sascha74
01.07.08, 13:59
Hall Leute,
weis jemand von euch wie man bei snort präprozessor http_inspect das oversize_chunk_encoding abschalten kann.
preprocessor http_inspect: global \
iis_unicode_map unicode.map 1250
# detect_anomalous_servers
#
preprocessor http_inspect_server: server default \
profile apache \
ports { 80 8080 } \
flow_depth 300
#preprocessor http_inspect_server: server xx.xx.xx.xx \
# ports { 80 8080 } \
# flow_depth 0 \
# ascii no \
# double_decode no \
# non_rfc_char { 0x00 } \
# chunk_length 900000 \
# non_strict \
# oversize_dir_length 300
gruss
sascha
weis jemand von euch wie man bei snort präprozessor http_inspect das oversize_chunk_encoding abschalten kann.
preprocessor http_inspect: global \
iis_unicode_map unicode.map 1250
# detect_anomalous_servers
#
preprocessor http_inspect_server: server default \
profile apache \
ports { 80 8080 } \
flow_depth 300
#preprocessor http_inspect_server: server xx.xx.xx.xx \
# ports { 80 8080 } \
# flow_depth 0 \
# ascii no \
# double_decode no \
# non_rfc_char { 0x00 } \
# chunk_length 900000 \
# non_strict \
# oversize_dir_length 300
gruss
sascha