0

I am trying to use snort to detect unauthorized HTTP access (wrong credentials or a HTTP status 401 code) by creating snort rules, I tried different combinations of snort options, but none of them fired an alert, here are the rules that I tried:


alert tcp $HOME_NET any <> !$HOME_NET any ( msg:"Possible bruteforce attack"; content:"401"; http_stat_code; flow: stateless;metadata:service http; sid:100112;rev:1;)

alert tcp any any <> any any ( msg:"Possible bruteforce attack"; flow:established,from_server; content:"HTTP/1.1 401 Unauthorized  (text/html)"; sid:100122;rev:1;)

alert tcp any any <> any any (msg:"Possible bruteforce attack";  flow:established,from_server;content:"401"; sid:100102; rev:9;)

alert tcp any any <> any any (msg: "Web resource not found"; content:"401"; http_stat_code; nocase;flow:from_server,established; priority:4; sid:100092; rev:011;) 

alert tcp any any <> any any (msg:"Possible bruteforce attack";content:"401";http_stat_code;nocase;sid:100012;rev:10;)

alert tcp any any <> any any (msg:"Possible bruteforce attack"; file_data;content:"POST"; http_method; content:"HTTP/1.1 401"; nocase;metadata:service http; sid:100032; rev:011;)

alert tcp any any <> any any (msg:"Possible bruteforce attack";pkt_data;content:"401";sid:100042;rev:10;)

alert tcp any any <> any any (msg:"Possible bruteforce attack";content:"401";http_client_body;sid:100052;rev:10;)

alert tcp any any <> any any (msg:"Possible bruteforce attack";content:"Unauthorized";nocase;metadata:service http; sid:100022;rev:10;)

alert tcp any any <> any any (msg:"Possible bruteforce attack";content:"POST";http_method;content:"HTTP/1.1 401";nocase;metadata:service http; sid:100062;rev:10;)

alert tcp any any <> any any (msg:"Possible bruteforce attack";file_data; content:"Unauthorized"; http_header;sid:100072;rev:10;)
alert tcp any any -> any any (content:"401";http_header; msg:"Possible brute force Attack"; flow:stateless; sid:100082;)

I've executed the following command:

sudo snort -A full -dev  -r '/media/sf_ubuntu_share/12-01/http brute_00002_20220112144052'    -i enp0s8 -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort/ 

And here is a sample of packets that I used to examine the rules

01/12-22:41:00.055356 08:00:27:73:1D:1F -> 08:00:27:2D:D5:5C type:0x800 len:0x2F5

192.168.1.7:80 -> 192.168.1.10:59312 TCP TTL:64 TOS:0x0 ID:38364 IpLen:20 DgmLen:743 DF

