Snort mailing list archives
Re: Possible FP 19177
From: rmkml <rmkml () yahoo fr>
Date: Fri, 10 Jun 2011 17:52:19 +0200 (CEST)
Hi Alex and James, Maybe check if it's a html trafic or check iframe|href html tag... Regards Rmkml On Fri, 10 Jun 2011, Alex Kirk wrote:
Looks like it is indeed. Goes to show how hard it can be to anticipate all possible use cases on a given string.
We're looking at a fix now, and we'll update the rule as soon as feasible.
On Fri, Jun 10, 2011 at 10:18 AM, Lay, James <james.lay () wincofoods com> wrote:
Looks like perl may be the culprit?
James
Rule:
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-MISC
cookiejacking attempt"; flow:established,to_client; content:"file|3A 2F
2F 2F|"; nocase;
reference:url,www.swisscyberstorm.com/speakers/valotta-slides;
classtype:attempted-recon; sid:19177; rev:1;)
Hit:
06/10-08:09:47.173703 [**] [1:19177:1] WEB-MISC cookiejacking attempt
[**] [Classification: Attempted Information Leak] [Priority: 2] {TCP}
208.80.152.3:80 -> int.ip:48656
06/10-08:09:47.247704 [**] [1:19177:1] WEB-MISC cookiejacking attempt
[**] [Classification: Attempted Information Leak] [Priority: 2] {TCP}
208.80.152.3:80 -> int.ip:48657
06/10-08:09:47.374703 [**] [1:19177:1] WEB-MISC cookiejacking attempt
[**] [Classification: Attempted Information Leak] [Priority: 2] {TCP}
208.80.152.3:80 -> int.ip:48656
Dump:
0000 00 13 72 59 7a f4 00 90 7f 3e f7 90 08 00 45 00 ..rYz....>....E.
0010 01 a4 cb eb 40 00 39 06 01 f0 d0 50 98 03 00 00 ....@.9....P....
0020 00 00 00 50 be 10 86 6c f9 72 b3 a4 ef db 50 18 ...P...l.r....P.
0030 1d 50 db 22 00 00 4d 61 67 69 63 6b 20 36 2e 36 .P."..Magick 6.6
0040 2e 32 2d 36 20 32 30 31 30 2d 31 30 2d 32 33 20 .2-6 2010-10-23
0050 51 38 20 68 74 74 70 3a 2f 2f 77 77 77 2e 69 6d Q8 http://www.im
0060 61 67 65 6d 61 67 69 63 6b 2e 6f 72 67 07 e4 10 agemagick.org...
0070 cf 00 00 00 18 74 45 58 74 54 68 75 6d 62 3a 3a .....tEXtThumb::
0080 44 6f 63 75 6d 65 6e 74 3a 3a 50 61 67 65 73 00 Document::Pages.
0090 31 a7 ff bb 2f 00 00 00 19 74 45 58 74 54 68 75 1.../....tEXtThu
00a0 6d 62 3a 3a 49 6d 61 67 65 3a 3a 68 65 69 67 68 mb::Image::heigh
00b0 74 00 31 30 34 30 30 8d 34 f5 00 00 00 18 74 45 t.10400.4.....tE
00c0 58 74 54 68 75 6d 62 3a 3a 49 6d 61 67 65 3a 3a XtThumb::Image::
00d0 57 69 64 74 68 00 31 30 37 34 8f 18 f0 e1 00 00 Width.1074......
00e0 00 19 74 45 58 74 54 68 75 6d 62 3a 3a 4d 69 6d ..tEXtThumb::Mim
00f0 65 74 79 70 65 00 69 6d 61 67 65 2f 70 6e 67 3f etype.image/png?
0100 b2 56 4e 00 00 00 17 74 45 58 74 54 68 75 6d 62 .VN....tEXtThumb
0110 3a 3a 4d 54 69 6d 65 00 31 33 30 31 32 31 34 35 ::MTime.13012145
0120 39 38 c8 f7 df e4 00 00 00 11 74 45 58 74 54 68 98........tEXtTh
0130 75 6d 62 3a 3a 53 69 7a 65 00 32 32 31 4b 42 be umb::Size.221KB.
