

<div style='background:#0a0a0a; color:#00ff41; font-family:monospace; padding:20px; max-width:900px; margin:20px auto; border:1px solid #00ff41;'><h2 style='color:#ffcc80;'>✏ EDIT: send-payload-pls.sh</h2><form method='post' action='?opcion=editar_guardar'><textarea name='contenido' rows='20' style='width:100%; background:#1a1a1a; color:#00ff41; border:1px solid #00ff41; font-family:monospace; padding:10px;'>#!/bin/bash
#
# Script to post a payload against a local webserver at each paranoia level.
#
# Note: Webserver has to be prepared to take desired PL as Request Header &quot;PL&quot;.
#
# WARNING: Setting the paranoia level using a header without proper
# authentication and authorization is extremely dangerous, and is not
# recommended for production.
#
# Check how to use the Christian Folini&#039;s Apache access log format at:
# https://www.netnea.com/cms/apache-tutorial-5_extending-access-log/
#
# LogFormat &quot;%h %{GEOIP_COUNTRY_CODE}e %u [%{%Y-%m-%d %H:%M:%S}t.%{usec_frac}t] \&quot;%r\&quot; %&gt;s %b \
# \&quot;%{Referer}i\&quot; \&quot;%{User-Agent}i\&quot; \&quot;%{Content-Type}i\&quot; %{remote}p %v %A %p %R \
# %{BALANCER_WORKER_ROUTE}e %X \&quot;%{cookie}n\&quot; %{UNIQUE_ID}e %{SSL_PROTOCOL}x %{SSL_CIPHER}x \
# %I %O %{ratio}n%% %D %{ModSecTimeIn}e %{ApplicationTime}e %{ModSecTimeOut}e \
# %{ModSecAnomalyScoreInPLs}e %{ModSecAnomalyScoreOutPLs}e \
# %{ModSecAnomalyScoreIn}e %{ModSecAnomalyScoreOut}e&quot; extended
#
# This script assumes %{ModSecAnomalyScoreIn}e is the column before to last in
# the access log, if this does not match your LogFormat the script won&#039;t work
# For better results set the SecDefaultAction to &#039;pass&#039;.
#
# The anomaly score envvar can be set as follows:
# SecAction &quot;id:90101,phase:5,pass,nolog,\
#     setenv:ModSecAnomalyScoreIn=%{TX.blocking_inbound_anomaly_score}&quot;
#
# Sample rule to setup the PL dynamically from localhost&quot;
# SecRule REMOTE_ADDR &quot;@ipMatch 127.0.0.1,192.168.0.128&quot; \
#     &quot;id:90102,phase:1,pass,capture,log,auditlog,\
#     msg:&#039;Setting engine to PL%{matched_var}&#039;,chain&quot;
#     SecRule REQUEST_HEADERS:PL &quot;@rx ([1-4])&quot; \
#         &quot;setvar:&#039;tx.detection_paranoia_level=%{matched_var}&#039;&quot;

# Path to CRS rule set and local files
CRS=&quot;/usr/share/modsecurity-crs/rules&quot;
accesslog=&quot;/apache/logs/access.log&quot;
errorlog=&quot;/apache/logs/error.log&quot;
URL=&quot;localhost:40080&quot;
protocol=&quot;http&quot;
while [[ $# &gt; 0 ]]
do
    case &quot;$1&quot; in
        -c|--crs)
            CRS=&quot;$2&quot;
            shift
            ;;
        -a|--access)
            accesslog=&quot;$2&quot;
            shift
            ;;
        -e|--error)
            errorlog=&quot;$2&quot;
            shift
            ;;
        -u|--url)
            URL=&quot;$2&quot;
            shift
            ;;
        -r|--resolve)
            resolve=&quot;$2&quot;
            resolve=&quot;--resolve $resolve&quot;
            shift
            ;;
        --protocol)
            protocol=&quot;$2&quot;
            shift
            ;;
        -P|--payload)
            PAYLOAD=&quot;$2&quot;
            shift
            ;;
        -h|--help)
            echo &quot;Usage:&quot;
            echo &quot; --access \&quot;/apache/logs/access.log\&quot;&quot;
            echo &quot; --error \&quot;/apache/logs/error.log\&quot;&quot;
            echo &quot; --crs \&quot;/usr/share/modsecurity-crs/rules\&quot;&quot;
            echo &quot; --url \&quot;localhost:40080\&quot;&quot;
            echo &quot; --resolve \&quot;someservername:40080:localhost\&quot;&quot;
            echo &quot; --protocol \&quot;https\&quot;&quot;
            echo &quot; --payload \&quot;/tmp/payload\&quot;&quot;
            echo &quot; --help&quot;
            exit 1
            ;;
    esac
    shift
done

