[Snort-users] Snort and Front Page extensions?

darek darek at ...6535...
Sat Aug 10 11:50:03 EDT 2002


Has anyone had experience with Front Page tripping up Snort when users 
"publish" their sites? I have a set of local rules, and the ones that 
get tripped up scan for /../. and /..%255c../ in the uri content, on the 
request of a client.

I havent had the chance to test FP, but I assume the CGIs that one needs 
in an Apache conf could conceivably contain those strings in the URL?

Perhaps I could avoid these false positives by setting a specific 
offset/depth?





More information about the Snort-users mailing list