Actions
Support #2475
closedoffset can also be a negative number?
Affected Versions:
Label:
Description
e.g:
http://localhost/?id=1&test=union select
rules:
alert tcp any any -> any any (msg:"test union select";content:"select";http_uri;nocase;offset:-7;content:"select";nocase;http_uri;classtype:test;sid:203456789;rev:1;)
it's ok,but not match.why?
Actions