I am trying to detect a string in HTML (already unzipped) with Snort. I set this rule to find content 7038685658 in my Apache web server's HTML:

alert tcp any any <> any any (msg:"cell"; file_data; content:"7038685658"; sid:9000001)

This is the location where the content is:

This is the location where the content is in

But I can not detect any alert from Snort. What am I doing wrong?


Try this

alert tcp any any <> any any (msg:"cell"; content:"7038685658"; sid:9000001;http_client_body; )

Make sure you are not loading a cached copy in the browser.

  • I tired, but did not work again. I got rid of cash on the browser and renewed the browser several times to detect content. But it did not work too. – King Dec 9 '17 at 0:49
  • I think you have configuration issue especially LRO. Check this guide (section 8). snort.org/documents/snort-2-9-9-x-on-ubuntu-14-16 – Sari Dec 9 '17 at 3:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.