Results 1 to 3 of 3

Thread: "full_whitespace option" ???

  1. August 4th, 2004, 08:12 AM #1
    zahra79
    zahra79 is offline
    Junior Member
    Join Date
    Aug 2004
    Posts
    12

    Question "full_whitespace option" ???

    how a attacker defeat a string that have space characters with tab characters?

    i want to underestand "full_whitespace option" in snort
    tnx
    Reply With Quote Reply With Quote
  2. August 4th, 2004, 01:15 PM #2
    Tiger Shark
    Tiger Shark is offline
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    This option is useful only if you have an apache server. The apache server translates tab characters into whitespaces while the other servers do not. This being the case replacing genuine whitespaces with tabs in an "illegal" request to an apache server would pass through the pattern matching of Snort but be translated back to whitespaces by the apache server and thus do it's "dirty deed" on a vulnerable server. Snorts HTTP normalization preprocessor allows you to turn on this option if you use an apache server. If not leave it off for performance reasons.
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
    Reply With Quote Reply With Quote
  3. August 7th, 2004, 06:27 AM #3
    zahra79
    zahra79 is offline
    Junior Member
    Join Date
    Aug 2004
    Posts
    12
    oh tnx very much.....
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules