[Snort-sigs] FTP - space.asp
rwagner at ...447...
Fri Jun 28 13:00:03 EDT 2002
I noticed several attempts to upload space.asp on a FTP server. This
script, combined with another will allow someone to view the drives on a
Server, disk space and see what is in the directories.
Both can be found here under space.zip.
alert tcp $EXTERNAL_NET any -> $HOME_NET 20:21 (msg:"FTP space.asp Attempt";
flags:A+; content:"space.asp"; tag: session, 300, packets;
reference:arachnids,0; sid:0; classtype:misc-attack; rev:1;)
Let me know if you have a better signature.
More information about the Snort-sigs