[prev in list] [next in list] [prev in thread] [next in thread] 

List:       emerging-sigs
Subject:    [Emerging-Sigs] FP 2012736
From:       jonkman () emergingthreatspro ! com (Matthew Jonkman)
Date:       2011-04-29 19:22:11
Message-ID: 6E1C36C9-2678-40B7-AE13-499E07D1CF26 () emergingthreatspro ! com
[Download RAW message or body]

Making it that way, different methods for older snorts, but we'll get it.

Matt

On Apr 29, 2011, at 3:21 PM, evilghost at packetmail.net wrote:

> * PGP Signed by an unverified key: 4/29/11 at 3:21:06 PM
> 
> On 04/29/11 14:17, Matthew Jonkman wrote:
> > How about adding \x0d\x0a to the end of the pcre? We could go past 4 or 5 digits, \
> > nothing to prevent it.
> 
> I don't know what happend to the PCRE, the original I had proposed didn't have
> the /i and also had a $ to note end of string after the [a-z}{3,4}$
> 
> 
> -- 
> 
> -evilghost
> 
> * evilghost at packetmail.net <evilghost at packetmail.net>
> * 0xEEEB1387 - Unverified(L)
> 
> 


----------------------------------------------------
Matthew Jonkman
Emergingthreats.net
Emerging Threats Pro
Open Information Security Foundation (OISF)
Phone 765-807-8630 x110
Fax 312-264-0205
http://www.emergingthreatspro.com
http://www.openinfosecfoundation.org
----------------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc


[prev in list] [next in list] [prev in thread] [next in thread]