I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
snort knows how to handle compressed HTTP requests and responses. So configuring snort in inline mode and writing rules with file_data before the content keyword would do it.
Sign up using Google
Sign up using Facebook
Sign up using Stack Exchange
By posting your answer, you agree to the
terms of service.
2 months ago
6 days ago