I'm trying to write a snort rule which outputs an alert whenever a web server returns an HTML document containing a specific string.

I've come up with the following rule:

alert tcp any any -> any any (msg:"Yay"; flow:to_client,established; content:"Content-Type: text/html"; http_header; content:"Hello there"; metadata:service http; sid:12345678; rev:1;)

The first content query checks whether the response contains an HTML document, the second one checks for the presence of the specific string I want to test the response against.

The strange thing is, when removing either of the content fields, the alert works fine. In combination, however, it does not.

Does anyone know why?

  • who's trolling? I found snort rule syntax that used the format I was suggesting. I guess the syntax I found didn't work ... – schroeder Jun 3 '15 at 23:02
  • have you worked with pcre? It will be clunky, but it might work for you. – schroeder Jun 3 '15 at 23:05
  • pcre should only be used if you're trying to match on a dynamic pattern, and should not be used in this case. – Damian T. Jul 13 '18 at 16:50

I know that this is an old question, but this has been something I've run into numerous times, so I figure that providing an answer may help others who have run into this.

My Explanation

In my experience, some versions of Snort have issues when switching from using HTTP options that reply on preprocessor parsing and then switching to not using them. Given the rule you provided, the first content string:

content:"Content-Type: text/html"; http_header;

Utilizes the http preprocessor and the Snort engine sort of gets into the mode of parsing parts of the request/response. Following up with the content string:

content:"Hello there";

... without specifying where to find it, the Snort engine has difficulty finding it.

Of course, this is my "theory" formed upon experience and trial-and-error troubleshooting.

Possible Solutions

  1. Specify content:"Hello there"; before the other content (move to the left). If applicable, specify fast_pattern:only;.

  2. Leave the content:"Hello there"; where it is, but try adding the pkt_data; option prior to it. This would tell Snort to forget about parsing HTTP request/response elements and move the doe_ptr to the beginning of the HTTP request (i.e. the packet) and then search for the content. Or, if that content is expected in the file data of the response, use the file_data; option instead. Again, pkt_data; or file_data; require you to put those options before the content options that need to be affected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.