Snort mailing list archives

Re: Why content and not uricontent?

From: Holger Mense <holger () project2501 de>
Date: Thu, 21 Apr 2005 20:03:18 +0200

Hi,

* Matt Kettler <mkettler () evi-inc com>:

Thus, while using uricontent closes the hole of encoded requests, it
opens the hole of someone using the POST command for the exploit.

On the other hand, content fails to handle encodings, but it does match
both POST and GET requests.


thank you for your detailed explanation. Now I did understand.

cu, Holger

-- 
Holger Mense

Attachment: signature.asc
Description: Digital signature

Current thread:

Why content and not uricontent? Holger Mense (Apr 12)
- Re: Why content and not uricontent? Brian (Apr 13)
  - Re: Why content and not uricontent? Holger Mense (Apr 21)
    - Re: Why content and not uricontent? Matt Kettler (Apr 21)
    - Re: Why content and not uricontent? Holger Mense (Apr 21)