Forum Discussion

nshelton85's avatar
nshelton85
Icon for Altostratus rankAltostratus
Sep 14, 2018

Extracting specific information from an HTTP POST and logging it.

I am trying to log the IP address and usernames that are attempting to login to our web portal. I have the iRule mostly working, but I am having difficulty finding out how to extract certain pieces of the HTTP form rather than the whole thing. The fields in the form are UserID, EnteredUserId,and Password. Currently with the script below I get the following message in my LTM log file ": domain=&UserID=Nate10&EnteredUserID=Nate10&Password=PasswordRemoved has attempted to login from 172.xxx.xxx.xxx:61562." For security reasons I would like to just log the UserID and EnteredUserID as well as have a variable that can be toggled on/off to log the password for debugging and troubleshooting. I have tried adding a couple of different scripts to mine that I have seen in other posts, but nothing seems to work. Any ideas?

 

when HTTP_REQUEST { if { [HTTP::method] equals "POST" } { if {[HTTP::header exists "Content-Length"] && [HTTP::header "Content-Length"] <= 1048576} { set content_length [HTTP::header "Content-Length"] } else { set content_length 1048576 } HTTP::collect $content_length } } when HTTP_REQUEST_DATA { set client [IP::client_addr]:[TCP::client_port] set url [HTTP::header Host][HTTP::uri] set HTTP_METHOD [HTTP::method] set HTTP_PAYLOAD [HTTP::payload] log local0. "This is a test message $url $client" if {($url contains "/servlet/Login")} { log local0. "$HTTP_PAYLOAD has attempted to login from $client" } }

 

application delivery
iRules
LTM
security
  • PeteWhite's avatar
    PeteWhite
    Icon for Employee rankEmployee
    Sep 14, 2018

    The simplest way is to use findstr on the payload

    set user [ findstr [HTTP::payload] "user=" 5 & ]

    If you know where the text is then you can also use 

    string range

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Sep 14, 2018

    You can try this:

    set user [ URI::query ?[HTTP::payload] user ]

    URI::query search the query string in a URI (starting with ?), then search the parameter user and return the value.

    As standard POST content format is the same as a query string, add a ? before payload to use URI::query command...