Worthy,
The rule is using content, so it's triggering on something in the
header. If thus attack is used mainly in the URI, then it should be
changed to uricontent. See if that reduces your false positives.
Dan
On Mon, 2004-09-27 at 20:37, Nigel Houghton wrote:
On 0, Worthy <listy@home.olsztyn.pl> allegedly wrote:
Hello,
Can somebody could tell me what is that rule looking for?
http://www.snort.org/snort-db/sid.html?sid=1333
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"WEB-ATTACKS id command attempt"; flow:to_server,established;
content:"|3B|id"; nocase; classtype:web-application-attack;
sid:1333; rev:6;)
What means "|3B|id" string?
3B is the Hex code for the character ";". Which means the rule looks for
attempts to run the command "id" which can occur in something like this:
http://www.foo.com/bar/somescript?input;id
The character ";" can be used on Unix/Linux style systems to enable more
than one command to be processed on a command line. Say something like
this:
#> ls; id
So if your script does not correctly sanitize user input or allows for the
addition of user supplied data to a POST/GET request for example, the
command "id" could be run and would return data on the user running the
webserver.
All alerts triggered by that rule are for PHP-Nuke 6.0.
The query is POST /index.php , should I need to worry?
Does the script have something like index.php&foo;id in it as a POST
parameter?
Are your $EXTERNAL_NET and $HTTP_SERVERS variables set correctly?
--
Best regards,
Worthy mailto: listy@home.olsztyn.pl
+-------------------------------------------------------------------------+
,,_ Nigel Houghton Research Engineer Sourcefire Inc.
o" )~ Vulnerability Research Team
''''
"Dude, dolphins are intelligent and friendly!" - Wendy
"Intelligent and friendly on rye bread, with some mayonaise." - Cartman
+-------------------------------------------------------------------------+
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
--
Daniel Roelker
Lead Snort Developer
Sourcefire, Inc.
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
