{\rtf1\ansi\ansicpg1252\cocoartf1504\cocoasubrtf830
{\fonttbl\f0\fnil\fcharset0 Menlo-Regular;\f1\fnil\fcharset134 PingFangSC-Regular;}
{\colortbl;\red255\green255\blue255;\red0\green0\blue0;\red213\green213\blue213;}
{\*\expandedcolortbl;;\csgray\c0;\cssrgb\c86630\c86630\c86630;}
\paperw11900\paperh16840\margl1440\margr1440\vieww28600\viewh18000\viewkind0
\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\pardirnatural\partightenfactor0

\f0\fs36 \cf2 \cb3 \CocoaLigature0 \
\{"transaction":\{"client_ip":"94.156.138.51","time_stamp":"Fri Mar  2 11:44:26 2018","server_id":"b601f6016c09495d37efd36ac8899ad0c2ce965f","client_port":59033,"host_ip":"94.156.138.51","host_port":80,"id":"151998386686.143137","request":\{"method":"GET","http_version":1.1,"uri":"/?%3Cscript%3E","headers":\{"Host":"activewaftest.com","Connection":"keep-alive","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36","Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8","Accept-Encoding":"gzip, deflate","Accept-Language":"en-US,en;q=0.9"\}\},"response":\{"http_code":200,"headers":\{\}\},"producer":\{"modsecurity":"ModSecurity v3.0.0rc1 (Linux)","connector":"ModSecurity-nginx v0.1.1-beta","secrules_engine":"Enabled","components":["OWASP_CRS/3.0.2\\""]\},"messages":[\{"message":"XSS Attack Detected via libinjection","details":\{"match":"detected XSS using libinjection.","reference":"v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941100","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"17","data":"Matched Data: accept-language found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"1","accuracy":"9"\}\},\{"message":"XSS Filter - Category 1: Script Tag Vector","details":\{"match":"Matched \\"Operator `Rx' with parameter `(?i)([<
\f1 \'a3\'bc
\f0 ]script[^>
\f1 \'a3\'be
\f0 ]*[>
\f1 \'a3\'be
\f0 ][\\\\s\\\\S]*?)' against variable `ARGS_NAMES:<script>' (Value: `<script>' )","reference":"o0,8o0,8v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941110","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"63","data":"Matched Data: <script> found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"4","accuracy":"9"\}\},\{"message":"NoScript XSS InjectionChecker: HTML Injection","details":\{"match":"Matched \\"Operator `Rx' with parameter `(?i)<[^\\\\w<>]*(?:[^<>\\\\\\"'\\\\s]*:)?[^\\\\w<>]*(?:\\\\W*?s\\\\W*?c\\\\W*?r\\\\W*?i\\\\W*?p\\\\W*?t|\\\\W*?f\\\\W*?o\\\\W*?r\\\\W*?m|\\\\W*?s\\\\W*?t\\\\W*?y\\\\W*?l\\\\W*?e|\\\\W*?s\\\\W*?v\\\\W*?g|\\\\W*?m\\\\W*?a\\\\W*?r\\\\W*?q\\\\W*?u\\\\W*?e\\\\W*?e|(?:\\\\W*?l\\\\W*?i\\\\W*?n\\\\W*?k|\\\\W*?o (3246 characters omitted)' against variable `ARGS_NAMES:<script>' (Value: `<script>' )","reference":"o0,7v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941160","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"195","data":"Matched Data: <script found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"1","accuracy":"8"\}\},\{"message":"Inbound Anomaly Score Exceeded (Total Score: 15)","details":\{"match":"Matched \\"Operator `Ge' with parameter `%\{tx.inbound_anomaly_score_threshold\}' against variable `TX:ANOMALY_SCORE' (Value: `15' )","reference":"","ruleId":"949110","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"36","data":"","severity":"2","ver":"","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic"],"maturity":"0","accuracy":"0"\}\},\{"message":"Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=15,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): NoScript XSS InjectionChecker: HTML Injection","details":\{"match":"Matched \\"Operator `Ge' with parameter `%\{tx.inbound_anomaly_score_threshold\}' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `15' )","reference":"","ruleId":"980130","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf","lineNumber":"61","data":"","severity":"0","ver":"","rev":"","tags":["event-correlation"],"maturity":"0","accuracy":"0"\}\}]\}\}\
