All,
Chas I took your rule that you provided yesterday and made it more
accurate. I submitted this rule for inclusion into the officially
community ruleset.
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-
MISC Twiki shell command execution"; flow:to_server,established;
uricontent:"/TwikiUsers?rev="; content:"|60|"; classtype:web-
application-activity; sid:<waitingonsid>; rev:2;)
Joel Esler
SOURCEfire
On Sep 16, 2005, at 7:51 AM, Chas Tomlin wrote:
Hi List,
Whilst cycling to work this morning I thought about how I'd seen
/etc/passwd fly off a server from port 80 yesterday courtesy of twiki.
I thought lucky I checked that 'web-misc /etc/passwd attempt' alert
as I
get so many from hackers attempting exploits but failing. It dawned on
me perhaps the rules could be extended so that they would check for
patterns in responses that occur commonly from the commands that are
being attempted. Things like;
root:x:0:0:root:/root:/bin/bash
from /etc/passwd or output from commands like uname -a
Perhaps the current web-misc rules could be given a lesser rating than
rules that detect commands that are actually successful?
This would slim down false positives greatly, anyone have anything
like
this?
Thanks
Chas Tomlin
Systems Administrator/Programmer
School of Electronics and Computer Science
University of Southampton
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server.
Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
