|
|
|
|
Snort Forums Archive
Archive Home » Rules » URIs
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
URIs
Posted by mosquitooth on April 12, 2005 06:53:58
Hi,
I've got some (newbie) questions concerning http and especially URIs I
couldn't find an answert to - but nethertheless I do need the answers to
write snort rules with the "uricontent" keyword.
- What does the string "\....\" in an URI mean? There are some hints on
"directory transversal" - could someone explain this any further?
- Every whitespace character in an URI is replaced by a "+" when encoded to
html (correct?). Now, does snort remove this "+" when it decodes the http
stream?
- What is the standard decoding for snort? UTF7, UTF8, Unicode, ASCII...?
- Several papers I tried to read about the subject contain the term "regular
expression". What's this?
Greetings and thanks in advance,
Peter |
|
Posted by harrychen on November 22, 2006 21:10:34
URI decoding: see "hi_norm.c " & 2.1.11 HttpInspect
Directory traversals: http://en.wikipedia.org/wiki/Directory_traversal
regards |
|
|
|
|
|
