Snort http rules not generating alerts
-
Http rules are not generating alerts but the preprocessor rules generate alerts just fine. I think this might be due to the custom pass list I created automatically including local interfaces though I did not check that box in the config screen. There are even ip6 addresses in that pass list yet I do not have ipv6 enabled for any interfaces. It's not what I expected but maybe this is normal.
If anyone could shed light on what I'm doing wrong, I sure would appreciate it.
About my setup
pfSense 2.4.2-RELEASE-p1
haproxy 0.54_2 (1.7.10)
snort 3.2.9.6 (2.9.11.1)--https--> [haproxy] --http--> [IIS] ^ snort on LANRuleset emerging threats open - web server category
Test case
Rule
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible DROP SQL Injection Attempt"; flow:to_server,established; content:"DROP"; nocase; http_uri; pcre:"/DROP\ +(database|procedure|table|column)/Ui"; reference:url,www.owasp.org/index.php/SQL_Injection; reference:url,www.w3schools.com/SQl/sql_drop.asp; reference:url,doc.emergingthreats.net/2010085; classtype:web-application-attack; sid:2010085; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, deployment Datacenter, tag SQL_Injection, signature_severity Major, created_at 2010_07_30, updated_at 2016_07_01;)String entered into web form
'; DROP DATABASE FOO --'Excerpt from packet capture verifying presence of offending string
Form item: "LastName" = "';drop database something –'"snort.config
snort configuration file
generated automatically by the pfSense subsystems do not modify manually
Define Local Network
ipvar HOME_NET [10.0.0.4,10.0.0.5,10.0.0.9,10.0.0.11,127.0.0.1,::1,fe80::20d:3aff:fef3:30e4]
ipvar EXTERNAL_NET [[10.0.0.4,10.0.0.11,fe80::20d:3aff:fef3:30e4]]Define Rule Path
var RULE_PATH /usr/local/etc/snort/snort_50718_hn1/rules
Define Servers
ipvar DNS_SERVERS [$HOME_NET]
ipvar SMTP_SERVERS [$HOME_NET]
ipvar HTTP_SERVERS [10.0.0.5]
ipvar WWW_SERVERS [$HOME_NET]
ipvar SQL_SERVERS [$HOME_NET]
ipvar TELNET_SERVERS [$HOME_NET]
ipvar SNMP_SERVERS [$HOME_NET]
ipvar FTP_SERVERS [$HOME_NET]
ipvar SSH_SERVERS [$HOME_NET]
ipvar POP_SERVERS [$HOME_NET]
ipvar IMAP_SERVERS [$HOME_NET]
ipvar SIP_PROXY_IP [$HOME_NET]
ipvar SIP_SERVERS [$HOME_NET]
ipvar RPC_SERVERS [$HOME_NET]
ipvar DNP3_SERVER [$HOME_NET]
ipvar DNP3_CLIENT [$HOME_NET]
ipvar MODBUS_SERVER [$HOME_NET]
ipvar MODBUS_CLIENT [$HOME_NET]
ipvar ENIP_SERVER [$HOME_NET]
ipvar ENIP_CLIENT [$HOME_NET]
ipvar AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]Define Server Ports
portvar DNS_PORTS [53]
portvar SMTP_PORTS [25]
portvar MAIL_PORTS [25,465,587,691]
portvar HTTP_PORTS [36,80,81,82,83,84,85,86,87,88,89,90,311,383,591,593,631,901,1220,1414,1533,1741,1830,2301,2381,2809,3037,3057,3128,3443,3702,4343,4848,5250,6080,6988,7000,7001,7144,7145,7510,7777,7779,8000,8008,8014,8028,8080,8081,8082,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8800,8888,8899,9000,9060,9080,9090,9091,9443,9999,10000,11371,15489,29991,33300,34412,34443,34444,41080,44440,50000,50002,51423,55555,56712]
portvar ORACLE_PORTS [1024:]
portvar MSSQL_PORTS [1433]
portvar TELNET_PORTS [23]
portvar SNMP_PORTS [161]
portvar FTP_PORTS [21,2100,3535]
portvar SSH_PORTS [22]
portvar POP2_PORTS [109]
portvar POP3_PORTS [110]
portvar IMAP_PORTS [143]
portvar SIP_PORTS [5060,5061,5600]
portvar AUTH_PORTS [113]
portvar FINGER_PORTS [79]
portvar IRC_PORTS [6665,6666,6667,6668,6669,7000]
portvar SMB_PORTS [139,445]
portvar NNTP_PORTS [119]
portvar RLOGIN_PORTS [513]
portvar RSH_PORTS [514]
portvar SSL_PORTS [443,465,563,636,989,992,993,994,995,7801,7802,7900,7901,7902,7903,7904,7905,7906,7907,7908,7909,7910,7911,7912,7913,7914,7915,7916,7917,7918,7919,7920]
portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143]
portvar SHELLCODE_PORTS [!80]
portvar SUN_RPC_PORTS [111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779]
