[***] Results from Oinkmaster started Fri Oct 1 20:00:02 2004 [***]
[///] Modified active rules: [///]
-> Modified active in bleeding.rules (15):
old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Stealth attempt to access SHELL\:";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*h[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*[\:]/i";
content:"="; content:!"shell\:"; classtype:web-application-attack;
sid:2001103; rev:1;)
new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Stealth attempt to access SHELL\:";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*h[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*[\:]/i";
content:"="; content:!"shell\:"; classtype:misc-attack; sid:2001103; rev:2;)
old: alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE
Internet Explorer Plugin.ocx Heap Overflow";
content:"06DD38D0-D187-11CF-A80D-00C04FD74AD8"; nocase; content:".load(";
nocase; reference:url,http.www.hnc3k.com/ievulnerabil.htm;
classtype:web-application-attack; sid:2001181; rev:1;)
new: alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE
Internet Explorer Plugin.ocx Heap Overflow";
content:"06DD38D0-D187-11CF-A80D-00C04FD74AD8"; nocase; content:".load(";
nocase; reference:url,http.www.hnc3k.com/ievulnerabil.htm;
classtype:misc-attack; sid:2001181; rev:2;)
old: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + VBSCRIPT";
pcre:"/TYPE[\s]*=[\s]*['"]*text/vbscript/i"; classtype:web-application-attack;
sid:2001079; rev:1;)
new: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + VBSCRIPT";
pcre:"/TYPE\s*=\s*['"]text\/vbscript/i"; classtype:web-application-attack;
sid:2001079; rev:2;)
old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Attempt to execute VBScript code";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*vbscript[\:]/i";
classtype:web-application-attack; sid:2001099; rev:1;)
new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Attempt to execute VBScript code";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*vbscript[\:]/i";
classtype:misc-attack; sid:2001099; rev:2;)
old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Stealth attempt to execute VBScript code";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*b[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:]/i";
content:"="; content:!"vbscript\:"; nocase; classtype:web-application-attack;
sid:2001102; rev:1;)
new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Stealth attempt to execute VBScript code";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*b[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:]/i";
content:"="; content:!"vbscript\:"; nocase; classtype:misc-attack;
sid:2001102; rev:2;)
old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Stealth attempt to access FILE\:";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*f[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*[\:]/i";
content:"="; content:!"shell\:"; nocase; classtype:web-application-attack;
sid:2001104; rev:1;)
new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Stealth attempt to access FILE\:";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*f[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*[\:]/i";
content:"="; content:!"shell\:"; nocase; classtype:misc-attack; sid:2001104;
rev:2;)
old: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + JAVASCRIPT";
pcre:"/TYPE[\s]*=[\s]*['"]*text/javascript/i";
classtype:web-application-attack; sid:2001076; rev:1;)
new: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt TYPE + JAVASCRIPT";
pcre:"/TYPE\s*=\s*['"]text\/javascript/i"; classtype:web-application-attack;
sid:2001076; rev:2;)
old: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + JAVASCRIPT";
pcre:"/TYPE[\s]*=[\s]*['"]*application/x-javascript/i";
classtype:web-application-attack; sid:2001077; rev:1;)
new: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + JAVASCRIPT";
pcre:"/TYPE\s*=\s*['"]application\/x-javascript/i";
classtype:web-application-attack; sid:2001077; rev:2;)
old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Internet Explorer Memory Corruption Bug";
pcre:"/<STYLE>[\s\S]*@\;\/*/i";
reference:url,www.securiteam.com/windowsntfocus/5XP051FDFM.html;
classtype:misc-activity; sid:2001205; rev:1;)
new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Internet Explorer Memory Corruption Bug";
pcre:"/<STYLE>@\;\/\*/i";
reference:url,www.securiteam.com/windowsntfocus/5XP051FDFM.html;
classtype:misc-activity; sid:2001205; rev:2;)
old: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + JSCRIPT";
pcre:"/TYPE[\s]*=[\s]*['"]*text/jscript/i"; classtype:web-application-attack;
sid:2001078; rev:1;)
new: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + JSCRIPT";
pcre:"/TYPE\s*=\s*['"]text\/jscript/i"; classtype:web-application-attack;
sid:2001078; rev:2;)
old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE IE trojan Ants3set 1.exe - process injection";
content:"|00|KERNEL32.DLL|00|GDI32.dll|00|MSVCRT.dll|00|USER32.dll|00||00|LoadLibraryA|00||00|GetProcAddress|00||00|ExitProcess|00|";
classtype:web-application-attack; sid:2001182; rev:1;)
new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE IE trojan Ants3set 1.exe - process injection";
content:"|00|KERNEL32.DLL|00|GDI32.dll|00|MSVCRT.dll|00|USER32.dll|00||00|LoadLibraryA|00||00|GetProcAddress|00||00|ExitProcess|00|";
classtype:misc-attack; sid:2001182; rev:2;)
old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Stealth attempt to execute Javascript code";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*j[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:]/i";
