Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

HaishanGuo
Staff
Staff

script for HTTP_DATA_REPLACE do not work

Version: v6.2.0 build 0210
Model: FAD VM

Description:  I try replace http body data in http response, the script is clone base on HTTP_DATA_FIND_REMOVE_REPLACE_DEMO

the script as:

when HTTP_RESPONSE{
--HTTP:collect command can be used in both HTTP_REQUEST
--and HTTP_RESPONSE events
--size is optional, otherwise, it will collect up to the full length
--or when 1.25M is reached

t={}
t["size"] = 100;
HTTP:collect(t)
}
when HTTP_DATA_RESPONSE{

--check the size of the content
t={};
t["operation"]="size";
sz=HTTP:payload(t);
debug("content size: %s\n", sz);

--replace a string or a regular expression in the buffered data by a new string
--offset, size and scope are optional, if scope is missing, "all" is assumed
t={};
t["operation"]="replace";
t["offset"] = 0;
t["size"] = sz;
t["scope"] = "all";-- or "first"
t["data"] = "http://cn.studyinchina.edu.cn";
t["new_data"] = "http://cn.proxy.studyinchina.edu.cn";
ret = HTTP:payload(t);
if ret then
debug("replaced %d occurences\n", ret);
else
debug("not found\n");
end
}

I also try 
t["data"] = "
http://cn.studyinchina.edu.cn/cscse2020/lxjh/lxyk/402274/index.html";
t["new_data"] = "
http://cn.proxy.studyinchina.edu.cn/cscse2020/lxjh/lxyk/402274/index.html";

but all two script can not trigger the replace action.
the website is:   www.cscse.edu.cn


Is there any wrong with my script ?

3 REPLIES 3
Ferry_k
Staff
Staff

Hi Haisan,

Can you validate that server-response is not compressed?
If that's the case you have to apply uncompression first to turn it into readable information before scritping.

------------------------------
Ferry
------------------------------
Ferry
Sr. Director Consulting Systems Engineering
HaishanGuo

Hi Ferry,

I'll confirm and try it later.

Thank you.
HaishanGuo

Hi Ferry:

I tried another site , the script worded 

Thank you.

UploadedImages_YfyoUDLR02aN3RWnNISQ_replace-cscse-T.png
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.