Added by Anoop Saldanha almost 12 years ago. Updated about 7 years ago.
Description
We can use a http_args keyword that would match on the "name = value"
pairs of http arguments from the query string or from the body.
The idea is to make this a sticky buffer. Does that sound fine?
Currently all the http keywords are modifiers. Would that be an
issue with regard to consistency on how other http keywords behave?
Can you give some rule examples?
alert tcp any any -> any any (http_args; content:"argument"; sid:1;)
alert tcp any any -> any any (http_args; content:"argument"; pcre:"/argument1"/; sid:1;)
Similarly, other content keywords can be used.
To use other modifier keywords or sticky buffer, one would have to use pkt_data.
alert tcp any any -> any any (http:args; content:"argument"; pcre:"/argument1/";
pkt_data; content:"uri"; http_uri; sid:1;)