Snort and Front Page extensions?

[darek <darek () nyi net>]

Has anyone had experience with Front Page tripping up Snort when users 
"publish" their sites? I have a set of local rules, and the ones that 
get tripped up scan for /../. and /..%255c../ in the uri content, on the 
request of a client.

I havent had the chance to test FP, but I assume the CGIs that one needs 
in an Apache conf could conceivably contain those strings in the URL?

Perhaps I could avoid these false positives by setting a specific 
offset/depth?



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users