Forum Discussion

Muhannad's avatar
Muhannad
Icon for Cirrus rankCirrus
Sep 08, 2020

HTTP_REQUEST_DATA IRULE to find a string.

Dear Experts,

 

I need your help to achive the following,

insert the variable: {"deviceName":"Apple-10"} in the payload when i find a string (P59MBLVR) in the payload:

 

I have tested the below, it is dropping all the traffic:

when HTTP_REQUEST {

 log local0. "starting collect"

   HTTP::collect [HTTP::header Content-Length]

   set clen [HTTP::header Content-Length]

}

when HTTP_REQUEST_DATA {

 binary scan [HTTP::payload] c* throwaway

 set payload [HTTP::payload]  

 set incoming [findstr $payload "P59MBLVR"]

 log local0. "before: $incoming"

 regsub -all {,  "formName} $incoming {, {"deviceName":"Apple-10"}, } newdata

 log local0. "new data is $newdata"

 HTTP::payload replace 0 $clen $newdata

 log local0. "after: [HTTP::payload]" 

}

------

The below IRULE did the job but it is impacting the traffic from non Apple application, so i need to matach a specific variable to take the action when the traffic is matching a specific variable :

when HTTP_REQUEST {

 log local0. "starting collect"

   HTTP::collect [HTTP::header Content-Length]

   set clen [HTTP::header Content-Length]

}

when HTTP_REQUEST_DATA {

 binary scan [HTTP::payload] c* throwaway

 set incoming [HTTP::payload]

 log local0. "before: $incoming"

 regsub -all {,  "formName} $incoming {, {"deviceName":"Apple-10"}, } newdata

 log local0. "new data is $newdata"

 HTTP::payload replace 0 $clen $newdata

 log local0. "after: [HTTP::payload]" 

}

 

I would appreciate your guidence about this issue.

 

Regards,

Muhannad

No RepliesBe the first to reply