caddy-waf/rules/hpp.json

[
    {
         "id": "hpp-duplicate-parameters",
        "phase": 2,
         "pattern":"(?i)(?:\\w+=\\w*&\\w+=\\w*){2,}",
        "targets": ["URI","ARGS"],
        "severity": "MEDIUM",
         "action": "log",
        "score": 4,
         "description": "Log multiple occurences of the same parameter."
    },
     {
        "id": "hpp-array-syntax",
         "phase": 2,
         "pattern":"(?i)(?:\\w+\\[\\w*\\]=\\w*&){2,}",
        "targets": ["URI", "ARGS"],
        "severity": "MEDIUM",
         "action": "log",
        "score": 3,
         "description": "Log multiple parameters with array like syntax which might indicate HPP"
      },
    {
         "id": "hpp-parameter-combining",
        "phase": 2,
         "pattern":"(?i)(?:(\\w+)=.*?&\\1=)",
        "targets":["URI","ARGS"],
        "severity": "MEDIUM",
         "action":"log",
        "score": 4,
         "description":"Log same parameters with different values which might indicate HPP"
     },
     {
       "id":"hpp-encoded-parameters",
       "phase":2,
        "pattern":"(?i)(?:(%[a-f0-9]{2,})+=[^&]*?&){2,}",
        "targets":["URI", "ARGS"],
       "severity":"MEDIUM",
        "action":"log",
        "score": 4,
       "description":"Log multiple encoded parameter which might indicate HPP"
     }
]