Regex for custom vulnerability signature - help needed

[torm]

Hi,

I'm not a regex expert, and I'm struggling to figure something out.

I'm making signature that looks at the "Referer" in the http-requst-header.

I've managed to build an expressions that matched on "Referer: http://cnn.com", that looks like this: ".*(Referer: http://cnn\.com)"

What I want to do next is make an expression that matches on everything except http://cnn.com as the referer.

That means it should look for Referer, and then maybe negate "http://cnn.com"?

Any ideas on how to do that?

- Tor

[jvalentine]

So, you're looking for a "negate" operator in the custom vulnerability signature functionality?  I don't believe that negate is there today... Check back in a week or so and there might be more information available. 

[torm]

Thanks for your reply Jared!

Yeah, i know But I'm actually looking for a way to do this in 6.0/6.1. If it's possible to build the regex in a way that makes it negate the string.

Not sure if it's supported, cause all my attempts have failed. 

[jvalentine]

I'm not aware of a way to accomplish what you're asking in 6.0/6.1.  7.0 is supposed to be available today and includes the negate feature.