Re: [mod-security-users] Variable name for "data"

[homesh j. <ho...@gm...>]

Dear Franziska,

Thanks for the reply.
I shared partial Json as I wanted to showcase the important part.
My requirement is simple. I wanted to know the variable name that holds the
[data \"or 2=2\"] like rule.msg variable holds the [msg \"SQL Injection\"]

Thanks,
Homesh


On Wed, Jun 1, 2022 at 7:44 PM Franziska Buehler <
fra...@gm...> wrote:

> Hi Homesh,
>
> That doesn't appear to be valid JSON. Can you please describe what you
> want to do exactly and how you tried to achieve this??
>
> Best,
> Franziska
>
>
>
> homesh joshi <ho...@gm...> schrieb am Di., 31. Mai 2022, 14:08:
>
>> Hi All,
>>
>> Please refer to the following from modsec logs in json format.
>>
>> [file \"/usr/share/modsec/rules/10_gen_rules.conf\"] [line \"283\"] [id
>> \"11\"] [rev \"43\"] [msg \"SQL Injection\"] [data \"or 2=2\"] [severity
>> \"CRITICAL\"]
>>
>> I am able to get the values of msg, id &  severity variables(using
>> rule.msg,rule.id,rule.severity) but I can't find the variable name for
>> data ([data \"or 2=2\"])
>>
>> I have searched on google as well as on modsec handbook pdf but can't
>> find the name.
>>
>> Can someone share some info on this please.
>>
>> Thanks,
>> Homesh
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>