ET WEB_SERVER Possible SSRF Attempt Inbound Using Common Dork M2
Sourceet/open
CreatedMay 2, 2022
UpdatedMay 2, 2022
Classificationmisc-activity
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SERVER Possible SSRF Attempt Inbound Using Common Dork M2"; flow:to_server,established; http.uri; content:"?redirect="; fast_pattern; pcre:"/^(?:\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/R"; classtype:misc-activity; sid:2036429; rev:1; metadata:attack_target Web_Server, created_at 2022_05_02, deployment Perimeter, deployment Internal, deprecation_reason Performance, performance_impact Moderate, confidence Medium, signature_severity Informational, updated_at 2022_05_02;)
Metadata
attack targetWeb_Server
created at2022_05_02
deploymentInternal
deprecation reasonPerformance
performance impactModerate
confidenceMedium
signature severityInformational
updated at2022_05_02
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!