Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error when parsing Unicode in URL #64

Open
Straevaras opened this issue Dec 19, 2017 · 0 comments
Open

Error when parsing Unicode in URL #64

Straevaras opened this issue Dec 19, 2017 · 0 comments

Comments

@Straevaras
Copy link

Straevaras commented Dec 19, 2017

Specific example for current ET Trojan ruleset : https://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-trojan.rules

alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN KHRAT DragonOK DNS Lookup (inter-ctrip .com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|inter-ctrip|03|com|00|"; nocase; distance:0; fast_pattern; metadata: former_category TROJAN; reference:url,blogs.forcepoint.com/security-labs/trojanized-adobe-installer-used-install-dragonok’s-new-custom-backdoor; classtype:trojan-activity; sid:2024108; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_03_29, performance_impact Low, updated_at 2017_03_29;)

Running gensidmsgmap creates exception

Traceback (most recent call last):
  File "/usr/bin/idstools-gensidmsgmap", line 12, in <module>
    sys.exit(main())
  File "/usr/lib/python2.7/site-packages/idstools/scripts/gensidmsgmap.py", line 131, in main
    print(idstools.rule.format_sidmsgmap(rules[rule_id]))
UnicodeEncodeError: 'ascii' codec can't encode character u'\u2019' in position 156: ordinal not in range(128)

For some reason a special character is used in the URL reference of the ET rule and gensidmsgmap can't handle it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant