Actions
Feature #4660
openbase64_decode cannot be used with Transformations like pcrexform
Effort:
Difficulty:
Label:
Description
I want to extract the regular matching content and then base64 decode it.
alert http any any -> any any (msg:"test";flow:from_client,established;http.request_body;pcrexform:"#(\w{8})#";base64_decode:bytes 4,offset 0 ;base64_data;conten:"test";
But,it reported a erro : previous transforms not consumed (list: 2, transform_cnt 1)
I found the reason,This is because base64_decode cannot be used with Transformations like pcrexform;
So I can only add pcre:"/./";
before base64_decode . But this pcre:"/./";
is meaningless.
alert http any any -> any any (msg:"test";flow:from_client,established;http.request_body;pcrexform:"#(\w{8})#";pcre:"/./";base64_decode:bytes 4,offset 0 ;base64_data;conten:"test";
Actions