[Snort-sigs] Avoidance of 1860.4 (WEB-MISC Linksys router default password login attempt)

Brian bmc at ...95...
Tue Jul 6 07:57:06 EDT 2004


> alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 
> (msg:"WEB-MISC Linksys router default password login attempt"; 
> flow:to_server,established; content:" OmFkbWlu"; 
> pcre:"/^Authorization\x3a\s*Basic +(?-i)OmFkbWlu/mi"; 
> reference:nessus,10999; classtype:default-login-attempt; sid:1860; rev:5;)
yep




More information about the Snort-sigs mailing list