Snort mailing list archives
Javascript in UA
From: James Lay <jlay () slave-tothe-box net>
Date: Mon, 22 Apr 2013 13:21:22 -0600
Saw this a while ago..thought I'd sig it up: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"SERVER-WEBAPP JavaScript in User-Agent, possible XSS"; content:"User-Agent|3A| <script>"; http_header; fast_pattern; reference:url,http://blog.spiderlabs.com/2012/11/honeypot-alert-referer-field-xss-attacks.html; classtype:web-application-attack; sid:10000048; rev:1;) As always, any advice that would make my sigs suck less would help :D Thanks...and happy Monday (queue groans). James ------------------------------------------------------------------------------ Precog is a next-generation analytics platform capable of advanced analytics on semi-structured data. The platform includes APIs for building apps and a phenomenal toolset for data science. Developers can use our toolset for easy data analysis & visualization. Get a free account! http://www2.precog.com/precogplatform/slashdotnewsletter _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Javascript in UA James Lay (Apr 22)
- Re: Javascript in UA Nick Randolph (Apr 22)
- Re: Javascript in UA James Lay (Apr 22)
- Re: Javascript in UA Joel Esler (Apr 22)
- Re: Javascript in UA James Lay (Apr 22)
- Re: Javascript in UA rmkml (Apr 22)
- Re: Javascript in UA Nick Randolph (Apr 22)