Re: [Snort-sigs] Sig 1147

BassPlayer wrote:
<snip>
> In regards to the multiple ways to list a file could you use the | regexp
> operarator to define multiple options and use \s+ for all white space?
>
> Like
>
> pcre:"/webdist\.cgi.+cat|awk|sed|head|tail\s+/";
<snip>


The pcre clause has full perl-regex functionality. Three issues with the
above match:

* The disjunction, i.e. a|b|c, must be surrounded by parentheses. As is
  your match is really:

    webdist\.cgi.+cat
  or
    awk
  or
    sed
  or
    head
  or
    tail\s+

* Consider placing \b in front of the disjunction. It helps substantially
  with false positives.

* \s+ is an overkill. You do not really care for CR, LF, FF,... and you
  also do not care if there is more than one character so the "+" is not
  buying you anything.
  

Cheers,
nnposter


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs