#!/bin/bash
#Copyright 2003 William Stearns <wstearns@pobox.com>
#Released under the GPL.

#ZZZZ Check Me and MyVersion
Me='snort-web-misc'
MyVersion='20031125'
#DefaultActions=''

[ -r /etc/firebricks/firebricks.conf ] &&			. /etc/firebricks/firebricks.conf
[ -r /etc/firebricks/$Me.conf ] &&				. /etc/firebricks/$Me.conf
[ -r ${FBLibDir:-'/usr/lib/firebricks/'}/firebrickslib ] &&	. ${FBLibDir:-'/usr/lib/firebricks/'}/firebrickslib
if [ -z "$FBLibVer" ]; then
	echo 'It looks like firebrickslib was not loaded, why?  Exiting' >&2
	exit 1
fi

for OneTask in $Tasks ; do
	case "$OneTask" in
	link)
		$IptablesBin -N $Me >/dev/null 2>&1
#ZZZZ try to restrict the following three to only send down what the chain needs to inspect.
		$IptablesBin $AppIn INPUT -i \! lo						-j $Me
		$IptablesBin $AppIn FORWARD							-j $Me
		$IptablesBin $AppIn OUTPUT							-j $Me
		;;
	unlink)
#ZZZZ Make the same changes as above (such as "-p tcp"), but if you cut and paste, note "$AppIn" is now "-D"
		$IptablesBin -D INPUT -i \! lo							-j $Me
		$IptablesBin -D FORWARD								-j $Me
		$IptablesBin -D OUTPUT								-j $Me
		$IptablesBin -X $Me >/dev/null 2>&1
		;;
	create)
		echo "Starting $Me" >&2
		FlushOrNewChain $Me


		LogAs="SID1497"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"<SCRIPT>"'	$Tail	# '"WEB-MISC cross site scripting attempt"' nocase-ignored classtype:web-application-attack sid:1497
		LogAs="SID1667"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"img src=javascript"'	$Tail	# '"WEB-MISC cross site scripting HTML Image tag set to javascript attempt"' nocase-ignored classtype:web-application-attack sid:1667
		LogAs="SID1250"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/level/"' --string '"/exec/"'	$Tail	# '"WEB-MISC Cisco IOS HTTP configuration attempt"' classtype:web-application-attack bugtraq,2936 sid:1250
		LogAs="SID1047"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"REVLOG / "'	$Tail	# '"WEB-MISC Netscape Enterprise DOS"' cve,CAN-2001-0251 bugtraq,2294 classtype:web-application-attack sid:1047
		LogAs="SID1048"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"INDEX "'	$Tail	# '"WEB-MISC Netscape Enterprise directory listing attempt"' cve,CAN-2001-0250 bugtraq,2285 classtype:web-application-attack sid:1048
		LogAs="SID1050"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"GETPROPERTIES"'	$Tail	# '"WEB-MISC iPlanet GETPROPERTIES attempt"' classtype:web-application-attack sid:1050
		LogAs="SID1054"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".js%70"'	$Tail	# '"WEB-MISC weblogic view source attempt"' bugtraq,2527 classtype:web-application-attack sid:1054
		LogAs="SID1055"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"%00.jsp"'	$Tail	# '"WEB-MISC Tomcat directory traversal attempt"' bugtraq,2518 classtype:web-application-attack sid:1055
		LogAs="SID1056"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"%252ejsp"'	$Tail	# '"WEB-MISC Tomcat view source attempt"' bugtraq,2527 classtype:web-application-attack sid:1056
		LogAs="SID1057"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"ftp.exe"'	$Tail	# '"WEB-MISC ftp attempt"' nocase-ignored classtype:web-application-activity sid:1057
		LogAs="SID1058"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"xp_enumdsn"'	$Tail	# '"WEB-MISC xp_enumdsn attempt"' nocase-ignored classtype:web-application-attack sid:1058
		LogAs="SID1059"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"xp_filelist"'	$Tail	# '"WEB-MISC xp_filelist attempt"' nocase-ignored classtype:web-application-attack sid:1059
		LogAs="SID1060"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"xp_availablemedia"'	$Tail	# '"WEB-MISC xp_availablemedia attempt"' nocase-ignored classtype:web-application-attack sid:1060
		LogAs="SID1061"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"xp_cmdshell"'	$Tail	# '"WEB-MISC xp_cmdshell attempt"' nocase-ignored classtype:web-application-attack sid:1061
		LogAs="SID1062"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"nc.exe"'	$Tail	# '"WEB-MISC nc.exe attempt"' nocase-ignored classtype:web-application-activity sid:1062
		LogAs="SID1064"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"wsh.exe"'	$Tail	# '"WEB-MISC wsh attempt"' nocase-ignored classtype:web-application-activity sid:1064
		LogAs="SID1065"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"rcmd.exe"'	$Tail	# '"WEB-MISC rcmd attempt"' nocase-ignored classtype:web-application-activity sid:1065
		LogAs="SID1066"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"telnet.exe"'	$Tail	# '"WEB-MISC telnet attempt"' nocase-ignored classtype:web-application-activity sid:1066
		LogAs="SID1067"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"net.exe"'	$Tail	# '"WEB-MISC net attempt"' nocase-ignored classtype:web-application-activity sid:1067
		LogAs="SID1068"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"tftp.exe"'	$Tail	# '"WEB-MISC tftp attempt"' nocase-ignored classtype:web-application-activity sid:1068
		LogAs="SID1069"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"xp_regread"'	$Tail	# '"WEB-MISC xp_regread attempt"' nocase-ignored classtype:web-application-activity sid:1069
		LogAs="SID1977"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"xp_regwrite"'	$Tail	# '"WEB-MISC xp_regwrite attempt"' nocase-ignored classtype:web-application-activity sid:1977
		LogAs="SID1978"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"xp_regdeletekey"'	$Tail	# '"WEB-MISC xp_regdeletekey attempt"' nocase-ignored classtype:web-application-activity sid:1978
		LogAs="SID1070"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"SEARCH "'	$Tail	# '"WEB-MISC WebDAV search access"' nocase-ignored arachnids,474 classtype:web-application-activity sid:1070
		LogAs="SID1071"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".htpasswd"'	$Tail	# '"WEB-MISC .htpasswd access"' nocase-ignored classtype:web-application-attack sid:1071
		LogAs="SID1072"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".nsf/"' --string '"../"'	$Tail	# '"WEB-MISC Lotus Domino directory traversal"' nocase-ignored cve,CVE-2001-0009 bugtraq,2173 classtype:web-application-attack sid:1072
		LogAs="SID1077"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/samples/search/queryhit.htm"'	$Tail	# '"WEB-MISC queryhit.htm access"' nocase-ignored classtype:web-application-activity sid:1077
		LogAs="SID1078"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/counter.exe"'	$Tail	# '"WEB-MISC counter.exe access"' nocase-ignored bugtraq,267 classtype:web-application-activity sid:1078
		LogAs="SID1079"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"<a:propfind"' --string '"xmlns:a="'DAV">"	$Tail	# '"WEB-MISC WebDAV propfind access"' nocase-ignored nocase-ignored bugtraq,1656 cve,CVE-2000-0869 classtype:web-application-activity sid:1079
		LogAs="SID1080"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/servlet/com.unify.servletexec.UploadServlet"'	$Tail	# '"WEB-MISC unify eWave ServletExec upload"' nocase-ignored classtype:web-application-attack sid:1080 bugtraq,1868 cve,CVE-2000-1024
		LogAs="SID1081"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/dsgw/bin/search?context="'	$Tail	# '"WEB-MISC Netscape Servers suite DOS"' nocase-ignored classtype:web-application-attack sid:1081 bugtraq,1868
		LogAs="SID1082"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"ref%3Cscript%20language%3D%22Javascript"'	$Tail	# '"WEB-MISC amazon 1-click cookie theft"' nocase-ignored classtype:web-application-attack sid:1082 bugtraq,1194 cve,CVE-2000-0439
		LogAs="SID1083"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/servlet/ServletExec"'	$Tail	# '"WEB-MISC unify eWave ServletExec DOS"' classtype:web-application-activity sid:1083
