SID: 2025823

Revision: 2

Class Type: attempted-recon

Metadata: attack_target IoT, created_at 2018_07_10, deployment Datacenter, performance_impact Low, signature_severity Major, updated_at 2018_07_10

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "/my_cgi.cgi"

  • Value: "request=no_auth"

  • Value: "request=load_settings"

  • Value: "table_name=admin_user"

  • Value: "table_name=user_user"

  • Value: "table_name=wireless_settings"

  • Value: "table_name=wireless_security"

  • Value: "table_name=wireless_wpa_settings"

Within:

PCRE:

Special Options:

  • http_uri

  • http_client_body

  • http_client_body

  • fast_pattern

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

source