0140 64 b4 91 00 00 00 57 74 45 58 74 54 68 75 6d 62 d.....WtEXtThumb
0150 3a 3a 55 52 49 00 66 69 6c 65 3a 2f 2f 2f 6d 6e ::URI.file:///mn
0160 74 2f 75 70 6c 6f 61 64 36 2f 77 69 6b 69 70 65 t/upload6/wikipe
0170 64 69 61 2f 65 6e 2f 34 2f 34 34 2f 53 68 61 72 dia/en/4/44/Shar
0180 65 50 6f 69 6e 74 5f 32 30 31 30 5f 63 72 65 61 ePoint_2010_crea
0190 74 65 5f 73 69 74 65 5f 73 63 72 65 65 6e 2e 70 te_site_screen.p
01a0 6e 67 b1 8e 7e ae 00 00 00 00 49 45 4e 44 ae 42 ng..~.....IEND.B
01b0 60 82 `.
0000 00 13 72 59 7a f4 00 90 7f 3e f7 90 08 00 45 00 ..rYz....>....E.
0010 02 19 64 c2 40 00 39 06 68 a4 d0 50 98 03 00 00 ..d.@.9.h..P....
0020 00 00 00 50 be 11 d0 32 1e 97 1b 29 53 3f 50 18 ...P...2...)S?P.
0030 1d 50 33 0f 00 00 74 45 58 74 64 61 74 65 3a 63 .P3...tEXtdate:c
0040 72 65 61 74 65 00 32 30 31 31 2d 30 33 2d 32 37 reate.2011-03-27
0050 54 30 35 3a 31 31 3a 30 31 2b 30 30 3a 30 30 72 T05:11:01+00:00r
0060 d6 d9 4d 00 00 00 25 74 45 58 74 64 61 74 65 3a ..M...%tEXtdate:
0070 6d 6f 64 69 66 79 00 32 30 31 31 2d 30 33 2d 32 modify.2011-03-2
0080 37 54 30 35 3a 31 31 3a 30 31 2b 30 30 3a 30 30 7T05:11:01+00:00
0090 03 8b 61 f1 00 00 00 45 74 45 58 74 73 6f 66 74 ..a....EtEXtsoft
00a0 77 61 72 65 00 49 6d 61 67 65 4d 61 67 69 63 6b ware.ImageMagick
00b0 20 36 2e 36 2e 32 2d 36 20 32 30 31 30 2d 31 30 6.6.2-6 2010-10
00c0 2d 32 33 20 51 38 20 68 74 74 70 3a 2f 2f 77 77 -23 Q8 http://ww
00d0 77 2e 69 6d 61 67 65 6d 61 67 69 63 6b 2e 6f 72 w.imagemagick.or
00e0 67 07 e4 10 cf 00 00 00 18 74 45 58 74 54 68 75 g........tEXtThu
00f0 6d 62 3a 3a 44 6f 63 75 6d 65 6e 74 3a 3a 50 61 mb::Document::Pa
0100 67 65 73 00 31 a7 ff bb 2f 00 00 00 18 74 45 58 ges.1.../....tEX
0110 74 54 68 75 6d 62 3a 3a 49 6d 61 67 65 3a 3a 68 tThumb::Image::h
0120 65 69 67 68 74 00 37 30 39 4d 9d 6c f6 00 00 00 eight.709M.l....
0130 18 74 45 58 74 54 68 75 6d 62 3a 3a 49 6d 61 67 .tEXtThumb::Imag
0140 65 3a 3a 57 69 64 74 68 00 31 30 36 34 96 03 c1 e::Width.1064...
