http_raw_body and http_uri issue
fusillator via Snort-users <[email protected]> Sat, 15 Mar 2025 19:10:42 +0100
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
aGkgYWxsIGl0IHNlZW1zIHRoZSBvcHRpb24gaHR0cF9yYXdfYm9keSBkb2VzIG5vdCBtYXRjaCBj b21iaW5lZCB3aXRoIApodHRwX3VyaS4uIG5vdCBzdXJlIHdoeSwgY291bGQgYmUgYSBidWcgb3Ig bXkgbWlzY29uY2VwdGlvbi4uCndoZXJlYXMgaXQgd29ya3MgYXMgZXhwZWN0ZWQgd2l0aCBmaWxl X2RhdGEgYnVmZmVyLgoKI2NhdCAvdXNyL2xvY2FsL2V0Yy9ydWxlcy9sb2NhbC5ydWxlcwphbGVy dCBodHRwKAptc2c6ICJ1cmkgZXhhbXBsZSBydWxlIjsKZ2lkOiAxOwpzaWQ6IDEwMDAwMDg7CmZs b3c6IHRvX2NsaWVudCxlc3RhYmxpc2hlZDsKaHR0cF91cmk7CmNvbnRlbnQ6Ii9hcGkvMjAxNC9z cGVsbHMiOwpodHRwX2hlYWRlcjpmaWVsZCBob3N0LHJlcXVlc3Q7CmNvbnRlbnQ6ICJ3d3cuZG5k NWVhcGkuY28iOwpodHRwX2hlYWRlcjpmaWVsZCB1c2VyLWFnZW50LHJlcXVlc3Q7CmNvbnRlbnQ6 ImN1cmwiLG5vY2FzZTsKaHR0cF9yYXdfYm9keTsKI2ZpbGVfZGF0YTsKY29udGVudDoiYXN0cmFs IixmYXN0X3BhdHRlcm47CikKCmlmIHlvdSB3YW50IHRvIHJlcHJvZHVjZSB0aGUgdGVzdCB5b3Ug Y2FuIHVzZSB0aGlzIGFwaQoKJCBjdXJsIC1pIC1MICdodHRwOi8vd3d3LmRuZDVlYXBpLmNvL2Fw aS8yMDE0L3NwZWxscz9sZXZlbD05JyAtSCAKJ0FjY2VwdDogYXBwbGljYXRpb24vanNvbicKSFRU UC8xLjEgMjAwIE9LClNlcnZlcjogQ293Ym95ClJlcG9ydC1UbzogCnsiZ3JvdXAiOiJoZXJva3Ut bmVsIiwibWF4X2FnZSI6MzYwMCwiZW5kcG9pbnRzIjpbeyJ1cmwiOiJodHRwczovL25lbC5oZXJv a3UuY29tL3JlcG9ydHM/dHM9MTc0MjA2MTQ1NCZzaWQ9MWIxMGIwZmYtOGE3Ni00NTQ4LWJlZmEt MzUzZmM2YzZjMDQ1JnM9OWNWazdsa3RGeldkdXFBUVZSdGZrcFo0ekpRWERqUExJbjdDSTVOMzBN TSUzRCJ9XX0KUmVwb3J0aW5nLUVuZHBvaW50czogCmhlcm9rdS1uZWw9aHR0cHM6Ly9uZWwuaGVy b2t1LmNvbS9yZXBvcnRzP3RzPTE3NDIwNjE0NTQmc2lkPTFiMTBiMGZmLThhNzYtNDU0OC1iZWZh LTM1M2ZjNmM2YzA0NSZzPTljVms3bGt0RnpXZHVxQVFWUnRma3BaNHpKUVhEalBMSW43Q0k1TjMw TU0lM0QKTmVsOiAKeyJyZXBvcnRfdG8iOiJoZXJva3UtbmVsIiwibWF4X2FnZSI6MzYwMCwic3Vj Y2Vzc19mcmFjdGlvbiI6MC4wMDUsImZhaWx1cmVfZnJhY3Rpb24iOjAuMDUsInJlc3BvbnNlX2hl YWRlcnMiOlsiVmlhIl19CkNvbm5lY3Rpb246IGtlZXAtYWxpdmUKWC1Qb3dlcmVkLUJ5OiBFeHBy