Snort mailing list archives
Re: [Snort-sigs] PCRE for SS#'s
From: Jon Baer <security () jonbaer net>
Date: Tue, 21 Sep 2004 13:17:07 -0400
Ive actually set this one up with FlexResp2 to block my wife's credit card #'s outgoing @ the gateway :-)
Evil I know but works pretty nicely .. and not mention big time money saver .. great use of Snort eh?
- Jon
#alert tcp any any -> any any (msg:"BLEEDING-EDGE SSN Detected in Clear Text"; pcre:"/\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b/"; sid:2001328; rev:1;)
------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: [Snort-sigs] PCRE for SS#'s Jon Baer (Sep 21)
- <Possible follow-ups>
- RE: Re: [Snort-sigs] PCRE for SS#'s Michael Miller (Sep 21)