Skip to content

Instantly share code, notes, and snippets.

@zimmerle
Created April 24, 2017 20:03
Show Gist options
  • Select an option

  • Save zimmerle/bef703e5f57c42d5d958fe20a59e8971 to your computer and use it in GitHub Desktop.

Select an option

Save zimmerle/bef703e5f57c42d5d958fe20a59e8971 to your computer and use it in GitHub Desktop.
Logs for an empty JSON
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Initialising transaction (txid AAAAAH8AAAEAAEU@q0wAAAAC).
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transaction context created (dcfg 1b224f8).
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Starting phase REQUEST_HEADERS.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1be06f8; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "23"] [id "200000"].
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1be06f8: SecRule "REQUEST_HEADERS:Content-Type" "@rx (?:application(?:/soap\\+|/)|text/)xml" "phase:1,auditlog,id:200000,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 2 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "rx" with param "(?:application(?:/soap\\+|/)|text/)xml" against REQUEST_HEADERS:Content-Type.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 13 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 0.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1be2458; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "30"] [id "200001"].
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1be2458: SecRule "REQUEST_HEADERS:Content-Type" "@rx application/json" "phase:1,auditlog,id:200001,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 0 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "rx" with param "application/json" against REQUEST_HEADERS:Content-Type.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 1 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Ctl: Set requestBodyProcessor to JSON.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Warning. Pattern match "application/json" at REQUEST_HEADERS:Content-Type. [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "30"] [id "200001"]
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 1.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Second phase starting (dcfg 1b224f8).
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Reading request body.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] JSON parser initialization
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][2] JSON parser error: parse error: premature EOF
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Completed receiving request body (length 0).
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Starting phase REQUEST_BODY.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1b4db48; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "60"] [id "200002"].
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1b4db48: SecRule "REQBODY_ERROR" "!@eq 0" "phase:2,auditlog,id:200002,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:%{reqbody_error_msg},severity:2"
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 0 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "!eq" with param "0" against REQBODY_ERROR.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 1 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][2] Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "60"] [id "200002"] [msg "Failed to parse request body."] [data "JSON parser error: parse error: premature EOF\x0a"] [severity "CRITICAL"]
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 1.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1c029f0; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "81"] [id "200003"].
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1c029f0: SecRule "MULTIPART_STRICT_ERROR" "!@eq 0" "phase:2,auditlog,id:200003,t:none,log,deny,status:400,msg:'Multipart request body failed strict validation: PE %{REQBODY_PROCESSOR_ERROR}, BQ %{MULTIPART_BOUNDARY_QUOTED}, BW %{MULTIPART_BOUNDARY_WHITESPACE}, DB %{MULTIPART_DATA_BEFORE}, DA %{MULTIPART_DATA_AFTER}, HF %{MULTIPART_HEADER_FOLDING}, LF %{MULTIPART_LF_LINE}, SM %{MULTIPART_MISSING_SEMICOLON}, IQ %{MULTIPART_INVALID_QUOTING}, IP %{MULTIPART_INVALID_PART}, IH %{MULTIPART_INVALID_HEADER_FOLDING}, FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 0 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "!eq" with param "0" against MULTIPART_STRICT_ERROR.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 0 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 0.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1c05848; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "86"] [id "200004"].
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1c05848: SecRule "MULTIPART_UNMATCHED_BOUNDARY" "!@eq 0" "phase:2,auditlog,id:200004,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Transformation completed in 0 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Executing operator "!eq" with param "0" against MULTIPART_UNMATCHED_BOUNDARY.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Operator completed in 1 usec.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 0.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Recipe: Invoking rule 1c06fb0; [file "/home/zimmerle/core-trustwave/ModSecurity/modsecurity.conf-recommended"] [line "100"] [id "200005"].
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][5] Rule 1c06fb0: SecRule "TX:/^MSC_/" "!@streq 0" "phase:2,log,auditlog,id:200005,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Rule returned 0.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Hook insert_filter: Adding input forwarding filter (r 1d6dfc0).
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Hook insert_filter: Adding output filter (r 1d6dfc0).
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Forwarding input: mode=0, block=0, nbytes=8192 (f 1d7c6f0, r 1d6dfc0).
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Sent EOS.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Input filter: Input forwarding complete.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d6dfc0][/][4] Initialising logging.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d7c860][/error/HTTP_NOT_FOUND.html.var][4] Starting phase LOGGING.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d7c860][/error/HTTP_NOT_FOUND.html.var][4] Recording persistent data took 0 microseconds.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d7c860][/error/HTTP_NOT_FOUND.html.var][4] Audit log: Logging this transaction.
[24/Apr/2017:17:01:57 --0300] [localhost/sid#1ac33d0][rid#1d7c860][/error/HTTP_NOT_FOUND.html.var][4] JSON: Cleaning up JSON results
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment