""ET WEB_SERVER IIS 8.3 Filename With Wildcard (Possible File/Dir Bruteforce)""

SID: 2015023

Revision: 2

Class Type: network-scan

Metadata: created_at 2012_07_04, updated_at 2012_07_04

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "~1"

Within:

PCRE: "/([*\?]~1|~1.?[*\?]|\/~1\/)/U"

Special Options:

  • http_uri

source