Tag: ids
Snorting the Web Farm
by Ryan M. on Jun.10, 2009, under My Blog
Here are some rules for you snort freaks to chew on that I have found useful in web heavy environments.
alert tcp $HTTP_SERVERS $HTTP_PORTS -> any any (msg:”ET ATTACK RESPONSE x2300 phpshell detected”; content:”Locus7Shell”; nocase; classtype:web-application-activity; reference:url,www.rfxn.com; sid:300010; rev:1;)
alert tcp $HTTP_SERVERS $HTTP_PORTS -> any any (msg:”ET ATTACK RESPONSE RFI Scanner detected”; content:”RFI Scanner”; classtype:web-application-activity; reference:url,www.rfxn.com; sid:300020; [...]
-
Welcome to R-fx Networks!
I welcome you to the new R-fx Networks, now strictly devoted to our projects and community at large. Join me as I strive to find a new path for the site and projects - we are still very much alive and active!
Please see the about us page for more details on why this change has been made. 
OSS-SEC Updates- CVE Request: ViewVC 1.1.4 / 1.0.10 -- XSS via user-provided query form input March 10, 2010
- CVE Request: DeviceKit privilege escalation via pluggable storage device labels March 10, 2010
- CVE Request -- Dovecot v1.2.11 -- DoS (excessive CPU use) by processing email with huge header March 10, 2010
- Re: phpmyvisites 2.3 March 10, 2010
- CVE Request -- aMSN -- improper SSL certificate validation (MITM) March 10, 2010
- BugTraq Updates
- Vuln: cURL/libcURL HTTP 'Location:' Redirect Security Bypass Vulnerability March 9, 2010
- Vuln: cURL / libcURL NULL Character CA SSL Certificate Validation Security Bypass Vulnerability March 9, 2010
- Vuln: Microsoft Excel MDXTUPLE Record Remote Heap Buffer Overflow Vulnerability March 9, 2010
- Vuln: Samba 'CAP_DAC_OVERRIDE' File Permissions Security Bypass Vulnerability March 9, 2010
- Bugtraq: Secunia Research: Employee Timeclock Software "mysqldump" Password Disclosure
- Milw0rm Updates
- ProdLer <= 2.0 (prodler.class.php sPath) RFI Vulnerability September 20, 2009
- BigAnt Server <= 2.50 SP6 Local (ZIP File) Buffer Overflow PoC #2 September 20, 2009
- Joomla com_mytube (user_id) Blind SQL Injection Exploit September 20, 2009
- cP Creator 2.7.1 (Cookie tickets) Remote SQL Injection Exploit September 20, 2009
- Joomla com_jinc (newsid) Blind SQL Injection Vulnerability September 20, 2009
