Nimbostratusiam trying to write a rule to search for a regex for any URL in HTTP::payload, this is what i am using:
when HTTP_REQUEST_DATA { if { [HTTP::payload] matches_regex {[(https?|ftp):\/\/..]} } { HTTP::respond 403 } }
But looks like this rule is matching anything in the payload whether URL or not. Any ideas would help.
CirrostratusThe [] pair in a regex matches any single character inside the brackets. So in your example a match is found if the payload contains (, h, t, p, s, etc. Try omitting the square brackets:
[HTTP::payload] matches_regex { (https?|ftp):\/\/.. }
NimbostratusI am also trying to allow some URLs but block all other URLs in the payload, i think datagroup is not possible as regex can't be used in a datagroup. Is there anyother way to achieve this?