Customized SERVICE HTTP signatures

mhayek — Sun, 10 Mar 2019 09:47:58 GMT

Starting this thread to gather inputs on creating custom HTTP signatures to detect specific URL sites. Has anyone used the regex in IPS 5.x to specify certain web URL to log or deny ?

Ex: Signature that can detect, log or block www.yahoo.com

Re: Customized SERVICE HTTP signatures

mhayek — Tue, 13 Dec 2005 17:04:32 GMT

Here is one example, please share others:

the URI is the stuff after the URL:

Example:

www.cisco.com/index.cgi?name=billy

The URI is: /index.cgi?name=bily

The host field in http header is:

www.cisco.com

So look for [Ww][Ww][Ww][.][Cc][Ii][Ss][Cc][Oo][.][Cc][Oo][Mm] in the header section and if you know the rest of the URL you can append that section in the URI:

[\x2f\x5c][Ii][Nn][Dd][Ee][Xx][.][Cc][Gg][Ii]

topic Customized SERVICE HTTP signatures in Network Security

Customized SERVICE HTTP signatures

Re: Customized SERVICE HTTP signatures