1,775
edits
No edit summary |
No edit summary |
||
Line 208: | Line 208: | ||
:— Data: This is the actual data string that is searched within the packer layer 7 payload. | :— Data: This is the actual data string that is searched within the packer layer 7 payload. | ||
::It is either searched as is (in case of the | ::It is either searched as is (in case of the '''string''' data type) or converted from a hexadecimal representation. | ||
:— Data type: The drop down box allows to select either | :— Data type: The drop down box allows to select either '''string''' which is a direct representation of the data, or '''hexadecimal''' which is the byte-wise hexadecimal representation of the data. | ||
:— Pos: This defines at which byte location the data should be searched for. It can be a single number which means exactly this position within the layer 7 payload. | :— Pos: This defines at which byte location the data should be searched for. It can be a single number which means exactly this position within the layer 7 payload. | ||
::It can also be a range meaning the data should be search within the interval of bytes. The start value of the range is inclusive, while the end value is exclusive. | ::It can also be a range meaning the data should be search within the interval of bytes. The start value of the range is inclusive, while the end value is exclusive. | ||
Line 229: | Line 229: | ||
::pos: 0 | ::pos: 0 | ||
'''Meaning: The pattern only applies if the text | '''Meaning: The pattern only applies if the text '''HELLO''' is found exactly at the start of the payload data.''' | ||
:— data: 8779827668 | :— data: 8779827668 | ||
Line 242: | Line 242: | ||
:1- Add a new protocol definition by clicking at the '''plus''' button. | :1- Add a new protocol definition by clicking at the '''plus''' button. | ||
:2- Enter a name for this protocol definition. | :2- Enter a name for this protocol definition. '''HTTP GET''' is short and appropriate. | ||
:3- As layer 7 protocol filter select | :3- As layer 7 protocol filter select '''HTTP'''. If you only want to analyze one specific HTTP server, define a new protocol for only this IP in the L7 module and select it from the custom protocol list. | ||
:4- Now edit the requests by clicking at the '''pencil''' button. | :4- Now edit the requests by clicking at the '''pencil''' button. | ||
:5- Add a new request by clicking at the '''plus''' button. | :5- Add a new request by clicking at the '''plus''' button. | ||
:6- Enter the name of this request, | :6- Enter the name of this request, '''GET''' is a good choice. | ||
:7- Add a new pattern by clicking at the '''plus''' button in the third column. | :7- Add a new pattern by clicking at the '''plus''' button in the third column. | ||
:8- Enter the three characters | :8- Enter the three characters '''GET''' (without the quotes) into the data field | ||
:9- Make sure the | :9- Make sure the '''data type''' drop down box still shows the default value '''string'''. | ||
:10- Enter | :10- Enter '''0''' (without the quotes) as the position, as the HTTP GET request always starts with the GET string. | ||
:11- The settings should look like the following picture: | :11- The settings should look like the following picture: | ||
{| class= | {| class= '''wikitable sortable''' | ||
|- | |- | ||
|[[File:Http get req edit.png|600px|none|right]] | |[[File:Http get req edit.png|600px|none|right]] | ||
Line 259: | Line 259: | ||
:13- Now edit the responses by clicking at the '''pencil''' button. | :13- Now edit the responses by clicking at the '''pencil''' button. | ||
:14- Add a new response by clicking at the '''plus''' button. | :14- Add a new response by clicking at the '''plus''' button. | ||
:15- Enter the name of this response, | :15- Enter the name of this response, '''HTTP response''' is a good choice. | ||
:16- Add a new pattern by clicking at the '''plus''' button in the third column. | :16- Add a new pattern by clicking at the '''plus''' button in the third column. | ||
:17- Enter the characters | :17- Enter the characters '''HTTP/1''' (without the quotes) into the data field. | ||
:18- Make sure the | :18- Make sure the '''data type''' drop down box still shows the default value '''string'''. | ||
:19- Enter | :19- Enter '''0''' (without the quotes) as the position, as the HTTP response always starts with the HTTP/1 string. | ||
:20- The settings should look like the following picture: | :20- The settings should look like the following picture: | ||
{| class="wikitable sortable" | {| class="wikitable sortable" |
edits