### Rename CRS Setup Example to Config

Source: https://coreruleset.org/docs/index.print

Rename the example setup file to 'crs-setup.conf' to enable it for use. This is a standard shell command.

```shell
mv crs-setup.conf.example crs-setup.conf
```

--------------------------------

### Install Go-ftw with Go Install

Source: https://coreruleset.org/docs/index.print

Installs the go-ftw binary using the go install command. Ensure you have a Go environment set up.

```bash
go install github.com/coreruleset/go-ftw@latest
```

--------------------------------

### Install go-ftw via Go

Source: https://coreruleset.org/docs/6-development/6-5-testing-the-rule-set/index.html

Use the go install command to fetch the latest go-ftw binary.

```bash
go install github.com/coreruleset/go-ftw@latest
```

--------------------------------

### Go-ftw Configuration for Nginx

Source: https://coreruleset.org/docs/index.print

Example configuration file for Go-ftw when used with Nginx. Ensure log paths and ports match your Nginx setup.

```yaml
logfile: /var/log/nginx/error.log
logmarkerheadername: X-CRS-TEST
testoverride:
  input:
    dest_addr: "127.0.0.1"
    port: 8080
```

--------------------------------

### Install Pre-commit Framework

Source: https://coreruleset.org/docs/6-development/6-1-contribution-guidelines/index.html

Install the pre-commit framework to automatically check and fix code style issues like trailing spaces and end-of-line characters. Run `pre-commit install` after downloading and installing the framework.

```bash
pre-commit install
```

--------------------------------

### Go-ftw Configuration for Apache httpd

Source: https://coreruleset.org/docs/index.print

Example configuration file for Go-ftw when used with Apache httpd. Verify log paths and ports are correct for your Apache setup.

```yaml
logfile: /var/log/apache2/error.log
logmarkerheadername: X-CRS-TEST
testoverride:
  input:
    dest_addr: "127.0.0.1"
    port: 80
```

--------------------------------

### Example Assembly File

Source: https://coreruleset.org/docs/index.print.html

An example of a .ra file demonstrating comments, flags, prefixes, suffixes, and regular expressions.

```regex
##! This line is a comment and will be ignored. The next line is empty and will also be ignored.

##! The next line sets the *ignore case* flag on the resulting expression:
##!+ i

##! The next line is the prefix comment. The assembled expression will be prefixed with its contents:
##!^ \

##! The next line is the suffix comment. The assembled expression will be suffixed with its contents:
##!$ \\[^0-9A-Z_a-z]*\

##! The following two lines are regular expressions that will be assembled:
--a--
__b__

##! Another comment, followed by another regular expression:
^#!/bin/bash
```

--------------------------------

### Start Docker Containers for Testing

Source: https://coreruleset.org/docs/6-development/6-5-testing-the-rule-set/index.html

Use this command to start the necessary Docker containers for testing the CRS with ModSecurity 2 and Apache httpd. Ensure you have Docker and docker-compose installed.

```bash
docker compose -f tests/docker-compose.yml up -d modsec2-apache
```

--------------------------------

### Install ModSecurity on RHEL compatible systems

Source: https://coreruleset.org/docs/index.print

Install the EPEL repository first, then use this command to install ModSecurity on RHEL and compatible distributions.

```bash
yum install mod_security
```

--------------------------------

### Start Albedo HTTP Server Locally

Source: https://coreruleset.org/docs/index.print

This command starts the Albedo HTTP server, which is required for testing WAF response rules. It listens on port 8085 by default.

```bash
./albedo -p 8085
```

--------------------------------

### Install CRS Toolchain with Go

Source: https://coreruleset.org/docs/index.print

Install the latest version of the CRS Toolchain directly using Go. This method requires Go 1.19 or higher to be installed.

```go
go install github.com/coreruleset/crs-toolchain/v2@latest
```

--------------------------------

### Install crs-toolchain with Go

Source: https://coreruleset.org/docs/6-development/6-2-crs-toolchain/index.html

Install the latest version of the crs-toolchain directly using Go. This method requires Go 1.19 or higher to be installed and configured on your system.

```go
go install github.com/coreruleset/crs-toolchain/v2@latest
```

