topic Re: Custom App for third party Browsers in Automation/API Discussions

Custom App for third party Browsers

paloasaf — Sun, 20 Feb 2011 14:06:07 GMT

I'm trying to create a custom app that identifies browsers as a matter of fact - i need to identify all browsers that do not have MSIE in their http-request .

i tried different regexp patterns and none of them seem to work

[^[MSIE]] - less than 7 chars

[^[MSIE [0-9]\.[0-9]]] - still less than 7 chars? (hmm 4 + 3)

User-Agent [^[MSIE]] - does not seems to work tested browsing on my computer with safari - PA detects it as web-browsing.

Re: Custom App for third party Browsers

paloasaf — Sun, 20 Feb 2011 14:15:54 GMT

i'm sorry. i ment

[^(MSIE)] -

[^(MSIE [0-9]\.[0-9])] -

User-Agent [^(MSIE)] -

Re: Custom App for third party Browsers

mharding — Tue, 22 Feb 2011 16:51:48 GMT

I would start from here. It's the same principle.

.*(User-Agent:) .* (Nmap Scripting Engine)

Re: Custom App for third party Browsers

paloasaf — Wed, 23 Feb 2011 12:20:47 GMT

the main problem is that i need to negate something.

of course i could create 10+ custom apps for each browser, but i think this i not the correct way - what happens if tomorrow somebody will create a new one?

and somthing else:

regex:

.*(User-Agent).*(Chrome)

is a bad idea - some cites write data for different borwsers, so that it is posiible that in http-req will appear word opera.

Re: Custom App for third party Browsers

mharding — Wed, 23 Feb 2011 14:37:00 GMT

I would set it up as a threat opposed to an app.

https://live.paloaltonetworks.com/docs/DOC-1503

Re: Custom App for third party Browsers

paloasaf — Thu, 24 Feb 2011 07:25:53 GMT

as i already said - it's a bad practice to create custom apps for all the browser, it is much more better to create a negating rule