首页alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER PHP Possible file Remote File Inclusion Attempt"; flow:established,to_server; http.uri; content:".php?"; content:"=file|3a|//"; reference:cve,2002-0953; reference:url,diablohorn.wordpress.com/2010/01/16/interesting-local-file-inclusion-method/; classtype:web-application-attack; sid:2013002; rev:6; metadata:created_at 2011_06_10, updated_at 2020_04_20;)

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER PHP Possible file Remote File Inclusion Attempt"; flow:established,to_server; http.uri; content:".php?"; content:"=file|3a|//"; reference:cve,2002-0953; reference:url,diablohorn.wordpress.com/2010/01/16/interesting-local-file-inclusion-method/; classtype:web-application-attack; sid:2013002; rev:6; metadata:created_at 2011_06_10, updated_at 2020_04_20;)

时间: 2024-01-24 14:19:17 浏览: 137

这是一个Snort规则，用于检测网络流量中是否存在可能的远程文件包含攻击尝试。当HTTP流量中出现URI路径中包含".php?"和"=file://"(或"=file%3A//")时，该规则会被触发，表示可能存在攻击行为。该规则的引用包括CVE编号2002-0953和一个博客文章的URL，提供更多关于本地文件包含漏洞的信息。

阅读全文