Forum Discussion
Oct 19, 2020
Hello Gerhackett.
After collecting the HTTP payload, you can do something like this.
when HTTP_RESPONSE_DATA {
set find "https?://.*.jpg"
set indices [regexp -all -indices -inline $find [HTTP::payload]]
foreach idx $indices {
set start [ expr { [lindex $idx 0] } ]
set end [expr { [lindex $idx 1] } ]
log local0. "[substr [HTTP::payload] $start $end]"
}
}
Modify the regex properly to match your goal. You can test your regex here:
Regards,
Dario.