Gecko [ www.finalhopeacademy.com ]

Name	Size	Permission
00_Init_Initialization.conf	3.27 KB	-rw-r--r--
01_Init_AppsInitialization.con...	1.84 KB	-rw-r--r--
02_Global_Generic.conf	23.78 KB	-rw-r--r--
03_Global_Agents.conf	5.15 KB	-rw-r--r--
04_Global_Domains.conf	3.3 KB	-rw-r--r--
05_Global_Incoming.conf	1.42 KB	-rw-r--r--
06_Global_Backdoor.conf	2.2 KB	-rw-r--r--
07_XSS_XSS.conf	36.21 KB	-rw-r--r--
08_Global_Other.conf	7.44 KB	-rw-r--r--
09_Bruteforce_Bruteforce.conf	5.98 KB	-rw-r--r--
10_HTTP_HTTP.conf	4.11 KB	-rw-r--r--
11_HTTP_HTTPDoS.conf	3.95 KB	-rw-r--r--
12_HTTP_Protocol.conf	12.1 KB	-rw-r--r--
13_HTTP_Request.conf	2.42 KB	-rw-r--r--
14_Outgoing_FilterGen.conf	5.35 KB	-rw-r--r--
15_Outgoing_FilterASP.conf	1.75 KB	-rw-r--r--
16_Outgoing_FilterPHP.conf	2.54 KB	-rw-r--r--
17_Outgoing_FilterSQL.conf	11.83 KB	-rw-r--r--
18_Outgoing_FilterOther.conf	3.57 KB	-rw-r--r--
19_Outgoing_FilterInFrame.conf	1.86 KB	-rw-r--r--
20_Outgoing_FiltersEnd.conf	2.49 KB	-rw-r--r--
21_PHP_PHPGen.conf	1.59 KB	-rw-r--r--
22_SQL_SQLi.conf	13.72 KB	-rw-r--r--
23_ROR_RORGen.conf	2.97 KB	-rw-r--r--
24_Apps_Joomla.conf	7.85 KB	-rw-r--r--
25_Apps_JComponent.conf	42.66 KB	-rw-r--r--
26_Apps_WordPress.conf	10.96 KB	-rw-r--r--
27_Apps_WPPlugin.conf	414.97 KB	-rw-r--r--
28_Apps_WHMCS.conf	967 B	-rw-r--r--
29_Apps_Drupal.conf	83.09 KB	-rw-r--r--
30_Apps_OtherApps.conf	484.08 KB	-rw-r--r--
LICENSE.txt	11.09 KB	-rw-r--r--
bl_IPs	0 B	-rw-r--r--
bl_URLs	714 B	-rw-r--r--
bl_agents	1.92 KB	-rw-r--r--
bl_domains	134.24 KB	-rw-r--r--
bl_input	3.84 KB	-rw-r--r--
bl_os_files	29.46 KB	-rw-r--r--
bl_output	2.17 KB	-rw-r--r--
bl_output_java	240 B	-rw-r--r--
bl_output_php	8.88 KB	-rw-r--r--
bl_output_sql	1.77 KB	-rw-r--r--
bl_php_functions	589 B	-rw-r--r--
bl_scanners	539 B	-rw-r--r--
bl_scanners_headers	216 B	-rw-r--r--
bl_scanners_urls	418 B	-rw-r--r--
categories.conf	262.29 KB	-rw-r--r--
cwatch_managed_domains	0 B	-rw-r--r--
cwatch_protected_domains	0 B	-rw-r--r--
rules.conf.main	975 B	-rw-r--r--
rules.dat	5 B	-rw-r--r--
userdata_bl_IPs	50 B	-rw-r--r--
userdata_bl_URLs	109 B	-rw-r--r--
userdata_bl_agents	37 B	-rw-r--r--
userdata_bl_cookies	34 B	-rw-r--r--
userdata_bl_domains	34 B	-rw-r--r--
userdata_bl_extensions	375 B	-rw-r--r--
userdata_bl_headers	98 B	-rw-r--r--
userdata_bl_referers	35 B	-rw-r--r--
userdata_login_pages	149 B	-rw-r--r--
userdata_wl_IPs	125 B	-rw-r--r--
userdata_wl_URLs	48 B	-rw-r--r--
userdata_wl_agents	37 B	-rw-r--r--
userdata_wl_content_type	193 B	-rw-r--r--
userdata_wl_domains	34 B	-rw-r--r--
userdata_wl_extensions	54 B	-rw-r--r--
userdata_wl_methods	30 B	-rw-r--r--

