SID 1:45886

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Potential Misfortune Cookie probe attempt

Rule Explanation

This event is generated when a crafted cookie designed to bypass authentication to certain web servers traverses the network. Impact: Attempted Admin Details: Snort detection looks for a crafted Cookie fitting the device ID's along with a null terminator. Ease of Attack: Simple, many proofs of concept exist on the web.

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group