Home page logo

snort logo Snort mailing list archives

flowbits: acunetix.scanner
From: waldo kitty <wkitty42 () windstream net>
Date: Wed, 29 May 2013 10:57:47 -0400

there is no check rule in the *.rules files for flowbits: acunetix.scanner...

registered subscriber using latest rules pulled 26 May 2013 for

    ,,_     -*> Snort! <*-
   o"  )~   Version GRE (Build 69)
    ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
            Copyright (C) 1998-2013 Sourcefire, Inc., et al.
            Using libpcap version 1.1.1
            Using PCRE version: 7.8 2008-09-05
            Using ZLIB version: 1.2.6

May 26 04:25:44 frodo snort[22314]: WARNING: flowbits key 'acunetix.scanner' is 
set but not ever checked.

$ grep -E "acunetix.scanner" /path/to/snort/*rules*/*.rules

/path/to/snort/rules/app-detect.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET 
$HTTP_PORTS (msg:"APP-DETECT Acunetix web vulnerability scan attempt"; 
flow:to_server,established; content:"Acunetix-"; fast_pattern:only; http_header; 
flowbits:set,acunetix.scanner; metadata:service http; 
reference:url,www.acunetix.com; classtype:web-application-attack; sid:25358; rev:1;)

NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
Snort-sigs mailing list
Snort-sigs () lists sourceforge net

Please visit http://blog.snort.org for the latest news about Snort!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]