signature based http-req-message-body

NoamRotter — Tue, 28 Mar 2023 10:37:02 GMT

HI all,

I'm trying to create a custom signature based on the POST payload the client is sending.

This is the POST collected from the server:

POST /pds HTTP/1.1 Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */* Referer: https://aaa.com.cn Accept-Language: zh-CN User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/7.0) Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Host: aaa.com.cn Content-Length: 276 Connection: Keep-Alive Cache-Control: no-cache X-Forwarded-Proto:https Cookie: __Secure-UqZBpD3n3keyY3Yp6VvxpmySSbQF5o9Gf5ec6w__=v1FKp4gw__Zls func=login&calling_system=primo&term1=short&institute=12ABC&selfreg=&bor_id=1&bor_verification=1&url=http%3A%2F%2Faaa.com.cn%2Ftransition%3FtargetUrl%3Dhttp%253A%252F%252Faaa.com.cn%252Fhelp%252Fcontent%253Fid%253DmyLibrary

I am trying to create a signature that will alert each time the payload contains:

"func=login&calling_system=primo&term1=short&institute="

Can you guide me through the configuration?

Thanks in advanced,

Noam.

Re: signature based http-req-message-body

nikoolayy1 — Mon, 03 Apr 2023 14:12:05 GMT

You may see this post for how to try regex match https://live.paloaltonetworks.com/t5/custom-signatures/custom-vulnerability-to-block-old-browser-versions/td-p/518666 as the regex match should be added in ( ).

topic Re: signature based http-req-message-body in Custom Signatures

signature based http-req-message-body

Re: signature based http-req-message-body