[Snort-sigs] improvements to web-misc rules

Hi List,

Whilst cycling to work this morning I thought about how I'd seen
/etc/passwd fly off a server from port 80 yesterday courtesy of twiki. 

I thought lucky I checked that 'web-misc /etc/passwd attempt' alert as I
get so many from hackers attempting exploits but failing. It dawned on
me perhaps the rules could be extended so that they would check for
patterns in responses that occur commonly from the commands that are
being attempted. Things like;

root:x:0:0:root:/root:/bin/bash

from /etc/passwd or output from commands like uname -a

Perhaps the current web-misc rules could be given a lesser rating than
rules that detect commands that are actually successful?

This would slim down false positives greatly, anyone have anything like
this?

Thanks

Chas Tomlin

Systems Administrator/Programmer
School of Electronics and Computer Science
University of Southampton




 


-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs