William,
If the page is static you can write an expression that will count a specific number
chars and then match some keyword. Say your page has the word foo at char 2001 you
could use this expression:
~.{2000}foo
This expression counts 2000 chars, then checks for foo.
This will only return true if the word foo starts at char count 2001.
If it is not entirely static you just need to identify a sufficiently large static
section, match
a keyword then count, then match the anchor keyword.
~foo.(2000}bar
This will look for foo then count 2000 chars then look for bar.
The kiddies would need to maintain the original char count in their hacked version of
your honey pot to evade detection.
Joe
From: "William" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date: Fri, 8 Jun 2001 21:17:57 -0400
>Does anyone have a way to check and see if a web page has been altered? We
>have a "honey pot" server set up and would like to be notified as soon a
>script kiddy "owns" it. I had been monitoring for a specific text string,
>but it got hit the other day and the majority of the text was left untouched
>(only minor modifications of a few choice words were made)
>
>any suggestions?
>
>
>Please visit http://www.ipswitch.com/support/mailing-lists.html
>to be removed from this list.
>
>An Archive of this list is available at:
>http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