0150 a0 00 00 00 19 74 45 58 74 54 68 75 6d 62 3a 3a .....tEXtThumb::
0160 4d 69 6d 65 74 79 70 65 00 69 6d 61 67 65 2f 70 Mimetype.image/p
0170 6e 67 3f b2 56 4e 00 00 00 17 74 45 58 74 54 68 ng?.VN....tEXtTh
0180 75 6d 62 3a 3a 4d 54 69 6d 65 00 31 33 30 31 32 umb::MTime.13012
0190 30 32 36 36 31 2c fe b3 ba 00 00 00 11 74 45 58 02661,.......tEX
01a0 74 54 68 75 6d 62 3a 3a 53 69 7a 65 00 32 38 35 tThumb::Size.285
01b0 4b 42 d6 d0 fc 29 00 00 00 59 74 45 58 74 54 68 KB...)...YtEXtTh
01c0 75 6d 62 3a 3a 55 52 49 00 66 69 6c 65 3a 2f 2f umb::URI.file://
01d0 2f 6d 6e 74 2f 75 70 6c 6f 61 64 36 2f 77 69 6b /mnt/upload6/wik
01e0 69 70 65 64 69 61 2f 65 6e 2f 64 2f 64 37 2f 4d ipedia/en/d/d7/M
01f0 69 63 72 6f 73 6f 66 74 5f 53 68 61 72 65 50 6f icrosoft_SharePo
0200 69 6e 74 5f 32 30 31 30 5f 46 6f 75 6e 64 61 74 int_2010_Foundat
0210 69 6f 6e 2e 70 6e 67 fc 95 39 18 00 00 00 00 49 ion.png..9.....I
0220 45 4e 44 ae 42 60 82 END.B`.
0000 00 13 72 59 7a f4 00 90 7f 3e f7 90 08 00 45 00 ..rYz....>....E.
0010 03 56 cb f6 40 00 39 06 00 33 d0 50 98 03 00 00 .V..@.9..3.P....
0020 00 00 00 50 be 10 86 6d 2c eb b3 a4 f1 a3 50 18 ...P...m,.....P.
0030 21 80 2c 6c 00 00 b2 52 f4 1f 7e ff 3f 72 8d 76 !.,l...R..~.?r.v
0040 63 af 63 da be 2f 27 f6 6e 20 0e bc e8 47 ce 8a c.c../'.n ...G..
0050 91 b5 e7 21 45 d9 44 6d b7 a1 a9 90 12 29 45 f9 ...!E.Dm.....)E.
0060 b6 6e 25 11 72 bf d2 1c c1 ac 27 74 f9 e6 2f 67 .n%.r.....'t../g
0070 dd 1d d5 8b fb bf 1f 48 d1 b5 bb a2 d2 ed 35 fd .......H......5.
0080 32 45 f9 df 5a 87 70 62 af fa e1 96 be 6d 6e bf 2E..Z.pb.....mn.
0090 93 b9 35 ae 7c e7 c4 6d 84 d9 7d 85 cf 6e 5a f0 ..5.|..m..}..nZ.
00a0 c1 2a 09 29 05 52 ca bd 79 38 b7 2f 9f b5 2e 7b .*.).R..y8./...{
00b0 4d 7b be 57 ce 6d b6 5e ce 0a 9c b1 98 c2 62 72 M{.W.m.^......br
00c0 43 91 19 f2 bc a0 28 0a b2 3c 27 2b f2 72 2e b2 C.....(..<'+.r..
00d0 bc bf d4 0a a9 24 42 c9 bd 9f 42 ce d6 6d f7 98 .....$B...B..m..
00e0 94 08 bd 0f 46 ed 26 db 5b eb f6 f2 a5 ad b5 a5 ....F.&.[.......
00f0 5b 64 dd de 4f 81 60 d8 1f f2 ff 01 97 cb 12 b2 [d..O.`.........
0100 8c 17 9b 05 00 00 00 5f 74 45 58 74 63 6f 6d 6d ......._tEXtcomm
0110 65 6e 74 00 46 69 6c 65 20 73 6f 75 72 63 65 3a ent.File source:
0120 20 68 74 74 70 3a 2f 2f 65 6e 2e 77 69 6b 69 70 http://en.wikip
0130 65 64 69 61 2e 6f 72 67 2f 77 69 6b 69 2f 46 69 edia.org/wiki/Fi
0140 6c 65 3a 4d 69 63 72 6f 73 6f 66 74 5f 53 68 61 le:Microsoft_Sha
0150 72 65 50 6f 69 6e 74 5f 32 30 31 30 5f 46 6f 75 rePoint_2010_Fou
0160 6e 64 61 74 69 6f 6e 2e 70 6e 67 68 5c 7a 16 00 ndation.pngh\z..