ZXNzCkFjY2Vzcy1Db250cm9sLUFsbG93LU9yaWdpbjogKgpYLVJhdGVsaW1pdC1MaW1pdDogNTAK WC1SYXRlbGltaXQtUmVtYWluaW5nOiA0OQpEYXRlOiBTYXQsIDE1IE1hciAyMDI1IDE3OjU3OjM0 IEdNVApYLVJhdGVsaW1pdC1SZXNldDogMTc0MjA2MTQ1NgpDb250ZW50LVR5cGU6IGFwcGxpY2F0 aW9uL2pzb247IGNoYXJzZXQ9dXRmLTgKQ29udGVudC1MZW5ndGg6IDE0MTkKRXRhZzogVy8iNThi LXdaNXZJYXZDS1dNQmZlcVh6VnBZTGVidHRXWSIKVmlhOiAxLjEgdmVndXIKCnsiY291bnQiOjE1 LCJyZXN1bHRzIjpbeyJpbmRleCI6ImFzdHJhbC1wcm9qZWN0aW9uIiwibmFtZSI6IkFzdHJhbCAK UHJvamVjdGlvbiIsImxldmVsIjo5LCJ1cmwiOiIvYXBpLzIwMTQvc3BlbGxzL2FzdHJhbC1wcm9q ZWN0aW9uIn0seyJpbmRleCI6ImZvcmVzaWdodCIsIm5hbWUiOiJGb3Jlc2lnaHQiLCJsZXZlbCI6 OSwidXJsIjoiL2FwaS8yMDE0L3NwZWxscy9mb3Jlc2lnaHQifSx7ImluZGV4IjoiZ2F0ZSIsIm5h bWUiOiJHYXRlIiwibGV2ZWwiOjksInVybCI6Ii9hcGkvMjAxNC9zcGVsbHMvZ2F0ZSJ9LHsiaW5k ZXgiOiJpbXByaXNvbm1lbnQiLCJuYW1lIjoiSW1wcmlzb25tZW50IiwibGV2ZWwiOjksInVybCI6 Ii9hcGkvMjAxNC9zcGVsbHMvaW1wcmlzb25tZW50In0seyJpbmRleCI6Im1hc3MtaGVhbCIsIm5h bWUiOiJNYXNzIApIZWFsIiwibGV2ZWwiOjksInVybCI6Ii9hcGkvMjAxNC9zcGVsbHMvbWFzcy1o ZWFsIn0seyJpbmRleCI6Im1ldGVvci1zd2FybSIsIm5hbWUiOiJNZXRlb3IgClN3YXJtIiwibGV2 ZWwiOjksInVybCI6Ii9hcGkvMjAxNC9zcGVsbHMvbWV0ZW9yLXN3YXJtIn0seyJpbmRleCI6InBv d2VyLXdvcmQta2lsbCIsIm5hbWUiOiJQb3dlciAKV29yZCAKS2lsbCIsImxldmVsIjo5LCJ1cmwi OiIvYXBpLzIwMTQvc3BlbGxzL3Bvd2VyLXdvcmQta2lsbCJ9LHsiaW5kZXgiOiJwcmlzbWF0aWMt d2FsbCIsIm5hbWUiOiJQcmlzbWF0aWMgCldhbGwiLCJsZXZlbCI6OSwidXJsIjoiL2FwaS8yMDE0 L3NwZWxscy9wcmlzbWF0aWMtd2FsbCJ9LHsiaW5kZXgiOiJzaGFwZWNoYW5nZSIsIm5hbWUiOiJT aGFwZWNoYW5nZSIsImxldmVsIjo5LCJ1cmwiOiIvYXBpLzIwMTQvc3BlbGxzL3NoYXBlY2hhbmdl In0seyJpbmRleCI6InN0b3JtLW9mLXZlbmdlYW5jZSIsIm5hbWUiOiJTdG9ybSAKb2YgClZlbmdl YW5jZSIsImxldmVsIjo5LCJ1cmwiOiIvYXBpLzIwMTQvc3BlbGxzL3N0b3JtLW9mLXZlbmdlYW5j ZSJ9LHsiaW5kZXgiOiJ0aW1lLXN0b3AiLCJuYW1lIjoiVGltZSAKU3RvcCIsImxldmVsIjo5LCJ1 cmwiOiIvYXBpLzIwMTQvc3BlbGxzL3RpbWUtc3RvcCJ9LHsiaW5kZXgiOiJ0cnVlLXBvbHltb3Jw aCIsIm5hbWUiOiJUcnVlIApQb2x5bW9ycGgiLCJsZXZlbCI6OSwidXJsIjoiL2FwaS8yMDE0L3Nw