Code Editor : 07_XSS_XSS.conf

# ---------------------------------------------------------------
# Comodo ModSecurity Rules
# Copyright (C) 2022 Comodo Security solutions All rights reserved.
#
# The COMODO SECURITY SOLUTIONS Mod Security Rule Set is distributed under
# THE COMODO SECURITY SOLUTIONS END USER LICENSE AGREEMENT,
# Please see the enclosed LICENCE file for full details.
# ---------------------------------------------------------------
# This is a FILE CONTAINING CHANGED or MODIFIED RULES FROM THE:
# OWASP ModSecurity Core Rule Set (CRS)
# ---------------------------------------------------------------

SecRule TX:CWAF_modsec "@eq 1" \
	"id:212780,msg:'COMODO WAF: IGNORE_CRS||%{tx.domain}|%{tx.mode}|2',phase:2,pass,nolog,t:none,skipAfter:'IGNORE_CRS_XSS',rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx (?:\bon[a-z]{3,16}|(?:parent|special)folder|script|document|meta|activexobject|expression|<!\[cdata\[|\.(innerhtml|fromcharcode|addimport)|settimeout|(?:shell|asfunction|http|mocha):|background|@import|alert|createtextrange|<input|iframe)" \
	"id:212030,phase:2,pass,setvar:'tx.pm_xss_points=+%{tx.points_limit4}',nolog,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule &TX:PM_XSS_POINTS "@eq 0" \
	"id:212040,phase:2,pass,nolog,t:none,skipAfter:'SECMARKER_212000',rev:1,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx \b(?:get|copy)(?:parent|special)folder\b" \
	"id:212050,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:lowercase,rev:3,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "\blowsrc\b[^a-zA-Z0-9_]{0,}?\bhttp:" \
	"id:212100,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:removeComments,t:lowercase,rev:3,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx style\W{0,}=.{0,}expression\W{0,}\(" \
	"id:212120,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "\bcreatetextrange\b" \
	"id:212140,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "\.execscript\b" \
	"id:212180,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "<body\b.{0,}?\bonload\b" \
	"id:212200,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "\bsettimeout\b[^a-zA-Z0-9_]{0,}?\(" \
	"id:212270,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx <i?frame" \
	"id:212280,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|!ARGS_POST:form[sign] "@rx \b(?:href|src|lowsrc|url)\b\W+?\b(?:(?:vb|java)script|shell)(?::|&colon)" \
	"id:212290,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:removeComments,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:emailglobalheader|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "<body\b.{0,}?\bbackground\b" \
	"id:212300,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "\btype\b\W+?\b(?:text|application)\b\W+?\b(?:(x-)?(?:java|vb|j|ecma)script)" \
	"id:212320,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:removeComments,t:lowercase,rev:3,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|!ARGS:template_data|!ARGS:fiets "@pm document.cookie .parentnode .innerhtml  <![cdata[" \
	"id:212340,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,rev:5,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "\bactivexobject\b" \
	"id:212380,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|!ARGS_POST:fiets "<script\b" \
	"id:212620,msg:'COMODO WAF: Cross-site Scripting (XSS) Attack||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecMarker SECMARKER_212000
SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx \bon(?:abort|blur|change|click|dblclick|dragdrop|error|focus|keydown|keypress|keyup|load|mouse(?:down|move|out|over|up)|move|readystatechange|reset|resize|select|submit|unload)\b[^a-zA-Z0-9_]{0,}?=" \
	"id:212750,msg:'COMODO WAF: XSS Attack Detected||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:lowercase,rev:3,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|!ARGS:search "@rx [\s\x22'](?:alert|eval|\.fromcharcode)\s?(?:\(|`)" \
	"id:212790,msg:'COMODO WAF: XSS Attack Detected||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:5,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS_NAMES:/singlepage\[section_/|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|!ARGS:wpTextbox1|!ARGS:/shortcodes\[\d+?\]\[string\]/ "@rx moz-binding\b|@import\b|(?:background|behavior)\b[^a-zA-Z0-9_]{0,}?:[^a-zA-Z0-9_]{0,}?url|background-image\b[^a-zA-Z0-9_]{0,}?:|expression\b[^a-zA-Z0-9_]{0,}?\(" \
	"id:212800,chain,msg:'COMODO WAF: XSS Attack Detected||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:cssDecode,t:removeComments,t:compressWhitespace,t:lowercase,rev:8,severity:2,tag:'CWAF',tag:'XSS'"
SecRule MATCHED_VAR "!@rx (?:body|content|description|post|desc|html_message|text)=" \
	"t:none,t:urlDecodeUni,t:lowercase"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "[\x22'<\/]xss[\x22'\/>]" \
	"id:212820,msg:'COMODO WAF: XSS Attack Detected||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:lowercase,rev:3,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "(88,83,83)" \
	"id:212830,msg:'COMODO WAF: XSS Attack Detected||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "'';!--\x22<xss>=&{()}" \
	"id:212840,msg:'COMODO WAF: XSS Attack Detected||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "&{" \
	"id:212850,msg:'COMODO WAF: XSS Attack Detected||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:emailglobalheader|!ARGS:html_message|!ARGS:text|!ARGS:template_data|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "<\!(doctype|entity)" \
	"id:212860,msg:'COMODO WAF: XSS Attack Detected||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@contains <style" \
	"id:212880,chain,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"
SecRule MATCHED_VAR "@rx (?i:<style.{0,399}?>.{0,399}?(?:@[i\\\\]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).{0,399}?(?:[(\\\\]|&#x?0*(?:40|28|92|5C);?)))" \
	"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace"

