RE: [Snort-sigs] False positive - sid:2303

> /usr/local/share/snort/web-php.rules:alert tcp $EXTERNAL_NET any -> 
> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP Advanced Poll 
> popup.php access"; 
> flow:to_server,established; uricontent:"/popup.php"; nocase; 
> reference:bugtraq,8890; reference:nessus,11487; 
> classtype:web-application-activity; sid:2303; rev:4;)
>
> I have no idea what triggered this one either.  There's no 
> "popup" or "php" 
> in there, much less a "/popup.php" in the payload.  (This one only 
> triggered once.)

Is it possible that the offending content is in the stream and not in
the packet you are looking at?

Stream4 creates a "psuedo" packet that has all of the content from the
stream, which is then reinserted into the detection engine.

If you are getting these alot, try running tcpdump or ethereal or snort
in packet logging mode (or sguil with log_packets) and take a look at
the whole stream.  I bet the content is in there someplace.

-steve


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs