Grabbing POST Parameters

Hi,

Is the client sending URL encoded or multipart/form-data POST parameters?

After collecting, how are you logging the payload? I assume you're logging the payload in the HTTP_REQUEST_DATA event, using HTTP::payload?

Can you capture a tcpdump of a request and view the TCP stream in Wireshark to see the exact HTTP headers and content you're sending?

Here is an example of how to collect the HTTP payload:

when HTTP_REQUEST {
   log local0. "path: [HTTP::path]"
   if { [HTTP::method] equals "POST" and [string tolower [HTTP::path]] ends_with "forumlogin.aspx"} {
      if {[HTTP::header value "Content-Length"] > 0} {
         log local0. "Found Content-Length: [HTTP::header value Content-Length]"
         set content_length [HTTP::header "Content-Length"]
      } else {
         set content_length 10
      }
      HTTP::collect $content_length
   }
}
when HTTP_REQUEST_DATA {
   log local0. "payload length: [HTTP::payload length]"
   log local0. "payload: [HTTP::payload]"
}

Aaron