[Snort-users] http directory traversal

RAMALINGA Reddy Rgreddy1 at ...4101...
Fri Nov 16 03:12:06 EST 2001

	I started using snort along with the rules that come with it. There
is one rule in web-misc.rules that reports "WEB-MISC http directory
traversal" if the content is either "..\\" or "../". I think this rule
should be looking for the same in uricontent rather than in content. Is
there any reason why it is looking in the content ? Please clarify.


More information about the Snort-users mailing list