[Snort-sigs] SID 1361

# This is a template for submitting snort signature descriptions to

Rule: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS nmap command attempt"; flow:to_server,established; content:"nmap%20";nocase; sid:1361; classtype:web-application-attack; rev:4;)

--
Sid: 1361

-- 
Summary: A web command execution attack involving the use of a
"nmap" command

-- 
Impact: attacker might have gained an ability to execute system commands
remotely on the system

-- 
Detailed Information: This signature triggers when a "nmap" command
is used over a plain-text (unencrypted) connection on one of the
specified web ports to the target web server. The "nmap" scanner may
be used to perform information gathering activities, such as port
scanning and OS fingerprinting. The signature looks for the "nmap"
command in the client to web server network traffic and does not
indicate whether the command was actually successful. The presence of
the "nmap" command in the URL indicates that an attacker attempted to
trick the web server into executing system in non-interactive mode
i.e. without a valid shell session. Another case when this signature
might trigger is unencrypted HTTP tunneling connection to the server
or a shell connection through an exploit of the web server.

-- 
Attack Scenarios: An attacker uses a "nmap" command to
perform anonymous reconnaissance and scan the machines within the DMZ.

--
Ease of Attack: very easy, no exploit software required

-- 
False Positives: none known

--
False Negatives: none known

-- 
Corrective Action: check the web server software for vulnerabilities
and possible upgrade the system to the latest version, also
investigate the server for signs of compromise

--
Contributors: Anton Chuvakin <
http://www.chuvakin.org>

-- 
Additional References:



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs