Security Incidents mailing list archives
Re: .ida Intrusion Attempt
From: Joe Smith <shadowm4n () yahoo com>
Date: Thu, 19 Jul 2001 10:55:10 -0700 (PDT)
Interesting. I played around with the rules some, and figured out why snort wasn't finding it with the .ida rule. Since I'm only logging the first 100 bytes of data, the .ida rule misses it because part of the criteria of the rule is for data size to be greater than 239 bytes. I've since adjusted my rule to not care about the dsize for the .ida rule. Now its catching it fine. -Joe --- Martin Roesch <roesch () sourcefire com> wrote:
That's a rule ordering issue, I'm pretty sure we fixed that one in 1.8-RELEASE... -Marty Joe Smith wrote:Hey all, Just got this .ida attack on my sensors. This is cute, how it splits the GET from the default.ida? query. Please note that while snort did detect it, itwasn'tdetected by the .ida rule. Instead, it detected it as a whisker splice attack. alert TCP $EXTERNAL any -> $INTERNAL 80 (msg:"IDS415/web-misc_http-whisker-splicing-attack-tab";dsize: <5; flags: A+; content: "|09|"; classtype: suspicious; reference: arachnids,415;) alert TCP $EXTERNAL any -> $INTERNAL 80 (msg: "IDS552/web-iis_IIS ISAPI Overflow ida"; dsize: 239; flags: A+; uricontent: ".ida?"; classtype: system-or-info-attempt; reference: arachnids,552;) I'm guessing that once snort found a match with whisker, it stopped looking for other matches. I've included the relavent frames for your review. 63.241.137.194-attacker my.poor.website HTTP GET Frame 4 (60 on wire, 60 captured) Ethernet II Internet Protocol Transmission Control Protocol, Src Port: 21500 (21500), Dst Port: 80 (80), Seq: 3988343872, Ack: 2181442487 Hypertext Transfer Protocol 0 00d0 b790 dd6f 0002 1724 4800 0800 4500 .....o...$H...E. 10 002c 105a 4000 7206 9c64 3ff1 89c2 3f59 .,.Z@.r..d?...?Y 20 5301 53fc 0050 edb9 4c40 8206 2bb7 5018 S.S..P..L@..+.P. 30 40b0 3ba1 0000 4745 5420 0000 @.;...GET .. 63.241.137.194-attacker my.poor.website HTTP Continuation Frame 5 (1434 on wire, 100 captured) Ethernet II Internet Protocol Transmission Control Protocol, Src Port: 21500 (21500), Dst Port: 80 (80), Seq: 3988343876, Ack: 2181442487 Hypertext Transfer Protocol 0 00d0 b790 dd6f 0002 1724 4800 0800 4500 .....o...$H...E. 10 058c 105b 4000 7206 9703 3ff1 89c2 3f59 ...[@.r...?...?Y 20 5301 53fc 0050 edb9 4c44 8206 2bb7 5018 S.S..P..LD..+.P. 30 40b0 0109 0000 2f64 6566 6175 6c74 2e69 @...../default.i 40 6461 3f4e 4e4e 4e4e 4e4e 4e4e 4e4e 4e4e da?NNNNNNNNNNNNN 50 4e4e 4e4e 4e4e 4e4e 4e4e 4e4e 4e4e 4e4e NNNNNNNNNNNNNNNN 60 4e4e 4e4eNNNN__________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/-- Martin Roesch roesch () sourcefire com http://www.sourcefire.com - http://www.snort.org
__________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/ ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- RE: .ida Intrusion Attempt, (continued)
- RE: .ida Intrusion Attempt Tulchinskiy, Sasha (Jul 19)
- Re: .ida Intrusion Attempt Sebastian Ip (Jul 19)
- Re: .ida Intrusion Attempt Kheos ml (Jul 19)
- Re: .ida Intrusion Attempt Sebastian Ip (Jul 19)
- RE: .ida Intrusion Attempt Yom, Francis (Jul 19)
- Re: .ida Intrusion Attempt Dr SuSE (Jul 19)
- Re: .ida Intrusion Attempt bugtraq (Jul 19)
- RE: .ida Intrusion Attempt Colby Rice (Jul 19)
- RE: .ida Intrusion Attempt Tim Winders (Jul 19)
- .ida Intrusion Attempt Joe Smith (Jul 19)
- Re: .ida Intrusion Attempt Martin Roesch (Jul 19)
- Re: .ida Intrusion Attempt Joe Smith (Jul 19)
- Re: .ida Intrusion Attempt Martin Roesch (Jul 19)
- RE: .ida Intrusion Attempt Ulrich Keil (Jul 19)
- Re: .ida Intrusion Attempt Russell Fulton (Jul 19)
- Re: .ida Intrusion Attempt Stuart Staniford (Jul 19)
- Re: .ida Intrusion Attempt E. Larry Lidz (Jul 20)
- Re: .ida Intrusion Attempt Kyle R Maxwell (Jul 20)
- Re: .ida Intrusion Attempt Stuart Staniford (Jul 19)
- RE: .ida Intrusion Attempt Tulchinskiy, Sasha (Jul 19)