I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
snort knows how to handle compressed HTTP requests and responses. So configuring snort in inline mode and writing rules with file_data before the content keyword would do it.
Sign up using Google
Sign up using Facebook
Sign up using Stack Exchange
2 years ago