--------------------------------

### Run CRS Toolchain

Source: https://coreruleset.org/docs/index.print

Once installed via Go and with binaries on your PATH, you can run the toolchain from any directory. This command checks the installed version.

```bash
crs-toolchain --version
```

--------------------------------

### Example Regular Expression Assembly File

Source: https://coreruleset.org/docs/6-development/6-3-assembling-regular-expressions/index.html

This example demonstrates the various directives and syntax used in a .ra file for assembling regular expressions, including comments, flags, prefixes, suffixes, and component expressions.

```regex-assembly
##! This line is a comment and will be ignored. The next line is empty and will also be ignored.

##! The next line sets the *ignore case* flag on the resulting expression:
##!+ i

##! The next line is the prefix comment. The assembled expression will be prefixed with its contents:
##!^ \

##! The next line is the suffix comment. The assembled expression will be suffixed with its contents:
##!$ \

##! The following two lines are regular expressions that will be assembled:
--a--
__b__

##! Another comment, followed by another regular expression:
^#!/bin/bash
```

--------------------------------

### Inner-link Referencing Examples

Source: https://coreruleset.org/docs/index.print

Provides examples of how to use the {{< ref "" >}} shortcode for internal link referencing within markdown files, pointing to specific files or directories.

```go-html-template
# general markdown format
{{< ref "path/to/file.md" >}}

# this will point to the directory 2-how-crs-works
{{< ref "2-how-crs-works" >}}

# this will point to the .md
{{< ref "2-3-false-positives-and-tuning.md" >}}
```

--------------------------------

### Rename Configuration Files

Source: https://coreruleset.org/docs/1-getting-started/1-2-extended_install/index.html

Commands to rename the example configuration files to their active counterparts.

```bash
mv crs-setup.conf.example crs-setup.conf
```

```bash
mv rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
mv rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
```

--------------------------------

### Example Regex Generation Input/Output

Source: https://coreruleset.org/docs/index.print

Illustrates the input format of a regex assembly file and the resulting optimized assembled regex.

```regex
# Input: regex-assembly/942170.ra might contain:
# select
# union
# where
# from

# Output: Optimized assembled regex
(?:from|select|union|where)
```

--------------------------------

### Include Processor Usage

Source: https://coreruleset.org/docs/6-development/6-3-assembling-regular-expressions/index.html

Examples of including external files and using definitions across files.

```text
POST
GET
HEAD
```

```text
##!> include http-headers
OPTIONS
```

```text
##!> define quotes ['"`]
##!> define opt-lazy-wspace \s*?
```

```text
##!> include lib

it{{quotes}}s{{opt-lazy-wspace}}possible
```

--------------------------------

### Start Albedo HTTP Server

Source: https://coreruleset.org/docs/6-development/6-5-testing-the-rule-set/index.html

Start the Albedo HTTP server on port 8085. Albedo is required for testing WAF response rules as it acts as a backend and provides a reflection feature.

```bash
./albedo -p 8085
```

--------------------------------

### Advanced Example: Nginx, CRS 3.3.9, JSON Output

Source: https://coreruleset.org/docs/index.print

This example demonstrates sending a payload to a specific CRS version (3.3.9) using the Nginx backend and requesting JSON output for script processing. It uses `jq` for pretty-printing.

```bash
curl -H "x-backend: nginx" \
  -H "x-crs-version: 3.3.9" \
  -H "x-format-output: json-matched-rules" \
  https://sandbox.coreruleset.org/?file=/etc/passwd | jq .
```

```json
[
  {
    "message": "OS File Access Attempt",
    "id": "930120",
    "paranoia_level": "1"
  },
  {
    "message": "Remote Command Execution: Unix Shell Code Found",
    "id": "932160",
    "paranoia_level": "1"
  },
  {
    "message": "Inbound Anomaly Score Exceeded (Total Score: 10)",
    "id": "949110",
    "paranoia_level": "1"
  }
]
```

--------------------------------

### Assemble Processor Alternation Example

Source: https://coreruleset.org/docs/6-development/6-3-assembling-regular-expressions

