Does anyone know if there is an IDS that can detect refers from a google hacking data

abefroman · 06-24-2008, 10:31 PM

Does anyone know if there is an IDS (or premade rules for an IDS) that can detect refers from a google hacking database keyword search?

Also, is there an updated google hacking database, this one's last entry was in 2006:
http://johnny.ihackstuff.com/ghdb.ph...summary&cat=19

unSpawn · 06-25-2008, 05:07 AM

Not that I know of. Are you going to build rules for that?
As for updating I think you answered that yourself: who updates it and where is it maintained?

unixfool · 06-25-2008, 05:47 AM

http://www.emergingthreats.net/... I'm not saying what you're looking for is there, but they do have a TON of sigs there that are contributions world-wide.

Another beauty of Snort rules is that what you don't find, you can create (although you might need some diligence and assistance to meet your requirements).

abefroman · 06-25-2008, 07:33 AM

Quote:

Originally Posted by unSpawn

Not that I know of. Are you going to build rules for that?
As for updating I think you answered that yourself: who updates it and where is it maintained?

Yes, I was thinking for writing some rules for snort if I couldn't find any already made.

OlRoy · 06-25-2008, 09:34 AM

What about using httpry with the "-s referer" option to only log the referer and then "tail -f" the log file to continually monitor it, and then pipe that command through "grep -f refererlist" where refererlist contains a list of regular expressions to match the referers you're looking for.

I would think that would be simpler than writing snort rules.

Edit: I just realized you would want to log more than the referer, but you get the idea

abefroman · 06-26-2008, 08:42 AM

Quote:

Originally Posted by OlRoy

What about using httpry with the "-s referer" option to only log the referer and then "tail -f" the log file to continually monitor it, and then pipe that command through "grep -f refererlist" where refererlist contains a list of regular expressions to match the referers you're looking for.

I would think that would be simpler than writing snort rules.

Edit: I just realized you would want to log more than the referer, but you get the idea

Yep, thanks!