Re: Variable name for "data"

Dear Azurit,

Tx.0 worked for me you are right it is there in the rule.

Thanks a lot.

Regards,
Homesh

On Wed, 1 Jun, 2022, 8:15 pm , <[email protected]> wrote:

> Hi Homesh,
>
> probably tx.0 but try looking at the rule ID 11, on logdata action.
>
> azurit
>
>
>
>
>
> Citát homesh joshi <[email protected]>:
>
> > Dear Franziska,
> >
> > Thanks for the reply.
> > I shared partial Json as I wanted to showcase the important part.
> > My requirement is simple. I wanted to know the variable name that holds
> the
> > [data \"or 2=2\"] like rule.msg variable holds the [msg \"SQL
> Injection\"]
> >
> > Thanks,
> > Homesh
> >
> >
> > On Wed, Jun 1, 2022 at 7:44 PM Franziska Buehler <
> > [email protected]> wrote:
> >
> >> Hi Homesh,
> >>
> >> That doesn't appear to be valid JSON. Can you please describe what you
> >> want to do exactly and how you tried to achieve this??
> >>
> >> Best,
> >> Franziska
> >>
> >>
> >>
> >> homesh joshi <[email protected]> schrieb am Di., 31. Mai 2022, 14:08:
> >>
> >>> Hi All,
> >>>
> >>> Please refer to the following from modsec logs in json format.
> >>>
> >>> [file \"/usr/share/modsec/rules/10_gen_rules.conf\"] [line \"283\"] [id
> >>> \"11\"] [rev \"43\"] [msg \"SQL Injection\"] [data \"or 2=2\"]
> [severity
> >>> \"CRITICAL\"]
> >>>
> >>> I am able to get the values of msg, id &  severity variables(using
> >>> rule.msg,rule.id,rule.severity) but I can't find the variable name for
> >>> data ([data \"or 2=2\"])
> >>>
> >>> I have searched on google as well as on modsec handbook pdf but can't
> >>> find the name.
> >>>
> >>> Can someone share some info on this please.
> >>>
> >>> Thanks,
> >>> Homesh
> >>>
> >>>
> >>> _______________________________________________
> >>> mod-security-users mailing list
> >>> [email protected]
> >>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> >>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> >>> http://www.modsecurity.org/projects/commercial/rules/
> >>> http://www.modsecurity.org/projects/commercial/support/
> >>>
> >> _______________________________________________
> >> mod-security-users mailing list
> >> [email protected]
> >> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> >> http://www.modsecurity.org/projects/commercial/rules/
> >> http://www.modsecurity.org/projects/commercial/support/
> >>
>
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/