Sagan medium stable other
[WEB-ATTACKS] Possible jBroFuzz Fuzzer Detected
[WEB-ATTACKS] Possible jBroFuzz Fuzzer Detected
Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WEB-ATTACKS] Possible jBroFuzz Fuzzer Detected"; content: "Host"; content: "localhost"; content:"User-Agent"; content: "Mozilla/5.0 (Windows"; content: "Windows NT 5.1"; content: "en-GB"; content: "Gecko/20061204 Firefox/2.0.0.1"; parse_src_ip: 1; parse_dst_ip: 2; reference:url,www.owasp.org/index.php/Category%3aOWASP_JBroFuzz; reference:url,doc.emergingthreats.net/2009476; xbits: set,recon,track ip_src,expire 86400; default_proto:tcp; default_dst_port: $HTTP_PORT; classtype:attempted-recon; sid:5001832; rev:3;) Field Validations
Loading…
Comments (0)
Loading comments...