POST Data in a form

[Chris_Williams]

Greetings DevCenter,

I am trying to write a custom application that will prevent specific data in an HTTP Post. In the attached trace, I would like to block the phrase 'THISISATEST' in the POST but allow any other phrase. (In reality I would also key in on several other headers to make it site specific, but I am not having problems with that part)

I have tried many option to include 'http-req-message-body' using both string text and HEX.

Any help would be appreciated.

Chris Williams

[bspilde]

Chris,

I believe what you are looking for in the pattern-match operator is context=http-req-host-header pattern=THISISATEST qualifier=http-method: POST.

Give that a try. I'm doing a custom application for one of our company's statistics applications via the GET method. Anytime it does a get on a very specific pattern to know if it is a customer GET or an employee GET.

Brad

[Chris_Williams]

Brad,

Thank you for the reply, but that did not work either. I thought the host-header pattern only matched strings in the host header field. It does work when I add the sites hostname; but I am looking for form data.

Thanks!
Chris Williams

[Chris_Williams · Accepted solution]

I finally ended up finding it with trial and error: http-req-params