ET WEB_SERVER Possible SSRF Attempt Inbound Using Common Dork M17

7.0.35.0SID: 2036444Rev: 2Disabled1 views
Sourceet/open
Fileemerging-web_server.rules
CreatedMay 2, 2022
UpdatedMarch 8, 2024
Classificationmisc-activity
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SERVER Possible SSRF Attempt Inbound Using Common Dork M17"; flow:established,to_server; http.uri; content:"?return="; fast_pattern; pcre:"/^(?:\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/R"; classtype:misc-activity; sid:2036444; rev:2; metadata:attack_target Web_Server, created_at 2022_05_02, deployment Perimeter, deployment Internal, deprecation_reason Performance, performance_impact Moderate, confidence Medium, signature_severity Informational, updated_at 2024_03_08;)

Metadata

attack targetWeb_Server
created at2022_05_02
deploymentInternal
deprecation reasonPerformance
performance impactModerate
confidenceMedium
signature severityInformational
updated at2024_03_08

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!