[Bro] HTTP encoding
Vern Paxson
vern at icir.org
Mon Apr 3 16:06:38 PDT 2006
> I was testing some evasion techniques using HTTP unicode encoding, and I was
> surprised to see that Bro seems to completely miss the attacks in that case.
Indeed, it lacks a Unicode decoder :-(. Morley Mao wrote one a while ago,
which unfortunately never got integrated. I'd be happy to send it along
to someone who wants to bring it up to date (and I promise to integrate
the result!).
Vern
More information about the Bro
mailing list