[Snort-sigs] sid:853

Chris Green cmg at ...26...
Thu Jan 17 12:35:20 EST 2002

web-cgi.rules:54:alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80
(msg:"WEB-CGI wrap access"; flags: A+;
 uricontent: "/wrap"; reference:bugtraq,373;
 classtype:attempted-recon; sid:853; rev:2;)

change the content to "/wrap?" to minimize false alerts. Wrap is the
proper name of the CGI

Chris Green <cmg at ...26...>
"I'm beginning to think that my router may be confused."

More information about the Snort-sigs mailing list