[Snort-users] uricontent questions

Brad W Rothwell ROTHBW at ...1871...
Wed Mar 2 15:30:27 EST 2005

I changed it to a more generic form. 
alert tcp any any <> any any (msg: "foo found"; 
uricontent:"foo"; nocase;)
and it still does not trip an alert.  Ideas?

Brad Rothwell
INL/ICP Cyber Security

Matt Kettler <mkettler at ...4108...> 
Sent by: snort-users-admin at lists.sourceforge.net
03/02/2005 02:43 PM

Brad W Rothwell <ROTHBW at ...1871...>, snort-users at lists.sourceforge.net

Re: [Snort-users] uricontent questions

At 02:54 PM 3/2/2005, Brad W Rothwell wrote:
>All,  I recently installed snort 2.3.0.  My understanding is that I can 
>use uricontent to search for strings as they appear in the browser 
>location bar.  For example, if the address location is 
><http://foo.com/>http://foo.com the following rule should alert.
>alert tcp any any <> $HTTP_SERVERS any (msg: "foo found"; 
>uricontent:"foo"; nocase;)
>I have http_inspect set to the following
>preprocessor http_inspect: global \
>     iis_unicode_map unicode.map 1252
>preprocessor http_inspect_server: server default \
>     profile all ports { 80 8080 8180 } oversize_dir_length 500 
flow_depth 0
>The rule does not alert.  Am I missing something.

what is HTTP_SERVERS set to? The above rule will only alert if the server 
for foo.com is actualy a part of that net range.

SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050302/4caf3a31/attachment.html>

More information about the Snort-users mailing list