Re: [Snort-sigs] False positive for rule 1:1365

On Fri, 24 Sep 2004, Worthy wrote:

>   I found false positive for rule 1:1365
>   it looks like this:
>
>   GET /pphlogger.php?id=[id]&referer=http%3A//www.domain.com.pl/%3F6%26
>   &r=1024x768&c=32&showme=n&st=js&title=Dystrybucja%20maszyn%20rolniczych
>   %20firm%20McCormick%2C%20Laverda%2C%20Kverneland%2C%20Manitou%20i%20 
> HTTP/1.1
>
>   this innocent request contain string rm%20
>
>   can rule may be changed to avoid such false positives?

A \b (word boundary) pcre specifier might narrow this sig to your liking:

   msg:"WEB-ATTACKS rm command attempt";
   flow:to_server,established;
   content:"rm%20"; nocase;
   pcre:"/\brm%20/i";                      <----------------------
   classtype:web-application-attack;
   sid:1365;

The above will match, for example, "GET /0wn3d.cgi?cmd=rm%20-f%20/", but not
"GET /innocent.cgi?var=charm%20%26%20strangeness" (nor your example), even
though "rm%20" appears in both.

-Mike


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs