gistfile1.txt

#!/usr/bin/perl

use strict;
use warnings;

use Text::CSV;
use Data::Dumper;

my $CSV = Text::CSV->new({ sep_char => ' ', escape_char => undef, binary => 1, allow_loose_quotes => 1 });

while (my $line = <DATA>) {
	$CSV->parse($line);

	print Dumper $CSV->fields;
}

__DATA__
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "(?i:(?:in\s*?\(+\s*?select)|(?:(?:n?and|x?x?or|div|like|between|and|not |\|\||\&\&)\s+[\s\w+]+(?:regexp\s*?\(|sounds\s+like\s*?[\"'`´’‘]|[=\d]+x))|([\"'`´’‘]\s*?\d\s*?(?:--|#))|(?:[\"'`´’‘][\%&<>^=]+\d\s*?(=|x?or|div|like|between|and))|(?:[\"'`´’‘]\W+[\w+-]+\s*?=\s*?\d\W+[\"'`´’‘])|(?:[\"'`´’‘]\s*?is\s*?\d.+[\"'`´’‘]?\w)|(?:[\"'`´’‘]\|?[\w-]{3,}[^\w\s.,]+[\"'`´’‘])|(?:[\"'`´’‘]\s*?is\s*?[\d.]+\s*?\W.*?[\"'`´’‘]))" "phase:2,capture,t:none,t:urlDecodeUni,block,msg:'Detects basic SQL authentication bypass attempts 3/3',id:'981246',tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.id}-%{rule.msg}',setvar:tx.sql_injection_score=+1,setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:'tx.%{tx.msg}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"



$VAR1 = 'SecRule';
$VAR2 = 'REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/*';
$VAR3 = '"(?i:(?:in\\s*?\\(+\\s*?select)|(?:(?:n?and|x?x?or|div|like|between|and|not';
$VAR4 = "|\\|\\||\\&\\&)\\s+[\\s\\w+]+(?:regexp\\s*?\\(|sounds\\s+like\\s*?[\\\"'`\x{b4}\x{2019}\x{2018}]|[=\\d]+x))|([\\\"'`\x{b4}\x{2019}\x{2018}]\\s*?\\d\\s*?(?:--|#))|(?:[\\\"'`\x{b4}\x{2019}\x{2018}][\\%&<>^=]+\\d\\s*?(=|x?or|div|like|between|and))|(?:[\\\"'`\x{b4}\x{2019}\x{2018}]\\W+[\\w+-]+\\s*?=\\s*?\\d\\W+[\\\"'`\x{b4}\x{2019}\x{2018}])|(?:[\\\"'`\x{b4}\x{2019}\x{2018}]\\s*?is\\s*?\\d.+[\\\"'`\x{b4}\x{2019}\x{2018}]?\\w)|(?:[\\\"'`\x{b4}\x{2019}\x{2018}]\\|?[\\w-]{3,}[^\\w\\s.,]+[\\\"'`\x{b4}\x{2019}\x{2018}])|(?:[\\\"'`\x{b4}\x{2019}\x{2018}]\\s*?is\\s*?[\\d.]+\\s*?\\W.*?[\\\"'`\x{b4}\x{2019}\x{2018}]))\"";
$VAR5 = 'phase:2,capture,t:none,t:urlDecodeUni,block,msg:\'Detects basic SQL authentication bypass attempts 3/3\',id:\'981246\',tag:\'OWASP_CRS/WEB_ATTACK/SQL_INJECTION\',logdata:\'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}\',severity:\'2\',setvar:\'tx.msg=%{rule.id}-%{rule.msg}\',setvar:tx.sql_injection_score=+1,setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:\'tx.%{tx.msg}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}\'';