***AP*** Seq: 0xF698CFB0  Ack: 0x21ABBCCB  Win: 0xEB  TcpLen: 32

TCP Options (3) => NOP NOP TS: 219756 189158 

48 54 54 50 2F 31 2E 31 20 34 30 31 20 55 6E 61  HTTP/1.1 401 Una
75 74 68 6F 72 69 7A 65 64 0D 0A 44 61 74 65 3A  uthorized..Date:
20 57 65 64 2C 20 31 32 20 4A 61 6E 20 32 30 32   Wed, 12 Jan 202
32 20 31 39 3A 34 31 3A 30 30 20 47 4D 54 0D 0A  2 19:41:00 GMT..
53 65 72 76 65 72 3A 20 41 70 61 63 68 65 2F 32  Server: Apache/2
2E 34 2E 37 20 28 55 62 75 6E 74 75 29 0D 0A 57  .4.7 (Ubuntu)..W
57 57 2D 41 75 74 68 65 6E 74 69 63 61 74 65 3A  WW-Authenticate:
20 42 61 73 69 63 20 72 65 61 6C 6D 3D 22 52 65   Basic realm="Re
73 74 72 69 63 74 65 64 20 43 6F 6E 74 65 6E 74  stricted Content
22 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74  "..Content-Lengt
68 3A 20 34 35 37 0D 0A 43 6F 6E 6E 65 63 74 69  h: 457..Connecti
6F 6E 3A 20 63 6C 6F 73 65 0D 0A 43 6F 6E 74 65  on: close..Conte
6E 74 2D 54 79 70 65 3A 20 74 65 78 74 2F 68 74  nt-Type: text/ht
6D 6C 3B 20 63 68 61 72 73 65 74 3D 69 73 6F 2D  ml; charset=iso-
38 38 35 39 2D 31 0D 0A 0D 0A 3C 21 44 4F 43 54  8859-1....<!DOCT
59 50 45 20 48 54 4D 4C 20 50 55 42 4C 49 43 20  YPE HTML PUBLIC 
22 2D 2F 2F 49 45 54 46 2F 2F 44 54 44 20 48 54  "-//IETF//DTD HT
4D 4C 20 32 2E 30 2F 2F 45 4E 22 3E 0A 3C 68 74  ML 2.0//EN">.<ht
6D 6C 3E 3C 68 65 61 64 3E 0A 3C 74 69 74 6C 65  ml><head>.<title
3E 34 30 31 20 55 6E 61 75 74 68 6F 72 69 7A 65  >401 Unauthorize
64 3C 2F 74 69 74 6C 65 3E 0A 3C 2F 68 65 61 64  d</title>.</head
3E 3C 62 6F 64 79 3E 0A 3C 68 31 3E 55 6E 61 75  ><body>.<h1>Unau
74 68 6F 72 69 7A 65 64 3C 2F 68 31 3E 0A 3C 70  thorized</h1>.<p
3E 54 68 69 73 20 73 65 72 76 65 72 20 63 6F 75  >This server cou
6C 64 20 6E 6F 74 20 76 65 72 69 66 79 20 74 68  ld not verify th
61 74 20 79 6F 75 0A 61 72 65 20 61 75 74 68 6F  at you.are autho
72 69 7A 65 64 20 74 6F 20 61 63 63 65 73 73 20  rized to access 
74 68 65 20 64 6F 63 75 6D 65 6E 74 0A 72 65 71  the document.req
75 65 73 74 65 64 2E 20 20 45 69 74 68 65 72 20  uested.  Either 
79 6F 75 20 73 75 70 70 6C 69 65 64 20 74 68 65  you supplied the
20 77 72 6F 6E 67 0A 63 72 65 64 65 6E 74 69 61   wrong.credentia
6C 73 20 28 65 2E 67 2E 2C 20 62 61 64 20 70 61  ls (e.g., bad pa
73 73 77 6F 72 64 29 2C 20 6F 72 20 79 6F 75 72  ssword), or your
0A 62 72 6F 77 73 65 72 20 64 6F 65 73 6E 27 74  .browser doesn't
20 75 6E 64 65 72 73 74 61 6E 64 20 68 6F 77 20   understand how 
74 6F 20 73 75 70 70 6C 79 0A 74 68 65 20 63 72  to supply.the cr
65 64 65 6E 74 69 61 6C 73 20 72 65 71 75 69 72  edentials requir
65 64 2E 3C 2F 70 3E 0A 3C 68 72 3E 0A 3C 61 64  ed.</p>.<hr>.<ad
64 72 65 73 73 3E 41 70 61 63 68 65 2F 32 2E 34  dress>Apache/2.4
2E 37 20 28 55 62 75 6E 74 75 29 20 53 65 72 76  .7 (Ubuntu) Serv
65 72 20 61 74 20 31 39 32 2E 31 36 38 2E 31 2E  er at 192.168.1.
37 20 50 6F 72 74 20 38 30 3C 2F 61 64 64 72 65  7 Port 80</addre
73 73 3E 0A 3C 2F 62 6F 64 79 3E 3C 2F 68 74 6D  ss>.</body></htm
6C 3E 0A                                         l>.



=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+



01/12-22:41:00.055443 08:00:27:2D:D5:5C -> 08:00:27:73:1D:1F type:0x800 len:0x42

192.168.1.10:59312 -> 192.168.1.7:80 TCP TTL:64 TOS:0x0 ID:24300 IpLen:20 DgmLen:52 DF

***A**** Seq: 0x21ABBCCB  Ack: 0xF698D263  Win: 0xEF  TcpLen: 32

TCP Options (3) => NOP NOP TS: 189158 219756 



=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

6
  • I suspect that the problem here is not the snort rule but the file you are using with the packets. Adjust that or use another format to test your rules.
    – schroeder
    Commented Jul 26, 2022 at 15:47
  • I used a pcap file captured by Wireshark. not sure how to adjust that Commented Jul 26, 2022 at 15:57
  • How did you extract the contents to include here? Use the same process to ensure that it is usable by snort. For instance, check the line breaks ...
    – schroeder
    Commented Jul 26, 2022 at 16:03
  • actually, the content that I posted here is copied from snort output. the one that appears when running snort in passive mode Commented Jul 26, 2022 at 16:07
  • So, what you posted is not a sample of the packets you used for snort, but is, in fact, snort's output?
    – schroeder
    Commented Aug 14, 2022 at 11:12

0

You must log in to answer this question.

Browse other questions tagged .