topic Re: Regex for custom vulnerability signature - help needed in Automation/API Discussions

Regex for custom vulnerability signature - help needed

torm — Wed, 03 Jun 2015 09:06:05 GMT

Hi,

I'm not a regex expert, and I'm struggling to figure something out.

I'm making signature that looks at the "Referer" in the http-requst-header.

I've managed to build an expressions that matched on "Referer: http://cnn.com", that looks like this: ".*(Referer: http://cnn\.com)"

What I want to do next is make an expression that matches on everything except http://cnn.com as the referer.

That means it should look for Referer, and then maybe negate "http://cnn.com"?

Any ideas on how to do that?

- Tor

Re: Regex for custom vulnerability signature - help needed

jvalentine — Wed, 03 Jun 2015 23:29:35 GMT

So, you're looking for a "negate" operator in the custom vulnerability signature functionality? I don't believe that negate is there today... Check back in a week or so and there might be more information available.

Re: Regex for custom vulnerability signature - help needed

torm — Thu, 04 Jun 2015 11:59:55 GMT

Thanks for your reply Jared!

Yeah, i know But I'm actually looking for a way to do this in 6.0/6.1. If it's possible to build the regex in a way that makes it negate the string.

Not sure if it's supported, cause all my attempts have failed.

Re: Regex for custom vulnerability signature - help needed

jvalentine — Thu, 04 Jun 2015 14:04:09 GMT

I'm not aware of a way to accomplish what you're asking in 6.0/6.1. 7.0 is supposed to be available today and includes the negate feature.