# Bro sqli + xss sans paper

**URL:** <https://community.zeek.org/t/bro-sqli-xss-sans-paper/4769>\
**Category:** Zeek\
**Created:** [April 11, 2017, 11:10am UTC](https://community.zeek.org/t/bro-sqli-xss-sans-paper/4769 "2017-04-11T11:10:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [April 11, 2017, 11:10am UTC](https://community.zeek.org/t/bro-sqli-xss-sans-paper/4769/1 "2017-04-11T11:10:08Z")

</div>

I am trying to add the two scripts for sqli and xss from this paper [https://www.sans.org/reading-room/whitepapers/detection/web-application-attack-analysis-bro-ids-34042](https://www.sans.org/reading-room/whitepapers/detection/web-application-attack-analysis-bro-ids-34042)

but i get this error HTTP::c$http$first\_chunk no such a field in record… Anyone knows what is happening?

Thanks in advanced.

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [May 30, 2017, 4:48pm UTC](https://community.zeek.org/t/bro-sqli-xss-sans-paper/4769/2 "2017-05-30T16:48:24Z")

</div>

Sorry for the slow reply, I hope that this is still useful after this  
while.

In any case, http$first\_chunk was removed in Bro 2.2; the script needs to  
be rewritten with the new http events.

Johanna

---

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [May 31, 2017, 8:56am UTC](https://community.zeek.org/t/bro-sqli-xss-sans-paper/4769/3 "2017-05-31T08:56:55Z")

</div>

Anyone knows how to change it? Thanks in advanced

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/bro-sqli-xss-sans-paper/4769/4 "2022-05-06T15:44:49Z")

</div>