Snort mailing list archives
Re: sadmind rule
From: Chris Green <cmg () uab edu>
Date: 09 May 2001 19:44:07 -0500
Andreas Östling <andreaso () it su se> writes:
It's also nice to have a generic rule that looks for IIS boxes responding to the "dir" requests with an actual directory listing. For example something like: alert tcp $INTERNAL 80 -> $EXTERNAL any (msg: "Directory listing response - possible vulnerable IIS"; flags: AP; content: "|20 44 69 72 65 63 74 6F 72 79 20 6F 66|"; depth: 13;)
Only use the | | notation if you have to. It takes a bit longer to understand that really is just matching content: " Directory of". Good idea for a rule though :>
...which may catch something like: VULN_IIS:80 -> ATTACKER:41742 TCP TTL:127 TOS:0x0 ID:33953 IpLen:20 DgmLen:1500 DF ***AP*** Seq: 0xDF622603 Ack: 0xF95527CF Win: 0x4411 TcpLen: 20 20 44 69 72 65 63 74 6F 72 79 20 6F 66 20 63 3A Directory of c: 5C 70 72 6F 67 72 61 6D 20 66 69 6C 65 73 5C 63 \program files\c 6F 6D 6D 6F 6E 20 66 69 6C 65 73 5C 73 79 73 74 ommon files\syst 65 6D 5C 6D 73 61 64 63 0D 0A 0D 0A 32 30 30 30 em\msadc....2000 2D 31 30 2D 30 39 20 20 30 39 3A 32 39 20 20 20 -10-09 09:29 20 20 20 20 3C 44 49 52 3E 20 20 20 20 20 20 20 <DIR> 20 20 20 2E 0D 0A 32 30 30 30 2D 31 30 2D 30 39 ...2000-10-09
-- Chris Green <cmg () uab edu> "Yeah, but you're taking the universe out of context." _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- sadmind rule Andrew Daviel (May 09)
- Re: sadmind rule Max Vision (May 09)
- Re: sadmind rule Andrew Daviel (May 09)
- Re: sadmind rule Andreas Östling (May 09)
- Re: sadmind rule Andrew Daviel (May 09)
- Re: sadmind rule Andreas Östling (May 09)
- Re: sadmind rule Chris Green (May 09)
- <Possible follow-ups>
- RE: SadMind rule Steve Halligan (May 09)
- snortsnarf Aaron McKinnon (May 09)
- Re: sadmind rule Polar Bear (May 09)
- Re: sadmind rule Max Vision (May 09)