[Snort-sigs] what attack response is sid 496 for?

Brian bmc at ...95...
Tue Jan 15 05:46:02 EST 2002


According to Chris Green:
> alert tcp $HTTP_SERVERS 80 -> $EXTERNAL_NET any \
>       (msg:"ATTACK RESPONSES directory listing"; \
>        content:"Directory Listing of"; nocase; flags:A+; \
>        classtype:unknown; sid:496; rev:2;)
> 
> I just confirmed that W2K/XP/NT4 uses "Directory of ${dir}" for dir
> so I'm a bit stumped as to what this one is for?  Autogenerated
> indexes?

Changed to "Directory of";

-- 
never offend people with style, when you can offend them with substance.





More information about the Snort-sigs mailing list