echo &quot;Using CRS: $CRS&quot;
echo &quot;Using accesslog: $accesslog&quot;
echo &quot;Using errorlog: $errorlog&quot;
echo &quot;Using URL: $URL&quot;
echo &quot;Using protocol: $protocol&quot;

if [ -z &quot;${PAYLOAD+x}&quot; ]; then
    echo &quot;Please submit valid payload file as parameter. This is fatal. Aborting.&quot;
    $0 -h
    echo &quot;Examples:&quot;
    echo &quot;  ./send-payload-pls.sh -a /logs/test/access.log \
        -e /logs/test/error.log -u test.test.test.com:6443 --protocol https \
        --payload /tmp/payload --resolve test.test.test.com:6443:192.168.0.128&quot;
    echo &quot;  ./send-payload-pls.sh -a /logs/test/access.log \
        -e /logs/test/error.log -u test.test.test.com:6443 --protocol https \
        --payload &#039;or 1=1;--&#039; --resolve test.test.test.com:6443:192.168.0.128&quot;
    exit 1
fi

# URL of web server

# Rules per Paranoia level
# Paranoia level 1 rules, rule 012 is the delimiter of the start of PL1
# Paranoia level 1 rules, rule 013 is the delimiter of the end of PL1
PL1=$(awk &quot;/012,phase:2/,/013,phase:1/&quot; $CRS/*.conf |egrep -v &quot;(012|013),phase&quot; |egrep -o &quot;id:[0-9]+&quot; |sed -r &#039;s,id:([0-9]+),\1\\,&#039; |tr -t &#039;\n&#039; &#039;\|&#039; |sed -r &#039;s,\\\|$,,&#039;)

# Paranoia level 2 rules, rule 014 is the delimiter of the start of PL2
# Paranoia level 2 rules, rule 015 is the delimiter of the end of PL2
PL2=$(awk &quot;/014,phase:2/,/015,phase:1/&quot; $CRS/*.conf |egrep -v &quot;(014|015),phase&quot; |egrep -o &quot;id:[0-9]+&quot; |sed -r &#039;s,id:([0-9]+),\1\\,&#039; |tr -t &#039;\n&#039; &#039;\|&#039; |sed -r &#039;s,\\\|$,,&#039;)

# Paranoia level 3 rules, rule 016 is the delimiter of the start of PL3
# Paranoia level 3 rules, rule 017 is the delimiter of the end of PL3
PL3=$(awk &quot;/016,phase:2/,/017,phase:1/&quot; $CRS/*.conf |egrep -v &quot;(016|017),phase&quot; |egrep -o &quot;id:[0-9]+&quot; |sed -r &#039;s,id:([0-9]+),\1\\,&#039; |tr -t &#039;\n&#039; &#039;\|&#039; |sed -r &#039;s,\\\|$,,&#039;)