ZWxscy90cnVlLXBvbHltb3JwaCJ9LHsiaW5kZXgiOiJ0cnVlLXJlc3VycmVjdGlvbiIsIm5hbWUi OiJUcnVlIApSZXN1cnJlY3Rpb24iLCJsZXZlbCI6OSwidXJsIjoiL2FwaS8yMDE0L3NwZWxscy90 cnVlLXJlc3VycmVjdGlvbiJ9LHsiaW5kZXgiOiJ3ZWlyZCIsIm5hbWUiOiJXZWlyZCIsImxldmVs Ijo5LCJ1cmwiOiIvYXBpLzIwMTQvc3BlbGxzL3dlaXJkIn0seyJpbmRleCI6Indpc2giLCJuYW1l IjoiV2lzaCIsImxldmVsIjo5LCJ1cmwiOiIvYXBpLzIwMTQvc3BlbGxzL3dpc2gifV19Cgp0aGlz IGlzIHRoZSBjb21tYW5kIEkgdXNlIHdpdGggaXB0YWJsZXMgcnVsZXM6CgojIGlwdGFibGVzIC1B IElOUFVUIC1qIE5GUVVFVUUgLWkgZXRoMCAtcCB0Y3AgLS1zcG9ydCA4MCAtLXF1ZXVlLW51bSA4 IAotLXF1ZXVlLWJ5cGFzcwojIGlwdGFibGVzIC1BIE9VVFBVVCAtaiBORlFVRVVFIC1vIGV0aDAg LXAgdGNwIC0tZHBvcnQgODAgLS1xdWV1ZS1udW0gOCAKLS1xdWV1ZS1ieXBhc3MKIyBzbm9ydCAt USAtLWRhcSBuZnEgLWkgOCAtYyAvdXNyL2xvY2FsL2V0Yy9zbm9ydC9zbm9ydC5sdWEgLVIgCi91 c3IvbG9jYWwvZXRjL3J1bGVzL2xvY2FsLnJ1bGVzIC0tbHVhICd0cmFjZS5tb2R1bGVzID0ge2Rl dGVjdGlvbiA9IAp7ZnBfc2VhcmNoID0gMSwgYnVmZmVyID0gMSB9fScgLS10d2Vha3MgbWF4X2Rl dGVjdCAtQSBGQVNUIC1zIDY1NTM1IC1rIApub25lIC1xCgpXaXRoIGZpbGVfZGF0YSBidWZmZXIg dGhlIHJ1bGUgaXMgbWF0Y2hlZDoKY2hhbmdpbmcgdGhlIHJ1bGU6CgojY2F0IC91c3IvbG9jYWwv ZXRjL3J1bGVzL2xvY2FsLnJ1bGVzCmFsZXJ0IGh0dHAoCm1zZzogInVyaSBleGFtcGxlIHJ1bGUi OwpnaWQ6IDE7CnNpZDogMTAwMDAwODsKZmxvdzogdG9fY2xpZW50LGVzdGFibGlzaGVkOwpodHRw X3VyaTsKY29udGVudDoiL2FwaS8yMDE0L3NwZWxscyI7Cmh0dHBfaGVhZGVyOmZpZWxkIGhvc3Qs cmVxdWVzdDsKY29udGVudDogInd3dy5kbmQ1ZWFwaS5jbyI7Cmh0dHBfaGVhZGVyOmZpZWxkIHVz ZXItYWdlbnQscmVxdWVzdDsKY29udGVudDoiY3VybCIsbm9jYXNlOwojaHR0cF9yYXdfYm9keTsK ZmlsZV9kYXRhOwpjb250ZW50OiJhc3RyYWwiLGZhc3RfcGF0dGVybjsKKQoKIyBzbm9ydCAtUSAt LWRhcSBuZnEgLWkgOCAtYyAvdXNyL2xvY2FsL2V0Yy9zbm9ydC9zbm9ydC5sdWEgLVIgCi91c3Iv bG9jYWwvZXRjL3J1bGVzL2xvY2FsLnJ1bGVzIC0tdHdlYWtzIG1heF9kZXRlY3QgLUEgRkFTVCAt cyA2NTUzNSAtayAKbm9uZSAtcQowMy8xNS0xODowNzowNS4zNTk5ODQgWyoqXSBbMToxMDAwMDA4 OjBdICJ1cmkgZXhhbXBsZSBydWxlIiBbKipdIApbUHJpb3JpdHk6IDBdIFtBcHBJRDogSFRUUF0g