Re: [Snort-sigs] install.php?phpbb_root_dir=http:// sig?

From: Brian <bmc(at)snort.org>
Date: Tue May 20 2003 - 11:45:25 EDT

On Tue, May 20, 2003 at 01:21:13PM +0200, Eric Appelboom wrote:
> Could someone write a signature for request like

How about:

alert tcp any any -> any $HTTP_SERVERS (msg:"foo"; flow:established,to_server; \

   uricontent:"/install.php"; content:"phpbb_root_dir=http\://";)

-brian

---

This SF.net email is sponsored by: ObjectStore. If flattening out C++ or Java code to make your application fit in a relational database is painful, don't do it! Check out ObjectStore. Now part of Progress Software. http://www.objectstore.net/sourceforge

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Tue May 20 12:24:34 2003