Re: Help with web servers

[Matt Kettler <mkettler () evi-inc com>]

At 08:54 PM 2/24/2003 +0100, Sébastien Bisoglio wrote:
> Thanx for your answer
>
> I'll explain you..
>
> I have two computer
> 1) The web server (192.168.1.10 in my network)
> 2) Firewall (and NAT) + SNORT (192.168.1.1 internal and 195.202.209.230
> external)
>
> Snort is listening on external (195.202.209.230 = eth1)

In this scenario the IP that snort should see for your web server is 
195.202.209.230

so: var HTTP_SERVERS [195.202.209.230/32] should theoretically work for you.


> I have tested an unicode bug (iis security "bug") on an another pc on
> internet and access my web server via 195.202.209.230
> IP address.
>
> but snort dont log them..

Ok that's the correct way to test it... Does snort catch other stuff from 
this source? Have you tried a simple "catch all" rule like this one?

alert tcp any any ->  HTTP_SERVERS 80 (msg: "Test inbound http traffic 
detected",flow:to_server,established;sid:1000000;rev 1;)

Note: the above rule should be very noisy.

Some other things to consider:

is HTTP_PORTS set correctly? Note that despite the name HTTP_PORTS can not 
be a comma delimited list, it must be a single number, or a range, or a 
negation of a number or range.

Valid examples:
        var HTTP_PORTS 80
        var HTTP_PORTS [80:100]

Invalid, common mistake:
        var HTTP_PORTS [80,8080]

Are you sure that there is a snort signature for the particular unicode bug 
you tried?

Do you have the http preprocessor fully enabled, as such:

preprocessor http_decode: 80 unicode iis_alt_unicode double_encode 
iis_flip_slash full_whitespace



> Sorry for my poor english but I'm french.

That's fine, I assumed you were a non native speaker, but based on your 
email address I had assumed you were Czech, not French.


> THX



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users