Wordpress seems to be getting it's butt kicked lately with all the xploits that are coming out for it and it's plugins. In a new one just published to milw0rm today, this one deals with "Simple Forum". I guess there is no rest for the exploit writers out there, even if this one does seem rather weak. Especially when the tag line at the bottom of the exploit reads: "i AM NOT HACKER". Instead of the much better "I am not A hacker". It's all in the details.
Without going off the deep-end here and discussing every single Snort rule keyword, I just wanted to touch on a few modifiers that people sometimes misunderstand. They aren't difficult, and hopefully after this explanation and a few examples, I can clear some of the air around these five modifiers.
The five modifiers that I am talking about are
OffsetDepthDistanceWithinnocaseThese five modifiers are not keywords of themselves, but rather they apply as modifiers to another keyword. That keyword is "content". The content keyword is one of the easiest pieces of the Snort rules language as all it does is look for a particular string. So for instance if I wanted to look for the word "joel" within a packet. A simple:
content:"joel";Would allow me to do that. The interesting part comes into play when you want to specify where inside of a particular packet you want the string "joel" to be looked for. If you are running just a plain content ma…
The five modifiers that I am talking about are
OffsetDepthDistanceWithinnocaseThese five modifiers are not keywords of themselves, but rather they apply as modifiers to another keyword. That keyword is "content". The content keyword is one of the easiest pieces of the Snort rules language as all it does is look for a particular string. So for instance if I wanted to look for the word "joel" within a packet. A simple:
content:"joel";Would allow me to do that. The interesting part comes into play when you want to specify where inside of a particular packet you want the string "joel" to be looked for. If you are running just a plain content ma…
Comments