0

The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual machine (VirtualBox) running Ubuntu 18.04.

This same qs was asked here but remains unanswered.

For testing purpose, HOME_NET is set as a single machine (192.168.30.102)

The created rule is as follows:

alert tcp $HOME_NET any -> any any (msg:"terrrorism content found"; content:"terrorism"; nocase; sid:10000002;)

This is referred from the excellent video by Dr. Philip Craiger here.
A few other variations also attempted as suggested here and here:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"terrrorism content found"; content:"terrorism"; nocase; sid:10000002;)

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"terrrorism content found"; content:"terrorism"; http_uri; sid:10000002;)

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"terrrorism content found"; content:"terrorism"; http_client_body; sid:10000002;)

For testing, a simple google search was done in the web browser (firefox). However no alerts are getting generated.

The rule to detect the word "HTTP" was executed properly:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP found"; content:"HTTP"; sid:10000002;)

This is a fairly simple rule because 'HTTP' is the first word in the packet application data. However any variation of the previous rule as described above doesn't seem to be working. Alerts are not getting generated.

I am a beginner in this field and trying to learn hence my apologies if this sounds to be a very obvious question. I would appreciate if anyone could point me in the right direction.

  • This has nothing to do with network access control. Tag removed. – schroeder Sep 3 at 14:21
  • My apologies for the wrong tag, and I also accept the downvote for this. Would you however be kind enough to guide me in finding the solution ? – kgkmeekg Sep 3 at 14:22
  • When testing something like this, always run a packet capture to see what the analysis process is seeing. That way, you can debug your settings. – schroeder Sep 3 at 14:22
  • Why exactly would you like to do this? Do you think someone in your home network may be a terrorist? – MechMK1 Sep 3 at 14:25
  • @MechMK1 I hope not. But the main motive here is to figure out if I can generate Snort alerts for certain types of web searches being done by the user. – kgkmeekg Sep 3 at 14:29
1

For testing, a simple google search was done in the web browser (firefox).

Search engines today are usually accessed by HTTPS (and this is definitely true with Google). in HTTPS all the HTTP is encrypted which includes the full HTTP request (i.e. the part containing the string "HTTP") and also what is searched for.

Given that Snort only sees the encrypted traffic it will not see the phrases of your signatures in the traffic. These only exist in the decrypted traffic but Snort has no access to this.

  • 1. Yeah that was exactly what I was suspecting. So is it is not possible to monitor the content ? – kgkmeekg Sep 3 at 14:19
  • 2. I am guessing that if I try to filter the reply packets, I would still face the same problem ? – kgkmeekg Sep 3 at 14:20
  • you need to apply snort on unencrypted traffic – schroeder Sep 3 at 14:21
  • @smkj33: HTTPS encrypts data in both directions, so you will have the same problem with reply packets. – Steffen Ullrich Sep 3 at 14:32
  • Since most of the reptable websites have TLS/SSL enabled, doesn't that make majority of the Snort content based rules ineffective ? – kgkmeekg Sep 3 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.