RE: [Snort-users] Testing Snort

permalink · #1 (**permalink**) 08-02-2004

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C478A4.9875E790
Content-Type: text/plain

I spoke too soon!

It now detects the WEB-IIS attacks if I run them from the PC running snort.

Cheers,

Jody

_____

From: Jody Gilbert
Sent: 02 August 2004 15:45
To: 'Joshua Berry'
Cc: snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] Testing Snort

It looks like this could be something to do with either Windows XP or XP
SP2.

I have just installed Snort on a Windows 2000 SP4 and it is working a treat.

Thanks,

Jody

_____

From: Joshua Berry [mailto:jberry@PENSON.COM]
Sent: 02 August 2004 14:24
To: Jody Gilbert
Cc: snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] Testing Snort

Do you have the http_inspect preprocessor enabled and correctly configured?

-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Jody Gilbert
Sent: Sunday, August 01, 2004 3:24 PM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Testing Snort

Hello All,

I have just installed snort for the first time and am trying to test it from
my PC.

I am having trouble testing the web-iis rules.

I have tried accessing /msadcs.dll and /cmd.exe on some of the web servers
on our LAN, but no alerts are created by snort.

I added the following rule Snort as a test, which produced plenty of alerts:

alert tcp any any -> $HOME_NET $HTTP_PORTS (msg:"Test WEB-IIS";
flow:to_server; sid:1970; rev:6;)

However, when I add 'uricontent:"/msadcs.dll"; nocase;' to the above rule I
do not get any alerts.

I am new to Snort, so I imagine (hope) it's something pretty simple.

Can anyone point me in the right direction?

I am running Snort 2.1.3 on a Windows XP PC.

Cheers,

Jody

-------------------------------------------------------------------------

Jody Gilbert
IT Manager

Ovum
Cardinal Tower
12 Farringdon Road
London, EC1M 3HS

Direct Line: +44 (0) 20 7551 9002
Mobile: +44 (0) 7775 826 806
Fax: +44 (0) 20 7551 9090
Email: <mailto:jdg@ovum.com> jdg@ovum.com
<http://www.ovum.com/> www.ovum.com

Advising on the commercial impact of technology and market changes in
Telecoms, software and IT services. Ovum has offices in London, Paris,
Cologne, Boston, Melbourne and Seoul.

*************** NOTICE & DISCLAIMER *************************

This email and any files transmitted with it are confidential and will be
protected by copyright and are for the attention of the addressee only. This
email may also be privileged.

If you have received this email in error please notify us by email reply and
delete it from your system.
You may not copy this message or disclose its contents to anyone. Any views
or opinions presented in this email are solely those of the author and do
not necessarily represent those of Ovum. Ovum accepts no liability for the
content of this email, or for the consequences of any actions taken on the
basis of the information provided, unless you are the intended recipient and
such liability accords with Ovum's Terms and Conditions of Business.

If you are not the intended recipient, please note that disclosing, copying,
distributing or taking any action in reliance on the contents of this
information is strictly prohibited.

Ovum accepts no liability for any damage caused by any virus transmitted by
this email.

Registered Office: Ovum Holdings Limited, Cardinal Tower, 12 Farringdon
Road, London EC1M 3HS, United Kingdom

************************************************** *****************

*************** NOTICE & DISCLAIMER *************************

This email and any files transmitted with it are confidential and will be protected by copyright and are for the attention of the addressee only. This email may also be privileged.

If you have received this email in error please notify us by email reply and delete it from your system.
You may not copy this message or disclose its contents to anyone. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Ovum. Ovum accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless you are the intended recipient and such liability accords with Ovum's Terms and Conditions of Business.

If you are not the intended recipient, please note that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

Ovum accepts no liability for any damage caused by any virus transmitted by this email.

