Project

General

Profile

Actions
Copy link

Feature #143

closed
WM GI

Support should be added for the http_uri content modifier

Feature #143: Support should be added for the http_uri content modifier

Added by Will Metcalf almost 16 years ago. Updated almost 16 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Gerado Iglesias Galvan
Target version:
0.9.2
Effort:
Difficulty:
Label:

Description

Looks like in snort it just points to the same normalized buffer as uricontent.

[3499] 4/5/2010 -- 19:41:06 - (detect.c:295) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(36)] - Error parsing signature "alert tcp any any -> any any (msg:"content match for ALLWorkAndnoplay + http_uri"; content:"ALLWorkAndnoplay"; http_uri; nocase; classtype:bad-unknown; sid:88; rev:1;)" from file /home/coz/allworkplain.rules at line 143

Actions
Copy link

Also available in: PDF Atom