SecRule ARGS|ARGS_NAMES|REQUEST_URI|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|!ARGS:fiets "@rx (?i:<script.{0,}?[\s+\/]{0,}?((src)|(xlink:href)|(href))[\s+\/\t]{0,}=)" \
	"id:212890,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:urlDecodeUni,rev:5,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@contains vmlframe" \
	"id:212910,chain,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,block,logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:lowercase,rev:6,severity:2,tag:'CWAF',tag:'XSS'"
SecRule MATCHED_VAR "@contains src" \
	"chain,t:lowercase"
SecRule MATCHED_VAR "@rx :vmlframe.{0,399}?src\/{0,}?=" \
	"capture,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "(?i:(j|(&#x{0,1}0{0,}((74)|(4A)|(106)|(6A));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(a|(&#x{0,1}0{0,}((65)|(41)|(97)|(61));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(v|(&#x{0,1}0{0,}((86)|(56)|(118)|(76));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(a|(&#x{0,1}0{0,}((65)|(41)|(97)|(61));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(s|(&#x{0,1}0{0,}((83)|(53)|(115)|(73));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(c|(&#x{0,1}0{0,}((67)|(43)|(99)|(63));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(r|(&#x{0,1}0{0,}((82)|(52)|(114)|(72));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(i|(&#x{0,1}0{0,}((73)|(49)|(105)|(69));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(p|(&#x{0,1}0{0,}((80)|(50)|(112)|(70));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(t|(&#x{0,1}0{0,}((84)|(54)|(116)|(74));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(:|(&((#x{0,1}0{0,}((58)|(3A));{0,1})|(colon;)))).)" \
	"id:212920,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:htmlEntityDecode,t:compressWhiteSpace,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "(?i:(v|(&#x{0,1}0{0,}((86)|(56)|(118)|(76));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(b|(&#x{0,1}0{0,}((66)|(42)|(98)|(62));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(s|(&#x{0,1}0{0,}((83)|(53)|(115)|(73));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(c|(&#x{0,1}0{0,}((67)|(43)|(99)|(63));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(r|(&#x{0,1}0{0,}((82)|(52)|(114)|(72));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(i|(&#x{0,1}0{0,}((73)|(49)|(105)|(69));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(p|(&#x{0,1}0{0,}((80)|(50)|(112)|(70));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(t|(&#x{0,1}0{0,}((84)|(54)|(116)|(74));{0,1}))([\r]|(&((#x{0,1}0{0,}(9|A|D|(13)|(10));{0,1})|(tab;)|(newline;)))){0,}(:|(&((#x{0,1}0{0,}((58)|(3A));{0,1})|(colon;)))).)" \
	"id:212930,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:htmlEntityDecode,t:compressWhiteSpace,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx <embed.{0,}?(?:src|type)\/{0,}?=" \
	"id:212940,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx <\??import.{0,}?implementation\/{0,}=" \
	"id:212950,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS_POST:emailglobalheader|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|!ARGS_POST:fiets "@rx <meta.{0,}?http-equiv\/{0,}?=\/{0,}?[\x22'`]{0,1}(?:c|r|s|&#?x?0{0,}?(?:67|43|99|63|82|52|114|72|83|53|115|73);?)" \
	"id:212960,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:7,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS_POST:emailglobalheader|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx <meta.{0,}?charset\/{0,}=" \
