[prev in list] [next in list] [prev in thread] [next in thread] 

List:       dragonidsuser
Subject:    [Dragonidsuser] WEB:DOUBLE-SLASH causes lots false events
From:       "Catherine Park" <pjh () enclue ! com>
Date:       2003-03-25 9:42:56
[Download RAW message or body]

Hello all..

We are very suffering from the false positive event-WEB:DOUBLE-SLASH.
This signature makes one event whenever the web page includes a url address string \
such as " referer:http://xxx.xxx.xxx.xxx". So we decide not to use this..

By the way, we found a strange thing with this signature.
Look at the following session :

Signature: T D A S 3 8 W WEB:DOUBLE-SLASH /2f/2f
Session : 
name={BF}{A9}{C0}{DA}{BF}{EE}{BF}{B5}{C0}{DA}&email=gnalfjfeoswkd@msn.com&password=12345&homepage=http://evegirl.co.tv&subject=%B1%A4%B0%ED%5D%BF%A9%C0%DA%B0%A1
 As you can see, the compare byte was 8 and the event occured.
If you have the experience similar to me or if you have any idea about this problem,
would you share with me? Hope your reply..

Thank you reading this..

Catherine Park
eNClue Co. Ltd
Tel  : +82-2-784-0957
Fax : +82-2-784-0959
E-mail : pjh@enclue.com
_______________________________________________
Dragonidsuser mailing list

For help please follow the below instructions.
You can make subsciption adjustments via email by sending a message to:

  Dragonidsuser-request@enterasys.com

with the word `help' in the subject or body (don't include the quotes), and you will \
get back a message with instructions.

You must know your password to change your options (including changing the password, \
itself) or to unsubscribe.   If you forget your password, don't worry, you will \
receive a monthly reminder telling you what all your enterasys.com mailing list \
passwords are, and how to unsubscribe or change your options.  


[prev in list] [next in list] [prev in thread] [next in thread]