webfp-lib

网络入侵检测系统

# $Id: webfp-lib,v 1.2 2000/11/18 08:25:04 roesch Exp $

alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-register.txt";flags:PA; content:"_private/register.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-admin.pl";flags:PA; content:"admin.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-administrators.pwd";flags:PA; content:"administrators.pwd"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-author.exe";flags:PA; content:"_vti_bin/_vti_aut/author.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-authors.pwd";flags:PA; content:"authors.pwd"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-cfgwiz.exe";flags:PA; content:"cfgqiz.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-contents.htm";flags:PA; content:"admcgi/contents.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-form_results";flags:PA; content:"_private/form_results.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-form_results.htm";flags:PA; content:"_private/form_results.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-Fpadmcgi.exe";flags:PA; content:"scripts/Fpadmcgi.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-fpadmin.htm";flags:PA; content:"admisapi/fpadmin.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-fpremadm.exe";flags:PA; content:"fpremadm.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-fpsrvadm.exe";flags:PA; content:"fpsrvadm.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-orders.htm";flags:PA; content:"_private/orders.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-access.cnf";flags:PA; content:"_vti_pvt/access.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-services.cnf";flags:PA; content:"_vti_pvt/services.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"IDS237 - Web-Frontpage .htw"; flags: PA; content: ".htw"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"IDS248 - Web-Frontpage fourdots request"; flags: PA; content: "|2e 2e 2e 2e 2f|"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-writeto.cnf";flags:PA; content:"_vti_pvt/writeto.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-users.pwd";flags:PA; content:"users.pwd"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-svcacl.cnf";flags:PA; content:"_vti_pvt/svcacl.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-orders.txt";flags:PA; content:"_private/orders.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-shtml.dll";flags:PA; content:"_vti_bin/shtml.dll"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-register.htm";flags:PA; content:"_private/register.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-service.stp";flags:PA; content:"_vti_pvt/service.stp"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-service.pwd";flags:PA; content:"service.pwd"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-service.cnf";flags:PA; content:"_vti_pvt/service.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-registrations.txt";flags:PA; content:"_private/registrations.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-registrations.htm";flags:PA; content:"_private/registrations.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"IDS271 - WEB-FrontPage - dvwssr request"; flags: PA; content: "dvwssr.dll"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"FrontPage-shtml.exe";flags:PA; content:"_vti_bin/shtml.exe"; nocase;)