#$Revision: 1.2 $ $Date: 2007/10/02 20:29:53 $ #Rules to detect cross site scripting attacks ####Created by Thomas Kilgore # javascript: uri schemes in GET requests alert(url_content:"javascript:"; nocase; msg:"javascript: GET request cross site scripting attempt"; reference:url,http://ha.ckers.org/xss.html; reference:url,http://en.wikipedia.org/wiki/Cross-site_scripting;) alert(url_content:"mocha:"; nocase; msg:"mocha: GET request cross site scripting attempt"; reference:url,http://ha.ckers.org/xss.html; reference:url,http://en.wikipedia.org/wiki/Cross-site_scripting;) alert(url_content:"livescript:"; nocase; msg:"livescript: GET request cross site scripting attempt"; reference:url,http://ha.ckers.org/xss.html; reference:url,http://en.wikipedia.org/wiki/Cross-site_scripting;) # normalish html tags using %3C and %3E in GET requests alert(url_content:"%3CSCRIPT"; nocase; msg:"