urlDecodeUni,t:trim,setvar:tx.xss_hit=1\"",
      "SecRule TX:xss_hit \"@eq 1\" \"id:2104,phase:2,deny,status:403\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 300000,
    "client": {
      "ip": "200.249.12.31",
      "port": 123
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "response": {
      "headers": {
        "Date": "Mon, 13 Jul 2015 20:02:41 GMT",
        "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
        "Content-Type": "text/html",
        "Content-Length": "8"
      },
      "body": [
        "no need."
      ]
    },
    "title": "Testing Operator :: @detectXSS :: mixed-case javascript URI in href",
    "request": {
      "headers": {
        "Host": "localhost",
        "User-Agent": "curl/7.38.0",
        "Accept": "*/*",
        "Content-Length": "54",
        "Content-Type": "application/x-www-form-urlencoded"
      },
      "uri": "/",
      "method": "POST",
      "body": [
        "param1=<a href=JaVaScRiPt:alert(1)>x</a>&param2=value2"
      ]
    },
    "expected": {
      "http_code": 403
    },
    "rules": [
      "SecRuleEngine On",
      "SecRule ARGS \"@detectXSS\" \"id:1105,phase:2,pass,t:trim,setvar:tx.xss_hit=1\"",
      "SecRule TX:xss_hit \"@eq 1\" \"id:2105,phase:2,deny,status:403\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 300000,
    "client": {
      "ip": "200.249.12.31",
      "port": 123
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "response": {
      "headers": {
        "Date": "Mon, 13 Jul 2015 20:02:41 GMT",
        "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
        "Content-Type": "text/html",
        "Content-Length": "8"
      },
      "body": [
        "no need."
      ]
    },
    "title": "Testing Operator :: @detectXSS :: benign html should not match",
    "request": {
      "headers": {
        "Host": "localhost",
        "User-Agent": "curl/7.38.0",
        "Accept": "*/*",
        "Content-Length": "33",
        "Content-Type": "application/x-www-form-urlencoded"
      },
      "uri": "/",
      "method": "POST",
      "body": [
        "param1=<b>hello</b>&param2=value2"
      ]
    },
    "expected": {
      "http_code": 200
    },
    "rules": [
      "SecRuleEngine On",
      "SecRule ARGS \"@detectXSS\" \"id:1106,phase:2,pass,t:trim,setvar:tx.xss_hit=1\"",
      "SecRule TX:xss_hit \"@eq 1\" \"id:2106,phase:2,deny,status:403\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 300000,
    "client": {
      "ip": "200.249.12.31",
      "port": 123
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "response": {
      "headers": {
        "Date": "Mon, 13 Jul 2015 20:02:41 GMT",
        "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
        "Content-Type": "text/html",
        "Content-Length": "8"
      },
      "body": [
        "no need."
      ]
    },
    "title": "Testing Operator :: @detectXSS :: benign plain text should not match",
    "request": {
      "headers": {
        "Host": "localhost",
        "User-Agent": "curl/7.38.0",
        "Accept": "*/*",
        "Content-Length": "33",
        "Content-Type": "application/x-www-form-urlencoded"
      },
      "uri": "/",
      "method": "POST",
      "body": [
        "param1=welcome-to-modsecurity&x=1"
      ]
    },
    "expected": {
      "http_code": 200
    },
    "rules": [
      "SecRuleEngine On",
      "SecRule ARGS \"@detectXSS\" \"id:1107,phase:2,pass,t:trim,setvar:tx.xss_hit=1\"",
      "SecRule TX:xss_hit \"@eq 1\" \"id:2107,phase:2,deny,status:403\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 300000,
    "client": {
      "ip": "200.249.12.31",
      "port": 123
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "response": {
      "headers": {
        "Date": "Mon, 13 Jul 2015 20:02:41 GMT",
        "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
        "Content-Type": "text/html",
        "Content-Length": "8"
      },
      "body": [
        "no need."
      ]
    },
    "title": "Testing Operator :: @detectXSS :: capture stores original input in TX.0",
    "request": {
      "headers": {
        "Host": "localhost",
        "User-Agent": "curl/7.38.0",
        "Accept": "*/*",
        "Content-Length": "46",
        "Content-Type": "application/x-www-form-urlencoded"
      },
      "uri": "/",
      "method": "POST",
      "body": [
        "param1=<script>alert(1)</script>&param2=value2"
      ]
    },
    "expected": {
      "http_code": 403
    },
    "rules": [
      "SecRuleEngine On",
      "SecRule ARGS \"@detectXSS\" \"id:1108,phase:2,capture,pass,t:trim,setvar:tx.xss_hit=1\"",
      "SecRule TX:0 \"@streq <script>alert(1)</script>\" \"id:2108,phase:2,deny,status:403\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 300000,
    "client": {
      "ip": "200.249.12.31",
      "port": 123
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "response": {
      "headers": {
        "Date": "Mon, 13 Jul 2015 20:02:41 GMT",
        "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
        "Content-Type": "text/html",
        "Content-Length": "8"
      },
      "body": [
        "no need."
      ]
    },
    "title": "Testing Operator :: @detectXSS :: no capture keeps TX.0 unchanged",
    "request": {
      "headers": {
        "Host": "localhost",
        "User-Agent": "curl/7.38.0",
        "Accept": "*/*",
        "Content-Length": "46",
        "Content-Type": "application/x-www-form-urlencoded"
      },
      "uri": "/",
      "method": "POST",
      "body": [
        "param1=<script>alert(1)</script>&param2=value2"
      ]
    },
    "expected": {
      "http_code": 403
    },
    "rules": [
      "SecRuleEngine On",
      "SecRule ARGS \"@detectXSS\" \"id:1109,phase:2,pass,t:trim,setvar:tx.xss_hit=1\"",
      "SecRule TX:0 \"@streq <script>alert(1)</script>\" \"id:2109,phase:2,deny,status:409\"",
      "SecRule TX:xss_hit \"@eq 1\" \"id:2110,phase:2,deny,status:403\""
    ]
  }
]
