[Oisf-users] Detect problem with http_header

Victor Julien victor at inliniac.net
Sat Dec 24 14:31:35 UTC 2011

On 12/23/2011 07:59 PM, Martin Holste wrote:
> I'm trying to get a signature to work which is looking for a specific
> server response HTTP header, namely:
> content:"|0d 0a|Content-Disposition: attachment|3b| filename=";
> If I add "http_header" as a modifier, it doesn't hit.  Client stuff
> seems to work fine.  I'm using the default libhtp config.
> Suggestions?

A quick look at code shows what the problem is: in our implementation
http_header currently only inspects the request headers. Please open a
feature request!

Happy holidays everyone!

Victor Julien
PGP: http://www.inliniac.net/victorjulien.asc

More information about the Oisf-users mailing list