<filters>
  

  <filter>
  

  <id>1</id>
  

  <rule><![CDATA[(?:"[^"]*[^-]?>)|(?:[^\w\s]\s*\/>)|(?:>")]]></rule>
  

  <description>finds html breaking injections including whitespace attacks</description>
  

  <tags>
  

  <tag>xss</tag>
  

  <tag>csrf</tag>
  

  </tags>
  

  <impact>4</impact>
  

  </filter>
  

  <filter>
  

  <id>2</id>
  

  <rule><![CDATA[(?:"+.*[<=]\s*"[^"]+")|(?:"\s*\w+\s*=)|(?:>\w=\/)|(?:#.+\)["\s]*>)|(?:"\s*(?:src|style|on\w+)\s*=\s*")|(?:[^"]?"[,;\s]+\w*[\[\(])]]></rule>
  

  <description>finds attribute breaking injections including whitespace attacks</description>
  

  <tags>
  

  <tag>xss</tag>
  

  <tag>csrf</tag>
  

  </tags>
  

  <impact>4</impact>
  

  </filter>
  

  <filter>
  

  <id>3</id>
  

  <rule><![CDATA[(?:^>[\w\s]*<\/?\w{2,}>)]]></rule>
  

  <description>finds unquoted attribute breaking injections</description>
  

  <tags>
  

  <tag>xss</tag>
  

  <tag>csrf</tag>
  

  </tags>
  

  <impact>2</impact>
  

  </filter>
  

  <filter>
  

  <id>4</id>
  

  <rule><![CDATA[(?:[+\/]\s*name[\W\d]*[)+])|(?:;\W*url\s*=)|(?:[^\w\s\/?:>]\s*(?:location|referrer|name)\s*[^\/\w\s-])]]></rule>
  

  <description>Detects url-, name-, JSON, and referrer-contained payload attacks</description>
  

  <tags>
  

  <tag>xss</tag>
  

  <tag>csrf</tag>
  

  </tags>
  

  <impact>5</impact>
  

  </filter>
  

  <filter>
  

  <id>5</id>
  

  <rule><![CDATA[(?:\W\s*hash\s*[^\w\s-])|(?:\w+=\W*[^,]*,[^\s(]\s*\()|(?:\?"[^\s"]":)|(?:(?<!\/)__[a-z]+__)|(?:(?:^|[\s)\]\}])(?:s|g)etter\s*=)]]></rule>
  

  <description>Detects hash-contained xss payload attacks, setter usage and property overloading</description>
  

  <tags>
  

  <tag>xss</tag>
  

  <tag>csrf</tag>
  

  </tags>
  

  <impact>5</impact>
  

  </filter>
  

  <filter>
  

  <id>6</id>
  

  <rule><![CDATA[(?:with\s*\(\s*.+\s*\)\s*\w+\s*\()|(?:(?:do|while|for)\s*\([^)]*\)\s*\{)|(?:\/[\w\s]*\[\W*\w)]]></rule>
  

  <description>Detects self contained xss via with(), common loops and regex to string conversion</description>
  

  <tags>
  

  <tag>xss</tag>
  

  <tag>csrf</tag>
  

  </tags>
  

  <impact>5</impact>
  

  </filter>
  

  <filter>
  

  <id>7</id>
  

  <rule><![CDATA[(?:[=(].+\?.+:)|(?:with\([^)]*\)\))|(?:\.\s*source\W)]]></rule>
  

  <description>Detects JavaScript with(), ternary operators and XML predicate attacks</description>
  

  <tags>
  

  <tag>xss</tag>
  

  <tag>csrf</tag>
  

  </tags>
  

  <impact>5</impact>
  

  </filter>
  

  <filter>
  

  <id>8</id>
  

  <rule><![CDATA[(?:\/\w*\s*\)\s*\()|(?:\([\w\s]+\([\w\s]+\)[\w\s]+\))|(?:(?<!(?:mozilla\/\d\.\d\s))\([^)[]+\[[^\]]+\][^)]*\))|(?:[^\s!][{([][^({[]+[{([][^}\])]+[}\])][\s+",\d]*[}\])])|(?:"\)?\]\W*\[)|(?:=\s*[^\s:;]+\s*[{([][^}\])]+[}\])];)]]></rule>
  

  <description>Detects self-executing JavaScript functions</description>
  

  <tags>
  

  <tag>xss</tag>
  

  <tag>csrf</tag>
  

  </tags>
  

  <impact>5</impact>
  

  </filter>
  

  <filter>
  

  <id>9</id>
  

  <rule><![CDATA[(?:\\u00[a-f0-9]{2})|(?:\\x0*[a-f0-9]{2})|(?:\\\d{2,3})]]></rule>
  

  <description>Detects the IE octal, hex and unicode entities</description>
  

  <tags>
  

  <tag>xss</tag>
  

  <tag>csrf</tag>
  

  </tags>
  

  <impact>2</impact>
  

  </filter>
  

  <filter>
  

  <id>10</id>
  

  <rule><![CDATA[(?:(?:\/|\\)?\.+(\/|\\)(?:\.+)?)|(?:\w+\.exe\??\s)|(?:;\s*\w+\s*\/[\w*-]+\/)|(?:\d\.\dx\|)|(?:%(?:c0\.|af\.|5c\.))|(?:\/(?:%2e){2})]]></rule>
  

  <description>Detects basic directory traversal</description>
  

  <tags>
  

  <tag>dt</tag>
  

  <tag>id</tag>
  

  <tag>lfi</tag>
  

  </tags>
  

  <impact>5</impact>
  

  </filter>