Re: Fwd: question.

["Russ Combs \(rucombs\) via Snort-devel" <snort-devel () lists snort org>]

This should be posted to snort-users or snort-sigs. snort-devel is for bugs and related development work.

Russ

________________________________
From: Snort-devel <snort-devel-bounces () lists snort org> on behalf of juan patricioo via Snort-devel <snort-devel () 
lists snort org>
Sent: Thursday, April 15, 2021 4:09 PM
To: snort-devel () lists snort org <snort-devel () lists snort org>
Subject: [Snort-devel] Fwd: question.



---------- Forwarded message ---------
De: juan patricioo <cursoredesinap9644 () gmail com<mailto:cursoredesinap9644 () gmail com>>
Date: jue, 15 abr 2021 a las 21:59
Subject: question.
To: <snort-users () lists snort org<mailto:snort-users () lists snort org>>


Hello, im trying to do a rule in snort that can capture de text on a text field in the next formulary:

http://cekb.unileon.es/formulario.html

[image.png]

Im trying:

alert tcp any any -> any 80 (msg:"script text"; content:"script"; nocase; sid:1000005; rev:1;)

But ¿nothing happens, can anyone help me?

Thanks!

_______________________________________________
Snort-devel mailing list
Snort-devel () lists snort org
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!