Bro sqli + xss sans paper

Zeek
1

I am trying to add the two scripts for sqli and xss from this paper https://www.sans.org/reading-room/whitepapers/detection/web-application-attack-analysis-bro-ids-34042

but i get this error HTTP::c$http$first_chunk no such a field in record… Anyone knows what is happening?

Thanks in advanced.

2

Sorry for the slow reply, I hope that this is still useful after this
while.

In any case, http$first_chunk was removed in Bro 2.2; the script needs to
be rewritten with the new http events.

Johanna

3

Anyone knows how to change it? Thanks in advanced