[Snort-sigs] Sid 1328 and 1329

Joshua Berry jberry at ...2562...
Mon Jul 26 10:13:26 EDT 2004


Why is 1328 listed as: "WEB-ATTACKS ps command attempt", but then
uricontent is set to: "/bin/ps"

And then 1329 is listed as: "WEB-ATTACKS /bin/ps command attempt", but
then uricontent is set to: "ps%20"

This seems backwards to me.
 
Josh Berry, CISSP & MCSE 
Information Security
214-765-1296
 
-------------------------------------------------------------------- 
If you spend more on coffee than on IT security, you will be hacked. 
What's more, you deserve to be hacked. 
     -- (Former) White House Cybersecurity adviser Richard Clarke 





More information about the Snort-sigs mailing list