		LogAs="SID1084"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"servlet/......."'	$Tail	# '"WEB-MISC Allaire JRUN DOS attempt"' nocase-ignored classtype:web-application-attack sid:1084 bugtraq,2337
		LogAs="SID1091"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"??????????"'	$Tail	# '"WEB-MISC ICQ Webfront HTTP DOS"' classtype:web-application-attack sid:1091
		LogAs="SID1095"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/webplus.exe?script=test.wml"'	$Tail	# '"WEB-MISC Talentsoft Web+ Source Code view access"' bugtraq,1722 classtype:web-application-attack sid:1095
		LogAs="SID1096"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/webplus.exe?about"'	$Tail	# '"WEB-MISC Talentsoft Web+ internal IP Address access"' bugtraq,1720 classtype:web-application-activity sid:1096
		LogAs="SID1098"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"_private/shopping_cart.mdb"'	$Tail	# '"WEB-MISC SmartWin CyberOffice Shopping Cart access"' bugtraq,1734 classtype:web-application-attack sid:1098
		LogAs="SID1099"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cybercop"'	$Tail	# '"WEB-MISC cybercop scan"' nocase-ignored arachnids,374 classtype:web-application-activity sid:1099
		LogAs="SID1100"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"User-Agent: Java1.2.1
"'	$Tail	# '"WEB-MISC L3retriever HTTP Probe"' arachnids,310 classtype:web-application-activity sid:1100
		LogAs="SID1101"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"User-Agent: Webtrends Security Analyzer
"'	$Tail	# '"WEB-MISC Webtrends HTTP probe"' arachnids,309 classtype:web-application-activity sid:1101
		LogAs="SID1102"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/nessus_is_probing_you_"'	$Tail	# '"WEB-MISC Nessus 404 probe"' arachnids,301 classtype:web-application-attack sid:1102
		LogAs="SID1103"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/admin-serv/config/admpw"'	$Tail	# '"WEB-MISC Netscape admin passwd"' nocase-ignored bugtraq,1579 classtype:web-application-attack sid:1103
		LogAs="SID1105"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/bb-hostsvc.sh?HOSTSVC"'	$Tail	# '"WEB-MISC BigBrother access"' nocase-ignored classtype:attempted-recon sid:1105
		LogAs="SID1612"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ftp.pl?dir=../.."'	$Tail	# '"WEB-MISC ftp.pl attempt"' nocase-ignored cve,CAN-2000-0674 bugtraq,1471 nessus,10467 classtype:web-application-attack sid:1612
		LogAs="SID1107"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ftp.pl"'	$Tail	# '"WEB-MISC ftp.pl access"' nocase-ignored cve,CAN-2000-0674 bugtraq,1471 nessus,10467 classtype:web-application-activity sid:1107
		LogAs="SID1108"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/jsp/snp/"' --string '".snp"'	$Tail	# '"WEB-MISC Tomcat server snoop access"' cve,CAN-2000-0760 bugtraq,1532 classtype:attempted-recon sid:1108
		LogAs="SID1109"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"|2F 25 30 30|"'	$Tail	# '"WEB-MISC ROXEN directory list attempt"' bugtraq,1510 cve,CVE-2000-0671 classtype:attempted-recon sid:1109
		LogAs="SID1110"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/site/eg/source.asp"'	$Tail	# '"WEB-MISC apache source.asp file access"' nocase-ignored bugtraq,1457 cve,CVE-2000-0628 classtype:attempted-recon sid:1110
		LogAs="SID1111"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/contextAdmin/contextAdmin.html"'	$Tail	# '"WEB-MISC Tomcat server exploit access"' nocase-ignored classtype:attempted-recon sid:1111
		LogAs="SID1115"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".html/......"'	$Tail	# '"WEB-MISC ICQ webserver DOS"' nocase-ignored cve,CVE-1999-0474 classtype:attempted-dos sid:1115
		LogAs="SID1116"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?DeleteDocument"'	$Tail	# '"WEB-MISC Lotus DelDoc attempt"' nocase-ignored classtype:attempted-recon sid:1116
		LogAs="SID1117"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?EditDocument"'	$Tail	# '"WEB-MISC Lotus EditDoc attempt"' nocase-ignored classtype:attempted-recon url,www.securiteam.com/exploits/5NP080A1RE.html sid:1117
		LogAs="SID1118"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"ls%20-l"'	$Tail	# '"WEB-MISC ls%20-l"' nocase-ignored classtype:attempted-recon sid:1118
		LogAs="SID1119"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mlog.phtml"'	$Tail	# '"WEB-MISC mlog.phtml access"' nocase-ignored bugtraq,713 cve,CVE-1999-0346 classtype:attempted-recon sid:1119
		LogAs="SID1120"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mylog.phtml"'	$Tail	# '"WEB-MISC mylog.phtml access"' nocase-ignored bugtraq,713 cve,CVE-1999-0068 classtype:attempted-recon sid:1120
		LogAs="SID1122"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/etc/passwd"'	$Tail	# '"WEB-MISC /etc/passwd"' nocase-ignored classtype:attempted-recon sid:1122
		LogAs="SID1123"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?PageServices"'	$Tail	# '"WEB-MISC ?PageServices access"' nocase-ignored bugtraq,1063 cve,CVE-1999-0269 classtype:attempted-recon sid:1123
		LogAs="SID1124"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/config/check.txt"'	$Tail	# '"WEB-MISC Ecommerce check.txt access"' nocase-ignored classtype:attempted-recon sid:1124
		LogAs="SID1125"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/webcart/"'	$Tail	# '"WEB-MISC webcart access"' nocase-ignored nessus,10298 cve,CAN-1999-0610 classtype:attempted-recon sid:1125
		LogAs="SID1126"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"_AuthChangeUrl?"'	$Tail	# '"WEB-MISC AuthChangeUrl access"' nocase-ignored classtype:attempted-recon sid:1126
		LogAs="SID1127"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/scripts/convert.bas"'	$Tail	# '"WEB-MISC convert.bas access"' nocase-ignored bugtraq,2025 cve,CVE-1999-0175 classtype:attempted-recon sid:1127
		LogAs="SID1128"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/scripts/cpshost.dll"'	$Tail	# '"WEB-MISC cpshost.dll access"' nocase-ignored classtype:attempted-recon sid:1128
		LogAs="SID1129"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".htaccess"'	$Tail	# '"WEB-MISC .htaccess access"' nocase-ignored classtype:attempted-recon sid:1129
		LogAs="SID1130"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".wwwacl"'	$Tail	# '"WEB-MISC .wwwacl access"' nocase-ignored classtype:attempted-recon sid:1130
		LogAs="SID1131"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".www_acl"'	$Tail	# '"WEB-MISC .wwwacl access"' nocase-ignored classtype:attempted-recon sid:1131
		LogAs="SID1136"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"cd.."'	$Tail	# '"WEB-MISC cd.."' nocase-ignored classtype:attempted-recon sid:1136
		LogAs="SID1140"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/guestbook.pl"'	$Tail	# '"WEB-MISC guestbook.pl access"' nocase-ignored nessus,10099 bugtraq,776 cve,CVE-1999-0237 arachnids,228 classtype:attempted-recon sid:1140
		LogAs="SID1141"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/handler"'	$Tail	# '"WEB-MISC handler access"' nocase-ignored nessus,10100 bugtraq,380 arachnids,235 cve,CVE-1999-0148 classtype:web-application-activity sid:1141
		LogAs="SID1142"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/...."'	$Tail	# '"WEB-MISC /.... access"' classtype:attempted-recon sid:1142
		LogAs="SID1143"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"///cgi-bin"'	$Tail	# '"WEB-MISC ///cgi-bin access"' nocase-ignored classtype:attempted-recon sid:1143
		LogAs="SID1144"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cgi-bin///"'	$Tail	# '"WEB-MISC /cgi-bin/// access"' nocase-ignored classtype:attempted-recon sid:1144
		LogAs="SID1145"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/~root"'	$Tail	# '"WEB-MISC /~root access"' nocase-ignored classtype:attempted-recon sid:1145