portvar DCERPC_NCACN_IP_TCP [139,445]
portvar DCERPC_NCADG_IP_UDP [138,1024:]
portvar DCERPC_NCACN_IP_LONG [135,139,445,593,1024:]
portvar DCERPC_NCACN_UDP_LONG [135,1024:]
portvar DCERPC_NCACN_UDP_SHORT [135,593,1024:]
portvar DCERPC_NCACN_TCP [2103,2105,2107]
portvar DCERPC_BRIGHTSTORE [6503,6504]
portvar DNP3_PORTS [20000]
portvar MODBUS_PORTS [502]
portvar GTP_PORTS [2123,2152,3386]Configure the snort decoder
config checksum_mode: none
config disable_decode_alerts
config disable_tcpopt_experimental_alerts
config disable_tcpopt_obsolete_alerts
config disable_ttcp_alerts
config disable_tcpopt_alerts
config disable_ipopt_alerts
config disable_decode_dropsEnable the GTP decoder
config enable_gtp
Configure PCRE match limitations
config pcre_match_limit: 3500
config pcre_match_limit_recursion: 1500Configure the detection engine
config detection: search-method ac-bnfa max-pattern-len 20 max_queue_events 5
config event_queue: max_queue 8 log 5 order_events content_lengthConfigure to show year in timestamps
config show_year
Configure IPv6 address logging in unified2 extra data
config log_ipv6_extra_data
Configure protocol aware flushing
For more information see README.stream5
config paf_max: 16000
Configure dynamically loaded libraries
dynamicpreprocessor directory /usr/local/etc/snort/snort_50718_hn1/snort_dynamicpreprocessor
dynamicengine directory /usr/local/lib/snort_dynamicengine
dynamicdetection directory /usr/local/lib/snort_dynamicrulesInline packet normalization. For more information, see README.normalize
Disabled since we do not use "inline" mode with pfSense
preprocessor normalize_ip4
preprocessor normalize_tcp: ips ecn stream
preprocessor normalize_icmp4
preprocessor normalize_ip6
preprocessor normalize_icmp6
Flow and stream
preprocessor frag3_global: memcap 4194304, max_frags 8192
preprocessor frag3_engine: policy bsd
timeout 60
min_ttl 1
detect_anomalies
overlap_limit 0
min_fragment_length 0preprocessor stream5_global:
track_tcp yes,
max_tcp 262144,
track_udp yes,
max_udp 131072,
track_icmp no,
memcap 8388608,
prune_log_max 1048576preprocessor stream5_tcp: policy bsd,
timeout 30,
overlap_limit 0,
max_window 0,
max_queued_bytes 1048576,
max_queued_segs 2621,
ports client 21 22 23 25 42 53 70 79 109 110 111 113 119 135 136 137
139 143 161 445 513 514 587 593 691 1433 1521 1741
2100 3306 6070 6665 6666 6667 6668 6669 7000 8181
32770 32771 32772 32773 32774 32775 32776 32777
32778 32779,
ports both 80 81 82 83 84 85 86 87 88 89 90 110 311 383 443 465 563
591 593 631 636 901 989 992 993 994 995 1220 1414 1533
1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848
5250 6080 6988 7907 7000 7001 7144 7145 7510 7802 7777
7779 7801 7900 7901 7902 7903 7904 7905 7906 7908 7909
7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920
8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118
8123 8180 8222 8243 8280 8300 8500 8800 8888 8899 9000
9060 9080 9090 9091 9443 9999 10000 11371 15489 29991
33300 34412 34443 34444 41080 44440 50000 50002 51423
55555 56712preprocessor stream5_udp: timeout 30
HTTP Inspect
preprocessor http_inspect: global
iis_unicode_map /usr/local/etc/snort/unicode.map 1252
compress_depth 65535
decompress_depth 65535
memcap 150994944
max_gzip_mem 838860preprocessor http_inspect_server:
server default
profile iis
ports { 36 80 81 82 83 84 85 86 87 88 89 90 311 383 591 593 631 901 1220 1414 1533 1741 1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848 5250 6080 6988 7000 7001 7144 7145 7510 7777 7779 8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8500 8800 8888 8899 9000 9060 9080 9090 9091 9443 9999 10000 11371 15489 29991 33300 34412 34443 34444 41080 44440 50000 50002 51423 55555 56712 }
server_flow_depth 0
client_flow_depth 0
http_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA }
post_depth 65495
max_headers 0
