"full_whitespace option" ???
Results 1 to 3 of 3

Thread: "full_whitespace option" ???

  1. #1
    Junior Member
    Join Date
    Aug 2004
    Posts
    12

    Question "full_whitespace option" ???

    how a attacker defeat a string that have space characters with tab characters?

    i want to underestand "full_whitespace option" in snort
    tnx

  2. #2
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    This option is useful only if you have an apache server. The apache server translates tab characters into whitespaces while the other servers do not. This being the case replacing genuine whitespaces with tabs in an "illegal" request to an apache server would pass through the pattern matching of Snort but be translated back to whitespaces by the apache server and thus do it's "dirty deed" on a vulnerable server. Snorts HTTP normalization preprocessor allows you to turn on this option if you use an apache server. If not leave it off for performance reasons.
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  3. #3
    Junior Member
    Join Date
    Aug 2004
    Posts
    12
    oh tnx very much.....

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides