Snort http rules not generating alerts



  • Http rules are not generating alerts but the preprocessor rules generate alerts just fine.  I think this might be due to the custom pass list I created automatically including local interfaces though I did not check that box in the config screen.  There are even ip6 addresses in that pass list yet I do not have ipv6 enabled for any interfaces.  It's not what I expected but maybe this is normal.

    If anyone could shed light on what I'm doing wrong, I sure would appreciate it.

    About my setup

    pfSense 2.4.2-RELEASE-p1
    haproxy 0.54_2 (1.7.10)
    snort 3.2.9.6 (2.9.11.1)

    --https--> [haproxy] --http--> [IIS]
                        ^
                     snort on LAN
    
    

    Ruleset emerging threats open - web server category

    Test case
    Rule
    alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible DROP SQL Injection Attempt"; flow:to_server,established; content:"DROP"; nocase; http_uri; pcre:"/DROP\ +(database|procedure|table|column)/Ui"; reference:url,www.owasp.org/index.php/SQL_Injection; reference:url,www.w3schools.com/SQl/sql_drop.asp; reference:url,doc.emergingthreats.net/2010085; classtype:web-application-attack; sid:2010085; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, deployment Datacenter, tag SQL_Injection, signature_severity Major, created_at 2010_07_30, updated_at 2016_07_01;)

    String entered into web form

    '; DROP DATABASE FOO --'
    

    Excerpt from packet capture verifying presence of offending string
    Form item: "LastName" = "';drop database something –'"

    snort.config

    snort configuration file

    generated automatically by the pfSense subsystems do not modify manually

    Define Local Network

    ipvar HOME_NET [10.0.0.4,10.0.0.5,10.0.0.9,10.0.0.11,127.0.0.1,::1,fe80::20d:3aff:fef3:30e4]
    ipvar EXTERNAL_NET [[10.0.0.4,10.0.0.11,fe80::20d:3aff:fef3:30e4]]

    Define Rule Path

    var RULE_PATH /usr/local/etc/snort/snort_50718_hn1/rules

    Define Servers

    ipvar DNS_SERVERS [$HOME_NET]
    ipvar SMTP_SERVERS [$HOME_NET]
    ipvar HTTP_SERVERS [10.0.0.5]
    ipvar WWW_SERVERS [$HOME_NET]
    ipvar SQL_SERVERS [$HOME_NET]
    ipvar TELNET_SERVERS [$HOME_NET]
    ipvar SNMP_SERVERS [$HOME_NET]
    ipvar FTP_SERVERS [$HOME_NET]
    ipvar SSH_SERVERS [$HOME_NET]
    ipvar POP_SERVERS [$HOME_NET]
    ipvar IMAP_SERVERS [$HOME_NET]
    ipvar SIP_PROXY_IP [$HOME_NET]
    ipvar SIP_SERVERS [$HOME_NET]
    ipvar RPC_SERVERS [$HOME_NET]
    ipvar DNP3_SERVER [$HOME_NET]
    ipvar DNP3_CLIENT [$HOME_NET]
    ipvar MODBUS_SERVER [$HOME_NET]
    ipvar MODBUS_CLIENT [$HOME_NET]
    ipvar ENIP_SERVER [$HOME_NET]
    ipvar ENIP_CLIENT [$HOME_NET]
    ipvar AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]

