[prev in list] [next in list] [prev in thread] [next in thread] 

List:       dshield
Subject:    Re: [Dshield] GDI+ POC snort rule help
From:       Brian Dessent <brian () dessent ! net>
Date:       2004-09-30 12:10:49
Message-ID: 415BF7C9.83DCE020 () dessent ! net
[Download RAW message or body]

Brian Dessent wrote:

pcre:"/^Content-Type\s*\x3a\s*image\x2fjpe?g.*\xFF\xD8.{2}.*\xFF[\xE1\xE2\xED\xFE]\x00[\x00\x01]/smi";
> 
> This matches "Content-Type: image-jpeg" or "Content-Type: image-jpg"

Oops, make that "image/jpeg" and "image/jpg".  Slash not dash.

Brian
_______________________________________________
DShield and the Internet Storm Center are sponsored by the SANS Institute.
To learn more about current SANS training, see http://www.sans.org .

_______________________________________________
send all posts to list@lists.dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
[prev in list] [next in list] [prev in thread] [next in thread]