Re: Log HTTP(S) URLs

[Patrik Israelsson <patrik.israelsson () sentor se>]

Huh?

I believe you've missed the very point of HTTPS, which is that it is encrypted 
by definition. The Snort FAQ indeed states that you can use Snort to log HTTP 
requests, but you will never be able to do the same for HTTPS as all its 
traffic is encrypted (well, if you knew the key for the session in question 
you could theoretically decrypt it, but that's something else).

Regards,
Patrik

On Thursday 15 March 2007 10:13, Manu wrote:
> Hi there,
>
> I am using Snort 2.6.1.3 on FreeBSD 6.2. The plan is to use snort only for
> logging HTTP(S) URLs requested from the internal network.
>
> I already read in the faq that it is possible, but I should use the dsniff
> package for that kind of work. Well, I tried it, but the urlsnarf tool only
> gets http urls.
>
> So, I am asking for help how the rule(s) must look like and hope that you
> can help me.
>
> Many thanks in advance,
>
> Manuel
>
>
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share
> your opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

Attachment: smime.p7s
Description:

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users