[Snort-sigs] install.php?phpbb_root_dir=http:// sig?

Brian bmc at ...95...
Tue May 20 08:44:09 EDT 2003


On Tue, May 20, 2003 at 01:21:13PM +0200, Eric Appelboom wrote:
> Could someone write a signature for request like 
> http://URL/install.php?phpbb_root_dir=http://MYBOX/

How about:

alert tcp any any -> any $HTTP_SERVERS (msg:"foo"; flow:established,to_server; \
   uricontent:"/install.php"; content:"phpbb_root_dir=http\://";)

-brian




More information about the Snort-sigs mailing list