On Thu, 26 Jun 2014, Philip Prindeville wrote:
On Jun 25, 2014, at 3:47 PM, John Hardin <[email protected]> wrote:
That still doesn't hit *only* the same GUID repeated. Try this:
rawbody L_REPEATING_UUIDS /<a href="\#"
[^\s>]+(;[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12})\1\1\1/i
Sorry, that got dropped along the way. I had tested:
rawbody L_REPEATING_UUIDS /<a href="\#"
.*(;[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12})(\1){4,}>/i
and indeed that works correctly.
OK, that's certainly another valid way to code it.
Note that you do not need parens around the \1. That captures it again,
which just wastes processing. \1{4,} should work.
Also, .* in a rawbody rule is a **really** bad idea. Note my suggested
alternative, which won't run wild scanning the entire message.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[email protected] FALaholic #11174 pgpk -a [email protected]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Maxim IX: Never turn your back on an enemy.
-----------------------------------------------------------------------
8 days until the 238th anniversary of the Declaration of Independence
