I am trying to use snort to detect unauthorized HTTP access (wrong credentials or a HTTP status 401 code) by creating snort rules, I tried different combinations of snort options, but none of them fired an alert, here are the rules that I tried:
alert tcp $HOME_NET any <> !$HOME_NET any ( msg:"Possible bruteforce attack"; content:"401"; http_stat_code; flow: stateless;metadata:service http; sid:100112;rev:1;)
alert tcp any any <> any any ( msg:"Possible bruteforce attack"; flow:established,from_server; content:"HTTP/1.1 401 Unauthorized (text/html)"; sid:100122;rev:1;)
alert tcp any any <> any any (msg:"Possible bruteforce attack"; flow:established,from_server;content:"401"; sid:100102; rev:9;)
alert tcp any any <> any any (msg: "Web resource not found"; content:"401"; http_stat_code; nocase;flow:from_server,established; priority:4; sid:100092; rev:011;)
alert tcp any any <> any any (msg:"Possible bruteforce attack";content:"401";http_stat_code;nocase;sid:100012;rev:10;)
alert tcp any any <> any any (msg:"Possible bruteforce attack"; file_data;content:"POST"; http_method; content:"HTTP/1.1 401"; nocase;metadata:service http; sid:100032; rev:011;)
alert tcp any any <> any any (msg:"Possible bruteforce attack";pkt_data;content:"401";sid:100042;rev:10;)
alert tcp any any <> any any (msg:"Possible bruteforce attack";content:"401";http_client_body;sid:100052;rev:10;)
alert tcp any any <> any any (msg:"Possible bruteforce attack";content:"Unauthorized";nocase;metadata:service http; sid:100022;rev:10;)
alert tcp any any <> any any (msg:"Possible bruteforce attack";content:"POST";http_method;content:"HTTP/1.1 401";nocase;metadata:service http; sid:100062;rev:10;)
alert tcp any any <> any any (msg:"Possible bruteforce attack";file_data; content:"Unauthorized"; http_header;sid:100072;rev:10;)
alert tcp any any -> any any (content:"401";http_header; msg:"Possible brute force Attack"; flow:stateless; sid:100082;)
I've executed the following command:
sudo snort -A full -dev -r '/media/sf_ubuntu_share/12-01/http brute_00002_20220112144052' -i enp0s8 -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort/
And here is a sample of packets that I used to examine the rules
01/12-22:41:00.055356 08:00:27:73:1D:1F -> 08:00:27:2D:D5:5C type:0x800 len:0x2F5
192.168.1.7:80 -> 192.168.1.10:59312 TCP TTL:64 TOS:0x0 ID:38364 IpLen:20 DgmLen:743 DF
***AP*** Seq: 0xF698CFB0 Ack: 0x21ABBCCB Win: 0xEB TcpLen: 32
TCP Options (3) => NOP NOP TS: 219756 189158
48 54 54 50 2F 31 2E 31 20 34 30 31 20 55 6E 61 HTTP/1.1 401 Una
75 74 68 6F 72 69 7A 65 64 0D 0A 44 61 74 65 3A uthorized..Date:
20 57 65 64 2C 20 31 32 20 4A 61 6E 20 32 30 32 Wed, 12 Jan 202
32 20 31 39 3A 34 31 3A 30 30 20 47 4D 54 0D 0A 2 19:41:00 GMT..