		LogAs="SID1662"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/~ftp"'	$Tail	# '"WEB-MISC /~ftp access"' nocase-ignored classtype:attempted-recon sid:1662
		LogAs="SID1146"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/config/import.txt"'	$Tail	# '"WEB-MISC Ecommerce import.txt access"' nocase-ignored classtype:attempted-recon sid:1146
		LogAs="SID1147"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"cat%20"'	$Tail	# '"WEB-MISC cat%20 access"' nocase-ignored cve,CVE-1999-0039 bugtraq,374 classtype:attempted-recon sid:1147
		LogAs="SID1148"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/orders/import.txt"'	$Tail	# '"WEB-MISC Ecommerce import.txt access"' nocase-ignored classtype:attempted-recon sid:1148
		LogAs="SID1150"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/catalog.nsf"'	$Tail	# '"WEB-MISC Domino catalog.nsf access"' nocase-ignored classtype:attempted-recon sid:1150
		LogAs="SID1151"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/domcfg.nsf"'	$Tail	# '"WEB-MISC Domino domcfg.nsf access"' nocase-ignored classtype:attempted-recon sid:1151
		LogAs="SID1152"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/domlog.nsf"'	$Tail	# '"WEB-MISC Domino domlog.nsf access"' nocase-ignored classtype:attempted-recon sid:1152
		LogAs="SID1153"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/log.nsf"'	$Tail	# '"WEB-MISC Domino log.nsf access"' nocase-ignored classtype:attempted-recon sid:1153
		LogAs="SID1154"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/names.nsf"'	$Tail	# '"WEB-MISC Domino names.nsf access"' nocase-ignored classtype:attempted-recon sid:1154
		LogAs="SID1575"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mab.nsf"'	$Tail	# '"WEB-MISC Domino mab.nsf access"' nocase-ignored classtype:attempted-recon sid:1575
		LogAs="SID1576"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cersvr.nsf"'	$Tail	# '"WEB-MISC Domino cersvr.nsf access"' nocase-ignored classtype:attempted-recon sid:1576
		LogAs="SID1577"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/setup.nsf"'	$Tail	# '"WEB-MISC Domino setup.nsf access"' nocase-ignored classtype:attempted-recon sid:1577
		LogAs="SID1578"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/statrep.nsf"'	$Tail	# '"WEB-MISC Domino statrep.nsf access"' nocase-ignored classtype:attempted-recon sid:1578
		LogAs="SID1579"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/webadmin.nsf"'	$Tail	# '"WEB-MISC Domino webadmin.nsf access"' nocase-ignored classtype:attempted-recon sid:1579
		LogAs="SID1580"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/events4.nsf"'	$Tail	# '"WEB-MISC Domino events4.nsf access"' nocase-ignored classtype:attempted-recon sid:1580
		LogAs="SID1581"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ntsync4.nsf"'	$Tail	# '"WEB-MISC Domino ntsync4.nsf access"' nocase-ignored classtype:attempted-recon sid:1581
		LogAs="SID1582"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/collect4.nsf"'	$Tail	# '"WEB-MISC Domino collect4.nsf access"' nocase-ignored classtype:attempted-recon sid:1582
		LogAs="SID1583"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mailw46.nsf"'	$Tail	# '"WEB-MISC Domino mailw46.nsf access"' nocase-ignored classtype:attempted-recon sid:1583
		LogAs="SID1584"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/bookmark.nsf"'	$Tail	# '"WEB-MISC Domino bookmark.nsf access"' nocase-ignored classtype:attempted-recon sid:1584
		LogAs="SID1585"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/agentrunner.nsf"'	$Tail	# '"WEB-MISC Domino agentrunner.nsf access"' nocase-ignored classtype:attempted-recon sid:1585
		LogAs="SID1586"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mail.box"'	$Tail	# '"WEB-MISC Domino mail.box access"' nocase-ignored classtype:attempted-recon sid:1586
		LogAs="SID1155"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/orders/checks.txt"'	$Tail	# '"WEB-MISC Ecommerce checks.txt access"' nocase-ignored classtype:attempted-recon sid:1155
		LogAs="SID1156"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"////////"'	$Tail	# '"WEB-MISC apache DOS attempt"' classtype:attempted-dos sid:1156
		LogAs="SID1157"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/PSUser/PSCOErrPage.htm"'	$Tail	# '"WEB-MISC Netscape PublishingXpert access"' nocase-ignored cve,CAN-2000-1196 classtype:web-application-activity sid:1157
		LogAs="SID1158"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/windmail.exe"'	$Tail	# '"WEB-MISC windmail.exe access"' nocase-ignored cve,CAN-2000-0242 bugtraq,1073 arachnids,465 nessus,10365 classtype:attempted-recon sid:1158
		LogAs="SID1159"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/webplus?script"'	$Tail	# '"WEB-MISC webplus access"' nocase-ignored cve,CVE-2000-1005 bugtraq,1174 bugtraq,1720 bugtraq,1722 bugtraq,1725 classtype:attempted-recon sid:1159
		LogAs="SID1160"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-"'	$Tail	# '"WEB-MISC Netscape dir index wp"' nocase-ignored bugtraq,1063 cve,CVE-2000-0236 arachnids,270 classtype:attempted-recon sid:1160
		LogAs="SID1162"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/c32web.exe/ChangeAdminPassword"'	$Tail	# '"WEB-MISC cart 32 AdminPwd access"' nocase-ignored cve,CAN-2000-0429 bugtraq,1153 classtype:attempted-recon sid:1162
		LogAs="SID1164"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/quikstore.cfg"'	$Tail	# '"WEB-MISC shopping cart access"' nocase-ignored classtype:attempted-recon bugtraq,2049 bugtraq,1983 cve,CAN-1999-0607 cve,CAN-2000-1188 sid:1164
		LogAs="SID1614"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/GWWEB.EXE?HELP="'	$Tail	# '"WEB-MISC Novell Groupwise gwweb.exe attempt"' nocase-ignored bugtraq,879 cve,CAN-1999-1006 classtype:attempted-recon sid:1614
		LogAs="SID1165"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/GWWEB.EXE"'	$Tail	# '"WEB-MISC Novell Groupwise gwweb.exe access"' nocase-ignored bugtraq,879 cve,CAN-1999-1006 classtype:attempted-recon sid:1165
		LogAs="SID1166"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ws_ftp.ini"'	$Tail	# '"WEB-MISC ws_ftp.ini access"' nocase-ignored cve,CAN-1999-1078 bugtraq,547 classtype:attempted-recon sid:1166
		LogAs="SID1167"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/rpm_query"'	$Tail	# '"WEB-MISC rpm_query access"' nocase-ignored cve,CVE-2000-0192 bugtraq,1036 classtype:attempted-recon sid:1167
		LogAs="SID1168"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mall_log_files/order.log"'	$Tail	# '"WEB-MISC mall log order access"' nocase-ignored classtype:attempted-recon sid:1168
		LogAs="SID1173"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ews/architext_query.pl"'	$Tail	# '"WEB-MISC architext_query.pl access"' nocase-ignored classtype:attempted-recon sid:1173
		LogAs="SID1175"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/wwwboard.pl"'	$Tail	# '"WEB-MISC wwwboard.pl access"' nocase-ignored bugtraq,649 bugtraq,1795 cve,CAN-1999-0930 classtype:attempted-recon sid:1175
		LogAs="SID1176"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/admin_files/order.log"'	$Tail	# '"WEB-MISC order.log access"' nocase-ignored classtype:attempted-recon sid:1176
		LogAs="SID1177"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-verify-link"'	$Tail	# '"WEB-MISC Netscape Enterprise Server directory view"' nocase-ignored bugtraq,1063 classtype:attempted-recon sid:1177
		LogAs="SID1180"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/get32.exe"'	$Tail	# '"WEB-MISC get32.exe access"' nocase-ignored cve,CAN-1999-0885 bugtraq,770 bugtraq,1485 arachnids,258 classtype:attempted-recon sid:1180
		LogAs="SID1181"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ping?query="'	$Tail	# '"WEB-MISC Annex Terminal DOS attempt"' cve,CAN-1999-1070 arachnids,260 classtype:attempted-dos sid:1181
