|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: [Dailydave] Testing the quickness of signature writers
From: Brian Caswell (bmc
snort.org)
Date: Tue May 02 2006 - 13:51:06 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On May 2, 2006, at 2:20 PM, M. Shirk wrote:
>> >> pcre:"/[\? \x3b\x26]module=[a-zA-Z0-9]*[^\x3b\x26]/U";
>>
>> A forward slash, followed by any one char from the set ('?',
>> ';', '&')
>> followed by the literal text "module=" followed by any number
>> (zero or more)
>> alphanumerics followed by any char that is neither ';' nor '&'.
>> All matched
>> against the decoded URI buffer.
>
> That space after the \? will be evaluated in the character set and
> the forward slash acts as the bracket for the pcre expression.
In the rule I originally sent, there was no space in the character
set. Probably added accidentally when dave copied it in his response.
Brian
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]