These seemed simple enuff
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY
WEB-PHP powergap remote file Inclusion Exploit s01";
flow:to_server,established; uricontent:"/s01.php|3f|shopid|3d|";
nocase; pcre:"/s01.php\x3fshopid\x3d(http|https|ftp)/Ui";
reference:url,www.powergap-shop.de;
reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY
WEB-PHP powergap remote file Inclusion Exploit s02";
flow:to_server,established; uricontent:"/s02.php|3f|shopid|3d|";
nocase; pcre:"/s02.php\x3fshopid\x3d(http|https|ftp)/Ui";
reference:url,www.powergap-shop.de;
reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY
WEB-PHP powergap remote file Inclusion Exploit s03";
flow:to_server,established; uricontent:"/s03.php|3f|shopid|3d|";
nocase; pcre:"/s03.php\x3fshopid\x3d(http|https|ftp)/Ui";
reference:url,www.powergap-shop.de;
reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY
WEB-PHP powergap remote file Inclusion Exploit s04";
flow:to_server,established; uricontent:"/s04.php|3f|shopid|3d|";
nocase; pcre:"/s04.php\x3fshopid\x3d(http|https|ftp)/Ui";
reference:url,www.powergap-shop.de;
reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html;)
alert tcp $EXTERNAL_NET any -> HOME_NET $HTTP_PORTS (msg:"COMMUNITY
WEB-PHP powergap remote file Inclusion Exploit sid variant";
flow:to_server,established; uricontent:"/sid|3d|"; nocase;
content:"|26|shopid|3d|"; nocase; within:20;
reference:url,www.powergap-shop.de;
reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COMMUNITY
WEB-PHP powergap remote file inclusion exploit sid variant 2";
flow:to_server,established; uricontent:"/sid|3d|"; nocase;
pcre:"/sid\x3d(http|https|ftp)/Ui"; reference
url,www.powergap-shop.de;
reference:url,msgs.securepoint.com/cgi-bin/get/bugtraq0608/301.html;)
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