	"id:212970,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:6,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx <link.{0,}?href\/{0,}=" \
	"id:212980,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx <base.{0,}?href\/{0,}=" \
	"id:212990,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx <applet(?:\/|>)" \
	"id:213000,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx <object.{0,}?(?:type|codetype|classid|code|data)\/{0,}=" \
	"id:213010,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "(?i:(((v|(\\\\u0076)|(\\166)|(\\x76))[^a-z0-9]{0,}(a|(\\\\u0061)|(\\141)|(\\x61))[^a-z0-9]{0,}(l|(\\\\u006C)|(\\154)|(\\x6C))[^a-z0-9]{0,}(u|(\\\\u0075)|(\\165)|(\\x75))[^a-z0-9]{0,}(e|(\\\\u0065)|(\\145)|(\\x65))[^a-z0-9]{0,}(O|(\\\\u004F)|(\\117)|(\\x4F))[^a-z0-9]{0,}(f|(\\\\u0066)|(\\146)|(\\x66)))|((t|(\\\\u0074)|(\\164)|(\\x74))[^a-z0-9]{0,}(o|(\\\\u006F)|(\\157)|(\\x6F))[^a-z0-9]{0,}(S|(\\\\u0053)|(\\123)|(\\x53))[^a-z0-9]{0,}(t|(\\\\u0074)|(\\164)|(\\x74))[^a-z0-9]{0,}(r|(\\\\u0072)|(\\162)|(\\x72))[^a-z0-9]{0,}(i|(\\\\u0069)|(\\151)|(\\x69))[^a-z0-9]{0,}(n|(\\\\u006E)|(\\156)|(\\x6E))[^a-z0-9]{0,}(g|(\\\\u0067)|(\\147)|(\\x67)))))" \
	"id:213020,chain,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:htmlEntityDecode,t:compressWhiteSpace,rev:6,severity:2,tag:'CWAF',tag:'XSS'"
SecRule REQUEST_FILENAME "!@endsWith wp-admin/nav-menus.php" \
	"chain,t:none,t:lowercase"
SecRule MATCHED_VAR "(?i:[\x22'].{0,250}?[,].{0,250}(((v|(\\\\u0076)|(\\166)|(\\x76))[^a-z0-9]{0,}(a|(\\\\u0061)|(\\141)|(\\x61))[^a-z0-9]{0,}(l|(\\\\u006C)|(\\154)|(\\x6C))[^a-z0-9]{0,}(u|(\\\\u0075)|(\\165)|(\\x75))[^a-z0-9]{0,}(e|(\\\\u0065)|(\\145)|(\\x65))[^a-z0-9]{0,}(O|(\\\\u004F)|(\\117)|(\\x4F))[^a-z0-9]{0,}(f|(\\\\u0066)|(\\146)|(\\x66)))|((t|(\\\\u0074)|(\\164)|(\\x74))[^a-z0-9]{0,}(o|(\\\\u006F)|(\\157)|(\\x6F))[^a-z0-9]{0,}(S|(\\\\u0053)|(\\123)|(\\x53))[^a-z0-9]{0,}(t|(\\\\u0074)|(\\164)|(\\x74))[^a-z0-9]{0,}(r|(\\\\u0072)|(\\162)|(\\x72))[^a-z0-9]{0,}(i|(\\\\u0069)|(\\151)|(\\x69))[^a-z0-9]{0,}(n|(\\\\u006E)|(\\156)|(\\x6E))[^a-z0-9]{0,}(g|(\\\\u0067)|(\\147)|(\\x67)))).{0,}?:)" \
	"setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',t:none,t:htmlEntityDecode,t:compressWhiteSpace"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx <isindex(?:\/|>)" \
	"id:213090,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx [\x22'\/`]datasrc=" \
	"id:213120,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:4,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:\+ADw\-|\+AD4\-).{0,399}(?:\+ADw\-|\+AD4\-|>)|(?:\+ADw\-|\+AD4\-|<).{0,399}(?:\+ADw\-|\+AD4\-)" \
	"id:212680,msg:'COMODO WAF: UTF-7 Encoding IE XSS - Attack Detected||%{tx.domain}|%{tx.mode}|2',phase:2,capture,block,setvar:'tx.xss_points=+%{tx.points_limit4}',setvar:'tx.points=+%{tx.points_limit4}',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',ctl:auditLogParts=+E,t:none,t:urlDecodeUni,t:lowercase,t:urlDecode,t:htmlEntityDecode,t:jsDecode,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|REQUEST_HEADERS:Referer|ARGS_POST|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx [\x22'\/`]on[a-z]{1,}?\/{0,}=" \
	"id:212760,msg:'COMODO WAF: IE XSS Filters - Attack Detected.||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS_POST|ARGS_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx _\d+?(?:\x22|')\(\):;\d" \
	"id:213030,msg:'COMODO WAF: XSS vulnerability||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeComments,t:removeWhitespace,rev:2,severity:2,tag:'CWAF',tag:'XSS'"

