[Snort-sigs] sid: 1113 - FPs

This is another example of a rule that I hope can be improved upon:

web-misc.rules

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC http directory traversal"; flow:to_server,established; content: "../"; reference:arachnids,297; classtype:attempted-recon; sid:1113; rev:4;)

content: "../" will trigger on any webpage that uses relative paths to reference files in Unix directories. We have tons of pages that do this, so we get many alerts. However, the Arachnids description is very specific.

"Contents: "../" The packet offset is zero, meaning that we start looking for this content string in the start of the packet data. This is a case sensitive search."

The request must come with a GET in front of it in order to exploit the vulnerability. In fact the packet trace that Arachnids shows to explain the exploit shows that clearly:

07/08-12:29:21.103460 attacker:1737 -> target:80 TCP TTL:64 TOS:0x10 ID:48175 DF
*****PA* Seq: 0x8CDE2D5B Ack: 0xD24163C Win: 0x7FB8 TCP Options => NOP NOP TS: 152351356 190236 47 45 54 20 2F 63 67 69 2D 62 69 6E 2F 66 6F 6F GET /cgi-bin/foo

62 61 72 2E 70 6C 3F 2F 62 6F 72 69 6E 67 2F 2E  bar.pl?/boring/.
2E 2F 2E 2E 2F 2E 2E 2F 65 74 63 2F 70 61 73 73  ./../../etc/pass
77 64 20 48 54 54 50 2F 31 2E 30 0A              wd HTTP/1.0.

It seems that this rule could be improved by using

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related snort.org Links snort-announce snort-cvsinfo snort-devel snort-sigs snort-users Request more information about Pantek

uricontent: "../"; depth: 512;

or

content: "GET /cgi-bin/"; nocase; offset: "0"; content: "../"; within: 50;

or something similar, to eliminate FPs from the body of an HTML document.

Here's a payload that shows a FP:

290 : 30 22 3E 3C 74 72 3E 3C 74 64 20 61 6C 69 67 6E   0">