http directory traversal

[RAMALINGA Reddy <Rgreddy1 () covansys com>]

Hi,
        I started using snort along with the rules that come with it. There
is one rule in web-misc.rules that reports "WEB-MISC http directory
traversal" if the content is either "..\\" or "../". I think this rule
should be looking for the same in uricontent rather than in content. Is
there any reason why it is looking in the content ? Please clarify.

Rali

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users