[Bro] how to get bro to support utf-8 chars like Chinese in detect-webapps.sig ?

Gao Yongwei itxx00 at gmail.com
Thu Dec 5 16:49:27 PST 2013


2013/12/5 Seth Hall <seth at icir.org>

>
> On Dec 4, 2013, at 9:38 AM, Gao Yongwei <itxx00 at gmail.com> wrote:
>
> > when I turn off gzip in nginx.conf , bro works fine, but when turn on
> gzip, bro seems not work.
> > how could bro unzip the html content before apply the payload ? thank.
>
> We have a specialized keyword for checking patterns in HTTP payloads.  It
> was decode the content prior to matching.
>
> http-reply-body /test\xF0\x9F\x92\xA9test/
>
> Thanks Seth,it works now !
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20131206/00907948/attachment.html 


More information about the Bro mailing list