Re: Variable name for "data"

homesh joshi <[email protected]> Wed, 1 Jun 2022 19:49:12 +0530
Newsgroups gmane.comp.apache.mod-security.user
Message-ID <CAAjxK7sc=_rKXz1=Q9oKxMBx1gL3aOA52y1Aq5acOQd6K1pO+w@mail.gmail.com>
Dear Franziska,

Thanks for the reply.
I shared partial Json as I wanted to showcase the important part.
My requirement is simple. I wanted to know the variable name that holds the
[data \"or 2=2\"] like rule.msg variable holds the [msg \"SQL Injection\"]

Thanks,
Homesh


On Wed, Jun 1, 2022 at 7:44 PM Franziska Buehler <
[email protected]> wrote:

> Hi Homesh,
>
> That doesn't appear to be valid JSON. Can you please describe what you
> want to do exactly and how you tried to achieve this??
>
> Best,
> Franziska
>
>
>
> homesh joshi <[email protected]> schrieb am Di., 31. Mai 2022, 14:08:
>
>> Hi All,
>>
>> Please refer to the following from modsec logs in json format.
>>
>> [file \"/usr/share/modsec/rules/10_gen_rules.conf\"] [line \"283\"] [id
>> \"11\"] [rev \"43\"] [msg \"SQL Injection\"] [data \"or 2=2\"] [severity
>> \"CRITICAL\"]
>>
>> I am able to get the values of msg, id &  severity variables(using
>> rule.msg,rule.id,rule.severity) but I can't find the variable name for
>> data ([data \"or 2=2\"])
>>
>> I have searched on google as well as on modsec handbook pdf but can't
>> find the name.
>>
>> Can someone share some info on this please.
>>
>> Thanks,
>> Homesh
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/