[Emerging-Sigs] GBot Rule

Matthew Jonkman jonkman at emergingthreatspro.com
Fri Oct 29 11:40:44 EDT 2010


Nice catch! I'll post something now. 

Matt


On Oct 29, 2010, at 11:22 AM, eltra1n wrote:

> Hey all - I captured this today. Can someone write a rule to look for the GBot user agent string?
>  
> User-Agent: gbot/2.3
>  
> Here is full captured packet:
>  
> GET /images/dating1.jpg?tq=pdT%2Ffq%2BTyQUW6KEaKyA%3D HTTP/1.0
> Connection: close
> Host: freeonlinedatingtips.net
> Accept: /
> User-Agent: gbot/2.3
> HTTP/1.1 302 Moved Temporarily
> Content-Length: 0
> Location: /images/dating1.jpg?tq=pdT%2Ffq%2BTyQUW6KEaKyA%3D?03937120
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 
> Support Emerging Threats! Get your ET Stuff! Tshirts, Coffee Mugs and Lanyards
> http://www.emergingthreats.net/index.php/support-et-and-buy-et-schwag.html


----------------------------------------------------
Matthew Jonkman
Emergingthreats.net
Emerging Threats Pro
Open Information Security Foundation (OISF)
Phone 765-807-8630
Fax 312-264-0205
http://www.emergingthreatspro.com
http://www.openinfosecfoundation.org
----------------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20101029/d2b91a99/attachment-0001.html


More information about the Emerging-sigs mailing list