On Wed, 25 Mar 2009, Giampaolo Tomassoni wrote:
From: John Hardin [mailto:jhar...@impsec.org]
Unfortunately no, at least at this time. rawbody rules don't do
multiline
matching (which would allow column counting), and rules in general are
just hit-or-miss, not hit-N-times.
So why this actually works to me?
rawbody LARGETABLE
m'<tr\W(?:[^<]|<(?!t[dr]\W))*(?:<td\W(?:[^<]|<(?!t[rd]\W))*){30,}</tr'is
Got SA 3.2.4.
I had forgotten about tflags multiple - when did multiline rawbody get
added?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
False is the idea of utility that sacrifices a thousand real
advantages for one imaginary or trifling inconvenience; that would
take fire from men because it burns, and water because one may drown
in it; that has no remedy for evils except destruction. The laws
that forbid the carrying of arms are laws of such a nature. They
disarm only those who are neither inclined nor determined to commit
crime. -- Cesare Beccaria, quoted by Thomas Jefferson
-----------------------------------------------------------------------
63 days since Obama's inauguration and still no unicorn!
