Speaker
Event Notes
An example Suricata rule shared during the session:
alert http any any -> any any ( msg:"demo"; http.uri; content: "whoami"; sid:123456; rev:1; )And a request it was tested against:
GET /path?a=b HTTP/1.1Host: localhost:8081User-Agent: curl/8.15.0Accept: */*Resources and links
- Suricatasuricata.io
- What’s That String? That Time a Weird String Revealed a Whole Operationlabs.greynoise.io
- Stack Overflow on matching HTML with regular expressionsstackoverflow.com
- XKCD: Standardsxkcd.com
- Capability Abstractionspecterops.io
- Invoke-DOSfuscation v1.0github.com
- CyberChef encode/decode multi-toolgchq.github.io
- RegExrregexr.com