[Snort-sigs] Crusoe Researches offer new rule for detecting Google Chrome browser undef handler special char attempt!

rmkml rmkml at ...324...
Wed Sep 3 09:24:33 EDT 2008


Hi,

Crusoe Researches offering a new rule for detecting Google Chrome browser 
undef handler special char attempt :

http://www.Crusoe-Researches.com/en/googlechromebrowserundefhandlerspecialchar.txt

Credits:
Crusoe Researches
http://www.Crusoe-Researches.com
contact at ...3281...
=> Crusoe Researches have more than 3323 UNIQ 'snort' rules for Commercial Access
          (Contact me directly if you are interested)

Crusoe Researches support Bro idps v1.3.25 project format rules
(http://www.bro-ids.org/):
signature sid-93323 {
   ip-proto == tcp
   event "WEB-CLIENT Google Chrome browser undefined handler special 
character attempt"
   tcp-state established,responder
   http-body /.*[hH][rR][eE][fF]\s*=\s*(\"|\')?(.){0,9}\:\s*(.){0,9}\%/
  }

Azwalaro new nidps open source project (WireShark based)
  http://www.Crusoe-Researches.com/azwalaro/
  azwalaro at ...3281...
  http matches "(?i)href\s*\=\s*(\"|\')?(.){0,9}\:\s*(.){0,9}\%"

Regards
Rmkml
Crusoe-Researches.com




More information about the Snort-sigs mailing list