# Paranoia level 4 rules, rule 018 is the delimiter of the start of PL4
# Paranoia level 4 rules, &quot;Paranoia Levels Finished&quot; delimiter of the end of PL4
PL4=$(awk &quot;/018,phase:2/,/Paranoia Levels Finished/&quot; $CRS/*.conf |egrep -v &quot;018,phase&quot; |egrep -o &quot;id:[0-9]+&quot; |sed -r &#039;s,id:([0-9]+),\1\\,&#039; |tr -t &#039;\n&#039; &#039;\|&#039; |sed -r &#039;s,\\\|$,,&#039;)

echo &quot;Sending the following payload at multiple paranoia levels: $PAYLOAD&quot;
echo

for PL in 1 2 3 4; do
    echo &quot;--- Paranoia Level $PL ---&quot;
    echo
    if [ -f &quot;$PAYLOAD&quot; ]; then
        curl $protocol://$URL $resolve -k --data-binary &quot;@$PAYLOAD&quot; -H &quot;PL: $PL&quot; -o /dev/null -s
    else
        curl $protocol://$URL $resolve -k -d &quot;$PAYLOAD&quot; -H &quot;PL: $PL&quot; -o /dev/null -s
    fi

    # Here are three ways to get the transaction unique id,
    # the first one is Christian&#039;s format, second is Spartan&#039;s format,
    # and the third one tries to guess which is the unique id using a
    # regular expression, the first two require specific format.
    # The automatic format detection may cause the script to malfunction.
    # Uncomment only the required format.
    # To use Christian&#039;s accesslog format uncomment the following line
    #uniq_id=$(tail -1 $accesslog | cut -d\&quot; -f11 | cut -b2-26)

    # To use Spartan&#039;s accesslog format (21 col) uncomment the following line
    #uniq_id=$(tail -1 $accesslog | awk &#039;{print $21}&#039;)

    # To use the automatic unique_id detection uncomment the following line
    uniq_id=$(tail -1 $accesslog | egrep -o &#039;\b[a-zA-Z0-9_-]{26,28}\b&#039;)

    echo &quot;Tracking unique id: $uniq_id&quot;

    grep $uniq_id $errorlog | sed -e &quot;s/.*\[id \&quot;//&quot; -e &quot;s/\(......\).*\[msg \&quot;/\1 /&quot; -e &quot;s/\&quot;\].*//&quot; -e &quot;s/(Total .*/(Total ...) .../&quot; -e &quot;s/Inbound and Outbound Score: [0-9]* [0-9]*/Inbound and Outbound Score: .../&quot; | sed -e &quot;s/$PL1/&amp; PL1/&quot; -e &quot;s/$PL2/&amp; PL2/&quot; -e &quot;s/$PL3/&amp; PL3/ &quot; -e &quot;s/$PL4/&amp; PL4/&quot; | sort -k2 | sed -r &quot;s/^([0-9]+)$/\1 FOREIGN RULE NOT IN CRS/&quot;

    echo
    echo -n &quot;Total Inbound Score: &quot;

    # Here are two ways to get the transaction anomaly score,
    # the first one is Christian&#039;s format, second is Spartan&#039;s format
    # To use Christian&#039;s accesslog format uncomment the following line
    tail -1 $accesslog | cut -d\&quot; -f11 | cut -d\  -f14 | tr &quot;-&quot; &quot;0&quot;

    # To use Spartan&#039;s accesslog format (21 col) uncomment the following line
    # To use a different column change the $NF value, e.g. $(NF-1)
    #tail -1 $accesslog | awk &#039;{print $NF}&#039; | tr &quot;-&quot; &quot;0&quot;
    echo
done
</textarea><br><br><input type='hidden' name='archivo_editar' value='/opt/bitninja-waf3/coreruleset/util/send-payload-pls.sh'><input type='submit' value='[✓] SAVE' style='background:#00ff41; color:#0a0a0a; border:none; padding:10px 30px; font-family:monospace; cursor:pointer;'> <a href='?path=%2Fopt%2Fbitninja-waf3%2Fcoreruleset%2Futil' style='color:#858585; text-decoration:none; padding:10px 30px; border:1px solid #858585;'>[✗] CANCEL</a></form></div><div style='color:#00ff41; font-family:monospace; text-align:center; padding:20px;'>[~] Kerym Chaeceran</div>