Blocking extensions using data filtering

leandro.scardua — Fri, 19 Aug 2016 02:03:01 GMT

Hello Everyone,

I need help, i'm trying configure the data filtering for block extension with: .cd5, .4zx and .pekey

Someone already managed to configure data filtering this format?

Thanks

Re: Blocking extensions using data filtering

Hithead — Fri, 19 Aug 2016 13:40:28 GMT

hi,

you can create a custom vulnerability signature to block it. But you have to Wireshark the traffic (down- or upload) with these files.

In the pcap you can read out the "file-unknown-body" signature of that file which looks like \x3136977BB061728878688662\x

with this condition you can configure a pattern-match and the action to block the traffic.

More information are available here: