<?php
$re = '`\[(msg|uri) "(.*?)"\]`mi';
$str = '[Wed Feb 06 08:57:54 2019] [error] [client 123.123.123.123] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "47"] [id "960015"] [rev "1"] [msg "Request Missing an Accept Header"] [severity "NOTICE"] [ver "OWASP_CRS/2.2.6"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "something.net"] [uri "/index.php/admin/"] [unique_id "XFsEAsDzZbMAAGY5i5oAAAAA"]';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
print_r($matches);
foreach($matches as $match){
$expected[] = $match[2];
}
print_r($expected);
?>
- Output for 7.1.25, 7.2.0 - 7.2.33, 7.3.0 - 7.3.33, 7.4.0 - 7.4.33, 8.0.0 - 8.0.30, 8.1.0 - 8.1.33, 8.2.0 - 8.2.29, 8.3.0 - 8.3.26, 8.4.1 - 8.4.13
- Array
(
[0] => Array
(
[0] => [msg "Request Missing an Accept Header"]
[1] => msg
[2] => Request Missing an Accept Header
)
[1] => Array
(
[0] => [uri "/index.php/admin/"]
[1] => uri
[2] => /index.php/admin/
)
)
Array
(
[0] => Request Missing an Accept Header
[1] => /index.php/admin/
)
preferences:
104.68 ms | 408 KiB | 5 Q