Fwd: question.

[juan patricioo via Snort-devel <snort-devel () lists snort org>]

---------- Forwarded message ---------
De: juan patricioo <cursoredesinap9644 () gmail com>
Date: jue, 15 abr 2021 a las 21:59
Subject: question.
To: <snort-users () lists snort org>


Hello, im trying to do a rule in snort that can capture de text on a text
field in the next formulary:

http://cekb.unileon.es/formulario.html

[image: image.png]

Im trying:

*alert tcp any any -> any 80 (msg:"script text"; content:"script"; nocase;
sid:1000005; rev:1;)*

But ¿nothing happens, can anyone help me?

Thanks!

_______________________________________________
Snort-devel mailing list
Snort-devel () lists snort org
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!