Re: PCRE and uricontent anchor

[Joel Esler <joel.esler () me com>]

Nice example.

--
Joel Esler
Sent from my iPhone

On Mar 26, 2010, at 2:52 PM, "evilghost () packetmail net" <evilghost () packetmail net 
> wrote:

> There's no reason that Joel's wouldn't work but like all things  
> there's
> multiple solutions.  I'd write it like this:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Evil  
> stuff";
> flow:established,to_server; content:"POST"; nocase; http_method;
> uricontent:".aspx?id="; nocase; pcre:"/\.aspx\?id=\d+$/Ui"; classtype:
> bad-unknown; sid:2010xxx; rev:1;)
>
> Please note the preceding period in ".aspx" uricontent match as well  
> as
> the PCRE and the end of string/buffer anchor in the URI constrained  
> PCRE
> which matches the cast of the id= query_string.
>
> Hope this helped.  Replace $HTTP_PORTS with 443 if you're really only
> concerned with an HTTPS endpoitn.
>
> -evilghost
>
> Curt Shaffer wrote:
> > I am attempting to write a rule that would capture a POST event to  
> > a url with a specific file. Here is an example:
> >
> > https://www.example.com/abc.aspx?id=459184950
> >
> > The id section is always different. We also want to look for any  
> > similar POSTS to any address. With that in mind, here is the basis  
> > of what we came up with.
> >
> > alert tcp $home_net any -> $external_net 443 (msg:"Bad stuff  
> > potentially going on"; pcre:"a.\.aspx\?id=.*"; classtype: trojan- 
> > activity; sid:10000015; rev:1;)
> >
> > My question is, I suppose can we use a pcre match with no content  
> > or uricontent anchor, but that would be a pretty slow rule most  
> > likely. Does anyone have a suggestion on how I could anchor this to  
> > make it more efficient?
> >
> > Thanks
> >
> > Curt
> > --- 
> > --- 
> > --- 
> > ---------------------------------------------------------------------
> > Download Intel&#174; Parallel Studio Eval
> > Try the new software tools for yourself. Speed compiling, find bugs
> > proactively, and fine-tune applications for parallel performance.
> > See why Intel Parallel Studio got high marks during beta.
> > http://p.sf.net/sfu/intel-sw-dev
> > _______________________________________________
> > Snort-sigs mailing list
> > Snort-sigs () lists sourceforge net
> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>
> --- 
> --- 
> --- 
> ---------------------------------------------------------------------
> Download Intel&#174; Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs

------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs