OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Williams Jon (WilliamsJonJohnDeere.com)
Date: Fri Nov 02 2001 - 10:23:16 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    I'm getting a lot of false positives on the WEB-MISC http directory
    traversal rule. In each one, the "../.." part isn't in the actual request,
    its in the Referrer: header. Is it possible to write the rule in such a
    manner that it only triggers on stuff in the request and ignores the rest of
    the packet? The rule in question is:

    alert tcp $INTERNAL any -> any 80 (msg:"WEB-MISC http directory traversal";
    flags: A+; content: "../"; reference:arachnids,297;
    classtype:attempted-recon; sid:1113; rev:1;)

    Thanks.

    Jon

    _______________________________________________
    Snort-users mailing list
    Snort-userslists.sourceforge.net
    Go to this URL to change user options or unsubscribe:
    https://lists.sourceforge.net/lists/listinfo/snort-users
    Snort-users list archive:
    http://www.geocrawler.com/redir-sf.php3?list=snort-users