Regsub always returns a 1 never 0

 

 

I get basically the some result. Even if I have a SSN in the HTTP payload this fails through to the else statement i.e. no SSN Found.

 

Same thing if there is not an SSN number in the payload. Finding

 

the SSN's was never a problem but now it doesn't look like its even finding them.

 

 

when HTTP_RESPONSE_DATA {

 

set payload [HTTP::payload [HTTP::payload length]]

 

set mcnx ?xxMASTERCARDxx?

 

set visanx ?xxxxxVISAxxxxx?

 

set amexnx ?xxxxxAMEXxxxxx?

 

set ssnx xxx-xx-xxxx

 

Find the SSNumbers

 

if { [regsub -all {/d{3}-/d{2}-/d{4}} $payload ssnx new_response] > 0 } {

 

log local0. "Outbound SSNumber Alert!!!"

 

log local0. $new_response

 

}

 

else {

 

log local0. "NO SSN Found!"

 

log local0. $new_response

 

}

 

 

 

Here is the output with the SSN:

 

 

Jul 12 00:36:35 tmm tmm[744]: Rule creditcard_detector : NO SSN Found!

 

Jul 12 00:36:35 tmm tmm[744]: Rule creditcard_detector : File: 4k.htm, Block 0000/0004.................................. 0000 00: 012-34-56789ABCDEFABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghyjkl 111-22-3333 0000 01: 0123456789ABCDEFABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghyjkl 0000 02: 0123456789ABCDEFABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghyjkl 0000