[Bro] how to get bro to support utf-8 chars like Chinese in detect-webapps.sig ?

Gao Yongwei itxx00 at gmail.com
Wed Dec 4 06:38:31 PST 2013


> Unfortunately Bro doesn't have any form of unicode support yet (we've been
> talking about this for quite some time but haven't converged on anything
> quite yet).  What you will have to do is expand the unicode characters
> you're hoping to match into it's constituent bytes.  So your signature
> payload may look like this…
>
> payload /test\xF0\x9F\x92\xA9test/
>
> It's certainly less than ideal, but does that work for you for now?
>
Hi ,Seth ,thanks for your quick reply , the constituent bytes format works
for me now! but I get into another problem:
when I turn off gzip in nginx.conf , bro works fine, but when turn on gzip,
bro seems not work.
how could bro unzip the html content before apply the payload ? thank.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20131204/e999cf5f/attachment.html 


More information about the Bro mailing list