RE: [Snort-sigs] SQLsnake - any able to create a sig for this one ?

["larosa, vjay" <larosa_vjay () emc com>]

Yes it does. Tested and verified.

vjl


-----Original Message-----
From: john () dndlabs net [mailto:john () dndlabs net]
Sent: Tuesday, May 21, 2002 10:38 PM
To: snort-users () lists sourceforge net; snort-sigs () lists sourceforge net
Subject: [Snort-sigs] SQLsnake - any able to create a sig for this one?


Does anyone know if the folllowing rule will detect the SQLsnake, I know 
it uses the "xp_cmdshell" extended stored procedure on MSSQL servers to
execute system commands 
(or at least that's my understanding)?  Or is there another rule?


sql.rules:alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"MS-SQL 
xp_cmdshell - program execution"; content: 
"x|00|p|00|_|00|c|00|m|00|d|00|s|00|h|00|e|00|l|00|l|00|"; nocase; flags: 
AP; offset: 8; classtype:attempted-user; sid:687; rev:1;)


-John

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users