Feature #1194: Implement http_args keyword to match http arguments - query string or body - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #1194

open

Implement http_args keyword to match http arguments - query string or body

Added by Anoop Saldanha almost 10 years ago. Updated about 5 years ago.

Status:

New

Priority:

Normal

Assignee:

Community Ticket

Target version:

TBD

Effort:

medium

Difficulty:

low

Label:

Description

We can use a http_args keyword that would match on the "name = value"
pairs of http arguments from the query string or from the body.

Related issues 1 (1 open — 0 closed)

Actions

Copy link

Updated by Anoop Saldanha almost 10 years ago

The idea is to make this a sticky buffer. Does that sound fine?
Currently all the http keywords are modifiers. Would that be an
issue with regard to consistency on how other http keywords behave?

Actions

Copy link

Updated by Victor Julien almost 10 years ago

Can you give some rule examples?

Actions

Copy link

Updated by Anoop Saldanha almost 10 years ago

alert tcp any any -> any any (http_args; content:"argument"; sid:1;)
alert tcp any any -> any any (http_args; content:"argument"; pcre:"/argument1"/; sid:1;)

Similarly, other content keywords can be used.

To use other modifier keywords or sticky buffer, one would have to use pkt_data.

alert tcp any any -> any any (http:args; content:"argument"; pcre:"/argument1/";
pkt_data; content:"uri"; http_uri; sid:1;)

Actions

Copy link