		LogAs="SID1182"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cgitest.exe|0d0a|user"'	$Tail	# '"WEB-MISC cgitest.exe attempt"' nocase-ignored nessus,10623 nessus,10040 cve,CVE-2000-0521 bugtraq,3885 arachnids,265 classtype:web-application-attack sid:1182
		LogAs="SID1587"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cgitest.exe"'	$Tail	# '"WEB-MISC cgitest.exe access"' nocase-ignored nessus,10623 cve,CVE-2000-0521 nessus,10040 bugtraq,3885 arachnids,265 classtype:web-application-activity sid:1587
		LogAs="SID1183"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-cs-dump"'	$Tail	# '"WEB-MISC Netscape Enterprise Server directory view"' nocase-ignored cve,CVE-2000-0236 bugtraq,1063 classtype:attempted-recon sid:1183
		LogAs="SID1184"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-ver-info"'	$Tail	# '"WEB-MISC Netscape Enterprise Server directory view"' nocase-ignored bugtraq,1063 classtype:attempted-recon sid:1184
		LogAs="SID1186"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-ver-diff"'	$Tail	# '"WEB-MISC Netscape Enterprise Server directory view"' nocase-ignored bugtraq,1063 classtype:attempted-recon sid:1186
		LogAs="SID1187"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/slxweb.dll/admin?command="'	$Tail	# '"WEB-MISC SalesLogix Eviewer web command attempt"' nocase-ignored bugtraq,1089 cve,CAN-2000-0289 classtype:web-application-attack sid:1187
		LogAs="SID1588"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/slxweb.dll"'	$Tail	# '"WEB-MISC SalesLogix Eviewer access"' nocase-ignored bugtraq,1089 cve,CAN-2000-0289 classtype:web-application-activity sid:1588
		LogAs="SID1188"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-start-ver"'	$Tail	# '"WEB-MISC Netscape Enterprise Server directory view"' nocase-ignored bugtraq,1063 classtype:attempted-recon sid:1188
		LogAs="SID1189"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-stop-ver"'	$Tail	# '"WEB-MISC Netscape Enterprise Server directory view"' nocase-ignored bugtraq,1063 classtype:attempted-recon sid:1189
		LogAs="SID1190"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-uncheckout"'	$Tail	# '"WEB-MISC Netscape Enterprise Server directory view"' nocase-ignored bugtraq,1063 classtype:attempted-recon sid:1190
		LogAs="SID1191"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-html-rend"'	$Tail	# '"WEB-MISC Netscape Enterprise Server directory view"' nocase-ignored bugtraq,1063 classtype:attempted-recon sid:1191
		LogAs="SID1381"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/officescan/cgi/jdkRqNotify.exe?"' --string '"domain="' --string '"event="'	$Tail	# '"WEB-MISC Trend Micro OfficeScan attempt"' nocase-ignored nocase-ignored nocase-ignored bugtraq,1057 classtype:attempted-recon sid:1381
		LogAs="SID1192"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/officescan/cgi/jdkRqNotify.exe"'	$Tail	# '"WEB-MISC Trend Micro OfficeScan access"' nocase-ignored bugtraq,1057 classtype:attempted-recon sid:1192
		LogAs="SID1193"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ows-bin/"' --string '"?&"'	$Tail	# '"WEB-MISC oracle web arbitrary command execution attempt"' nocase-ignored cve,CVE-2000-0169 bugtraq,1053 nessus,10348 classtype:web-application-attack sid:1193
		LogAs="SID1880"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ows-bin/"'	$Tail	# '"WEB-MISC oracle web application server access"' nocase-ignored cve,CVE-2000-0169 bugtraq,1053 nessus,10348 classtype:web-application-activity sid:1880
		LogAs="SID1198"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?wp-usr-prop"'	$Tail	# '"WEB-MISC Netscape Enterprise Server directory view"' nocase-ignored bugtraq,1063 classtype:web-application-attack sid:1198
		LogAs="SID1202"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/search.vts"'	$Tail	# '"WEB-MISC search.vts access"' classtype:attempted-recon sid:1202
		LogAs="SID1615"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/htgrep"' --string '"hdr=/"'	$Tail	# '"WEB-MISC htgrep attempt"' classtype:web-application-attack cve,CAN-2000-0832 sid:1615
		LogAs="SID1207"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/htgrep"'	$Tail	# '"WEB-MISC htgrep access"' classtype:web-application-activity cve,CAN-2000-0832 sid:1207
		LogAs="SID1209"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/.nsconfig"'	$Tail	# '"WEB-MISC .nsconfig access"' classtype:attempted-recon sid:1209
		LogAs="SID1212"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/admin_files"'	$Tail	# '"WEB-MISC Admin_files access"' nocase-ignored classtype:attempted-recon sid:1212
		LogAs="SID1213"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/backup"'	$Tail	# '"WEB-MISC backup access"' nocase-ignored classtype:attempted-recon sid:1213
		LogAs="SID1214"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/intranet/"'	$Tail	# '"WEB-MISC intranet access"' nocase-ignored classtype:attempted-recon sid:1214
		LogAs="SID1216"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/filemail"'	$Tail	# '"WEB-MISC filemail access"' nocase-ignored classtype:attempted-recon sid:1216
		LogAs="SID1217"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/plusmail"'	$Tail	# '"WEB-MISC plusmail access"' nocase-ignored cve,CAN-2000-0074 bugtraq,2653 classtype:attempted-recon sid:1217
		LogAs="SID1218"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/adminlogin"'	$Tail	# '"WEB-MISC adminlogin access"' nocase-ignored classtype:attempted-recon sid:1218
		LogAs="SID1220"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ultraboard"'	$Tail	# '"WEB-MISC ultraboard access"' nocase-ignored classtype:attempted-recon sid:1220
		LogAs="SID1589"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/empower?DB="'	$Tail	# '"WEB-MISC musicat empower attempt"' nocase-ignored classtype:web-application-attack sid:1589
		LogAs="SID1221"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/empower"'	$Tail	# '"WEB-MISC musicat empower access"' nocase-ignored classtype:web-application-activity sid:1221
		LogAs="SID1224"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ROADS/cgi-bin/search.pl"' --string '"form="'	$Tail	# '"WEB-MISC ROADS search.pl attempt"' nocase-ignored cve,CAN-2001-0215 bugtraq,2371 nessus,10627 classtype:attempted-recon sid:1224
		LogAs="SID1230"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/FtpSave.dll"'	$Tail	# '"WEB-MISC VirusWall FtpSave access"' nocase-ignored bugtraq,2808 cve,CAN-2001-0432 nessus,10733 classtype:attempted-recon sid:1230
		LogAs="SID1234"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/FtpSaveCSP.dll"'	$Tail	# '"WEB-MISC VirusWall FtpSaveCSP access"' nocase-ignored bugtraq,2808 cve,CAN-2001-0432 nessus,10733 classtype:attempted-recon sid:1234
		LogAs="SID1235"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/FtpSaveCVP.dll"'	$Tail	# '"WEB-MISC VirusWall FtpSaveCVP access"' nocase-ignored bugtraq,2808 cve,CAN-2001-0432 nessus,10733 classtype:attempted-recon sid:1235
		LogAs="SID1236"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".js%2570"'	$Tail	# '"WEB-MISC Tomcat sourecode view"' nocase-ignored classtype:attempted-recon sid:1236
		LogAs="SID1237"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".j%2573p"'	$Tail	# '"WEB-MISC Tomcat sourecode view"' nocase-ignored classtype:attempted-recon sid:1237
		LogAs="SID1238"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".%256Asp"'	$Tail	# '"WEB-MISC Tomcat sourecode view"' nocase-ignored classtype:attempted-recon sid:1238
		LogAs="SID1241"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/SWEditServlet"' --string '"template=../../../"'	$Tail	# '"WEB-MISC SWEditServlet directory traversal attempt"' classtype:attempted-user sid:1241
		LogAs="SID1259"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/SWEditServlet"'	$Tail	# '"WEB-MISC SWEditServlet access"' classtype:attempted-recon sid:1259
