I found a couple of examples with uri_detail checks (instead of uri checks) that are written in a very similar way to what John suggested.
I wil test this today. Having writen two plugins already (that is, on the edge to begin to understand how the PMS works ;) ), I knew that one could work with the hash of hashes uri_details provided by the PMS. But seeing nowhere a rule of that kind, I never tried it before. This will be done today, tested with my own samples, and I will later post my results on this thread. Thank's for all of your suggestions, I really appreciate. Alex, from prypiat. Yes, I recycle. On 12-09-26 06:48 AM, Axb wrote: > On 09/26/2012 12:46 PM, Martin Gregorie wrote: >> On Wed, 2012-09-26 at 12:05 +0200, Axb wrote: >>> have you looked at the URIDetail plugin ? >>> >> I didn't know it existed until now, but it looks useful. It looks as if >> it can easily solve the OP's problem too. >> >> Martin > > > If you could create a couple of (working) sample rules, we could add > to SA documentation and to the SA ruleset (for masscheck) > > Thanx > > Axb >
