Hillstone Networks

'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>

RULE（RULE ID：339635）

Rule General Information


Release Date:		2025-11-18

Rule Name:		Scanner Ffuf Detection

Severity:

CVE ID:

Rule Protection Details


Description:		Ffuf is a fast web fuzzer written in Go. This rule is used to detect the scanning traffic of Ffuf.

Impact:		Attackers use scanners to scan targets, may find vulnerabilities in the target system, resulting in system information leakage, and then attack the system to obtain system permissions.

Affected OS:		Windows, Linux, Others

Reference:

Solutions

1. If it is determined that there is scanning behavior from an unknown IP address, it is recommended to block the IP address immediately. 2. Make sure that the file system permissions of Web servers and applications are set properly to limit access to sensitive files and directories. 3. Ensure that the system and applications have been updated to the latest version, and fix known vulnerabilities to reduce the impact on the system.