[Emerging-Sigs] Misfires on 2001685

[Jack Pepper]

Quoting Matt Jonkman <jonkman at jonkmans.com>:

> Wouldn't it be a 0a right before though? Like in an http stream  
> you'd have |0d 0a| to end the previous line...
>

         0x00f0:  6f6e 3a20 4b65 6570 2d41 6c69 7665 0d0a  on:.Keep-Alive..
         0x0100:  436f 6e74 656e 742d 5479 7065 3a20 696d  Content-Type:.im
         0x0110:  6167 652f 626d 700d 0a0d 0a42 4d5a 5b01  age/bmp....BMZ[.
         0x0120:  0000 0000 007a 0000 006c 0000 0096 0000  .....z...l......


Right you are, sir.  And that's why they pay you the big bucks!

jp



-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com