Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Signatures
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Snort-sigs] False positive for sid 1478

from [Brock, Anthony - NET] Network Security [Permanent Link]
Subject: [Snort-sigs] False positive for sid 1478
Date: Tue, 2 May 2006 12:15:39 -0700 
# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others.  References in the rules themselves
# should be used for linking to other's work. 
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
# 
# $Id$
#
# 

Rule:  WEB-CGI swc access

--
Sid: 1478

--
False Positives: This rule will match on any web access that includes
the '/swc' string. So, a URL that contains
'http://<server>/~waggones/swcity/f/art2.jpg' incorrectly matches.

--
Corrective Action: Modify the uricontent to match on a script. Either
look for '/swc?' or possibly look for 'ctr' in the POST variables.


-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Snort-sigs] False positive for sid 1478, Brock, Anthony - NET <=
Previous by Date:  Re: [Snort-sigs] Sig 1147, Jason Brvenik
Next by Date:  [Snort-sigs] False Positive, ANDREW J WOOD
Previous by Thread:  Re: [Snort-sigs] correction and new rule about keyloggers, Nigel Houghton
Next by Thread:  [Snort-sigs] False Positive, ANDREW J WOOD
Indexes:  [Date] [Thread] [Top] [All Lists]