[Snort-users] Finding specific File transfers with Snort?

Jürgen Nieveler Juergen.Nieveler at ...1917...
Thu Apr 26 11:52:48 EDT 2001


I'm rather new to Snort, and don't know if this has been covered before:

Can you use Snort to find out if there is a command "put swinger.jpg" in a
FTP Session?


I noticed on a couple of old misconfigured FTP-Servers that allowed
anonymous write access that all contained a file "swinger.jpg", which seems
to be put there by some scanning robot to test for and mark open servers.

It would be nice to be able to check for this kind of thing, as it could
warn you of possible scans from the "warez-kiddies" :-)

Mit freundlichen Grüßen / Yours sincerely

Juergen Nieveler
Encrease AG
Team eCommerce
Tel.: +49/241/16008-327
Fax:  +49/241/16008-354
Email: juergen.nieveler at ...1917...
Web: www.encrease.de
2AAB A988 0B80 D53F FC53  3BED 8CC0 2092 922D 8378 (DH)
5ADF A15E 91E4 98DB  2391 0D29 8B08 A884 (RSA)

More information about the Snort-users mailing list