|Think about Loose Coupling|
Inserting domain name into Snort ruleby miniperl (Initiate)
|on Oct 04, 2012 at 17:31 UTC||Need Help??|
miniperl has asked for the
wisdom of the Perl Monks concerning the following question:
I have a list a domain names that I need to create snort rules for. Inserting text into a line is not too complicated but what needs to be done here is.
If I have a domain
It need to be put into rule first here:
msg:"watch for domain foo.com";
Then inserted again further down the rule but modified first:
The number is a count of the number of characters of each part of the domain. foo contains 3 characters so it is preceded by |03|. There will always be a |00| at the end.
The tricky part is the domain could have any number of sections:
So if I had foo.foobar.com the end result would be
blah blah blah blah -> blah blah (msg:"watch for domain foo.foobar.com"; blah; blah; content:"|03|foo|06|foobar|03|com|00|"; blah; blah;)