Feature #143
closed
Support should be added for the http_uri content modifier
Added by Will Metcalf almost 14 years ago.
Updated almost 14 years ago.
Description
Looks like in snort it just points to the same normalized buffer as uricontent.
[3499] 4/5/2010 -- 19:41:06 - (detect.c:295) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(36)] - Error parsing signature "alert tcp any any -> any any (msg:"content match for ALLWorkAndnoplay + http_uri"; content:"ALLWorkAndnoplay"; http_uri; nocase; classtype:bad-unknown; sid:88; rev:1;)" from file /home/coz/allworkplain.rules at line 143
Is the http_uri keyword just another name for the uricontent keyword?
Yes they point to the same normalized buffer, the format is content:"/someuri"; http_uri;
- Target version changed from 1.0.0 to 0.9.1
- Due date changed from 05/14/2010 to 05/16/2010
- Status changed from New to Assigned
- Assignee changed from Victor Julien to Gerado Iglesias Galvan
- Estimated time changed from 2.50 h to 0.00 h
- Due date changed from 05/16/2010 to 05/28/2010
- Target version changed from 0.9.1 to 0.9.2
- Status changed from Assigned to Closed
- % Done changed from 0 to 100
Patch is applied, thanks Gerardo.
Also available in: Atom
PDF