# SPDX-License-Identifier: AGPL-3.0-only
# WordPress REST-API author enumeration that the WAF refused: a 403 on
# /wp-json/wp/v2/users is CVE-2017-5487 probing, and the refusal proves
# the WAF classified it that way too. The stock ?author= form is caught
# by wp-user-enum from the pack; this is the REST form.
parser: wp-user-enum-blocked
log: http
prefilter: "/wp-json/wp/"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*/wp-json/wp/v\d+/users[^ "?]*)(?:\?[^ "]*)? [^"]*" 403 '
time_field: time
time_format: nginx