    Define Server Ports

    portvar DNS_PORTS [53]
    portvar SMTP_PORTS [25]
    portvar MAIL_PORTS [25,465,587,691]
    portvar HTTP_PORTS [36,80,81,82,83,84,85,86,87,88,89,90,311,383,591,593,631,901,1220,1414,1533,1741,1830,2301,2381,2809,3037,3057,3128,3443,3702,4343,4848,5250,6080,6988,7000,7001,7144,7145,7510,7777,7779,8000,8008,8014,8028,8080,8081,8082,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8800,8888,8899,9000,9060,9080,9090,9091,9443,9999,10000,11371,15489,29991,33300,34412,34443,34444,41080,44440,50000,50002,51423,55555,56712]
    portvar ORACLE_PORTS [1024:]
    portvar MSSQL_PORTS [1433]
    portvar TELNET_PORTS [23]
    portvar SNMP_PORTS [161]
    portvar FTP_PORTS [21,2100,3535]
    portvar SSH_PORTS [22]
    portvar POP2_PORTS [109]
    portvar POP3_PORTS [110]
    portvar IMAP_PORTS [143]
    portvar SIP_PORTS [5060,5061,5600]
    portvar AUTH_PORTS [113]
    portvar FINGER_PORTS [79]
    portvar IRC_PORTS [6665,6666,6667,6668,6669,7000]
    portvar SMB_PORTS [139,445]
    portvar NNTP_PORTS [119]
    portvar RLOGIN_PORTS [513]
    portvar RSH_PORTS [514]
    portvar SSL_PORTS [443,465,563,636,989,992,993,994,995,7801,7802,7900,7901,7902,7903,7904,7905,7906,7907,7908,7909,7910,7911,7912,7913,7914,7915,7916,7917,7918,7919,7920]
    portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143]
    portvar SHELLCODE_PORTS [!80]
    portvar SUN_RPC_PORTS [111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779]
    portvar DCERPC_NCACN_IP_TCP [139,445]
    portvar DCERPC_NCADG_IP_UDP [138,1024:]
    portvar DCERPC_NCACN_IP_LONG [135,139,445,593,1024:]
    portvar DCERPC_NCACN_UDP_LONG [135,1024:]
    portvar DCERPC_NCACN_UDP_SHORT [135,593,1024:]
    portvar DCERPC_NCACN_TCP [2103,2105,2107]
    portvar DCERPC_BRIGHTSTORE [6503,6504]
    portvar DNP3_PORTS [20000]
    portvar MODBUS_PORTS [502]
    portvar GTP_PORTS [2123,2152,3386]

    Configure the snort decoder

    config checksum_mode: none
    config disable_decode_alerts
    config disable_tcpopt_experimental_alerts
    config disable_tcpopt_obsolete_alerts
    config disable_ttcp_alerts
    config disable_tcpopt_alerts
    config disable_ipopt_alerts
    config disable_decode_drops

    Enable the GTP decoder

    config enable_gtp

    Configure PCRE match limitations

    config pcre_match_limit: 3500
    config pcre_match_limit_recursion: 1500

    Configure the detection engine

    config detection: search-method ac-bnfa max-pattern-len 20 max_queue_events 5
    config event_queue: max_queue 8 log 5 order_events content_length

    Configure to show year in timestamps

    config show_year

    Configure IPv6 address logging in unified2 extra data

    config log_ipv6_extra_data

    Configure protocol aware flushing

    For more information see README.stream5

    config paf_max: 16000

    Configure dynamically loaded libraries

    dynamicpreprocessor directory /usr/local/etc/snort/snort_50718_hn1/snort_dynamicpreprocessor
    dynamicengine directory /usr/local/lib/snort_dynamicengine
    dynamicdetection directory /usr/local/lib/snort_dynamicrules

    Inline packet normalization. For more information, see README.normalize

    Disabled since we do not use "inline" mode with pfSense

    preprocessor normalize_ip4

    preprocessor normalize_tcp: ips ecn stream

    preprocessor normalize_icmp4

    preprocessor normalize_ip6

    preprocessor normalize_icmp6

    Flow and stream

    preprocessor frag3_global: memcap 4194304, max_frags 8192

    preprocessor frag3_engine: policy bsd
    timeout 60
    min_ttl 1
    detect_anomalies
    overlap_limit 0
    min_fragment_length 0

    preprocessor stream5_global:
    track_tcp yes,
    max_tcp 262144,
    track_udp yes,
    max_udp 131072,
    track_icmp no,
    memcap 8388608,
    prune_log_max 1048576