Demonstrates how the assemble processor converts multiple lines into a single regular expression.

```text
##!> assemble
  ##! slash patterns
  \x5c
  ##! URI encoded
  %2f
  %5c
  ##!=>
  
  ##! dot patterns
  \.
  \.%00
  \.%01
##!<
```

```text
(?:\x5c|%(?:2f|5c))\.(?:%0[0-1])?
```

--------------------------------

### Get General Help for CRS Toolchain

Source: https://coreruleset.org/docs/index.print

Run this command to display general help information for the CRS Toolchain.

```bash
crs-toolchain --help
```

--------------------------------

### Verify ModSecurity Nginx Log Output

Source: https://coreruleset.org/docs/1-getting-started/1-2-extended_install/index.html

Example log entry confirming successful ModSecurity initialization on Nginx.

```text
2022/04/21 23:45:52 [notice] 1#1: ModSecurity-nginx v1.0.2 (rules loaded inline/local/remote: 0/6/0)
```

--------------------------------

### Rename CRS Setup File

Source: https://coreruleset.org/docs/index.print

Renames the example CRS setup configuration file to the active configuration file name. This is typically done after making necessary modifications to the example file.

```bash
cd /etc/crs4
mv crs-setup.conf.example crs-setup.conf
```

--------------------------------

### Build go-ftw from Source

Source: https://coreruleset.org/docs/6-development/6-5-testing-the-rule-set/index.html

Clone the repository and compile the binary locally.

```bash
git clone https://github.com/coreruleset/go-ftw.git
cd go-ftw
go build
```

--------------------------------

### Example Assembly File Structure

Source: https://coreruleset.org/docs/6-development/6-3-assembling-regular-expressions

A sample .ra file demonstrating comments, flags, prefixes, suffixes, and regex assembly.

```text
##! This line is a comment and will be ignored. The next line is empty and will also be ignored.

##! The next line sets the *ignore case* flag on the resulting expression:
##!+ i

##! The next line is the prefix comment. The assembled expression will be prefixed with its contents:
##!^ \b

##! The next line is the suffix comment. The assembled expression will be suffixed with its contents:
##!$ \W*\(

##! The following two lines are regular expressions that will be assembled:
--a--
__b__

##! Another comment, followed by another regular expression:
^#!/bin/bash
```

--------------------------------

### Command Line Evasion Example (Unix)

Source: https://coreruleset.org/docs/index.print

Demonstrates escaping strategies for Unix-like terminals using the 'cmdline' processor with 'unix' argument. Lines starting with a single quote are treated as literals. The '@' token matches a word followed by a non-whitespace token, while '~' matches a word not immediately followed by whitespace.

```shell
##!> cmdline unix
  w@
  gcc~
  'python[23]
  aptitude@
  pacman@
##!<
```

--------------------------------

### Create Empty Plugin Configuration Files

Source: https://coreruleset.org/docs/4-about-plugins/4-1-plugins/index.html

Shell commands to initialize placeholder files for plugin configurations, preventing errors when no plugins are installed.

```bash
crs/plugins/empty-config.conf
crs/plugins/empty-before.conf
crs/plugins/empty-after.conf
```

--------------------------------

### Rule Action Order Example

Source: https://coreruleset.org/docs/index.print

Illustrates the recommended order for rule actions to maintain consistency. This order should be followed when defining rule actions.

```apache
id
phase
allow | block | deny | drop | pass | proxy | redirect
status
capture
t:xxx
log
nolog
auditlog
noauditlog
msg
logdata
tag
sanitiseArg
sanitiseRequestHeader
sanitiseMatched
sanitiseMatchedBytes
ctl
ver
severity
multiMatch
initcol
setenv
setvar
expirevar
chain
skip
skipAfter
```

--------------------------------

### Build Go-ftw from Source

Source: https://coreruleset.org/docs/index.print

Clones the Go-ftw repository and builds the binary from source. This requires Git and a Go environment.

```bash
git clone https://github.com/coreruleset/go-ftw.git
cd go-ftw
go build
```