		LogAs="SID1139"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"HEAD/./"'	$Tail	# '"WEB-MISC whisker HEAD/./"' classtype:attempted-recon url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html sid:1139
		LogAs="SID1258"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/OvCgi/OpenView5.exe?Context=Snmp&Action=Snmp&Host=&Oid="'	$Tail	# '"WEB-MISC HP OpenView Manager DOS"' nocase-ignored bugtraq,2845 sid:1258 classtype:misc-activity
		LogAs="SID1260"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"Authorization: Basic "' --string !'""'	$Tail	# '"WEB-MISC long basic authorization string"' nocase-ignored classtype:attempted-dos bugtraq,3230 sid:1260
		LogAs="SID1291"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/graphics/sml3com"'	$Tail	# '"WEB-MISC sml3com access"' classtype:web-application-activity bugtraq,2721 sid:1291
		LogAs="SID1001"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/carbo.dll"' --string '"icatcommand="'	$Tail	# '"WEB-MISC carbo.dll access"' nocase-ignored cve,CAN-1999-1069 bugtraq,2126 classtype:attempted-recon sid:1001
		LogAs="SID1302"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cgi-bin/console.exe"'	$Tail	# '"WEB-MISC console.exe access"' nocase-ignored bugtraq,3375 classtype:attempted-recon sid:1302
		LogAs="SID1303"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cgi-bin/cs.exe"'	$Tail	# '"WEB-MISC cs.exe access"' nocase-ignored bugtraq,3375 classtype:attempted-recon sid:1303
		LogAs="SID1113"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"../"'	$Tail	# '"WEB-MISC http directory traversal"' arachnids,297 classtype:attempted-recon sid:1113
		LogAs="SID1375"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"GET x HTTP/1.0"'	$Tail	# '"WEB-MISC sadmind worm access"' classtype:attempted-recon url,www.cert.org/advisories/CA-2001-11.html sid:1375
		LogAs="SID1376"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/%3f.jsp"'	$Tail	# '"WEB-MISC jrun directory browse attempt"' classtype:web-application-attack sid:1376
		LogAs="SID1385"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/admin_/"'	$Tail	# '"WEB-MISC mod-plsql administration access"' nessus,10849 bugtraq,3726 bugtraq,3727 classtype:web-application-activity sid:1385
		LogAs="SID1391"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"includedir="'	$Tail	# '"WEB-MISC Phorecast remote code execution attempt"' bugtraq,3388 classtype:web-application-attack sid:1391
		LogAs="SID1403"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/viewcode"'	$Tail	# '"WEB-MISC viewcode access"' classtype:web-application-attack sid:1403
		LogAs="SID1404"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/showcode"'	$Tail	# '"WEB-MISC showcode access"' classtype:web-application-attack sid:1404
		LogAs="SID1433"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/.history"'	$Tail	# '"WEB-MISC .history access"' classtype:web-application-attack sid:1433
		LogAs="SID1434"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/.bash_history"'	$Tail	# '"WEB-MISC .bash_history access"' classtype:web-application-attack sid:1434
		LogAs="SID1489"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/~nobody"'	$Tail	# '"WEB-MISC /~nobody access"' classtype:web-application-attack sid:1489
		LogAs="SID1492"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/newuser?Image=../.."'	$Tail	# '"WEB-MISC RBS ISP /newuser directory traversal attempt"' classtype:web-application-attack sid:1492
		LogAs="SID1493"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/newuser"'	$Tail	# '"WEB-MISC RBS ISP /newuser access"' classtype:web-application-activity sid:1493
		LogAs="SID1663"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/*%0a.pl"'	$Tail	# '"WEB-MISC *%0a.pl access"' nocase-ignored classtype:web-application-attack sid:1663
		LogAs="SID1664"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mkplog.exe"'	$Tail	# '"WEB-MISC mkplog.exe access"' nocase-ignored classtype:web-application-activity sid:1664
		LogAs="SID1665"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mkilog.exe"'	$Tail	# '"WEB-MISC mkilog.exe access"' nocase-ignored classtype:web-application-activity sid:1665
		LogAs="SID509"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"pccsmysqladm/incs/dbconnect.inc"'	$Tail	# '"WEB-MISC PCCS mysql database admin tool access"' nocase-ignored arachnids,300 classtype:web-application-attack sid:509
		LogAs="SID1769"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/.DS_Store"'	$Tail	# '"WEB-MISC .DS_Store access"' classtype:web-application-activity url,www.macintouch.com/mosxreaderreports46.html sid:1769
		LogAs="SID1770"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/.FBCIndex"'	$Tail	# '"WEB-MISC .FBCIndex access"' classtype:web-application-activity url,www.securiteam.com/securitynews/5LP0O005FS.html sid:1770
		LogAs="SID1500"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/exair/search/"'	$Tail	# '"WEB-MISC ExAir access"' cve,CVE-1999-0449 classtype:web-application-activity sid:1500
		LogAs="SID1519"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/?M=D"'	$Tail	# '"WEB-MISC apache ?M=D directory list attempt"' classtype:web-application-activity cve,CVE-2001-0731 bugtraq,3009 sid:1519
		LogAs="SID1520"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/server-info"'	$Tail	# '"WEB-MISC server-info access"' url,httpd.apache.org/docs/mod/mod_info.html classtype:web-application-activity sid:1520
		LogAs="SID1521"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/server-status"'	$Tail	# '"WEB-MISC server-status access"' url,httpd.apache.org/docs/mod/mod_info.html classtype:web-application-activity sid:1521
		LogAs="SID1522"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ans.pl?p=../../"'	$Tail	# '"WEB-MISC ans.pl attempt"' classtype:web-application-attack cve,CAN-2002-0307 nessus,10875 bugtraq,4147 bugtraq,4149 sid:1522
		LogAs="SID1523"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ans.pl"'	$Tail	# '"WEB-MISC ans.pl access"' classtype:web-application-activity cve,CAN-2002-0307 nessus,10875 bugtraq,4147 bugtraq,4149 sid:1523
		LogAs="SID1524"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cd/../config/html/cnf_gi.htm"'	$Tail	# '"WEB-MISC AxisStorpoint CD attempt"' classtype:web-application-attack cve,CAN-2000-0191 sid:1524
		LogAs="SID1525"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/config/html/cnf_gi.htm"'	$Tail	# '"WEB-MISC Axis Storpoint CD access"' classtype:web-application-activity cve,CAN-2000-0191 sid:1525
		LogAs="SID1526"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/inc/sendmail.inc"'	$Tail	# '"WEB-MISC basilix sendmail.inc access"' nessus,10601 cve,CAN-2001-1044 classtype:web-application-activity sid:1526
		LogAs="SID1527"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/class/mysql.class"'	$Tail	# '"WEB-MISC basilix mysql.class access"' nessus,10601 cve,CAN-2001-1044 classtype:web-application-activity sid:1527
		LogAs="SID1528"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/servlet/sunexamples.BBoardServlet"'	$Tail	# '"WEB-MISC BBoard access"' classtype:web-application-activity nessus,10507 cve,CAN-2000-0629 sid:1528
		LogAs="SID1544"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/exec/show/config/cr"'	$Tail	# '"WEB-MISC Cisco Catalyst command execution attempt"' nocase-ignored cve,CAN-2000-0945 classtype:web-application-activity sid:1544
		LogAs="SID1546"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/%%"'	$Tail	# '"WEB-MISC Cisco /%% DOS attempt"' classtype:web-application-attack cve,CVE-2000-0380 bugtraq,1154 sid:1546
		LogAs="SID1551"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/CVS/Entries"'	$Tail	# '"WEB-MISC /CVS/Entries access"' classtype:web-application-activity sid:1551
