[Snort-sigs] new rule for detect WEB-PHP AppServ main.php appserv_root param access

rmkml rmkml at ...324...
Fri Jan 6 03:56:41 EST 2006


Hi,

please check and maybe add this new rule :

web-php.rules:
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP AppServ main.php appserv_root param access"; uricontent:"/appserv/main.php"; nocase; uricontent:"appserv_root|3D|"; nocase; classtype:web-application-attack; )

Improve/comments are welcome.

Regards
Rmkml




More information about the Snort-sigs mailing list