web-client.rules

Firestorm NIDS是一个性能非常高的网络入侵检测系统 (NIDS)。目前

# (C) Copyright 2002, Martin Roesch, Brian Caswell, et al.  All rights reserved.
# $Id: web-client.rules,v 1.1 2002/08/12 11:42:08 scara Exp $
#---------------
# WEB-CLIENT RULES
#---------------
#
# These signatures look for two things:
# * bad things coming from our users 
# * attacks against our web users

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"WEB-CLIENT Outlook EML access"; uricontent:".eml"; flow:from_client,established; classtype:attempted-admin; sid:1233; rev:7;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT XMLHttpRequest attempt"; flow:to_client,established; content:"new XMLHttpRequest\("; content:"file\://"; nocase; classtype:web-application-attack; sid:1735; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"WEB-CLIENT readme.eml download attempt"; flow:from_client,established; uricontent:"/readme.eml"; nocase; classtype:attempted-user; sid:1284; reference:url,www.cert.org/advisories/CA-2001-26.html; rev:9;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT readme.eml autoload attempt"; flow:to_client,established; content:"window.open(\"readme.eml\""; nocase; classtype:attempted-user; sid:1290; reference:url,www.cert.org/advisories/CA-2001-26.html; rev:8;)