0

The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual machine (VirtualBox) running Ubuntu 18.04.

This same qs was asked here but remains unanswered.

For testing purpose, HOME_NET is set as a single machine (192.168.30.102)

The created rule is as follows:

alert tcp $HOME_NET any -> any any (msg:"terrrorism content found"; content:"terrorism"; nocase; sid:10000002;)

This is referred from the excellent video by Dr. Philip Craiger here.
A few other variations also attempted as suggested here and here:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"terrrorism content found"; content:"terrorism"; nocase; sid:10000002;)

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"terrrorism content found"; content:"terrorism"; http_uri; sid:10000002;)

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"terrrorism content found"; content:"terrorism"; http_client_body; sid:10000002;)

For testing, a simple google search was done in the web browser (firefox). However no alerts are getting generated.

The rule to detect the word "HTTP" was executed properly:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP found"; content:"HTTP"; sid:10000002;)

This is a fairly simple rule because 'HTTP' is the first word in the packet application data. However any variation of the previous rule as described above doesn't seem to be working. Alerts are not getting generated.

I am a beginner in this field and trying to learn hence my apologies if this sounds to be a very obvious question. I would appreciate if anyone could point me in the right direction.

6
  • This has nothing to do with network access control. Tag removed.
    – schroeder
    Commented Sep 3, 2019 at 14:21
  • My apologies for the wrong tag, and I also accept the downvote for this. Would you however be kind enough to guide me in finding the solution ?
    – kgkmeekg
    Commented Sep 3, 2019 at 14:22
  • When testing something like this, always run a packet capture to see what the analysis process is seeing. That way, you can debug your settings.
    – schroeder
    Commented Sep 3, 2019 at 14:22
  • Why exactly would you like to do this? Do you think someone in your home network may be a terrorist?
    – user163495
    Commented Sep 3, 2019 at 14:25
  • @MechMK1 I hope not. But the main motive here is to figure out if I can generate Snort alerts for certain types of web searches being done by the user.
    – kgkmeekg
    Commented Sep 3, 2019 at 14:29

1 Answer 1

1

For testing, a simple google search was done in the web browser (firefox).

Search engines today are usually accessed by HTTPS (and this is definitely true with Google). in HTTPS all the HTTP is encrypted which includes the full HTTP request (i.e. the part containing the string "HTTP") and also what is searched for.

Given that Snort only sees the encrypted traffic it will not see the phrases of your signatures in the traffic. These only exist in the decrypted traffic but Snort has no access to this.

6
  • 1. Yeah that was exactly what I was suspecting. So is it is not possible to monitor the content ?
    – kgkmeekg
    Commented Sep 3, 2019 at 14:19
  • 2. I am guessing that if I try to filter the reply packets, I would still face the same problem ?
    – kgkmeekg
    Commented Sep 3, 2019 at 14:20
  • you need to apply snort on unencrypted traffic
    – schroeder
    Commented Sep 3, 2019 at 14:21
  • @smkj33: HTTPS encrypts data in both directions, so you will have the same problem with reply packets. Commented Sep 3, 2019 at 14:32
  • Since most of the reptable websites have TLS/SSL enabled, doesn't that make majority of the Snort content based rules ineffective ?
    – kgkmeekg
    Commented Sep 3, 2019 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .