Feature #1194: Implement http_args keyword to match http arguments - query string or body - Suricata - Open Information Security Foundation

Actions

#1

Updated by Anoop Saldanha almost 10 years ago

The idea is to make this a sticky buffer. Does that sound fine?
Currently all the http keywords are modifiers. Would that be an
issue with regard to consistency on how other http keywords behave?

Actions

Copy link

#2

Updated by Victor Julien almost 10 years ago

Can you give some rule examples?

Actions

Copy link

#3

Updated by Anoop Saldanha almost 10 years ago

alert tcp any any -> any any (http_args; content:"argument"; sid:1;)
alert tcp any any -> any any (http_args; content:"argument"; pcre:"/argument1"/; sid:1;)

Similarly, other content keywords can be used.

To use other modifier keywords or sticky buffer, one would have to use pkt_data.

alert tcp any any -> any any (http:args; content:"argument"; pcre:"/argument1/";
pkt_data; content:"uri"; http_uri; sid:1;)

Actions

Copy link

#4