\
\
\
\
\
\
\{"transaction":\{"client_ip":"94.156.138.51","time_stamp":"Fri Mar  2 11:44:49 2018","server_id":"b601f6016c09495d37efd36ac8899ad0c2ce965f","client_port":59035,"host_ip":"94.156.138.51","host_port":80,"id":"151998388943.061490","request":\{"method":"GET","http_version":1.1,"uri":"/?%3Cscript%3E","headers":\{"Host":"activewaftest.com","Connection":"keep-alive","Cache-Control":"max-age=0","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36","Cookie":"uid=TU2Xb1qZHPpxKBMfAwMDAg==","Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8","Accept-Encoding":"gzip, deflate","Accept-Language":"en-US,en;q=0.9"\}\},"response":\{"http_code":200,"headers":\{\}\},"producer":\{"modsecurity":"ModSecurity v3.0.0rc1 (Linux)","connector":"ModSecurity-nginx v0.1.1-beta","secrules_engine":"Enabled","components":["OWASP_CRS/3.0.2\\""]\},"messages":[\{"message":"XSS Attack Detected via libinjection","details":\{"match":"detected XSS using libinjection.","reference":"v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941100","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"17","data":"Matched Data: accept-language found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"1","accuracy":"9"\}\},\{"message":"XSS Filter - Category 1: Script Tag Vector","details":\{"match":"Matched \\"Operator `Rx' with parameter `(?i)([<
\f1 \'a3\'bc
\f0 ]script[^>
\f1 \'a3\'be
\f0 ]*[>
\f1 \'a3\'be
\f0 ][\\\\s\\\\S]*?)' against variable `ARGS_NAMES:<script>' (Value: `<script>' )","reference":"o0,8o0,8v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941110","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"63","data":"Matched Data: <script> found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"4","accuracy":"9"\}\},\{"message":"NoScript XSS InjectionChecker: HTML Injection","details":\{"match":"Matched \\"Operator `Rx' with parameter `(?i)<[^\\\\w<>]*(?:[^<>\\\\\\"'\\\\s]*:)?[^\\\\w<>]*(?:\\\\W*?s\\\\W*?c\\\\W*?r\\\\W*?i\\\\W*?p\\\\W*?t|\\\\W*?f\\\\W*?o\\\\W*?r\\\\W*?m|\\\\W*?s\\\\W*?t\\\\W*?y\\\\W*?l\\\\W*?e|\\\\W*?s\\\\W*?v\\\\W*?g|\\\\W*?m\\\\W*?a\\\\W*?r\\\\W*?q\\\\W*?u\\\\W*?e\\\\W*?e|(?:\\\\W*?l\\\\W*?i\\\\W*?n\\\\W*?k|\\\\W*?o (3246 characters omitted)' against variable `ARGS_NAMES:<script>' (Value: `<script>' )","reference":"o0,7v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941160","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"195","data":"Matched Data: <script found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"1","accuracy":"8"\}\},\{"message":"Inbound Anomaly Score Exceeded (Total Score: 15)","details":\{"match":"Matched \\"Operator `Ge' with parameter `%\{tx.inbound_anomaly_score_threshold\}' against variable `TX:ANOMALY_SCORE' (Value: `15' )","reference":"","ruleId":"949110","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"36","data":"","severity":"2","ver":"","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic"],"maturity":"0","accuracy":"0"\}\},\{"message":"Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=15,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): NoScript XSS InjectionChecker: HTML Injection","details":\{"match":"Matched \\"Operator `Ge' with parameter `%\{tx.inbound_anomaly_score_threshold\}' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `15' )","reference":"","ruleId":"980130","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf","lineNumber":"61","data":"","severity":"0","ver":"","rev":"","tags":["event-correlation"],"maturity":"0","accuracy":"0"\}\}]\}\}\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\{"transaction":\{"client_ip":"94.156.138.51","time_stamp":"Fri Mar  2 11:45:16 2018","server_id":"b601f6016c09495d37efd36ac8899ad0c2ce965f","client_port":59048,"host_ip":"94.156.138.51","host_port":80,"id":"151998391644.623735","request":\{"method":"GET","http_version":1.1,"uri":"/?