--------------------------------

### Directory Naming Convention Example

Source: https://coreruleset.org/docs/index.print

Illustrates the convention for naming directories within the project, using lowercase letters and hyphens to separate words.

```bash
. 
├── 1-getting-started 
│   ├── 1-1-crs-installation.md 
│   ├── 1-2-extended_install.md 
│   ├── 1-3-using-containers.md 
│   ├── 1-4-engine_integration_options.md 
│   └── _index.md 
... 
```

--------------------------------

### Configure go-ftw for Web Servers

Source: https://coreruleset.org/docs/6-development/6-5-testing-the-rule-set/index.html

Create environment-specific configuration files for Nginx and Apache to define log paths and ports.

```yaml
logfile: /var/log/nginx/error.log
logmarkerheadername: X-CRS-TEST
testoverride:
  input:
    dest_addr: "127.0.0.1"
    port: 8080
```

```yaml
logfile: /var/log/apache2/error.log
logmarkerheadername: X-CRS-TEST
testoverride:
  input:
    dest_addr: "127.0.0.1"
    port: 80
```

--------------------------------

### Install ModSecurity on Fedora

Source: https://coreruleset.org/docs/index.print

Use this command to install Apache with ModSecurity on Fedora systems. Ensure your system is up-to-date.

```bash
dnf install mod_security
```

--------------------------------

### Install ModSecurity on Debian

Source: https://coreruleset.org/docs/index.print.html

Use this command to install ModSecurity on Debian-based systems. Ensure ModSecurity is kept updated.

```bash
apt install modsecurity
```

--------------------------------

### Install shell completion

Source: https://coreruleset.org/docs/6-development/6-2-crs-toolchain/index.html

Generates and installs shell completion scripts for various shells to enable tab completion.

```bash
mkdir -p ~/.oh-my-zsh/completions
crs-toolchain completion zsh > ~/.oh-my-zsh/completions/_crs-toolchain
```

```bash
crs-toolchain completion bash > /etc/bash_completion.d/crs-toolchain
```

```bash
crs-toolchain completion fish > ~/.config/fish/completions/crs-toolchain.fish
```

```powershell
crs-toolchain completion powershell | Out-String | Invoke-Expression
```

--------------------------------

### Include Processor Example with Suffix Replacements

Source: https://coreruleset.org/docs/index.print

Shows how to use the 'include' processor to insert the content of another file. Suffix replacements can be specified to modify parts of the included content based on matching suffixes.

```text
##!> include http-headers
OPTIONS
```

--------------------------------

### Accessing Built-in Help

Source: https://coreruleset.org/docs/6-development/6-2-crs-toolchain/index.html

Use these commands to view general or command-specific help documentation.

```bash
# General help
crs-toolchain --help

# Command-specific help
crs-toolchain regex --help
crs-toolchain regex generate --help
crs-toolchain util --help
```

--------------------------------

### Processor Directive Example

Source: https://coreruleset.org/docs/index.print

A basic example illustrating the use of processor directives (`##!>` and `##!<`) for preprocessing blocks of lines, including nested processors.

```regex
##!> cmdline unix
  command1
  command2
  ##!> assemble
    nested1
    nested2
  ##!<
##!<
```

--------------------------------

### Include Processor with Definitions Example

Source: https://coreruleset.org/docs/index.print

Illustrates using the 'include' processor to incorporate definitions from another file, effectively creating a library of expressions. These definitions can then be used in the including file.

```text
##!> define quotes ['"`]
##!> define opt-lazy-wspace \s*?
```

```text
##!> include lib

it{{quotes}}s{{opt-lazy-wspace}}possible
```

--------------------------------

### Verify crs-toolchain Installation

Source: https://coreruleset.org/docs/6-development/6-2-crs-toolchain/index.html

Verify that the crs-toolchain has been installed correctly by checking its version and viewing the available commands. These commands confirm the tool is accessible and functional.

```shell
# Check version
crs-toolchain --version

# View available commands
crs-toolchain --help
```