Registered Office: Ovum Holdings Limited, Cardinal Tower, 12 Farringdon Road, London EC1M 3HS, United Kingdom

************************************************** *****************

------_=_NextPart_001_01C478A4.9875E790
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:st1=3D"urn:schemas-microsoft-com:office:smarttags" xmlns=3D"http://ww=
w.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Dus-ascii">

<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">

<title>Testing Snort</title>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"country-region"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"PlaceType"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"PlaceName"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"place"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"Street"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"PostalCode"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"City"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"address"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"time"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"stocktickeruk"/>
<o:SmartTagType namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"PersonName"/>

<style>

</style>

</head>

<body lang=3DEN-GB link=3Dblue vlink=3Dblue>

<div class=3DSection1>

I spoke too soon!<o:p></o:p></f=
ont>

<o:p> </o:p>

It now detects the <st1:stocktickeruk
w:st=3D"on">WEB</st1:stocktickeruk>-IIS attacks if I run them from the PC r=
unning
snort.<o:p></o:p>

<o:p> </o:p>

Cheers,<o:p></o:p>

Jody<o:p></o:p>

<o:p> </o:p>

<div>

<div class=3DMsoNormal align=3Dcenter style=3D'text-align:center'>

<hr size=3D2 width=3D"100%" align=3Dcenter tabindex=3D-1>

</div>

From:=

Jody Gilbert 
Sent: 02 August 2004 15:45<b=
r>
To: 'Joshua Berry' 
Cc: <st1:PersonName w:st=3D"=
on">snort-users@lists.sourceforge.net</st1:PersonName> 
Subject: RE: [Snort-users] T=
esting
Snort<o:p></o:p>

</div>

<o:p> </o:p>

It looks like this could be something =
to
do with either Windows XP or XP SP2.<o:p></o:p>

I have just installed Snort on a Windo=
ws
2000 SP4 and it is working a treat.<o:p></o:p>

<o:p> </o:p>

Thanks,<o:p></o:p>

Jody<o:p></o:p>

<o:p> </o:p>

<div>

<div class=3DMsoNormal align=3Dcenter style=3D'text-align:center'>

<hr size=3D2 width=3D"100%" align=3Dcenter tabindex=3D-1>

</div>

From:=

Joshua Berry [mailto:jberry@PENSON.COM] 
Sent: 02 August 2004 14:24<b=
r>
To: Jody Gilbert 
Cc: <st1:PersonName w:st=3D"=
on">snort-users@lists.sourceforge.net</st1:PersonName> 
Subject: RE: [Snort-users] T=
esting
Snort<o:p></o:p>

</div>

<o:p> </o:p>

Do you have the
http_inspect preprocessor enabled and correctly configured?<o:p></o:p></spa=
n>

<o:p> </o:p></=
span>

-----Original
Message----- 
From: snort-users-admin@list=
s.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Jody Gilbert 
Sent: Sunday, August 01, 200=
4 <st1:time
Minute=3D"24" Hour=3D"15" w:st=3D"on">3:24 PM</st1:time> 
To: <st1:PersonName w:st=3D"=
on">snort-users@lists.sourceforge.net</st1:PersonName> 
Subject: [Snort-users] Testi=
ng
Snort<o:p></o:p>

<o:p=
> </o:p>

Hello All,<o:p></o:p>

I have just installed snort fo=
r the
first time and am trying to test it from my PC.<o:p></o:p>

I am having trouble testing the
web-iis rules.<o:p></o:p>

I have tried accessing<=
/font> /msadcs.dll and /cmd.exe on some of the web serve=
rs
on our <st1:stocktickeruk w:st=3D"on">LAN</st1:stocktickeruk>, but no alert=
s are
created by snort.<o:p></o:p>

I added the following rule</sp=
an> Snort <fo=
nt
size=3D2 face=3DArial>as
a test, which produced plenty of
alerts:<o:p></o:p>

alert tcp any any -> $HOME_=
<st1:stocktickeruk
w:st=3D"on">NET</st1:stocktickeruk> $HTTP_PORTS (msg:"Test <st1:stockt=
ickeruk
w:st=3D"on">WEB</st1:stocktickeruk>-IIS"; flow:to_server; sid:1970; re=
v:6;)<o:p></o:p>

However, when I add</fo=
nt> 'uricontent:"/msadcs.dll"; nocase;' to =
the
above rule I do not get any alerts.<o:p></=
o:p>

I am new to Snort, so I imagine
(hope) it's something pretty simple.<o:p></o:p>

Can anyone point me in the rig=
ht
direction?<o:p></o:p>

I am running Snort 2.1.3 on a
Windows XP PC.<o:p></o:p>

Cheers,<o:p></o:p>

Jody<o:p></o:p>

<o:p=
> </o:p>

<=
span
lang=3DEN-US style=3D'font-size:10.0pt;font-family:Arial;color:black'>-----=
--------------------------------------------------------------------=
 
