[Snort-users] (no subject)

Erik Fichtner emf at ...367...
Thu Jan 17 07:39:13 EST 2002


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Jan 17, 2002 at 10:01:16AM +0100, Patrice.Arnal at ...4604... wrote:
> BUT I have a site with a "Calendar.gif file" .  What I want is uricontent 
> "/calendar" but NOT Calendar.gif

pass tcp blah blah (flags:A+; uricontent:"/Calendar.gif")
alert tcp blah blah (msg:"WEB-CGI calendar access"; ... )

- -- 
Erik Fichtner
Security Administrator, ServerVault, Inc.
703-333-5900
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE8Ru/5Q7EzrewLMS0RAkO8AJ0Txs54uXk4h2II/ABvNuJUXix7zQCfZ5Lc
76zHMeBZPN1bUHozNG7Skkg=
=gPgZ
-----END PGP SIGNATURE-----




More information about the Snort-users mailing list