|
|
| Do you know where your variables are? | |
| PerlMonks |
Inserting domain name into Snort ruleby miniperl (Initiate) |
| on Oct 04, 2012 at 17:31 UTC ( #997269=perlquestion: print w/ replies, xml ) | Need Help?? |
|
miniperl has asked for the
wisdom of the Perl Monks concerning the following question:
I have a list a domain names that I need to create snort rules for. Inserting text into a line is not too complicated but what needs to be done here is. If I have a domain foo.com It need to be put into rule first here: msg:"watch for domain foo.com"; Then inserted again further down the rule but modified first: content:"|03|foo|03|com|00|"; The number is a count of the number of characters of each part of the domain. foo contains 3 characters so it is preceded by |03|. There will always be a |00| at the end. The tricky part is the domain could have any number of sections: foo.com foo.foobar.com foo.foobar.foo.com So if I had foo.foobar.com the end result would be blah blah blah blah -> blah blah (msg:"watch for domain foo.foobar.com"; blah; blah; content:"|03|foo|06|foobar|03|com|00|"; blah; blah;)
Back to
Seekers of Perl Wisdom
|
|
||||||||||||||||||||||||||||||||