# SIGS: Http header whitespace

**URL:** <https://community.emergingthreats.net/t/sigs-http-header-whitespace/2462>\
**Category:** Rule Signatures\
**Created:** [February 20, 2025, 1:53pm UTC](https://community.emergingthreats.net/t/sigs-http-header-whitespace/2462 "2025-02-20T13:53:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [February 20, 2025, 1:53pm UTC](https://community.emergingthreats.net/t/sigs-http-header-whitespace/2462/1 "2025-02-20T13:53:02Z")

</div>

Experimental sigs for looking for whitespace errors in HTTP headers; that sometimes appear as mistakes especially in fake http headers.

Kind Regards,  
Kevin Ross

alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Host Request header”; flow:established,to\_server; content:“Host|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156001; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in User Agent Request header”; flow:established,to\_server; content:“User-Agent|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156002; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Host Request header”; flow:established,to\_server; content:“Host|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156003; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Referer Request header”; flow:established,to\_server; content:“Referer|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156004; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Cookie Request header”; flow:established,to\_server; content:“Cookie|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156005; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Connection Request header”; flow:established,to\_server; content:“Connection|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156006; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Length Request header”; flow:established,to\_server; content:“Length|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156007; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Content-Type Request header”; flow:established,to\_server; content:“Content-Type|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156008; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Accept-Language Request header”; flow:established,to\_server; content:“Accept-Language|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156009; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Accept-Encoding Request header”; flow:established,to\_server; content:“Accept-Encoding|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156010; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Authorization Request header”; flow:established,to\_server; content:“Authorization|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156011; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Authorization Request header”; flow:established,to\_server; content:“Authorization|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156012; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Expect Request header”; flow:established,to\_server; content:“Expect|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156013; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Range Request header”; flow:established,to\_server; content:“Expect|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156015; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Via Request header”; flow:established,to\_server; content:“Via|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156016; rev:1;)  
alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Content-Encoding Request header”; flow:established,to\_server; content:“Content-Encoding|3A 20 20|”; http\_header; classtype:bad-unknown; sid:156017; rev:1;)

# This one may need looked at. I can’t remember if HTTP header argument allows for the return/newline in the header too.

alert tcp $HOME\_NET any → EXTERNAL\_NET $HTTP\_PORTS (msg:“ET HUNTING Extra Whitespace in Termination of Request Header”; flow:established,to\_server; content:“|20 0D 0A 0D 0A|”; http\_header; classtype:bad-unknown; sid:156018; rev:1;)

---

<div class="post-metadata">

**Author:** ![bingohotdog](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/bingohotdog/32/42_2.png) [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\
**Post date:** [February 24, 2025, 8:45pm UTC](https://community.emergingthreats.net/t/sigs-http-header-whitespace/2462/2 "2025-02-24T20:45:45Z")

</div>

Hi Kevin,

I’m looking into this submission and will provide updates once the rules are released.

Cheers,  
🌭

EDIT: @kevross33 In RFC 7230 for HTTP/1.1, whitespace is defined as SP / HTAB or space and horizontal tabs. Were you strictly looking for spaces only? Or, can we add horizontal tabs to this detection logic?