[Snort-users] Why content and not uricontent?

Brian bmc at ...950...
Wed Apr 13 08:55:21 EDT 2005


On Tue, Apr 12, 2005 at 11:43:59PM +0200, Holger Mense wrote:
> Now I am curios. Can someone explain me, if there are any reasons
> for using content over uricontent?

phf can be exploited via POST as well as GET.  http inspect doesn't
provide a normalized parameter detection method, so we use content to
catch both GET and POST attacks.

Brian




More information about the Snort-users mailing list