Nimbostratus
So, basically I just want to write out the POST variable "username" to log.
rule get_user_id {
when HTTP_REQUEST {
if { [HTTP::uri] contains "login" } {
set username [HTTP::username]
log "username: $username"
}
}
}
what do I need more, can find much about it in the forum.
Br, Mattias
Employee
You won't be able to retrieve data like this if it's a POST method. POST means you have to check the payload, to do this you'll have to use HTTP::collect, HTTP::payload, when HTTP_RESPONSE and when HTTP_RESPONSE_DATA
when HTTP_REQUEST {
if {[HTTP::uri] contains "login"} {
HTTP::collect
}
}
when HTTP_REQUEST_DATA {
set parameter_vals [split [HTTP::payload] "&"]
Break out the POST data for username
for {set i 0} {$i < [llength $namevals]} {incr i} {
set params [split [lindex $namevals $i] "="]
if { [lindex $params 0] equals "username" } {
set username [lindex $params 1]
}
}
}
I didn't tested it but should be close
HTH
N.
Nimbostratus
But, I can still not getting it to work.
if I strip it down just to:
when HTTP_REQUEST {
if {[HTTP::uri] contains "login"} {
HTTP::collect
log "found login"
}
}
when HTTP_REQUEST_DATA {
log "[HTTP::payload]"
}
I still not getting any data... except the debug "found" that I added, It also seems that the login process is going alot slower.. Is this rules consuming resources ?
Br, Mattias