I have set up an free evaluation Confluence Server on my local host and have configured "snort.conf" to point to my localhost as "HOME_NET" environment variable.
I tried to test the ICMP rule by running "ping localhost" and I immediately see output in /var/log/snort/alert file. So I know the ICMP rule works correctly.
However, I cannot get any of the "web-attacks.rules" to work. For example, how do I test this rule?
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"WEB-ATTACKS uname -a command attempt"; flow:to_server,established; content:"uname%20-a"; nocase; classtype:web-application-a
ttack; sid:1331; rev:5;)
I would appreciate all / any advise in testing any of the "web-attacks.rules". In fact, if someone could point me to a test script that triggers all the "web-attacks.rules" that would be ideal.