e1RDUH0gOTkuODMuMjIwLjEwODo4MCAtPiAxMC43OS43OC4xOTk6Mzk5NTYKCmhlcmUncyB0aGUg dmVyc2lvbiBJJ20gdXNpbmcKCiMgc25vcnQgLVYKCiDCoMKgICwsX8KgwqDCoMKgIC0qPiBTbm9y dCsrIDwqLQogwqAgbyLCoCApfsKgwqAgVmVyc2lvbiAzLjYuMS4wCiDCoMKgICcnJyfCoMKgwqAg QnkgTWFydGluIFJvZXNjaCAmIFRoZSBTbm9ydCBUZWFtCiDCoMKgwqDCoMKgwqDCoMKgwqDCoCBo dHRwOi8vc25vcnQub3JnL2NvbnRhY3QjdGVhbQogwqDCoMKgwqDCoMKgwqDCoMKgwqAgQ29weXJp Z2h0IChDKSAyMDE0LTIwMjQgQ2lzY28gYW5kL29yIGl0cyBhZmZpbGlhdGVzLiBBbGwgCnJpZ2h0 cyByZXNlcnZlZC4KIMKgwqDCoMKgwqDCoMKgwqDCoMKgIENvcHlyaWdodCAoQykgMTk5OC0yMDEz IFNvdXJjZWZpcmUsIEluYy4sIGV0IGFsLgogwqDCoMKgwqDCoMKgwqDCoMKgwqAgVXNpbmcgREFR IHZlcnNpb24gMy4wLjE3CiDCoMKgwqDCoMKgwqDCoMKgwqDCoCBVc2luZyBIeXBlcnNjYW4gdmVy c2lvbiA1LjQuOQogwqDCoMKgwqDCoMKgwqDCoMKgwqAgVXNpbmcgSmVtYWxsb2MgdmVyc2lvbiAK NS4zLjAtMC1nNTRlYWVkMWQ4YjU2YjFhYTUyOGJlM2JkZDE4NzdlNTljNTZmYTkwYwogwqDCoMKg wqDCoMKgwqDCoMKgwqAgVXNpbmcgbGlicGNhcCB2ZXJzaW9uIDEuMTAuMyAod2l0aCBUUEFDS0VU X1YzKQogwqDCoMKgwqDCoMKgwqDCoMKgwqAgVXNpbmcgTHVhSklUIHZlcnNpb24gMi4xLjAtYmV0 YTMKIMKgwqDCoMKgwqDCoMKgwqDCoMKgIFVzaW5nIExaTUEgdmVyc2lvbiA1LjQuMQogwqDCoMKg wqDCoMKgwqDCoMKgwqAgVXNpbmcgT3BlblNTTCAzLjAuMTUgMyBTZXAgMjAyNAogwqDCoMKgwqDC oMKgwqDCoMKgwqAgVXNpbmcgUENSRSB2ZXJzaW9uIDguNDUgMjAyMS0wNi0xNQogwqDCoMKgwqDC oMKgwqDCoMKgwqAgVXNpbmcgWkxJQiB2ZXJzaW9uIDEuMi4xMwoKCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fClNub3J0LXVzZXJzIG1haWxpbmcgbGlzdApT bm9ydC11c2Vyc0BsaXN0cy5zbm9ydC5vcmcKR28gdG8gdGhpcyBVUkwgdG8gY2hhbmdlIHVzZXIg b3B0aW9ucyBvciB1bnN1YnNjcmliZToKaHR0cHM6Ly9saXN0cy5zbm9ydC5vcmcvbWFpbG1hbi9s aXN0aW5mby9zbm9ydC11c2VycwoKCVRvIHVuc3Vic2NyaWJlLCBzZW5kIGFuIGVtYWlsIHRvOgoJ c25vcnQtdXNlcnMtbGVhdmVAbGlzdHMuc25vcnQub3JnCgpQbGVhc2UgdmlzaXQgaHR0cDovL2Js b2cuc25vcnQub3JnIHRvIHN0YXkgY3VycmVudCBvbiBhbGwgdGhlIGxhdGVzdCBTbm9ydCBuZXdz IQoKUGxlYXNlIGZvbGxvdyB0aGVzZSBydWxlczogaHR0cHM6Ly9zbm9ydC5vcmcvZmFxL3doYXQt aXMtdGhlLW1haWxpbmctbGlzdC1ldGlxdWV0dGUK