OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Mark Horn (mark-dated-1023035667.a64897hornclan.com)
Date: Fri May 03 2002 - 11:34:26 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Hi,

    I'm a relative newbie to snort. I'm trying to write some rules that will
    allow me to detect things like GNU httptunnel, corkscrew, ppp-in-telnet,
    etc. I'm stuck on the first one.

    One of the characteristics of GNU httptunnel is that it will open up a
    simultaneous GET and POST between the client and the server. After having
    looked at quite a few proxy logs, I think that this is a relatively unique
    identification for GNU httptunnel. Here's a sample proxy log output for a
    GNU httptunnel session:

    xxx.xxx.xxx.xxx - - [ 3/May/2002:12:29:38 -0400] "GET http://server:1111/index.html HTTP/1.0" - - "-" "-"
    xxx.xxx.xxx.xxx - - [ 3/May/2002:12:29:38 -0400] "POST http://server:1111/index.html HTTP/1.0" - - "-" "-"

    I've read the Snort Users Manual. I've found the sections on
    activate/dynamic rules and the tag option. I'm having a hard time
    understanding how to effectively implement these features. I'm trying to
    write rules that will do this:

    1a) If you see client issue a GET to server, wait 1 second.
    1b) If see client from 1a issue POST to server from 1a w/in the 1 second,
    issue an alert.

    2a) If you see client issue a POST to server, wait 1 second.
    2b) If see client from 2a issue GET to server from 2a w/in the 1 second,
    issue an alert.

    It seems to me that I ought to be able to do something like this but I
    can't seem to figure out how to use either activate/dynamic rules or tag's
    to implement it.

    Anyone have some suggestions?

    Thanks,
    - Mark

    P.S. I'm not subscribed to the list. I would appreciate if you would cc:
    me on any responses. Thanks.

    _______________________________________________________________

    Have big pipes? SourceForge.net is looking for download mirrors. We supply
    the hardware. You get the recognition. Email Us: bandwidthsourceforge.net
    _______________________________________________
    Snort-users mailing list
    Snort-userslists.sourceforge.net
    Go to this URL to change user options or unsubscribe:
    https://lists.sourceforge.net/lists/listinfo/snort-users
    Snort-users list archive:
    http://www.geocrawler.com/redir-sf.php3?list=snort-users