[Snort-sigs] Error in sid 1668

Kreimendahl, Chad J Chad.Kreimendahl at ...361...
Mon May 6 08:50:04 EDT 2002


The content line has 'TTTP' (previous revision had HTTP)... I believe HTTP
is the right way.

tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORT (msg:"WEB-CGI /cgi-bin/
access"; flags:A+; flow:to_server; uricontent:"/cgi-bin/";
content:"/cgi-bin/ TTTP"; nocase; classtype:web-application-attack;
sid:1668; rev:2;) 




More information about the Snort-sigs mailing list