RE: [Snort-users] Re: [Snort-sigs] PCRE for SS#'s

It wouldn't work for https....and thus 99% of the sites she'd be buying
stuff from...

-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Jon Baer
Sent: Tuesday, September 21, 2004 11:17 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Re: [Snort-sigs] PCRE for SS#'s

Ive actually set this one up with FlexResp2 to block my wife's credit
card #'s outgoing @ the gateway :-)

Evil I know but works pretty nicely .. and not mention big time money
saver .. great use of Snort eh?

- Jon

> #alert tcp any any -> any any (msg:"BLEEDING-EDGE SSN Detected in Clear
> Text"; pcre:"/\b[0-9]{3}-[0-9]{2}-[0-9]
> {4}\b/"; sid:2001328; rev:1;)
>


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users