[Snort-users] Why content and not uricontent?

Holger Mense holger at ...13256...
Thu Apr 21 11:03:42 EDT 2005


* Matt Kettler <mkettler at ...4108...>:
> Thus, while using uricontent closes the hole of encoded requests, it
> opens the hole of someone using the POST command for the exploit.
> On the other hand, content fails to handle encodings, but it does match
> both POST and GET requests.

thank you for your detailed explanation. Now I did understand.

cu, Holger

Holger Mense
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050421/49abb6db/attachment.sig>

More information about the Snort-users mailing list