Hillstone Networks

'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>

RULE（RULE ID：339636）

Rule General Information


Release Date:		2025-11-18

Rule Name:		Scanner Gobuster Detection

Severity:

CVE ID:

Rule Protection Details


Description:		Gobuster is a scanner written in Go, primarily used for dictionary-based directory discovery, virtual host (vhost) probing, and DNS subdomain enumeration. This rule is intended to detect scanning traffic generated by Gobuster.

Impact:		Attackers use scanners to scan targets, may find vulnerabilities in the target system, resulting in system information leakage, and then attack the system to obtain system permissions.

Affected OS:		Windows, Linux, Others

Reference:

Solutions

1. If it is determined that there is scanning behavior from an unknown IP address, it is recommended to block the IP address immediately. 2. Make sure that the file system permissions of Web servers and applications are set properly to limit access to sensitive files and directories. 3. Ensure that the system and applications have been updated to the latest version, and fix known vulnerabilities to reduce the impact on the system.