[Snort-sigs] request enhance old sid 3193 please

rmkml rmkml at ...174...
Sun Jul 29 19:31:58 EDT 2012


Hi,
Im request on old sid 3193 to enhance pcre,

old:
  pcre:"/.cmd\x22.*\x26.*/smi";

new:
  pcre:"/\.cmd\x22.*?\x26/Ui";

Fire with this URI:
  /a.cmd"a&
  /a.cmd%22a&
  /a.cmd"a%26
  /a.cmd%22a%26

Regards
Rmkml

http://twitter.com/rmkml




More information about the Snort-sigs mailing list