Forum Discussion
Mike_Maher
Nimbostratus
NimbostratusAttack Signature question
Can someone take a look at the Attack Signature below and let me know if it looks ok. I don't have much experience writing them and want to make sure I am not making some sort of big mistake.
content: "/proc/self/fd/3" nocase; headercontent: "Mozilla/5.0 (Windows NT 6.0;) Gecko/20110814 Firefox/6.0" nocase;
Here's a manual for syntax details on ASM custom signatures: http://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/config_guide_asm_10_2_0/asm_apx_attack_sig_syntax.html
And, Nathan is right about the semicolon following the "content"
natheCirrocumulus
Mike,
I think you need to pop a ; after the content too e.g. content: "/proc/self/fd/3"; nocase;
Also, do you need to escape the special characters in the headercontent? You would use the pipe | to do this. I can't be 100% on this.
N
