4 ms·
I wouldn't read too much into the missing "S" in the write-up. It's unclear from that one rule but the majority of the Snort rules for this exploit stop HTTPS.
by nl 6y ago
I wouldn't read too much into the missing "S" in the write-up.
It's unclear from that one rule but the majority of the Snort rules for this exploit stop HTTPS. Note the "port 443" in the rules.
- marcan_42 6y agoAnd those rules are matching TLS ciphertext (record headers and SNI). The path rule is matching plaintext, so it's obviously not inspecting TLS.