[Snort-sigs] FTP - space.asp

Robert Wagner rwagner at ...447...
Fri Jun 28 13:00:03 EDT 2002

I noticed several attempts to upload space.asp on a FTP server.  This
script, combined with another will allow someone to view the drives on a
Server, disk space and see what is in the directories.
Both can be found here under space.zip.

alert tcp $EXTERNAL_NET any -> $HOME_NET 20:21 (msg:"FTP space.asp Attempt";
flags:A+; content:"space.asp"; tag: session, 300, packets;
reference:arachnids,0; sid:0; classtype:misc-attack; rev:1;)

Let me know if you have a better signature.

More information about the Snort-sigs mailing list