[Snort-sigs] False positive - sid:1333

Paul Schmehl pauls at ...1311...
Fri Mar 18 12:55:50 EST 2005


/usr/local/share/snort/web-attacks.rules:alert tcp $EXTERNAL_NET any -> 
$HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS id command attempt"; 
flow:to_server,established; content:"|3B|id"; nocase; 
classtype:web-application-attack; sid:1333; rev:6;)

This is a bit of a mystery.  I can't find the string ";id" anywhere in the 
packet.

length = 599

000 : 47 45 54 20 2F 77 65 62 2D 63 74 2F 65 6E 38 2F   GET /web-ct/en8/
010 : 69 6D 67 2F 73 6D 61 6C 6C 5F 75 6E 72 65 61 64   img/small_unread
020 : 5F 6D 65 73 73 61 67 65 73 2E 67 69 66 20 48 54   _messages.gif HT
030 : 54 50 2F 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20   TP/1.1..Accept:
040 : 2A 2F 2A 0D 0A 52 65 66 65 72 65 72 3A 20 68 74   */*..Referer: ht
050 : 74 70 3A 2F 2F 77 65 62 63 74 2E 75 74 64 61 6C   tp://webct.utdal
060 : 6C 61 73 2E 65 64 75 2F 53 43 52 49 50 54 2F 31   las.edu/SCRIPT/1
070 : 30 36 37 38 32 30 30 35 53 2F 73 63 72 69 70 74   06782005S/script
080 : 73 2F 73 74 75 64 65 6E 74 2F 73 65 72 76 65 5F   s/student/serve_
090 : 62 75 6C 6C 65 74 69 6E 3F 41 43 54 49 4F 4E 3D   bulletin?ACTION=
0a0 : 4C 49 53 54 26 41 52 47 31 3D 4D 61 69 6E 26 50   LIST&ARG1=Main&P
0b0 : 41 47 45 3D 30 0D 0A 41 63 63 65 70 74 2D 4C 61   AGE=0..Accept-La
0c0 : 6E 67 75 61 67 65 3A 20 65 6E 2D 75 73 0D 0A 41   nguage: en-us..A
0d0 : 63 63 65 70 74 2D 45 6E 63 6F 64 69 6E 67 3A 20   ccept-Encoding:
0e0 : 67 7A 69 70 2C 20 64 65 66 6C 61 74 65 0D 0A 49   gzip, deflate..I
0f0 : 66 2D 4D 6F 64 69 66 69 65 64 2D 53 69 6E 63 65   f-Modified-Since
100 : 3A 20 46 72 69 2C 20 32 35 20 4A 75 6C 20 32 30   : Fri, 25 Jul 20
110 : 30 33 20 32 33 3A 32 34 3A 35 36 20 47 4D 54 0D   03 23:24:56 GMT.
120 : 0A 49 66 2D 4E 6F 6E 65 2D 4D 61 74 63 68 3A 20   .If-None-Match:
130 : 22 32 31 32 62 64 64 2D 38 62 2D 38 33 33 31 61   "212bdd-8b-8331a
140 : 32 30 30 22 0D 0A 55 73 65 72 2D 41 67 65 6E 74   200"..User-Agent
150 : 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63   : Mozilla/4.0 (c
160 : 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 20   ompatible; MSIE
170 : 36 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20   6.0; Windows NT
180 : 35 2E 31 3B 20 53 56 31 3B 20 2E 4E 45 54 20 43   5.1; SV1; .NET C
190 : 4C 52 20 31 2E 31 2E 34 33 32 32 29 0D 0A 48 6F   LR 1.1.4322)..Ho
1a0 : 73 74 3A 20 77 65 62 63 74 2E 75 74 64 61 6C 6C   st: webct.utdall
1b0 : 61 73 2E 65 64 75 0D 0A 43 6F 6E 6E 65 63 74 69   as.edu..Connecti
1c0 : 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A   on: Keep-Alive..
1d0 : 43 6F 6F 6B 69 65 3A 20 57 65 62 43 54 54 69 63   Cookie: WebCTTic

removed 1e0 through 200 because it was a username/password combo

210 : 48 58 4D 25 32 36 65 78 70 69 72 79 25 33 44 31   HXM%26expiry%3D1
220 : 31 31 30 38 34 37 37 39 36 25 32 36 68 61 73 68   110847796%26hash
230 : 25 33 44 36 61 35 66 33 64 36 31 61 32 64 36 62   %3D6a5f3d61a2d6b
240 : 61 62 62 61 65 64 63 34 65 32 33 64 66 66 61 35   abbaedc4e23dffa5
250 : 63 66 36 0D 0A 0D 0A                              cf6....

I don't know what this alert is triggering on.  If it was in hex, it would 
be |3B 69 64|, but I don't see that anywhere either.  There are four 3Bs 
(;), but none are followed by 69 (i).  So what the heck is this thing 
triggering on?

Paul Schmehl (pauls at ...1311...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-sigs mailing list