Re: Browsing Whitehats

[rottz () securityflaw com]

uhh snort automagically gives you the URL to the IDS signature
You should see something like this in your alert file
[Xref => http://www.whitehats.com/info/IDS243]
same thing with bugtraq and cve

You must be running an old version of snort, try upgrading to snort
1.8.1

Mads Rasmussen wrote:
> When receiving an alert it now comes with a IDS number, but how do you search
> for this number at whitehats.com?
>
> I tried the url suggested by the FAQ
>
> http://www.whitehats.com/ids/
>
> You have to go into the advanced search mode and in the field "Additinal
> search criteria" select IDSkey and in the next "contains" and then you enter
> your ids key that snort ouputs.
>
> Voila you got a idea what's going on with that particular alert
>
> Regards,
>
> Mads
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
rottz at securityflaw dot com
Founder of Securityflaw

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users