max_header_length 0
max_spaces 0
enable_xff
enable_cookie
normalize_cookies
normalize_headers
normalize_utf
extended_response_inspection
inspect_gzip
unlimited_decompress
normalize_javascript
max_javascript_whitespaces 200Snort Output Logs
output alert_csv: alert timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority
output alert_syslog: LOG_AUTH LOG_ALERToutput alert_pf: /usr/local/etc/snort/snort_50718_hn1/CSTM_HOME_NET,snort2c,both,kill
Misc Includes
include /usr/local/etc/snort/snort_50718_hn1/reference.config
include /usr/local/etc/snort/snort_50718_hn1/classification.configSnort user pass through configuration
Rules Selection
include $RULE_PATH/snort.rules
include $RULE_PATH/flowbit-required.rules
include $RULE_PATH/custom.rules -
Are you sure you copied the content of the snort.conf file accurately? I'm asking because this line should have the NOT operator ("!") in front of the variable declaration (unless you have a customized EXTERNAL_NET list created):
ipvar EXTERNAL_NET [[10.0.0.4,10.0.0.11,fe80::20d:3aff:fef3:30e4]]Generally EXTERNAL_NET should contain only IP addresses that are not in HOME_NET. Also realize that if you are testing from your LAN and the web server is also on your LAN, then Snort will never see the traffic as your switch will route it port-to-port and leave the firewall (and Snort) out of the loop. Not sure from your diagram how things are configured in your network in terms of IP segments.
Bill
-
Thanks for the response.
I am testing from inside the LAN but I figured that because IIS bound traffic is exiting the LAN interface, it is subject to fw rules and thus snort inspection. Also the preprocessor rules are generating alerts okay.
The external net variable has been customized. Not sure where the ipv6 address came from but the others are ips of my pfsense interfaces.
I think the problem might be due to my custom pass list which I tried to make empty. The local interface addresses are added automatically. Can you confirm if traffic originating from an ip in the pass list is still checked? Or is it just discarded immediately? I think that might be the problem.
One other thing I didn't mention is that haproxy is adding x-forward-for headers to http traffic and I was hoping to detect and block those addresses when offensive. Is that possible or am I going about this the wrong way?
-
Thanks for the response.
I am testing from inside the LAN but I figured that because IIS bound traffic is exiting the LAN interface, it is subject to fw rules and thus snort inspection. Also the preprocessor rules are generating alerts okay.
The external net variable has been customized. Not sure where the ipv6 address came from but the others are ips of my pfsense interfaces.
I think the problem might be due to my custom pass list which I tried to make empty. The local interface addresses are added automatically. Can you confirm if traffic originating from an ip in the pass list is still checked? Or is it just discarded immediately? I think that might be the problem.
One other thing I didn't mention is that haproxy is adding x-forward-for headers to http traffic and I was hoping to detect and block those addresses when offensive. Is that possible or am I going about this the wrong way?
A pass list entry prevents that IP address from being blocked, but it has no impact on the alert showing up on the ALERTS tab. So the pass list has no bearing on what alerts you see. It only determines whether or not the IP itself gets added to the "blocked IPs" snort2c table in the pf firewall.
In your case, a failure to see alerts would be due to one or both of the following: (1) the traffic in question is not actually traversing the firewall, or (2) the IP addressess in HOME_NET and EXTERNAL_NET are not correct in terms of the rule's logic, and thus the rule is not triggered.
Bill
