Create hpp.json

rules/hpp.json

@@ -0,0 +1,42 @@
+[
+    {
+         "id": "hpp-duplicate-parameters",
+        "phase": 2,
+         "pattern":"(?i)(?:\\w+=\\w*&\\w+=\\w*){2,}",
+        "targets": ["URI","ARGS"],
+        "severity": "MEDIUM",
+         "action": "log",
+        "score": 4,
+         "description": "Log multiple occurences of the same parameter."
+    },
+     {
+        "id": "hpp-array-syntax",
+         "phase": 2,
+         "pattern":"(?i)(?:\\w+\\[\\w*\\]=\\w*&){2,}",
+        "targets": ["URI", "ARGS"],
+        "severity": "MEDIUM",
+         "action": "log",
+        "score": 3,
+         "description": "Log multiple parameters with array like syntax which might indicate HPP"
+      },
+    {
+         "id": "hpp-parameter-combining",
+        "phase": 2,
+         "pattern":"(?i)(?:(\\w+)=.*?&\\1=)",
+        "targets":["URI","ARGS"],
+        "severity": "MEDIUM",
+         "action":"log",
+        "score": 4,
+         "description":"Log same parameters with different values which might indicate HPP"
+     },
+     {
+       "id":"hpp-encoded-parameters",
+       "phase":2,
+        "pattern":"(?i)(?:(%[a-f0-9]{2,})+=[^&]*?&){2,}",
+        "targets":["URI", "ARGS"],
+       "severity":"MEDIUM",
+        "action":"log",
+        "score": 4,
+       "description":"Log multiple encoded parameter which might indicate HPP"
+     }
+]