Re: Matching http_cookie content

["Al Lewis \(allewi\) via Snort-sigs" <snort-sigs () lists snort org>]

This may have been asked/answered already (if so sorry) ... Do you have a pcap of the traffic? Is the content there?

Based on that script where is the "jdni" in the body of the get request?

You can add something like this into your conf to see the buffer/pattern matching attempts

trace =
{
    modules =
    {
        all = 255,
      snort = { all = 255 }
    }
}

If I start taking the rule apart, I can see it match in the cookie but then move on and miss other matches.

P0:detection:rule_eval:1: Reached leaf, cursor name http_cookie, cursor position 0

http_inspect.stream_tcp[12]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
6A 6E 64 69 3D 24 7B 6A  6E 64 69 3A              jndi=${j ndi:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
P0:detection:rule_eval:1: Matched rule gid:sid:rev 1:58726:6



I suspect the jdni / content is missing in the payload of your get request.




________________________________
From: Snort-sigs <snort-sigs-bounces () lists snort org> on behalf of Stephen Reese via Snort-sigs <snort-sigs () lists 
snort org>
Sent: Wednesday, April 3, 2024 8:25 AM
To: Alex Tatistcheff <alext () pobox com>
Cc: snort-sigs () lists snort org <snort-sigs () lists snort org>
Subject: Re: [Snort-sigs] Matching http_cookie content

On Fri, May 12, 2023 at 10:29 AM Alex Tatistcheff <alext () pobox com<mailto:alext () pobox com>> wrote:
I would first simplify the Talos rule until you get it to alert. Then add keywords back in until you find the culprit. 
Unless you've done this you dont know what part of the rule is not matching.

Thanks, I do not have an issue generating requests using the Scapy or sockets library for most rules, it's a handful of 
rules related to http_cookie and http_client_body that are troublesome. The pattern I see in the rules I am unable to 
trigger is related to rules having a content option defined twice whereas other rules only have the content option once.

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!