""ET WEB_SERVER Possible SSRF Attempt Inbound Using Common Dork M7""

SID: 2036434

Revision: 1

Class Type: misc-activity

Metadata: attack_target Web_Server, created_at 2022_05_02, deployment Perimeter, deployment Internal, deprecation_reason Performance, performance_impact Moderate, signature_severity Informational, updated_at 2022_05_02

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: any

Flow: to_server,established

Contents:

  • Value: "?window="

Within:

PCRE: "/\?window=(?:\w{2,6}://|\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})/U"

Special Options:

  • http_uri

  • fast_pattern

source