Forum Discussion
CirrusHTTP_REQUEST_DATA IRULE to find a string.
Dear Experts,
I need your help to achive the following,
insert the variable: {"deviceName":"Apple-10"} in the payload when i find a string (P59MBLVR) in the payload:
I have tested the below, it is dropping all the traffic:
when HTTP_REQUEST {
log local0. "starting collect"
HTTP::collect [HTTP::header Content-Length]
set clen [HTTP::header Content-Length]
}
when HTTP_REQUEST_DATA {
binary scan [HTTP::payload] c* throwaway
set payload [HTTP::payload]
set incoming [findstr $payload "P59MBLVR"]
log local0. "before: $incoming"
regsub -all {, "formName} $incoming {, {"deviceName":"Apple-10"}, } newdata
log local0. "new data is $newdata"
HTTP::payload replace 0 $clen $newdata
log local0. "after: [HTTP::payload]"
}
------
The below IRULE did the job but it is impacting the traffic from non Apple application, so i need to matach a specific variable to take the action when the traffic is matching a specific variable :
when HTTP_REQUEST {
log local0. "starting collect"
HTTP::collect [HTTP::header Content-Length]
set clen [HTTP::header Content-Length]
}
when HTTP_REQUEST_DATA {
binary scan [HTTP::payload] c* throwaway
set incoming [HTTP::payload]
log local0. "before: $incoming"
regsub -all {, "formName} $incoming {, {"deviceName":"Apple-10"}, } newdata
log local0. "new data is $newdata"
HTTP::payload replace 0 $clen $newdata
log local0. "after: [HTTP::payload]"
}
I would appreciate your guidence about this issue.
Regards,
Muhannad
