Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Signatures
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Snort-sigs] testing snort signature with uri content

from [Akash Mahajan] Network Security [Permanent Link]
Subject: Re: [Snort-sigs] testing snort signature with uri content
Date: Wed, 13 Feb 2008 16:14:28 +0530 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

MD B Zaman L wrote:
|
|        alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80  (msg:"uri
| content testing successful "; flow:to_server,established;
| uricontent:"/server-info";
|        sid:1000007; )
|

You might want to change $HTTP_SERVERS to $HOME_NET and 80 to $HTTP_SERVERS

Its always a good idea to breakup your test in two parts.

Part one is the actual sig for pattern matching. In part one you can give any
any -> any any

After you have confirmed the sig getting you alerts you can go to part two

Part two is where you can using wireshark/ethereal see what is the source and
destination and if your variables in the conf file are defined according to 
that.

regards
Akash
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFHssoLYnm8H2VnLaMRAq6KAKCU6JrQyuwXBq09SenOfeB/vQiKDQCdHPdN
OrvaRCLcy0rcvZizO5bNADE=
=qdWP
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Snort-sigs] testing snort signature with uri content, MD B Zaman L
Next by Date:  Re: [Snort-sigs] testing snort signature with uri content, Joel Esler
Previous by Thread:  [Snort-sigs] testing snort signature with uri content, MD B Zaman L
Next by Thread:  Re: [Snort-sigs] testing snort signature with uri content, Joel Esler
Indexes:  [Date] [Thread] [Top] [All Lists]