53 65 72 76 65 72 3A 20 41 70 61 63 68 65 2F 32 Server: Apache/2
2E 34 2E 37 20 28 55 62 75 6E 74 75 29 0D 0A 57 .4.7 (Ubuntu)..W
57 57 2D 41 75 74 68 65 6E 74 69 63 61 74 65 3A WW-Authenticate:
20 42 61 73 69 63 20 72 65 61 6C 6D 3D 22 52 65 Basic realm="Re
73 74 72 69 63 74 65 64 20 43 6F 6E 74 65 6E 74 stricted Content
22 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 "..Content-Lengt
68 3A 20 34 35 37 0D 0A 43 6F 6E 6E 65 63 74 69 h: 457..Connecti
6F 6E 3A 20 63 6C 6F 73 65 0D 0A 43 6F 6E 74 65 on: close..Conte
6E 74 2D 54 79 70 65 3A 20 74 65 78 74 2F 68 74 nt-Type: text/ht
6D 6C 3B 20 63 68 61 72 73 65 74 3D 69 73 6F 2D ml; charset=iso-
38 38 35 39 2D 31 0D 0A 0D 0A 3C 21 44 4F 43 54 8859-1....<!DOCT
59 50 45 20 48 54 4D 4C 20 50 55 42 4C 49 43 20 YPE HTML PUBLIC
22 2D 2F 2F 49 45 54 46 2F 2F 44 54 44 20 48 54 "-//IETF//DTD HT
4D 4C 20 32 2E 30 2F 2F 45 4E 22 3E 0A 3C 68 74 ML 2.0//EN">.<ht
6D 6C 3E 3C 68 65 61 64 3E 0A 3C 74 69 74 6C 65 ml><head>.<title
3E 34 30 31 20 55 6E 61 75 74 68 6F 72 69 7A 65 >401 Unauthorize
64 3C 2F 74 69 74 6C 65 3E 0A 3C 2F 68 65 61 64 d</title>.</head
3E 3C 62 6F 64 79 3E 0A 3C 68 31 3E 55 6E 61 75 ><body>.<h1>Unau
74 68 6F 72 69 7A 65 64 3C 2F 68 31 3E 0A 3C 70 thorized</h1>.<p
3E 54 68 69 73 20 73 65 72 76 65 72 20 63 6F 75 >This server cou
6C 64 20 6E 6F 74 20 76 65 72 69 66 79 20 74 68 ld not verify th
61 74 20 79 6F 75 0A 61 72 65 20 61 75 74 68 6F at you.are autho
72 69 7A 65 64 20 74 6F 20 61 63 63 65 73 73 20 rized to access
74 68 65 20 64 6F 63 75 6D 65 6E 74 0A 72 65 71 the document.req
75 65 73 74 65 64 2E 20 20 45 69 74 68 65 72 20 uested. Either
79 6F 75 20 73 75 70 70 6C 69 65 64 20 74 68 65 you supplied the
20 77 72 6F 6E 67 0A 63 72 65 64 65 6E 74 69 61 wrong.credentia
6C 73 20 28 65 2E 67 2E 2C 20 62 61 64 20 70 61 ls (e.g., bad pa
73 73 77 6F 72 64 29 2C 20 6F 72 20 79 6F 75 72 ssword), or your
0A 62 72 6F 77 73 65 72 20 64 6F 65 73 6E 27 74 .browser doesn't
20 75 6E 64 65 72 73 74 61 6E 64 20 68 6F 77 20 understand how
74 6F 20 73 75 70 70 6C 79 0A 74 68 65 20 63 72 to supply.the cr
65 64 65 6E 74 69 61 6C 73 20 72 65 71 75 69 72 edentials requir
65 64 2E 3C 2F 70 3E 0A 3C 68 72 3E 0A 3C 61 64 ed.</p>.<hr>.<ad
64 72 65 73 73 3E 41 70 61 63 68 65 2F 32 2E 34 dress>Apache/2.4
2E 37 20 28 55 62 75 6E 74 75 29 20 53 65 72 76 .7 (Ubuntu) Serv
65 72 20 61 74 20 31 39 32 2E 31 36 38 2E 31 2E er at 192.168.1.
37 20 50 6F 72 74 20 38 30 3C 2F 61 64 64 72 65 7 Port 80</addre
73 73 3E 0A 3C 2F 62 6F 64 79 3E 3C 2F 68 74 6D ss>.</body></htm
6C 3E 0A l>.
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
01/12-22:41:00.055443 08:00:27:2D:D5:5C -> 08:00:27:73:1D:1F type:0x800 len:0x42
192.168.1.10:59312 -> 192.168.1.7:80 TCP TTL:64 TOS:0x0 ID:24300 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x21ABBCCB Ack: 0xF698D263 Win: 0xEF TcpLen: 32
TCP Options (3) => NOP NOP TS: 189158 219756
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
