How to use HTTP ZIP detection/conversion ?

Zeek
1

Hi Bro Workers,
Anyone how to extract zip on http stream and search (ids) on ?
example with this link with firefox browser:
  http://www.milw0rm.com/exploits/5619
  ...
  User-Agent: Mozilla/5.0 .....
  ...
  Server: Apache
  Content-Encoding: gzip
  Vary: Accept-Encoding
  ...
same with wget:
  ...
  User-Agent: Wget...
  ...
  Server: Apache
  ...

example bro ids signature (snort like) work without encoding :
signature sid-92912 {
   ip-proto == tcp
   event "example IE Print Table of Links"
   tcp-state established,responder
   http-body /.*[hH][rR][eE][fF]\s*=(.){0,16}[hH][tT][tT][pP]\:(.){0,49}=[^>]*<\s*([jJ][aA][vV][aA])?[sS][cC][rR][iI][pP][tT]/
   }

It is possible ?
Regards
Rmkml
Crusoe-Researches.com

2

Don't worry, It Just Works(TM) :slight_smile:

Just make sure that configure can find zlib (w/ development
headers). If unsure, double-check that HAVE_LIBZ is 1 in config.h.
Then Bro will decode gzip content encodings and pass the unzipped
data on to http-body's pattern matching.

(If this doesn't seem to work for you even though configure found
zlib, please send me a small trace and a signature which reproduce
the problem.)

Robin