		LogAs="SID1552"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cvsweb/version"'	$Tail	# '"WEB-MISC cvsweb version access"' cve,CAN-2000-0670 classtype:web-application-activity sid:1552
		LogAs="SID1559"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/doc/packages"'	$Tail	# '"WEB-MISC /doc/packages access"' nocase-ignored classtype:web-application-activity sid:1559
		LogAs="SID1560"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/doc/"'	$Tail	# '"WEB-MISC /doc/ access"' nocase-ignored cve,CVE-1999-0678 bugtraq,318 classtype:web-application-activity sid:1560
		LogAs="SID1561"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"?open"'	$Tail	# '"WEB-MISC ?open access"' nocase-ignored classtype:web-application-activity sid:1561
		LogAs="SID1563"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/login.htm?password="'	$Tail	# '"WEB-MISC login.htm attempt"' nocase-ignored cve,CAN-1999-1533 classtype:web-application-activity sid:1563
		LogAs="SID1564"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/login.htm"'	$Tail	# '"WEB-MISC login.htm access"' nocase-ignored cve,CAN-1999-1533 classtype:web-application-activity sid:1564
		LogAs="SID1603"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"DELETE "'	$Tail	# '"WEB-MISC DELETE attempt"' nocase-ignored classtype:web-application-activity sid:1603
		LogAs="SID1670"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/home/ftp"'	$Tail	# '"WEB-MISC /home/ftp access"' nocase-ignored classtype:web-application-activity sid:1670
		LogAs="SID1671"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/home/www"'	$Tail	# '"WEB-MISC /home/www access"' nocase-ignored classtype:web-application-activity sid:1671
		LogAs="SID1738"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/global.inc"'	$Tail	# '"WEB-MISC global.inc access"' nocase-ignored bugtraq,4612 classtype:web-application-attack sid:1738
		LogAs="SID1744"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"secure_site, ok"'	$Tail	# '"WEB-MISC SecureSite authentication bypass attempt"' nocase-ignored bugtraq,4621 classtype:web-application-attack sid:1744
		LogAs="SID1757"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/b2/b2-include/"' --string '"b2inc"' --string '"http://"'	$Tail	# '"WEB-MISC b2 arbitrary command execution attempt"' classtype:web-application-attack sid:1757
		LogAs="SID1758"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/b2/b2-include/"' --string '"b2inc"' --string '"http://"'	$Tail	# '"WEB-MISC b2 access"' classtype:web-application-attack sid:1758
		LogAs="SID1766"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/search.dll"' --string '"query=%00"'	$Tail	# '"WEB-MISC search.dll directory listing attempt"' cve,CAN-2000-0835 nessus,10514 classtype:web-application-attack sid:1766
		LogAs="SID1767"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/search.dll"'	$Tail	# '"WEB-MISC search.dll access"' nessus,10514 cve,CAN-2000-0835 classtype:web-application-activity sid:1767
		LogAs="SID1498"		$Ipt -A $Me -p tcp --dport 8181 -m string --string '"/../../"'	$Tail	# '"WEB-MISC PIX firewall manager directory traversal attempt"' classtype:web-application-attack sid:1498
		LogAs="SID1604"		$Ipt -A $Me -p tcp --dport 4080 -m string --string '"/../../"'	$Tail	# '"WEB-MISC iChat directory traversal attempt"' classtype:web-application-activity cve,CAN-1999-0897 sid:1604
		LogAs="SID1558"		$Ipt -A $Me -p tcp --dport 8080 -m string --string '"whois://"'	$Tail	# '"WEB-MISC Delegate whois overflow attempt"' nocase-ignored cve,CVE-2000-0165 classtype:web-application-activity sid:1558
		LogAs="SID1518"		$Ipt -A $Me -p tcp --dport 8000 -m string --string '"/nstelemetry.adp"'	$Tail	# '"WEB-MISC nstelemetry.adp access"' classtype:web-application-activity sid:1518
		LogAs="SID1132"		$Ipt -A $Me -p tcp --dport 457 -m string --string '"�_�������^1��F�"'	$Tail	# '"WEB-MISC Netscape Unixware overflow"' arachnids,180 classtype:attempted-recon sid:1132
		LogAs="SID1199"		$Ipt -A $Me -p tcp --dport 2301 -m string --string '"../"'	$Tail	# '"WEB-MISC Compaq Insight directory traversal"' bugtraq,282 arachnids,244 cve,CVE-1999-0771 classtype:web-application-attack sid:1199
		LogAs="SID1231"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/catinfo"'	$Tail	# '"WEB-MISC VirusWall catinfo access"' nocase-ignored bugtraq,2808 bugtraq,2579 nessus,10650 cve,CAN-2001-0432 classtype:attempted-recon sid:1231
		LogAs="SID1232"		$Ipt -A $Me -p tcp --dport 1812 -m string --string '"/catinfo"'	$Tail	# '"WEB-MISC VirusWall catinfo access"' nocase-ignored bugtraq,2808 bugtraq,2579 nessus,10650 cve,CAN-2001-0432 classtype:attempted-recon sid:1232
		LogAs="SID1809"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"CCCCCCC: AAAAAAAAAAAAAAAAAAA"'	$Tail	# '"WEB-MISC Apache Chunked-Encoding worm attempt"' nocase-ignored classtype:web-application-attack bugtraq,4474 cve,CAN-2002-0079 bugtraq,5033 cve,CAN-2002-0392 sid:1809
		LogAs="SID1807"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"Transfer-Encoding:"' --string '"chunked"'	$Tail	# '"WEB-MISC Chunked-Encoding transfer attempt"' nocase-ignored nocase-ignored classtype:web-application-attack bugtraq,4474 cve,CAN-2002-0079 bugtraq,5033 cve,CAN-2002-0392 sid:1807
		LogAs="SID1814"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/StreamingStatistics"'	$Tail	# '"WEB-MISC CISCO VoIP DOS ATTEMPT"' bugtraq,4794 classtype:misc-attack sid:1814
		LogAs="SID1820"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ncommerce3/ExecMacro/orderdspc.d2w"'	$Tail	# '"WEB-MISC IBM Net.Commerce orderdspc.d2w access"' cve,CVE-2001-0319 nessus,11020 classtype:web-application-activity sid:1820
		LogAs="SID1826"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/WEB-INF"'	$Tail	# '"WEB-MISC WEB-INF access"' nocase-ignored nessus,11037 classtype:web-application-activity sid:1826
		LogAs="SID1827"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/servlet/"' --string '"/org.apache."'	$Tail	# '"WEB-MISC Tomcat servlet mapping cross site scripting attempt"' nessus,11041 bugtraq,5193 classtype:web-application-attack sid:1827
		LogAs="SID1828"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/search"' --string '"NS-query-pat="' --string '"../../"'	$Tail	# '"WEB-MISC iPlanet Search directory traversal attempt"' nessus,11043 bugtraq,5191 classtype:web-application-attack sid:1828
		LogAs="SID1829"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/examples/servlet/TroubleShooter"'	$Tail	# '"WEB-MISC Tomcat TroubleShooter servlet access"' nessus,11046 bugtraq,4575 classtype:web-application-activity sid:1829
		LogAs="SID1830"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/examples/servlet/SnoopServlet"'	$Tail	# '"WEB-MISC Tomcat SnoopServlet servlet access"' nessus,11046 bugtraq,4575 classtype:web-application-activity sid:1830
		LogAs="SID1831"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/servlet/con"'	$Tail	# '"WEB-MISC jigsaw dos attempt"' nessus,11047 classtype:web-application-attack sid:1831
		LogAs="SID1835"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/error/500error.jsp"' --string '"et="' --string '"<script"'	$Tail	# '"WEB-MISC Macromedia SiteSpring cross site scripting attempt"' nocase-ignored nocase-ignored bugtraq,5249 classtype:web-application-attack sid:1835
		LogAs="SID1839"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mailman/"' --string '"?"' --string '"info="' --string '"<script"'	$Tail	# '"WEB-MISC mailman cross site scripting attempt"' nocase-ignored nocase-ignored bugtraq,5298 classtype:web-application-attack sid:1839
		LogAs="SID1847"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/webalizer/"'	$Tail	# '"WEB-MISC webalizer access"' nocase-ignored nessus,10816 cve,CAN-1999-0643 classtype:web-application-activity sid:1847
