Dailydave mailing list archives
RE: Testing the quickness of signature writers
From: "Dave Korn" <dave.korn () artimi com>
Date: Tue, 2 May 2006 19:59:25 +0100
On 02 May 2006 19:51, Brian Caswell wrote:
On May 2, 2006, at 2:20 PM, M. Shirk wrote:pcre:"/[\? \x3b\x26]module=[a-zA-Z0-9]*[^\x3b\x26]/U";A forward slash, followed by any one char from the set ('?', ';', '&') followed by the literal text "module=" followed by any number (zero or more) alphanumerics followed by any char that is neither ';' nor '&'. All matched against the decoded URI buffer.That space after the \? will be evaluated in the character set and the forward slash acts as the bracket for the pcre expression.In the rule I originally sent, there was no space in the character set. Probably added accidentally when dave copied it in his response.
Ah, yes, I didn't unwrap the lines correctly; mea culpa. BTW I haven't read the original advisory, so I dunno: doesn't this only check the first cgi param after the end of the path? Wouldn't it work if you replaced http://server/path/?module=EVIL*GOES*HERE&otherparams=stuff&yetmore=more with http://server/path/?foo=bar&module=EVIL*GOES*HERE&otherparams=stuff&yetmore=mo re or some other re-ordering? cheers, DaveK -- Can't think of a witty .sigline today....
Current thread:
- Testing the quickness of signature writers Dave Aitel (May 01)
- Re: Testing the quickness of signature writers Brian Caswell (May 01)
- Re: Testing the quickness of signature writers Dave Aitel (May 02)
- RE: Testing the quickness of signature writers Dave Korn (May 02)
- RE: Testing the quickness of signature writers M. Shirk (May 02)
- Re: Testing the quickness of signature writers Dave Aitel (May 02)
- Re: Testing the quickness of signature writers Brian Caswell (May 02)
- RE: Testing the quickness of signature writers Dave Korn (May 02)
- Re: Testing the quickness of signature writers Dave Aitel (May 02)
- Re: Testing the quickness of signature writers Brian Caswell (May 01)
- Re: Testing the quickness of signature writers Brian Caswell (May 02)