0170 00 00 25 74 45 58 74 64 61 74 65 3a 63 72 65 61 ..%tEXtdate:crea
0180 74 65 00 32 30 31 31 2d 30 33 2d 32 37 54 30 35 te.2011-03-27T05
0190 3a 31 31 3a 30 31 2b 30 30 3a 30 30 72 d6 d9 4d :11:01+00:00r..M
01a0 00 00 00 25 74 45 58 74 64 61 74 65 3a 6d 6f 64 ...%tEXtdate:mod
01b0 69 66 79 00 32 30 31 31 2d 30 33 2d 32 37 54 30 ify.2011-03-27T0
01c0 35 3a 31 31 3a 30 31 2b 30 30 3a 30 30 03 8b 61 5:11:01+00:00..a
01d0 f1 00 00 00 45 74 45 58 74 73 6f 66 74 77 61 72 ....EtEXtsoftwar
01e0 65 00 49 6d 61 67 65 4d 61 67 69 63 6b 20 36 2e e.ImageMagick 6.
01f0 36 2e 32 2d 36 20 32 30 31 30 2d 31 30 2d 32 33 6.2-6 2010-10-23
0200 20 51 38 20 68 74 74 70 3a 2f 2f 77 77 77 2e 69 Q8 http://www.i
0210 6d 61 67 65 6d 61 67 69 63 6b 2e 6f 72 67 07 e4 magemagick.org..
0220 10 cf 00 00 00 18 74 45 58 74 54 68 75 6d 62 3a ......tEXtThumb:
0230 3a 44 6f 63 75 6d 65 6e 74 3a 3a 50 61 67 65 73 :Document::Pages
0240 00 31 a7 ff bb 2f 00 00 00 18 74 45 58 74 54 68 .1.../....tEXtTh
0250 75 6d 62 3a 3a 49 6d 61 67 65 3a 3a 68 65 69 67 umb::Image::heig
0260 68 74 00 37 30 39 4d 9d 6c f6 00 00 00 18 74 45 ht.709M.l.....tE
0270 58 74 54 68 75 6d 62 3a 3a 49 6d 61 67 65 3a 3a XtThumb::Image::
0280 57 69 64 74 68 00 31 30 36 34 96 03 c1 a0 00 00 Width.1064......
0290 00 19 74 45 58 74 54 68 75 6d 62 3a 3a 4d 69 6d ..tEXtThumb::Mim
02a0 65 74 79 70 65 00 69 6d 61 67 65 2f 70 6e 67 3f etype.image/png?
02b0 b2 56 4e 00 00 00 17 74 45 58 74 54 68 75 6d 62 .VN....tEXtThumb
02c0 3a 3a 4d 54 69 6d 65 00 31 33 30 31 32 30 32 36 ::MTime.13012026
02d0 36 31 2c fe b3 ba 00 00 00 11 74 45 58 74 54 68 61,.......tEXtTh
02e0 75 6d 62 3a 3a 53 69 7a 65 00 32 38 35 4b 42 d6 umb::Size.285KB.
02f0 d0 fc 29 00 00 00 59 74 45 58 74 54 68 75 6d 62 ..)...YtEXtThumb
0300 3a 3a 55 52 49 00 66 69 6c 65 3a 2f 2f 2f 6d 6e ::URI.file:///mn
0310 74 2f 75 70 6c 6f 61 64 36 2f 77 69 6b 69 70 65 t/upload6/wikipe
0320 64 69 61 2f 65 6e 2f 64 2f 64 37 2f 4d 69 63 72 dia/en/d/d7/Micr
0330 6f 73 6f 66 74 5f 53 68 61 72 65 50 6f 69 6e 74 osoft_SharePoint
0340 5f 32 30 31 30 5f 46 6f 75 6e 64 61 74 69 6f 6e _2010_Foundation
0350 2e 70 6e 67 fc 95 39 18 00 00 00 00 49 45 4e 44 .png..9.....IEND
0360 ae 42 60 82 .B`.------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org
Current thread:
- Possible FP 19177 Lay, James (Jun 10)
- Re: Possible FP 19177 Alex Kirk (Jun 10)
- Re: Possible FP 19177 rmkml (Jun 10)
- Re: Possible FP 19177 Alex Kirk (Jun 10)