HTTP: Brute Search Attempt
This protocol anomaly is multiple 301 (Moved Permanently), 403 (Forbidden), 404 (Not Found) and 405 (Method Not Allowed) errors between a unique pair of hosts within a short period of time. This could indicate that a search robot or a script is methodically searching a Web site for vulnerable directories or CGI scripts. The default maximum number of 301/403/404/405 errors is 16; you can change this setting in the Sensor Settings Rulebase>Protocol Thresholds and Configuration>HTTP>Maximum Number of 301/403/404/405 Errors Per Minute.
Extended Description
If a website logs a great number of HTTP response codes such as 301 (Moved Permanently), 403 (Forbidden), 404 (Not Found) and 405 (Method Not Allowed), it could indicate a search robot or a script is methodically searching a website for vulnerability.
References
Short Name
HTTP:EXPLOIT:BRUTE-SEARCH
Severity
Major
Recommended
False
Recommended Action
None
Category
HTTP
Keywords
brute http search
Release Date
01/27/2004
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3559
False Positive
Occasionally