Re: JavaScript Normalization

["Al Lewis (allewi)" <allewi () cisco com>]

Hello,

By “how" do you mean in the code or how to enable it?

In the code a good place to start would be “snort_httpinspect.c"

To enable it please see the manual: 
http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node17.html#SECTION00327000000000000000


Thanks!

Albert Lewis
QA SNORT/Sourcefire
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Email: allewi () cisco com<mailto:allewi () cisco com>


From: Kevin Wang <kevin.wang () Istuary com<mailto:kevin.wang () Istuary com>>
Date: Wednesday, July 6, 2016 at 5:31 PM
To: 'snort-users' <snort-users () lists sourceforge net<mailto:snort-users () lists sourceforge net>>
Subject: [Snort-users] JavaScript Normalization

Hello,

Can anyone give some detail on how Snort normalize JavaScript? If you give some document/material, that is even better.

Thanks,
Kevin



Email Disclaimer & Confidentiality Notice
This message is confidential and intended solely for the use of the recipient to whom they are addressed. If you are 
not the intended recipient you should not deliver, distribute or copy this e-mail. Please notify the sender immediately 
by e-mail and delete this e-mail from your system. Copyright © 2016 by Istuary Innovation Labs, Inc. All rights 
reserved.

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!