--------------------------------

### SecMarker Formatting Example

Source: https://coreruleset.org/docs/index.print

Shows the required format for SecMarker directives, which must use double quotes, be in UPPERCASE, and separate words with hyphens.

```apache
SecMarker "END-RESPONSE-959-BLOCKING-EVALUATION"
SecMarker "END-REQUEST-910-IP-REPUTATION"
```

--------------------------------

### Example Exclude File Content

Source: https://coreruleset.org/docs/index.print

This is an example of content that would be placed in an exclude file. Lines matching this verbatim content in the include file will be removed.

```text
cat
wget
who
zless
```

--------------------------------

### Get Command-Specific Help for CRS Toolchain

Source: https://coreruleset.org/docs/index.print

Use these commands to get detailed help for specific CRS Toolchain commands like 'regex' or 'util'.

```bash
crs-toolchain regex --help
```

```bash
crs-toolchain regex generate --help
```

```bash
crs-toolchain util --help
```

--------------------------------

### Run crs-toolchain after Go Installation

Source: https://coreruleset.org/docs/6-development/6-2-crs-toolchain/index.html

Execute the crs-toolchain command after installing it via Go. This assumes that the Go binaries directory is included in your system's PATH.

```shell
crs-toolchain --version
```

--------------------------------

### Assemble Processor with Input/Output Markers

Source: https://coreruleset.org/docs/index.print

Demonstrates using input and output markers to separate and assemble different parts of a regular expression. Lines within markers are treated as alternations.

```regex
##!> assemble
  ##! slash patterns
  \x5c
  ##! URI encoded
  %2f
  %5c
  ##!=>
  
  ##! dot patterns
  \.
  \.%00
  \.%01
##!<
```

--------------------------------

### Example Regex Generation Input and Output

Source: https://coreruleset.org/docs/6-development/6-2-crs-toolchain

Illustrates the input format of a regex assembly (.ra) file and the resulting optimized assembled regex output.

```regex
# Input: regex-assembly/942170.ra might contain:
# select
# union
# where
# from

# Output: Optimized assembled regex
(?:from|select|union|where)
```

--------------------------------

### Update crs-toolchain using Self-Update

Source: https://coreruleset.org/docs/6-development/6-2-crs-toolchain/index.html

Update the installed crs-toolchain to the latest available version using its built-in self-update functionality. This command automatically handles downloading and installing the newest release for your platform.

```shell
crs-toolchain util self-update
```

--------------------------------

### Rename Exclusion Rule Example Files

Source: https://coreruleset.org/docs/index.print

Rename the example exclusion rule files by removing the '.example' suffix to activate them. This prevents updates from overwriting custom exclusions. These are standard shell commands.

```shell
mv rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
```

```shell
mv rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
```

--------------------------------

### Assemble Processor Concatenation and Storage

Source: https://coreruleset.org/docs/6-development/6-3-assembling-regular-expressions

Examples showing how to store and retrieve regular expression blocks using input and output markers.

```text
##!> assemble
  ab
  ##!=< myinput
  ##!> assemble
    ##!=> myinput
  ##!<
##!<
```

```text
##!> assemble
  ab
  ##!=< myinput
##!<
##!> assemble
  ##!=> myinput
##!<
```

```text
##!> assemble
  ##! slash patterns
  \x5c
  ##! URI encoded
  %2f
  %5c
  ##!=< slashes
  ##!=> slashes

  ##! dot patterns
  \.
  \.%00
  \.%01
  ##!=>
  ##!=> slashes
##!<
```

--------------------------------

### Verify CRS Installation with Curl

Source: https://coreruleset.org/docs/index.print

Send a 'malicious' request to your site using curl to verify that CRS is installed and active. A successful verification should result in a 403 Forbidden error if blocking mode is enabled.

```bash
curl 'https://www.example.com/?foo=/etc/passwd&bar=/bin/sh'
```

--------------------------------

### Apache 2.4 Startup Error: Error parsing actions

Source: https://coreruleset.org/docs/7-known-issues

Apache versions before 2.4.11 may fail to start due to a bug in parsing multi-line configuration directives. Upgrade Apache or use the `join-multiline-rules` script.

```apache
Error parsing actions: Unknown action: \
Action 'configtest' failed.
```