%3Cscript%3E","headers":\{"Host":"activewaftest.com","Connection":"keep-alive","Cache-Control":"max-age=0","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36","Cookie":"uid=TU2Xb1qZHPpxKBMfAwMDAg==","Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8","Accept-Encoding":"gzip, deflate","Accept-Language":"en-US,en;q=0.9"\}\},"response":\{"http_code":200,"headers":\{\}\},"producer":\{"modsecurity":"ModSecurity v3.0.0rc1 (Linux)","connector":"ModSecurity-nginx v0.1.1-beta","secrules_engine":"Enabled","components":["OWASP_CRS/3.0.2\\""]\},"messages":[\{"message":"XSS Attack Detected via libinjection","details":\{"match":"detected XSS using libinjection.","reference":"v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941100","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"17","data":"Matched Data: accept-language found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"1","accuracy":"9"\}\},\{"message":"XSS Filter - Category 1: Script Tag Vector","details":\{"match":"Matched \\"Operator `Rx' with parameter `(?i)([<
\f1 \'a3\'bc
\f0 ]script[^>
\f1 \'a3\'be
\f0 ]*[>
\f1 \'a3\'be
\f0 ][\\\\s\\\\S]*?)' against variable `ARGS_NAMES:<script>' (Value: `<script>' )","reference":"o0,8o0,8v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941110","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"63","data":"Matched Data: <script> found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"4","accuracy":"9"\}\},\{"message":"NoScript XSS InjectionChecker: HTML Injection","details":\{"match":"Matched \\"Operator `Rx' with parameter `(?i)<[^\\\\w<>]*(?:[^<>\\\\\\"'\\\\s]*:)?[^\\\\w<>]*(?:\\\\W*?s\\\\W*?c\\\\W*?r\\\\W*?i\\\\W*?p\\\\W*?t|\\\\W*?f\\\\W*?o\\\\W*?r\\\\W*?m|\\\\W*?s\\\\W*?t\\\\W*?y\\\\W*?l\\\\W*?e|\\\\W*?s\\\\W*?v\\\\W*?g|\\\\W*?m\\\\W*?a\\\\W*?r\\\\W*?q\\\\W*?u\\\\W*?e\\\\W*?e|(?:\\\\W*?l\\\\W*?i\\\\W*?n\\\\W*?k|\\\\W*?o (3246 characters omitted)' against variable `ARGS_NAMES:<script>' (Value: `<script>' )","reference":"o0,7v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941160","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"195","data":"Matched Data: <script found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"1","accuracy":"8"\}\},\{"message":"Inbound Anomaly Score Exceeded (Total Score: 15)","details":\{"match":"Matched \\"Operator `Ge' with parameter `%\{tx.inbound_anomaly_score_threshold\}' against variable `TX:ANOMALY_SCORE' (Value: `15' )","reference":"","ruleId":"949110","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"36","data":"","severity":"2","ver":"","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic"],"maturity":"0","accuracy":"0"\}\},\{"message":"Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=15,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): NoScript XSS InjectionChecker: HTML Injection","details":\{"match":"Matched \\"Operator `Ge' with parameter `%\{tx.inbound_anomaly_score_threshold\}' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `15' )","reference":"","ruleId":"980130","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf","lineNumber":"61","data":"","severity":"0","ver":"","rev":"","tags":["event-correlation"],"maturity":"0","accuracy":"0"\}\}]\}\}\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\{"transaction":\{"client_ip":"94.156.138.51","time_stamp":"Fri Mar  2 11:45:24 2018","server_id":"b601f6016c09495d37efd36ac8899ad0c2ce965f","client_port":59048,"host_ip":"94.156.138.51","host_port":80,"id":"151998392480.785845","request":\{"method":"GET","http_version":1.1,"uri":"/?