What does the http_uri content modifier do is SNORT

Question

I am very confused about exactly what http_uri does. Can someone explain this to me w.r.t NORMALIZED and UNNORMALIZED uri fields?

Answer 1

The normalized and non-normalized uri keywords works differently in snort. Normalization means parsing of the http_uri and then store into the buffer for matching. However in non-normalized uri will directly saved into the buffer without parsing. For example, suppose the http request came like,

/somefile.php?username=%27;echo%20

Then for normalized uri every hex characters will represented in their corresponding ASCII value, so after normalization the request will look like

/somefile.php?username=';echo

then this string will get stored in the buffer for further matching. In case of non-normalized uri the request will stored in the buffer as it is for further matching.