ftp-lib

该源码是用C语言编写的,实现网络入侵检测系统的功能

# $Id: ftp-lib,v 1.2 2000/11/18 08:25:04 roesch Exp $

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-pass-h0tb0x";flags:PA; content:"pass h0tb0x";) 
alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"FTP-NT-bad-login"; content:"Login failed.";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"IDS134 - CVE-1999-0202 - FTP tar parameters";flags:PA; content:"RETR--use-compress-program";) 
alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"IDS137 - CVE-1999-0183 - TFTP parent directory"; content:"..";) 
alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"IDS138 - CVE-1999-0183 - TFTP rootdirectory"; content:"|0001|/";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-cwd~root"; flags:PA; content:"cwd ~root"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-forward";flags:PA; content:".forward";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-linux-nullpass";flags:PA; content:"pass null |0d|"; nocase;) 
alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"FTP-bad-login";flags:PA; content:"530 Login incorrect";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-nopassword";flags:PA; content:"pass |0d|"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"IDS257 - Aix FTP Buffer Overflow";flags:PA;dsize:>1300; content:"CEL ";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-pass-wh00t";flags:PA; content:"pass wh00t"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-rhosts";flags:PA; content:".rhosts"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-shosts";flags:PA; content:".shosts"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-site-exec";flags:PA; content:"site exec"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-user-root";flags:PA; content:"user root |0d|"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-user-warez";flags:PA; content:"user warez |0d|"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"IDS213 - FTP-Password Retrieval"; content:"passwd"; flags: AP;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"IDS148 - CVE-1999-0183 - TFTP Write"; content:"|00 02|"; depth:2; ) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP-linux-nulluser";flags:PA; content:"user null |0d|"; nocase;)