From: Alejandro Flores (alejandro.florestriforsec.com.br)
Date: Mon Apr 05 2004 - 12:25:11 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

        hello,

        Payload: "uid=48(apache) gid=48(web)"
        (You must set this to the corresponding group your webserver is running
to)
        If it finds the pattern 'uid=' it will continue searching until it
finds '(web)'. If it find both, then the event is fired.
        The rule options are checked as a large logical and, and they are
checked sequentially.

Regards,
Alejandro Flores

> Hi,
>
> I am new to the snort. Can some one tell me when multiple contents are
> specified in a rule as in the following rule, what does it mean? Does it
> mean that all the contents MUST be matched and does it also mean that they
> should be in the same sequence as specified in the rule or the sequencing
> does not matter (for e.g for the following rule, "uid=" and "(web)" should
> they be in the same sequence or "(web)" can be before "uid=".
>
> alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ATTACK
> RESPONSES id check returned web"; flow:from_server,established;
> content:"uid="; content:"(web)"; classtype:bad-unknown; sid:1884; rev:2;)
>
> Thanks
> GM
>
> _________________________________________________________________
> Apply now for a Citibank Suvidha Account.
> http://go.msnserver.com/IN/45532.asp Get a FREE Citibank Picture Card .
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: IBM Linux Tutorials
> Free Linux tutorial presented by Daniel Robbins, President and CEO of
> GenToo technologies. Learn everything from fundamentals to system
> administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-userslists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>

--TriForSec
http://www.triforsec.com.br/

-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]