%3Cscript%3E","headers":\{"Host":"activewaftest.com","Connection":"keep-alive","Cache-Control":"max-age=0","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36","Cookie":"uid=TU2Xb1qZHPpxKBMfAwMDAg==","Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8","Accept-Encoding":"gzip, deflate","Accept-Language":"en-US,en;q=0.9"\}\},"response":\{"http_code":200,"headers":\{\}\},"producer":\{"modsecurity":"ModSecurity v3.0.0rc1 (Linux)","connector":"ModSecurity-nginx v0.1.1-beta","secrules_engine":"Enabled","components":["OWASP_CRS/3.0.2\\""]\},"messages":[\{"message":"XSS Attack Detected via libinjection","details":\{"match":"detected XSS using libinjection.","reference":"v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941100","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"17","data":"Matched Data: accept-language found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"1","accuracy":"9"\}\},\{"message":"XSS Filter - Category 1: Script Tag Vector","details":\{"match":"Matched \\"Operator `Rx' with parameter `(?i)([<
\f1 \'a3\'bc
\f0 ]script[^>
\f1 \'a3\'be
\f0 ]*[>
\f1 \'a3\'be
\f0 ][\\\\s\\\\S]*?)' against variable `ARGS_NAMES:<script>' (Value: `<script>' )","reference":"o0,8o0,8v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941110","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"63","data":"Matched Data: <script> found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"4","accuracy":"9"\}\},\{"message":"NoScript XSS InjectionChecker: HTML Injection","details":\{"match":"Matched \\"Operator `Rx' with parameter `(?i)<[^\\\\w<>]*(?:[^<>\\\\\\"'\\\\s]*:)?[^\\\\w<>]*(?:\\\\W*?s\\\\W*?c\\\\W*?r\\\\W*?i\\\\W*?p\\\\W*?t|\\\\W*?f\\\\W*?o\\\\W*?r\\\\W*?m|\\\\W*?s\\\\W*?t\\\\W*?y\\\\W*?l\\\\W*?e|\\\\W*?s\\\\W*?v\\\\W*?g|\\\\W*?m\\\\W*?a\\\\W*?r\\\\W*?q\\\\W*?u\\\\W*?e\\\\W*?e|(?:\\\\W*?l\\\\W*?i\\\\W*?n\\\\W*?k|\\\\W*?o (3246 characters omitted)' against variable `ARGS_NAMES:<script>' (Value: `<script>' )","reference":"o0,7v6,8t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941160","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"195","data":"Matched Data: <script found within ARGS_NAMES:<script>: <script>","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-xss","OWASP_CRS/WEB_ATTACK/XSS","WASCTC/WASC-8","WASCTC/WASC-22","OWASP_TOP_10/A3","OWASP_AppSensor/IE1","CAPEC-242"],"maturity":"1","accuracy":"8"\}\},\{"message":"Inbound Anomaly Score Exceeded (Total Score: 15)","details":\{"match":"Matched \\"Operator `Ge' with parameter `%\{tx.inbound_anomaly_score_threshold\}' against variable `TX:ANOMALY_SCORE' (Value: `15' )","reference":"","ruleId":"949110","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"36","data":"","severity":"2","ver":"","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic"],"maturity":"0","accuracy":"0"\}\},\{"message":"Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=15,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): NoScript XSS InjectionChecker: HTML Injection","details":\{"match":"Matched \\"Operator `Ge' with parameter `%\{tx.inbound_anomaly_score_threshold\}' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `15' )","reference":"","ruleId":"980130","file":"/usr/local/nginx/conf/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf","lineNumber":"61","data":"","severity":"0","ver":"","rev":"","tags":["event-correlation"],"maturity":"0","accuracy":"0"\}\}]\}\}}