  
Jody Gi=
lbert 
IT Manager 
  
Ovum 
<st1:place w:st=3D"on"><st1:PlaceName w:st=3D"on">Cardinal</st1:PlaceName> <st1:PlaceType w:st=3D"on">Tower</st1:PlaceType></s=
pan></st1:place> 
<st1:Street w:st=3D"on"><st1:address w:st=3D"on">12 Farringdon Road</st1:address></st1=
:Street> 
<st1:place w:st=3D"on"><st1:City w:st=3D"on">London</st1:City>=
, <st1:PostalCode w:st=3D"on">EC1M 3HS</st1:PostalCo=
de></st1:place> 
 
Direct =
Line:
+44 (0) 20 7551 9002 
<st1:place w:st=3D"on"><st1:City w:st=3D"on">Mobile</st1:City=
></st1:place>: +44 (0) 7775 8=
26 806 
Fax: +4=
4 (0) 20
7551 9090 
Email: <a href=3D"mailto:jdg@ovum.com">jdg@ovum.com<=
/span></a> 
<a href=3D"http://www.ovum.com/">www.ovum.com<=
/span></a> <o:p></o:p>

Advising on the commercial imp=
act of
technology and market changes in Telecoms, software and IT services.  =
Ovum
has offices in <st1:City w:st=3D"on">London</st1:City>, <st1:City w:st=3D"o=
n">Paris</st1:City>,
<st1:City w:st=3D"on">Cologne</st1:City>, <st1:City w:st=3D"on">Boston</st1=
:City>, <st1:City
w:st=3D"on">Melbourne</st1:City> and <st1:place w:st=3D"on"><st1:City w:st=
=3D"on">Seoul</st1:City></st1:place>.<o:p></o:p>

 
 
*************** NOTICE & DISCLAIMER ************************* 
 
This email and any files transmitted with it are confidential and will be
protected by copyright and are for the attention of the addressee only. This
email may also be privileged. 
 
If you have received this email in error please notify us by email reply and
delete it from your system. 
You may not copy this message or disclose its contents to anyone. Any views=
or
opinions presented in this email are solely those of the author and do not
necessarily represent those of Ovum. Ovum accepts no liability for the cont=
ent
of this email, or for the consequences of any actions taken on the basis of=
the
information provided, unless you are the intended recipient and such liabil=
ity
accords with Ovum's Terms and Conditions of Business. 
 
If you are not the intended recipient, please note that disclosing, copying,
distributing or taking any action in reliance on the contents of this
information is strictly prohibited. 
 
Ovum accepts no liability for any damage caused by any virus transmitted by
this email. 
 
Registered Office: Ovum Holdings Limited, <st1:PlaceName w:st=3D"on">Cardin=
al</st1:PlaceName>
<st1:PlaceType w:st=3D"on">Tower</st1:PlaceType>, <st1:place w:st=3D"on">12
Farringdon Road, <st1:City w:st=3D"on">London</st1:City> <st1:PostalCode w=
:st=3D"on">EC1M
3HS</st1:PostalCode>, <st1:country-region w:st=3D"on">United Kingdom</st1=
:country-region></st1:place> 
 
************************************************** *****************<=
/font><o:p></o:p>

</div>

 
 
*************** NOTICE & DISCLAIMER ************************* 
 
This email and any files transmitted with it are confidential and will be p=
rotected by copyright and are for the attention of the addressee only. Thi=
s email may also be privileged. 
 
If you have received this email in error please notify us by email reply an=
d delete it from your system. 
You may not copy this message or disclose its contents to anyone. Any view=
s or opinions presented in this email are solely those of the author and do=
not necessarily represent those of Ovum. Ovum accepts no liability for th=
e content of this email, or for the consequences of any actions taken on th=
e basis of the information provided, unless you are the intended recipient =
and such liability accords with Ovum's Terms and Conditions of Business. <=
BR>
 
If you are not the intended recipient, please note that disclosing, copying=
, distributing or taking any action in reliance on the contents of this inf=
ormation is strictly prohibited. 
 
Ovum accepts no liability for any damage caused by any virus transmitted by=
this email. 
 
Registered Office: Ovum Holdings Limited, Cardinal Tower, 12 Farringdon Roa=
d, London EC1M 3HS, United Kingdom 
 
************************************************** ***************** 

</body>

</html>

------_=_NextPart_001_01C478A4.9875E790--

-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode