On Wed, 25 Jun 2014, Philip Prindeville wrote:
Including 6 distinct UUID’s would seem to be useful. Including the same UUID 6
times seems broken.
Perhaps a pattern like:
body /((;[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12})){4,}/
would be… no, wait… we’d need to save the first one, and then check for 3 or
more recurrences of the exact same literal string.
rawbody L_REPEATING_UUIDS /<a href="\#"
.*(;[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}){4,}>/i
describe L_REPEATING_UUIDS Seeing the same tracking info repeated
score L_REPEATING_UUIDS 0.1
That still doesn't hit *only* the same GUID repeated. Try this:
rawbody L_REPEATING_UUIDS /<a href="\#"
[^\s>]+(;[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12})\1\1\1/i
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The United States has become a place where entertainers and
professional athletes are mistaken for people of importance.
-- Maureen Johnson Smith Long
-----------------------------------------------------------------------
9 days until the 238th anniversary of the Declaration of Independence
