Re: [Snort-sigs] WebDAV nessus script?

From: Bennett Todd <bet(at)rahul.net>
Date: Wed Mar 19 2003 - 11:23:53 EST

2003-03-18T20:41:00 Frank Knobbe:
> On Tue, 2003-03-18 at 17:37, Jason Haar wrote:

Why "="? I'd think we'd be wanting

        content:!="|0a|"; within:1000;

And if that works, then how much more would be needed to use this trick to confine another content: search to ensure it preceeds a terminator, allowing much more precise sigs for things like the CERT CA-2003-07 Remote Buffer Overflow in Sendmail? Is this doable within snort's current signature language?

-Bennett

---

This SF.net email is sponsored by: Does your code think in ink? You could win a Tablet PC. Get a free Tablet PC hat just for playing. What are you waiting for?
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigsReceived on Wed Mar 19 11:59:01 2003