# How to use HTTP ZIP detection/conversion ?

**URL:** <https://community.zeek.org/t/how-to-use-http-zip-detection-conversion/1336>\
**Category:** Zeek\
**Created:** [May 19, 2008, 12:29am UTC](https://community.zeek.org/t/how-to-use-http-zip-detection-conversion/1336 "2008-05-19T00:29:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmkml](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rmkml](https://community.zeek.org/u/rmkml)\
**Post date:** [May 19, 2008, 12:29am UTC](https://community.zeek.org/t/how-to-use-http-zip-detection-conversion/1336/1 "2008-05-19T00:29:38Z")

</div>

Hi Bro Workers,  
Anyone how to extract zip on http stream and search (ids) on ?  
example with this link with firefox browser:  
&nbsp;&nbsp;[http://www.milw0rm.com/exploits/5619](http://www.milw0rm.com/exploits/5619)  
&nbsp;&nbsp;...  
&nbsp;&nbsp;User-Agent: Mozilla/5.0 .....  
&nbsp;&nbsp;...  
&nbsp;&nbsp;Server: Apache  
&nbsp;&nbsp;Content-Encoding: gzip  
&nbsp;&nbsp;Vary: Accept-Encoding  
&nbsp;&nbsp;...  
same with wget:  
&nbsp;&nbsp;...  
&nbsp;&nbsp;User-Agent: Wget...  
&nbsp;&nbsp;...  
&nbsp;&nbsp;Server: Apache  
&nbsp;&nbsp;...

example bro ids signature (snort like) work without encoding :  
signature sid-92912 {  
&nbsp;&nbsp;&nbsp;ip-proto == tcp  
&nbsp;&nbsp;&nbsp;event "example IE Print Table of Links"  
&nbsp;&nbsp;&nbsp;tcp-state established,responder  
&nbsp;&nbsp;&nbsp;http-body /.\*[hH][rR][eE][fF]\s\*=(.){0,16}[hH][tT][tT][pP]\:(.){0,49}=[^\>]\*\<\s\*([jJ][aA][vV][aA])?[sS][cC][rR][iI][pP][tT]/  
&nbsp;&nbsp;&nbsp;}

It is possible ?  
Regards  
Rmkml  
[Crusoe-Researches.com](http://Crusoe-Researches.com)

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [May 20, 2008, 4:13am UTC](https://community.zeek.org/t/how-to-use-http-zip-detection-conversion/1336/2 "2008-05-20T04:13:22Z")

</div>

Don't worry, It Just Works(TM) 🙂

Just make sure that configure can find zlib (w/ development  
headers). If unsure, double-check that HAVE\_LIBZ is 1 in config.h.  
Then Bro will decode gzip content encodings and pass the unzipped  
data on to http-body's pattern matching.

(If this doesn't seem to work for you even though configure found  
zlib, please send me a small trace and a signature which reproduce  
the problem.)

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/how-to-use-http-zip-detection-conversion/1336/3 "2022-05-06T15:38:33Z")

</div>