If the goal is to stop someone then you need to be able to get inline or
have automated controls on the web server. If you can get inline or even
passive with snort then you can do a bunch of things with differing
levels of success.
1) On the main page, and all sub pages, embedded in whitespace, place a
link the same color as the background, anchored by a 1x1 image.
2) use a robots.txt
3) Use hidden text links in the content.
4) Watch for user agents of known spider tools
Then write rules to look for all of this activity. If you get inline you
can drop or reject the requests and continue to do so for a period of
time. If passive you can use something like snortsam to shun them on the
local firewall or the border routers...
If your goal is bandwidth limitation for offenders there are better
tools available but you should be able to use snortsam to affect that
change too.
None of this will be perfect though and you should be suspect of any
technology that claims to be able to identify and handle this situation
perfectly.
Michael Boman wrote:
On Fri, 17 Dec 2004 14:38:16 +0200, Dimitrios Patsos <dpat@space.gr> wrote:
Hi!
Can anybody provide some help on how can we prevent a user from making a
local mirror of a web site by using both host & network IDS?
Thank you in advance.
A similar request came up on snort-users about two weeks ago. The
answer is archived at
http://sourceforge.net/mailarchive/message.php?msg_id=10258872
Best regards
Michael Boman
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
