ASM::payload

Description

This command retrieves or replaces the payload collected by ASM.

Syntax

ASM::payload [[<offset>] <length>]
ASM::payload length
ASM::payload replace <offset> <length> <string>

ASM::payload [[<offset>] <length>]

  • The command will retrieve up to length bytes of payload starting at offset. If offset is not specified, a value of offset 0 will be used. If neither length nor offset are specified, then all of the payload will be returned.

ASM::payload length

  • The command will return the length of the payload that is currently collected

ASM::payload replace <offset> <length> <string>

  • The command will replace <length> bytes of payload starting at <offset> with whatever is specified in string. To get insert behavior leave the <length> argument at zero. To get the same behavior as delete use an empty string.
Note: Make sure you update the Content-Length header as this does not occur automatically. See K13696 for details.

Examples

This example replaces the request payload with another string in case a specific violation is detected.
when ASM_REQUEST_VIOLATION
{
  set x [ASM::violation_data]
   if {([lindex $x 0] contains "VIOLATION_EVASION_DETECTED")}
   {
      ASM::payload replace 0 0 "1234567890"
   }
}