|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
[ISSForum] POST request with certain fieldname
D.Toloshny
transtk.ru
Date: Mon Jul 04 2005 - 07:19:09 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
I need to monitor some kind of HTTP Activity by RealSecure Network Sensor
7.
I need to monitor some POST request, for example where fieldname is Login
or Password.
RNE have UserDefined POST_Data event but its like a trigger. I cant see in
console usefull details like filedname and its value. Of course i can
LogWithRaw or use Logevidence. But its not good.
I find in iss1-pam.so one string. Its pam.http.post.content. I cant find
this pam parameter in docs, and i tried it. With the help of this PAM
parameter i can monitor POST request but it work only on value, not on
filedname. And in console view a can see all detail of POST request.
Maybe somebody know how to monitor POST request with certain filedname,
and with detailed console view of POST request.
_______________________________________________
ISSForum mailing list
ISSForumiss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforumiss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]