Re: [mod-security-users] rule for common My_eGallery exploit

[Ivan R. <iv...@we...>]

> However when I look at some of the example rules on the website, these seem to be handled as:
> 
> wget\x20
> 
> I assume the \x is a placeholder for %

  They do the same thing. % is used in URL encoding, while \x is
  used in regular expressions. In both cases, the two characters
  that follow are a hexidecimal representation of the character.

  A simple space does not have to be encoded with \x20, but some
  other characters (\x0a, \x0d) do.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]