[prev in list] [next in list] [prev in thread] [next in thread]
List: snort-users
Subject: Re: [Snort-users] How to detect http response body
From: Y M <snort () outlook ! com>
Date: 2016-11-03 3:38:20
Message-ID: CY1PR17MB017089913522D13957AFC85DA8A30 () CY1PR17MB0170 ! namprd17 ! prod ! outlook ! com
[Download RAW message or body]
[Attachment #2 (text/plain)]
Whoops, I misread your original post. Yeah, client request body won't work in this \
case. In this case without a capture it would be difficult to tell what's going.
YM
On Thu, Nov 3, 2016 at 4:28 AM +0300, "Maxim" \
<hittlle@163.com<mailto:hittlle@163.com>> wrote:
It's response body, not request body
--
发自我的网易邮箱手机智能版
在 2016-11-02 20:04:45，"Y M" <snort@outlook.com> 写道：
Have you tried using the content modifier "http_client_body"? Also, If the string \
constantly appears at fixed offset, you can further optimize with content modifiers \
"offset" and "depth". These are all part of the documentation.
http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node32.html#SECTION004511000000000000000
YM
On Wed, Nov 2, 2016 at 2:14 PM +0300, "Maxim" \
<hittlle@163.com<mailto:hittlle@163.com>> wrote:
Hi all,
We came across a weird scenario. We used the following rule to detect http response \
body alert tcp any any -> $HOME_NET any ( sid: 10000003; file_data; content:"ASED"; \
nocase; rev:1; classtype: misc-activity;msg:"cve-test";) And we do see such a string \
in the response body, but snort did not trigger any alerts. Are we missing anything? \
Many thanks
[Attachment #3 (text/html)]
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<meta content="text/html; charset=gb2312">
</head>
<body>
<div>Whoops, I misread your original post. Yeah, client request body won't work in \
this case. In this case without a capture it would be difficult to tell what's \
going.</div> <div><br>
</div>
<div>YM<br>
<br>
<div class="acompli_signature"></div>
<br>
</div>
<br>
<br>
<br>
<div class="gmail_quote">On Thu, Nov 3, 2016 at 4:28 AM +0300, "Maxim" \
<span dir="ltr"> <<a href="mailto:hittlle@163.com" \
target="_blank">hittlle@163.com</a>></span> wrote:<br> <br>
</div>
<div>It's response body, not request body<br>
<br>
<br>
<br>
<br>
<div id="spnEditorSign_app">--<br>
发自我的网易邮箱手机智能版</div>
<br>
<br>
<br>
在 2016-11-02 20:04:45，"Y M" <snort@outlook.com> \
写道：<br> <blockquote id="isReplyContent" style="padding-left:1ex; margin:0px 0px \
0px 0.8ex; border-left:#ccc 1px solid"> <div>Have you tried using the content \
modifier "http_client_body"? Also, If the string constantly appears at \
fixed offset, you can further optimize with content modifiers "offset" and \
"depth". These are all part of the documentation.</div> <div><br>
</div>
<div><a dir="ltr" href="http://manual-snort-org.s3-website-us-east-1.amazonaws.com/nod \
e32.html#SECTION004511000000000000000">http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node32.html#SECTION004511000000000000000</a></div>
<div><br>
</div>
<div>YM<br>
<br>
<div class="acompli_signature"></div>
<br>
</div>
<br>
<br>
<br>
<div class="gmail_quote">On Wed, Nov 2, 2016 at 2:14 PM +0300, "Maxim" \
<span dir="ltr"> <<a href="mailto:hittlle@163.com" \
target="_blank">hittlle@163.com</a>></span> wrote:<br> <br>
</div>
<div>
<div style="line-height:1.7; color:#000000; font-size:14px; font-family:Arial">
<div>Hi all,</div>
<div>We came across a weird scenario. We used the following rule to detect http \
response body</div> <div> alert tcp any any -> $HOME_NET any ( sid: \
10000003; file_data; content:"ASED"; nocase; rev:1; classtype: \
misc-activity;msg:"cve-test";)</div> <div>And we do see such a string in \
the response body, but snort did not trigger any alerts. Are we missing anything? \
Many thanks</div> </div>
<br>
<br>
<span title="neteasefooter">
<p> </p>
</span></div>
</blockquote>
<br>
<br>
<span title="neteasefooter">
<p> </p>
</span></div>
</body>
</html>
[Attachment #4 (--===============6573381418528175002==)]
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today. http://sdm.link/xeonphi
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
Please visit http://blog.snort.org to stay current on all the latest Snort news!
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic