-
August 4th, 2004, 08:12 AM
#1
Junior Member
"full_whitespace option" ???
how a attacker defeat a string that have space characters with tab characters?
i want to underestand "full_whitespace option" in snort
tnx
-
August 4th, 2004, 01:15 PM
#2
This option is useful only if you have an apache server. The apache server translates tab characters into whitespaces while the other servers do not. This being the case replacing genuine whitespaces with tabs in an "illegal" request to an apache server would pass through the pattern matching of Snort but be translated back to whitespaces by the apache server and thus do it's "dirty deed" on a vulnerable server. Snorts HTTP normalization preprocessor allows you to turn on this option if you use an apache server. If not leave it off for performance reasons.
Don\'t SYN us.... We\'ll SYN you.....
\"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
-
August 7th, 2004, 06:27 AM
#3
Junior Member
oh tnx very much.....
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|