Snort mailing list archives
Re: Matching PCRE
From: Joel Esler <jesler () sourcefire com>
Date: Tue, 19 Jan 2010 19:45:45 -0500
\1 will match a previous parenthetical match. \2, etc. -- Joel Esler On Jan 19, 2010, at 7:07 PM, Paul Schmehl <pschmehl_lists () tx rr com> wrote:
Which raised a question in mind which I've been unable to find an answer to. Is there any sort of backreference in pcre that requires an *exact* match with the previous string? IOW, if I have eeapple as a match, is there anyway to force the backreference to only match on the entire string and not any one part of it? I poked around on the web and found \$ and \0, but neither seemed to do the trick. I could return to \d instead of \w, but that would eliminate an entire class of sql injection matches (e.g. or a=a, etc.) --On Tuesday, January 19, 2010 15:13:46 -0600 Matt Olney <molney () sourcefire com> wrote:I think greediness may be biting you in the butt... So this would match: re> /(\w+).?=.?\1/ <----rough rewrite of your pcre data> applee=eapple 0: applee=eapple 1: apple data> sap=bsa 0: sap=bsa 1: sa data> buffalo=uffalo 0: uffalo=uffalo 1: uffalo data> buff=abuf 0: buff=abuf 1: buf-- Paul Schmehl, Senior Infosec Analyst As if it wasn't already obvious, my opinions are my own and not those of my employer. ******************************************* "It is as useless to argue with those who have renounced the use of reason as to administer medication to the dead." Thomas Jefferson --- --- --- --------------------------------------------------------------------- Throughout its 18-year history, RSA Conference consistently attracts the world's best and brightest in the field, creating opportunities for Conference attendees to learn about information security's most important issues through interactions with peers, luminaries and emerging and established companies. http://p.sf.net/sfu/rsaconf-dev2dev _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
------------------------------------------------------------------------------ Throughout its 18-year history, RSA Conference consistently attracts the world's best and brightest in the field, creating opportunities for Conference attendees to learn about information security's most important issues through interactions with peers, luminaries and emerging and established companies. http://p.sf.net/sfu/rsaconf-dev2dev _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
Current thread:
- Matching PCRE Paul Schmehl (Jan 19)
- Re: Matching PCRE Guise McAllaster (Jan 19)
- Re: Matching PCRE Guise McAllaster (Jan 19)
- Re: Matching PCRE Matt Olney (Jan 19)
- Re: Matching PCRE Paul Schmehl (Jan 19)
- Re: Matching PCRE Paul Schmehl (Jan 19)
- Re: Matching PCRE Joel Esler (Jan 19)
- Re: Matching PCRE Matt Olney (Jan 19)
- Re: Matching PCRE Paul Schmehl (Jan 19)
- Re: Matching PCRE Guise McAllaster (Jan 19)
- Re: Matching PCRE Guise McAllaster (Jan 19)