Need help with basic Snort rule to dectect string in a web page

abefroman · 05-22-2008, 12:52 PM

I have the rule:
alert ip any any -> any any (msg: "Test String"; flow: to_client,established; content:"teststring"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; classtype: policy-violation; sid: 2001351; rev:6

But it is not alerting went i bring up a test html page with "teststring" inside of it.

Thanks in advance!

chakka.lokesh · 05-22-2008, 11:36 PM

Quote:

alert ip any any -> any any (msg...

try changing the ip to tcp

alert tcp any any -> any any (msg...

abefroman · 05-23-2008, 08:34 AM

Hmm, that didn't work. I even tried removing nocase; threshold: type threshold, track by_dst,count 5, seconds 360;

If you know how to do this see:
http://www.linuxquestions.org/questi...ritten-644285/

abefroman · 05-26-2008, 03:05 PM

ip will include all protocols including tcp, upd and icmp

chakka.lokesh · 05-27-2008, 12:09 AM

That protocol hierarchy is with respect to networks

but r u sure that when u mention ip, snort is going to check the payload of the inner level protocols like tcp, udp, icmp, http, ftp, smtp etc.........

.

abefroman · 05-27-2008, 02:49 PM

Quote:

Originally Posted by chakka.lokesh

That protocol hierarchy is with respect to networks

but r u sure that when u mention ip, snort is going to check the payload of the inner level protocols like tcp, udp, icmp, http, ftp, smtp etc.........

.

Nope, I'm not sure

And I think you're right, its not checking the whole payload, it didn't check it with tcp either, and it won't let me use http:
snort[17134]: FATAL ERROR: /etc/snort/rules/creditcard.rules(14) => Bad protocol: http

Any ideas?

chakka.lokesh · 05-27-2008, 11:33 PM

alert tcp any any -> any any (msg:"test string"; flow:established; content:"test string"; nocase; sid:2001315; rev:1;)

try this rule. copy and paste it as it is. DO NOT do any changes. let us see what it does.

abefroman · 05-28-2008, 08:26 AM

Didn't work, I even tried a rule for asdf and make a .html page containing only asdf, not even <html>

I think this has to do something with the http_inspect or stream5 preprocessors in the snort.conf file.

This is what I have:
preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
track_udp no
preprocessor stream5_tcp: policy first, use_static_footprint_sizes
# preprocessor stream5_udp: ignore_any_rules

preprocessor http_inspect: global \
iis_unicode_map unicode.map 1252

preprocessor http_inspect_server: server default \
profile all ports { 80 8080 8180 } \
oversize_dir_length 500 \
flow_depth 0

Do I need to add something to tell it to reassemble packets with stream5 both ways on port 80?

chakka.lokesh · 08-19-2008, 11:42 PM

yesterday, I got one idea. I am not sure whether it works or not.
but try this.

In the attack responses file, see the rule with sid:498.

there u replace the content "uid=0|28|root|29|" with "test string"

observe what snort is doing.