SecRule REQUEST_URI|ARGS|ARGS_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx (?:'|\x22)(?:fscommand|seeksegmenttime|on[a-z]{3,16})=(?:\x22|')" \
	"id:213050,chain,msg:'COMODO WAF: XSS vulnerability||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeWhitespace,t:lowercase,rev:3,severity:2,tag:'CWAF',tag:'XSS'"
SecRule MATCHED_VAR "!@rx (?:body|content|description|post|desc|html_message|text)=" \
	"t:none,t:urlDecodeUni,t:lowercase"

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!ARGS:/jform\[params\]\[offcanvas_topmod_style\]/|!ARGS:/jform\[params\]\[djmegamenu-module_style\]/|!ARGS:/jform\[params\]\[offcanvas_botmod_style\]/|!ARGS:emailglobalheader "@rx (?i)((?:\bx(?:link:href|html|mlns)|!ENTITY\b.{0,399}?\b(?:SYSTEM|PUBLIC)|\bdata:text\/html))" \
	"id:213060,msg:'COMODO WAF: XSS Filter - Category 3: Attribute Vector||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeNulls,t:removeComments,t:compressWhiteSpace,rev:7,severity:2,tag:'CWAF',tag:'XSS'"

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ "@rx ![!+ ]\[\]" \
	"id:213070,msg:'COMODO WAF: JSFuck / Hieroglyphy obfuscation detected||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeNulls,t:compressWhiteSpace,rev:1,severity:2,tag:'CWAF',tag:'XSS'"

SecMarker IGNORE_CRS_XSS

${this.title}

Code Editor : 07_XSS_XSS.conf