how a attacker defeat a string that have space characters with tab characters?
i want to underestand "full_whitespace option" in snort :confused:
tnx
Printable View
how a attacker defeat a string that have space characters with tab characters?
i want to underestand "full_whitespace option" in snort :confused:
tnx
This option is useful only if you have an apache server. The apache server translates tab characters into whitespaces while the other servers do not. This being the case replacing genuine whitespaces with tabs in an "illegal" request to an apache server would pass through the pattern matching of Snort but be translated back to whitespaces by the apache server and thus do it's "dirty deed" on a vulnerable server. Snorts HTTP normalization preprocessor allows you to turn on this option if you use an apache server. If not leave it off for performance reasons.
oh tnx very much..... ;)