/usr/local/share/snort/web-php.rules:alert tcp $EXTERNAL_NET any ->
$HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP modules.php access";
flow:to_server,established; uricontent:"/modules.php"; nocase;
reference:bugtraq,9879; classtype:web-application-activity; sid:2565;
rev:1;)
This is another mystery. There's no "php" or "modules" in this packet,
much less a "modules.php".
Payload follows:
length = 382
000 : 47 45 54 20 2F 77 65 62 63 74 2F 68 6F 6D 65 61 GET /webct/homea
010 : 72 65 61 2F 68 6F 6D 65 61 72 65 61 3F 20 48 54 rea/homearea? HT
020 : 54 50 2F 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 TP/1.1..Accept:
030 : 2A 2F 2A 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 */*..Accept-Lang
040 : 75 61 67 65 3A 20 65 6E 2D 75 73 0D 0A 41 63 63 uage: en-us..Acc
050 : 65 70 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A ept-Encoding: gz
060 : 69 70 2C 20 64 65 66 6C 61 74 65 0D 0A 55 73 65 ip, deflate..Use
070 : 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 r-Agent: Mozilla
080 : 2F 34 2E 30 20 28 63 6F 6D 70 61 74 69 62 6C 65 /4.0 (compatible
090 : 3B 20 4D 53 49 45 20 36 2E 30 3B 20 57 69 6E 64 ; MSIE 6.0; Wind
0a0 : 6F 77 73 20 4E 54 20 35 2E 31 3B 20 53 56 31 3B ows NT 5.1; SV1;
0b0 : 20 2E 4E 45 54 20 43 4C 52 20 31 2E 31 2E 34 33 .NET CLR 1.1.43
0c0 : 32 32 29 0D 0A 48 6F 73 74 3A 20 77 65 62 63 74 22)..Host: webct
0d0 : 2E 75 74 64 61 6C 6C 61 73 2E 65 64 75 0D 0A 43 .utdallas.edu..C
0e0 : 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D onnection: Keep-
0f0 : 41 6C 69 76 65 0D 0A 43 6F 6F 6B 69 65 3A 20 57 Alive..Cookie: W
100 : 65 62 43 54 54 69 63 6B 65 74 3D 75 73 65 72 6E ebCTTicket=usern
removed lines 110 through 130 - username/password combo
140 : 69 72 79 25 33 44 31 31 31 31 31 33 31 35 35 30 iry%3D1111131550
150 : 25 32 36 68 61 73 68 25 33 44 36 32 30 63 36 31 %26hash%3D620c61
160 : 36 64 35 61 33 34 34 62 65 64 32 66 37 37 36 39 6d5a344bed2f7769
170 : 31 33 34 39 62 39 65 65 38 37 0D 0A 0D 0A 1349b9ee87....
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
