No subject


Thu Nov 23 16:34:03 EST 2017


void prompt (int fd) {
    char buf[5];

   memset(&buf, 0, sizeof buf);

   sprintf(buf, "> ");
   send(fd, &buf, strlen(buf), 0);
}

We can we tighten up the signatures by having content: "> "; offset: 0;
depth: 1;

references
http://ciac.llnl.gov/ciac/bulletins/k-037.shtml
http://staff.washington.edu/dittrich/misc/mstream.analysis.txt  (lists the
original rules)
http://www.cert.org/incident_notes/IN-2000-05.html
http://security.royans.net/info/posts/bugtraq_ddos4.shtml





More information about the Snort-sigs mailing list