Which may be found at http://www.grotto-group.com/~gulfie/projects... maybe
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules Fri Dec 2 00:57:33 2005 | |
|---|---|
| Filename : line | Rules |
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 1 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 2 | # $Id: bleeding-inappropriate.rules,v 1.605 2005/11/30 00:14:20 bhartstein Exp $
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 3 | # Bleeding Snort inappropriate rules.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 4 | # These are rules not stable, mature, or applicable enough to be part of the snort.org official sets.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 5 | # Someday some may be, at which time they'll be removed from this list and be available via Snort.org
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 6 | # This is for the bleeding edge junkies. Use at your own risk!!!
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 7 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 8 | # SID's are 2000000+ to avoid conflicts
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 9 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 10 | # Only basic testing has been done. At this point all we guarantee is that they won't crash a recent snort release.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 11 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 12 | # More information available at www.bleedingsnort.com
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 13 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 14 | # Please submit any custom rules or ideas to bleeding@bleedingsnort.com or the snort-sigs mailing list
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 15 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 16 | #*************************************************************
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 17 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 18 | # Copyright (c) 2005, Bleedingsnort.com
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 19 | # All rights reserved.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 20 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 21 | # Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 22 | # following conditions are met:
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 23 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 24 | # * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 25 | # disclaimer.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 26 | # * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 27 | # following disclaimer in the documentation and/or other materials provided with the distribution.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 28 | # * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 29 | # from this software without specific prior written permission.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 30 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 31 | # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 32 | # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 33 | # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 34 | # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 35 | # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 36 | # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 37 | # USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 38 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 39 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 40 | # Info for these sigs from Gary Kalbfleisch
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 41 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Kiddy Porn preteen"; flow: from_server,established; content:"preteen"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; classtype: policy-violation; sid: 2001346; rev:6; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 42 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Kiddy Porn pre-teen"; flow: from_server,established; content:"pre-teen"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; classtype: policy-violation; sid: 2001347; rev:6; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 43 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Kiddy Porn early teen"; flow: from_server,established; content:"early teen"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; classtype: policy-violation; sid: 2001348; rev:6; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 44 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 45 | #From Patrick Harper
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 46 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Kiddy Porn pthc"; flow: from_server,established; content:" pthc "; nocase; classtype: policy-violation; sid: 2001386; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 47 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Kiddy Porn zeps"; flow: from_server,established; content:" zeps "; nocase; classtype: policy-violation; sid: 2001387; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 48 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Kiddy Porn r@ygold"; flow: from_server,established; content:" r@ygold "; nocase; classtype: policy-violation; sid: 2001388; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 49 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Kiddy Porn childlover"; flow: from_server,established; content:" childlover "; nocase; classtype: policy-violation; sid: 2001389; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 50 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 51 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE free XXX"; flow: to_client,established; content:"FREE XXX"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; classtype: kickass-porn; sid: 2001349; rev:5; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 52 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE hardcore anal"; flow: to_client,established; content:"hardcore anal"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; classtype: kickass-porn; sid: 2001350; rev:5; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 53 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE masturbation"; flow: to_client,established; content:"masturbat"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; classtype: kickass-porn; sid: 2001351; rev:5; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 54 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE ejaculation"; flow: to_client,established; content:"ejaculat"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; classtype: kickass-porn; sid: 2001352; rev:5; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 55 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE BDSM"; flow: to_client,established; content:"BDSM"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; classtype: kickass-porn; sid: 2001353; rev:5; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 56 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 57 | #Experiment by Matt Jonkman
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 58 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Sextracker Tracking Code Detected (1)"; flow: from_server,established; content:"BEGIN SEXLIST REFERRER-STATS CODE"; nocase; classtype: kickass-porn; sid: 2001392; rev:7; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 59 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Sextracker Tracking Code Detected (2)"; flow: from_server,established; content:"BEGIN SEXTRACKER CODE"; nocase; classtype: kickass-porn; sid: 2001393; rev:7; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 60 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 61 | #By Jeffrey Lowe
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 62 | alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: "BLEEDING-EDGE INAPPROPRIATE Likely Porn"; flow: established,from_server; pcre:"/ (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b/i"; classtype: kickass-porn; sid: 2001608; rev:5; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-inappropriate.rules : 63 |
|