[Snort-users] Porn.rules dont work?

FRANCIS PROVENCHER francis.provencher at ...14009...
Thu Jul 12 14:42:14 EDT 2007


I all,

I'v look around and read multiples thread's about the porn.rules.

I run a box with snort ( Version 2.6.1.5 (Build 59)  FreeBSD).

I uncomment it on the snort.conf 
...
include $RULE_PATH/nntp.rules
include $RULE_PATH/other-ids.rules
include $RULE_PATH/web-attacks.rules
include $RULE_PATH/backdoor.rules
include $RULE_PATH/shellcode.rules
include $RULE_PATH/policy.rules
include $RULE_PATH/porn.rules
....

I look on the $RULE_PATH/ to see if the rules is here;

Porn.rules exist.

I browse the web via google with a proxy set to the port 8080, i search for upskirt, XXX, Free PORN and lot's of expression list on the rules but i never received alert on my BASE Console.

I have to change something in the rule (like $HTTP_PORTS) to work?

Some one have an idea.





Francis Provencher
Ministère de la Sécurité publique du Québec
Direction des technologies de l'information
Division de la sécurité informatique
Tél: 1 418 646-3258
Courriel:   Francis.provencher at ...14010...
 
CEH - Certified Ethical Hackers
SSCP - System Security Certified Practitionner
Sec+ - Security +




More information about the Snort-users mailing list