		LogAs="SID1848"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/webcart-lite/"'	$Tail	# '"WEB-MISC webcart-lite access"' nocase-ignored cve,CAN-1999-0610 nessus,10298 classtype:web-application-activity sid:1848
		LogAs="SID1849"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/webfind.exe"'	$Tail	# '"WEB-MISC webfind.exe access"' nocase-ignored cve,CAN-2000-0622 nessus,10475 classtype:web-application-activity sid:1849
		LogAs="SID1851"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/active.log"'	$Tail	# '"WEB-MISC active.log access"' nocase-ignored nessus,10470 cve,CAN-2000-0642 classtype:web-application-activity sid:1851
		LogAs="SID1852"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/robots.txt"'	$Tail	# '"WEB-MISC robots.txt access"' nocase-ignored nessus,10302 classtype:web-application-activity sid:1852
		LogAs="SID1857"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/robot.txt"'	$Tail	# '"WEB-MISC robot.txt access"' nocase-ignored nessus,10302 classtype:web-application-activity sid:1857
		LogAs="SID1858"		$Ipt -A $Me -p tcp --dport 8181 -m string --string '"/pixfir~1/how_to_login.html"'	$Tail	# '"WEB-MISC CISCO PIX Firewall Manager directory traversal attempt"' bugtraq,691 nessus,10819 classtype:misc-attack sid:1858
		LogAs="SID1859"		$Ipt -A $Me -p tcp --dport 9090 -m string --string '"/servlet/admin"' --string '"ae9f86d6beaa3f9ecb9a5b7e072a4138"'	$Tail	# '"WEB-MISC Sun JavaServer default password login attempt"' nessus,10995 classtype:default-login-attempt sid:1859
		LogAs="SID1860"		$Ipt -A $Me -p tcp --dport 8080 -m string --string '"Authorization: Basic OmFkbWlu"'	$Tail	# '"WEB-MISC Linksys router default password login attempt"' nessus,10999 classtype:default-login-attempt sid:1860
		LogAs="SID1861"		$Ipt -A $Me -p tcp --dport 8080 -m string --string '"Authorization: "' --string '" Basic "' --string '"YWRtaW46YWRtaW4"'	$Tail	# '"WEB-MISC Linksys router default username and password login attempt"' nocase-ignored nocase-ignored nessus,10999 classtype:default-login-attempt sid:1861
		LogAs="SID2230"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"Authorization: "' --string '" Basic "' --string '"YWRtaW46cGFzc3dvcmQ"'	$Tail	# '"WEB-MISC NetGear router default password login attempt (admin:password)"' nocase-ignored nocase-ignored nessus,11737 classtype:default-login-attempt sid:2230
		LogAs="SID1871"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/XSQLConfig.xml"'	$Tail	# '"WEB-MISC Oracle XSQLConfig.xml access"' nessus,10855 cve,CAN-2002-0568 classtype:web-application-activity sid:1871
		LogAs="SID1872"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/dms0"'	$Tail	# '"WEB-MISC Oracle Dynamic Monitoring Services (dms) access"' nessus,10848 classtype:web-application-activity sid:1872
		LogAs="SID1873"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/globals.jsa"'	$Tail	# '"WEB-MISC globals.jsa access"' nessus,10850 cve,CAN-2002-0562 classtype:web-application-activity sid:1873
		LogAs="SID1874"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/oprocmgr-status"'	$Tail	# '"WEB-MISC Oracle Java Process Manager access"' nessus,10851 classtype:web-application-activity sid:1874
		LogAs="SID1881"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"GET / HTTP/1.1

"'	$Tail	# '"WEB-MISC bad HTTP/1.1 request, Potentially worm attack"' url,securityresponse.symantec.com/avcenter/security/Content/2002.09.13.html classtype:web-application-activity sid:1881
		LogAs="SID1808"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"�PR��PQRP�;̀"'	$Tail	# '"WEB-MISC apache chunked encoding memory corruption exploit attempt"' bugtraq,5033 cve,CAN-2002-0392 classtype:web-application-activity sid:1808
		LogAs="SID1943"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/Carello/add.exe"'	$Tail	# '"WEB-MISC /Carello/add.exe access"' nocase-ignored cve,CVE-2000-0396 bugtraq,1245 classtype:web-application-activity sid:1943
		LogAs="SID1944"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ecscripts/ecware.exe"'	$Tail	# '"WEB-MISC /ecscripts/ecware.exe access"' nocase-ignored classtype:web-application-activity sid:1944
		LogAs="SID1969"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ion-p"'	$Tail	# '"WEB-MISC ion-p access"' nocase-ignored bugtraq,6091 classtype:web-application-activity sid:1969
		LogAs="SID1499"		$Ipt -A $Me -p tcp --dport 8888 -m string --string '"/SiteScope/cgi/go.exe/SiteScope"'	$Tail	# '"WEB-MISC SiteScope Service access"' nessus,10778 classtype:web-application-activity sid:1499
		LogAs="SID1946"		$Ipt -A $Me -p tcp --dport 8888 -m string --string '"/cgi-bin/admin/admin"'	$Tail	# '"WEB-MISC answerbook2 admin attempt"' classtype:web-application-activity sid:1946
		LogAs="SID1979"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"POST"' --string '"/perl/"'	$Tail	# '"WEB-MISC perl post attempt"' bugtraq,5520 nessus,11158 classtype:web-application-attack sid:1979
		LogAs="SID2056"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"TRACE"'	$Tail	# '"WEB-MISC TRACE attempt"' url,www.whitehatsec.com/press_releases/WH-PR-20030120.pdf nessus,11213 classtype:web-application-attack sid:2056
		LogAs="SID2057"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/helpout.exe"'	$Tail	# '"WEB-MISC helpout.exe access"' nessus,11162 classtype:web-application-activity sid:2057
		LogAs="SID2058"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/MsmMask.exe"' --string '"mask="'	$Tail	# '"WEB-MISC MsmMask.exe attempt"' nessus,11163 classtype:web-application-attack sid:2058
		LogAs="SID2059"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/MsmMask.exe"'	$Tail	# '"WEB-MISC MsmMask.exe access"' nessus,11163 classtype:web-application-activity sid:2059
		LogAs="SID2060"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/DB4Web/"'	$Tail	# '"WEB-MISC DB4Web access"' nessus,11180 classtype:web-application-activity sid:2060
		LogAs="SID2061"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"|00|.jsp"'	$Tail	# '"WEB-MISC Tomcat null byte directory listing attempt"' cve,CAN-2003-0042 bugtraq,6721 classtype:web-application-attack sid:2061
		LogAs="SID2062"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/.perf"'	$Tail	# '"WEB-MISC iPlanet .perf access"' classtype:web-application-activity sid:2062
		LogAs="SID2063"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/dm/demarc"' --string '"s_key="' --string '"'"' --string '"'"' --string '"'"'	$Tail	# '"WEB-MISC Demarc SQL injection attempt"' classtype:web-application-activity sid:2063
		LogAs="SID2064"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".csp"' --string '".csp"' --string '"."'	$Tail	# '"WEB-MISC Lotus Notes .csp script source download attempt"' classtype:web-application-attack sid:2064
		LogAs="SID2066"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".pl"' --string '".pl"' --string '"."'	$Tail	# '"WEB-MISC Lotus Notes .pl script source download attempt"' classtype:web-application-attack sid:2066
		LogAs="SID2067"		$Ipt -A $Me -p tcp --dport 80 -m string --string '".exe"' --string '".exe"' --string '"."'	$Tail	# '"WEB-MISC Lotus Notes .exe script source download attempt"' classtype:web-application-attack sid:2067
		LogAs="SID2068"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/diffs/"' --string '"'"' --string '";"' --string '"'"'	$Tail	# '"WEB-MISC BitKeeper arbitrary command attempt"' bugtraq,6588 classtype:web-application-attack sid:2068
		LogAs="SID2069"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/chip.ini"'	$Tail	# '"WEB-MISC chip.ini access"' bugtraq,2755 cve,CAN-2001-0749 classtype:web-application-activity sid:2069
		LogAs="SID2071"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/post32.exe"'	$Tail	# '"WEB-MISC post32.exe access"' bugtraq,1485 classtype:web-application-activity sid:2071
