The OWASP Core Rule Set (CRS) is a generic collection of attack-detection rules commonly used with ModSecurity and other web application firewalls. It looks for patterns associated with SQL injection, cross-site scripting, protocol abuse, file-upload tricks, and other common web attacks. The CRS is designed to be broadly useful, not application-specific, so it gives defenders a strong baseline of protection without writing every rule by hand.
In practice, CRS only works as well as the request data fed into it. If the WAF parser misreads multipart bodies, XML, or other request formats, the rules may inspect the wrong content or miss it entirely. Attackers can exploit that gap by shaping requests so the firewall and the backend application interpret them differently. For defenders, CRS is therefore not just a ruleset to tune; it is part of a larger inspection pipeline that must parse, normalize, and error-handle traffic correctly.