content:"="; content:!"javascript\:"; nocase;
classtype:web-application-attack; sid:2001101; rev:1;)
new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Stealth attempt to execute Javascript code";
pcre:"/(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*j[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:]/i";
content:"="; content:!"javascript\:"; nocase; classtype:misc-attack;
sid:2001101; rev:2;)
old: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + ECMACRIPT";
pcre:"/TYPE[\s]*=[\s]*['"]*text/ecmascript/i";
classtype:web-application-attack; sid:2001081; rev:1;)
new: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + ECMACRIPT";
pcre:"/TYPE\s*=\s*['"]text\/ecmascript/i"; classtype:web-application-attack;
sid:2001081; rev:2;)
old: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + VBSCRIPT";
pcre:"/TYPE[\s]*=[\s]*['"]*application/x-vbscript/i";
classtype:web-application-attack; sid:2001080; rev:1;)
new: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE + VBSCRIPT";
pcre:"/TYPE\s*=\s*['"]application\/x-vbscript/i";
classtype:web-application-attack; sid:2001080; rev:2;)
old: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE Internet Explorer XSS to Custom HTTP Errors in Local Zone";
flow:to_server,established; uricontent:"404.htm#"; nocase;
reference:url,http.www.hnc3k.com/ievulnerabil.htm;
classtype:web-application-attack; sid:2001177; rev:1;)
new: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"BLEEDING-EDGE Internet Explorer XSS to Custom HTTP Errors in Local Zone";
flow:to_server,established; uricontent:"404.htm#"; nocase;
reference:url,http.www.hnc3k.com/ievulnerabil.htm; classtype:misc-attack;
sid:2001177; rev:2;)
[---] Disabled rules: [---]
-> Disabled in bleeding.rules (5):
#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"BLEEDING-EDGE
MS-SQL SQL Injection allowing empty or wrong inputwith an OR 4";
flow:to_server,established; content:"'|00|'|00|";content:"O|00|R|00|";
content:"L|00|I|00|K|00|E|00|"; content:"'|00|'|00|"; reference:
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf;reference:
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html;nocase;
classtype:attempted-user; sid:2000492; rev:3;)
#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"BLEEDING-EDGE
MS-SQL SQL Injection allowing empty or wrong inputwith an OR 2";
flow:to_server,established; content:"'|00|'|00|";content:"O|00|R|00|";
content:">|00|"; content:"'|00|'|00|"; reference:
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf;reference:
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html;nocase;
classtype:attempted-user; sid:2000490; rev:2;)
#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"BLEEDING-EDGE
MS-SQL SQL Injection allowing empty or wrong inputwith an OR 3";
flow:to_server,established; content:"'|00|'|00|";content:"O|00|R|00|";
content:"<|00|"; content:"'|00|'|00|"; reference:
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf;reference:
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html;nocase;
classtype:attempted-user; sid:2000491; rev:3;)
#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"BLEEDING-EDGE
MS-SQL SQL Injection allowing empty or wrong inputwith an OR 5";
flow:to_server,established;
content:"'|00|'|00|";content:"O|00|R|00|";content:"B|00|E|00|T|00|W|00|E|00|E|00|N|00|";
content:"'|00|'|00|"; reference:
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf;reference:
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html;nocase;
classtype:attempted-user; sid:2000493; rev:3;)
#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"BLEEDING-EDGE
MS-SQL SQL Injection allowing empty or wrong inputwith an OR";
flow:to_server,established; content:"'|00|'|00|";content:"O|00|R|00|";
content:"=|00|"; content:"'|00|'|00|"; reference:
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf;reference:
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html;nocase;
classtype:attempted-user; sid:2000375; rev:3;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (1):
2001076 || BLEEDING-EDGE WEB-MISC cross site scripting attempt TYPE +
JAVASCRIPT
-> Added to bleeding.rules (2):
#Submitted by Joseph Gama, Tweaks by Owen Crowe
#Submitted by Joseph Gama, Tweaks by Owen Crowe
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (6):
2000375 || BLEEDING-EDGE MS-SQL SQL Injection allowing empty or wrong
inputwith an OR ||
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html ||
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf
2000490 || BLEEDING-EDGE MS-SQL SQL Injection allowing empty or wrong
inputwith an OR 2 ||
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html ||
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf
2000491 || BLEEDING-EDGE MS-SQL SQL Injection allowing empty or wrong
inputwith an OR 3 ||
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html ||
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf
2000492 || BLEEDING-EDGE MS-SQL SQL Injection allowing empty or wrong
inputwith an OR 4 ||
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html ||
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf
2000493 || BLEEDING-EDGE MS-SQL SQL Injection allowing empty or wrong
inputwith an OR 5 ||
url,http.www.securitymap.net/sdm/docs/windows/mssql-checklist.html ||
url,http.www.nextgenss.com/papers/more_advanced_sql_injection.pdf
2001076 || BLEEDING-EDGE WEB-MISC cross site scripting attempt STYLE +
JAVASCRIPT
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
