I'm playing around with some snort rules, and I've been noticing some odd
interaction between http_inspect_server and some of the snort rules. I
created a capture which *should* match two rules. I created a snort.conf
that is extremely basic (it contains those two rules and the supporting
variables and preprocessors to make them both work) The two rules are:
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC
Cisco IOS HTTP configuration attempt"; flow:to_server,established;
uricontent:"/level/"; uricontent:"/exec/"; reference:bugtraq,2936;
reference:cve,2001-0537; classtype:web-application-attack; sid:1250;
rev:11;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES
directory listing"; flow:from_server,established; content:"Volume Serial
Number"; classtype:bad-unknown; sid:1292; rev:8;)
The rest of the config is:
var HOME_NET any
var HTTP_SERVERS $HOME_NET
var EXTERNAL_NET any
var HTTP_PORTS 80
var RULE_PATH /etc/snort
include $RULE_PATH/classification.config
include $RULE_PATH/reference.config
preprocessor flow: stats_interval 0 hash 2
preprocessor http_inspect: global iis_unicode_map /etc/snort/unicode.map
1252
preprocessor http_inspect_server: server default profile all ports { 80 8080
8180 } oversize_dir_length 500
I run the command:
snort -c ./mysnort.conf -l /root/log/ -r ./mydata.pcap -A full -k none
If I comment out the http_inspect_server line, then I see an alert from the
second rule. If I don't, then I see an alert from the first rule. I would
really like to see both, and I can't figure out why that preprocessor would
suppress the second alert. Well, also, I can't figure out why the absence
of that preprocessor would suppress the first alert (isn't uricontent
handled by http_inspect, not http_inspect_server?)
I'm just a tad confused. Anyone have any insight as to what I'm doing
wrong? (FYI, Snort Version 2.2.0 (Build 30), on a 2.6.5 kernel Gentoo
system)
thanks,
-Joe Patterson, CCNP, CISSP
Senior Security Engineer
SteelCloud, Inc.
(954)318-3200x105
jpatterson@asgardgroup.com
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
