Forum Discussion
icherif_189553
Nimbostratus
Jun 09, 2015Class for regular expressions | Filter requests from attacks
Hello all, I am new in F5 irule and i want to filter requests and drop those that contain attack signatures. Signatures (in form of regex) are stored in a class and all requests (GET and POST) should be filtered with each regex.
I thought it will be something like this (For the GET requests) :
if { [class match [string tolower HTTP::uri] contains class_attack_blocked] } {
log local0.alert "attack blocked"
}
The content of the class is :
/((\%27)|(\'))union/ix
Could you please help me. Thanks in advance.
1 Reply
- nitass
Employee
are these useful?
iRules 101 - 10 - Regular Expressions by Joe Pruitt
https://devcentral.f5.com/articles/irules-101-10-regular-expressionsSo Yeah, Regex is Bad by Jason Rahm
https://devcentral.f5.com/articles/so-yeah-regex-is-bad
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
