|
Details
|
|
The aim of HTTP is to allow localized file transfers (essentially in HTML) with the help of a character string called URL between a navigator (the client) and a web server.
Communication between the navigator and the server is carried out in two steps : <p style="padding-left: 8px">- The navigator makes an HTTP request,
- The server processes the request and then sends an HTTP response.</p> In reality the communication is carried out in more steps if the processing of the request by the server is considered.
An HTTP request is a set of lines which the navigator sends to the server. It comprises among other things :
<p style="padding-left: 8px">- a line of request : a line indicating the type of document requested, the method to be applied, and the version of the protocol used. The line comprises, in particular, the URL that is being sought.
- body of the request : an optional set of lines which needs to be separated from the lines preceding it by an empty line and which allows data sending by a POST command during the sending of data to a server through a form.</p> An HTTP response is a set of lines the server sends to the navigator. It comprises among other things :
<p style="padding-left: 8px">- a status line : a line indicating the version of the protocol used and the status of the request being processed with the help of a code and explanatory text (error 404 not found, for example)
- body of the response : contents of the requested document.</p> The attack aims at inserting fraudulent executable code by transmitting a request or response of which the URL exceeds the maximum size allowed.
If this alarm is configured as pass and if a packet that triggers the alarms is received, the corresponding plugin will detach from the connection and no further protocol analysis will be performed.
|
