Forum Discussion
Michael_Jenkins
May 27, 2015Cirrostratus
I'd suggest using a
switch -glob
instead of regex, because the performance will be better (and I find it simpler to read too)
when HTTP_REQUEST {
log local0. "User-Agent:[HTTP::header "User-Agent"]"
switch -glob [string tolower [HTTP::header "User-Agent"]] {
"*sqlmap*" -
"*havij*" -
"*nmap*" -
"*nessus*" -
"*absinthe*" -
"*nikto*" -
"*w3af*" -
"*pangolin*" -
"*bsqlbf*" -
"*prog.customcrawler*" -
"*sql power injector*" -
"*mysqloit*" -
"*netsparker*" {
if { !([IP::addr [IP::client_addr] equals 192.168.115.100]) } {
discard
log local0. "[HTTP::header "User-Agent"] discarding."
}
}
}