		LogAs="SID2072"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/lyris.pl"'	$Tail	# '"WEB-MISC lyris.pl access"' cve,CVE-2000-0758 bugtraq,1584 classtype:web-application-activity sid:2072
		LogAs="SID2073"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/globals.pl"'	$Tail	# '"WEB-MISC globals.pl access"' cve,CVE-2001-0330 bugtraq,2671 classtype:web-application-activity sid:2073
		LogAs="SID2135"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/philboard.mdb"'	$Tail	# '"WEB-MISC philboard.mdb access"' nessus,11682 classtype:web-application-activity sid:2135
		LogAs="SID2136"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/philboard_admin.asp"' --string '"Cookie"' --string '"philboard_admin=True"'	$Tail	# '"WEB-MISC philboard_admin.asp authentication bypass attempt"' nocase-ignored nessus,11675 bugtraq,7739 classtype:web-application-attack sid:2136
		LogAs="SID2137"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/philboard_admin.asp"'	$Tail	# '"WEB-MISC philboard_admin.asp access"' nessus,11675 bugtraq,7739 classtype:web-application-activity sid:2137
		LogAs="SID2138"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/logicworks.ini"'	$Tail	# '"WEB-MISC logicworks.ini access"' nessus,11639 bugtraq,6996 classtype:web-application-activity sid:2138
		LogAs="SID2139"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/*.shtml"'	$Tail	# '"WEB-MISC /*.shtml access"' bugtraq,1517 cve,CAN-2000-0683 nessus,11604 classtype:web-application-activity sid:2139
		LogAs="SID2156"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/mod_gzip_status"'	$Tail	# '"WEB-MISC mod_gzip_status access"' nessus,11685 classtype:web-application-activity sid:2156
		LogAs="SID2231"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/register.dll"'	$Tail	# '"WEB-MISC register.dll access"' nocase-ignored cve,CAN-2001-0958 nessus,11747 classtype:web-application-activity sid:2231
		LogAs="SID2232"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ContentFilter.dll"'	$Tail	# '"WEB-MISC ContentFilter.dll access"' nocase-ignored cve,CAN-2001-0958 nessus,11747 classtype:web-application-activity sid:2232
		LogAs="SID2233"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/SFNofitication.dll"'	$Tail	# '"WEB-MISC SFNofitication.dll access"' nocase-ignored cve,CAN-2001-0958 nessus,11747 classtype:web-application-activity sid:2233
		LogAs="SID2234"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/TOP10.dll"'	$Tail	# '"WEB-MISC TOP10.dll access"' nocase-ignored cve,CAN-2001-0958 nessus,11747 classtype:web-application-activity sid:2234
		LogAs="SID2235"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/SpamExcp.dll"'	$Tail	# '"WEB-MISC SpamExcp.dll access"' nocase-ignored cve,CAN-2001-0958 nessus,11747 classtype:web-application-activity sid:2235
		LogAs="SID2236"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/spamrule.dll"'	$Tail	# '"WEB-MISC spamrule.dll access"' nocase-ignored cve,CAN-2001-0958 nessus,11747 classtype:web-application-activity sid:2236
		LogAs="SID2237"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cgiWebupdate.exe"'	$Tail	# '"WEB-MISC cgiWebupdate.exe access"' nocase-ignored cve,CAN-2001-1150 nessus,11722 classtype:web-application-activity sid:2237
		LogAs="SID2238"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ConsoleHelp/"' --string '".jsp"'	$Tail	# '"WEB-MISC WebLogic ConsoleHelp view source attempt"' nocase-ignored nocase-ignored cve,CAN-2000-0682 nessus,11724 classtype:web-application-attack sid:2238
		LogAs="SID2239"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/redirect.exe"'	$Tail	# '"WEB-MISC redirect.exe access"' nocase-ignored cve,CAN-2000-0401 classtype:web-application-activity sid:2239
		LogAs="SID2240"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/changepw.exe"'	$Tail	# '"WEB-MISC changepw.exe access"' nocase-ignored cve,CAN-2000-0401 classtype:web-application-activity sid:2240
		LogAs="SID2241"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/cwmail.exe"'	$Tail	# '"WEB-MISC cwmail.exe access"' nocase-ignored cve,CAN-2002-0273 nessus,11727 classtype:web-application-activity sid:2241
		LogAs="SID2242"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ddicgi.exe"'	$Tail	# '"WEB-MISC ddicgi.exe access"' nocase-ignored cve,CAN-2000-0826 nessus,11728 bugtraq,1657 classtype:web-application-activity sid:2242
		LogAs="SID2243"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/ndcgi.exe"'	$Tail	# '"WEB-MISC ndcgi.exe access"' nocase-ignored cve,CAN-2001-0922 nessus,11730 classtype:web-application-activity sid:2243
		LogAs="SID2244"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/VsSetCookie.exe"'	$Tail	# '"WEB-MISC VsSetCookie.exe access"' nocase-ignored cve,CAN-2002-0236 nessus,11731 bugtraq,3784 classtype:web-application-activity sid:2244
		LogAs="SID2245"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/Webnews.exe"'	$Tail	# '"WEB-MISC Webnews.exe access"' nocase-ignored cve,CAN-2002-0290 nessus,11732 bugtraq,4124 classtype:web-application-activity sid:2245
		LogAs="SID2246"		$Ipt -A $Me -p tcp --dport 80 -m string --string '"/webadmin.dll"'	$Tail	# '"WEB-MISC webadmin.dll access"' nocase-ignored nessus,11771 classtype:web-application-activity sid:2246


		;;
	destroy)
		echo "Stopping $Me" >&2
		DestroyChain $Me
		;;
	renamechain)
		TempChain="$Me-$RANDOM"
		echo "Replacing existing rules in $Me with new rules" >&2
		$IptablesBin -E $Me $TempChain
		;;
	replacelinks)
		if [ -z "$TempChain" ]; then
			echo "No temporary chain to relink in $Me replacelinks, replace operation incomplete." >&2
		elif ! $IptablesBin -L $Me -n >/dev/null 2>&1 ; then
			echo "No $Me chain in $Me, replace operation incomplete." >&2
		elif ! $IptablesBin -L $TempChain -n >/dev/null 2>&1 ; then
			echo "No $TempChain chain in $Me, replace operation incomplete." >&2
		elif [ "`$IptablesBin -L INPUT -n --line-numbers | grep $TempChain | wc -l`" -ne 1 ]; then
			echo "Too few/many references to $TempChain in INPUT in $Me replacelinks, replace operation incomplete." >&2
		elif [ "`$IptablesBin -L FORWARD -n --line-numbers | grep $TempChain | wc -l`" -ne 1 ]; then
			echo "Too few/many references to $TempChain in FORWARD in $Me replacelinks, replace operation incomplete." >&2
		elif [ "`$IptablesBin -L OUTPUT -n --line-numbers | grep $TempChain | wc -l`" -ne 1 ]; then
			echo "Too few/many references to $TempChain in OUTPUT in $Me replacelinks, replace operation incomplete." >&2
		else
#ZZZZ Place the same criteria you used in link/unlink above in the following three lines.
#ZZZZ Criteria should go just in front of "-j $Me"
			$IptablesBin -R INPUT `$IptablesBin -L INPUT -n --line-numbers | grep $TempChain | awk '{print $1}'` -i \! lo		-j $Me
			$IptablesBin -R FORWARD `$IptablesBin -L FORWARD -n --line-numbers | grep $TempChain | awk '{print $1}'`		-j $Me
			$IptablesBin -R OUTPUT `$IptablesBin -L OUTPUT -n --line-numbers | grep $TempChain | awk '{print $1}'`			-j $Me
			DestroyChain $TempChain
			unset TempChain
		fi
		;;
	status)
		if $IptablesBin -L $Me -n >/dev/null 2>&1 ; then
			echo "$Me created" >&2
		else
			echo "$Me destroyed" >&2
		fi
		;;
	version)
		echo "$Me $MyVersion, firebrickslib $FBLibVer" >&2
		;;
	help)
		DefaultHelp
#ZZZZ Please change the text to appropriate help text for this module.  You should
#ZZZZ cover what the module does, if it's generally safe to use, and under what
#ZZZZ conditions it should not be used.  Please replace the lines between the two
#ZZZZ EOTEXT lines with your own.
		cat <<EOTEXT >&2
	The $Me module puts in some blocks for fragmented icmp packets
(illegal) and address mask and timestamp requests and replies.  At best,
these are uncommon and are used in network mapping.  These rules should
be safe to use on any network.
EOTEXT
		;;
	*)
		echo "Unknown action $Action in $Me, no action taken." >&2
		;;
	esac
done