    preprocessor stream5_tcp: policy bsd,
    timeout 30,
    overlap_limit 0,
    max_window 0,
    max_queued_bytes 1048576,
    max_queued_segs 2621,
    ports client 21 22 23 25 42 53 70 79 109 110 111 113 119 135 136 137
                139 143 161 445 513 514 587 593 691 1433 1521 1741
                2100 3306 6070 6665 6666 6667 6668 6669 7000 8181
                32770 32771 32772 32773 32774 32775 32776 32777
                32778 32779,
    ports both 80 81 82 83 84 85 86 87 88 89 90 110 311 383 443 465 563
              591 593 631 636 901 989 992 993 994 995 1220 1414 1533
              1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848
              5250 6080 6988 7907 7000 7001 7144 7145 7510 7802 7777
              7779 7801 7900 7901 7902 7903 7904 7905 7906 7908 7909
              7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920
              8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118
              8123 8180 8222 8243 8280 8300 8500 8800 8888 8899 9000
              9060 9080 9090 9091 9443 9999 10000 11371 15489 29991
              33300 34412 34443 34444 41080 44440 50000 50002 51423
              55555 56712

    preprocessor stream5_udp: timeout 30

    HTTP Inspect

    preprocessor http_inspect: global
    iis_unicode_map /usr/local/etc/snort/unicode.map 1252
    compress_depth 65535
    decompress_depth 65535
    memcap 150994944
    max_gzip_mem 838860

    preprocessor http_inspect_server:
    server default
    profile iis
    ports { 36 80 81 82 83 84 85 86 87 88 89 90 311 383 591 593 631 901 1220 1414 1533 1741 1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848 5250 6080 6988 7000 7001 7144 7145 7510 7777 7779 8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8500 8800 8888 8899 9000 9060 9080 9090 9091 9443 9999 10000 11371 15489 29991 33300 34412 34443 34444 41080 44440 50000 50002 51423 55555 56712 }
    server_flow_depth 0
    client_flow_depth 0
    http_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA }
    post_depth 65495
    max_headers 0
    max_header_length 0
    max_spaces 0
    enable_xff
    enable_cookie
    normalize_cookies
    normalize_headers
    normalize_utf
    extended_response_inspection
    inspect_gzip
    unlimited_decompress
    normalize_javascript
    max_javascript_whitespaces 200

    Snort Output Logs

    output alert_csv: alert timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority
    output alert_syslog: LOG_AUTH LOG_ALERT

    output alert_pf: /usr/local/etc/snort/snort_50718_hn1/CSTM_HOME_NET,snort2c,both,kill

    Misc Includes

    include /usr/local/etc/snort/snort_50718_hn1/reference.config
    include /usr/local/etc/snort/snort_50718_hn1/classification.config

    Snort user pass through configuration

    Rules Selection

    include $RULE_PATH/snort.rules
    include $RULE_PATH/flowbit-required.rules
    include $RULE_PATH/custom.rules



  • Are you sure you copied the content of the snort.conf file accurately?  I'm asking because this line should have the NOT operator ("!") in front of the variable declaration (unless you have a customized EXTERNAL_NET list created):

    ipvar EXTERNAL_NET [[10.0.0.4,10.0.0.11,fe80::20d:3aff:fef3:30e4]]
    

    Generally EXTERNAL_NET should contain only IP addresses that are not in HOME_NET.  Also realize that if you are testing from your LAN and the web server is also on your LAN, then Snort will never see the traffic as your switch will route it port-to-port and leave the firewall (and Snort) out of the loop.  Not sure from your diagram how things are configured in your network in terms of IP segments.

    Bill



  • Thanks for the response.

    I am testing from inside the LAN but I figured that because IIS bound traffic is exiting the LAN interface, it is subject to fw rules and thus snort inspection.  Also the preprocessor rules are generating alerts okay.

    The external net variable has been customized.  Not sure where the ipv6 address came from but the others are ips of my pfsense interfaces.

    I think the problem might be due to my custom pass list which I tried to make empty.  The local interface addresses are added automatically.  Can you confirm if traffic originating from an ip in the pass list is still checked?  Or is it just discarded immediately?  I think that might be the problem.

    One other thing I didn't mention is that haproxy is adding x-forward-for headers to http traffic and I was hoping to detect and block those addresses when offensive.  Is that possible or am I going about this the wrong way?



  • @pffan:

    Thanks for the response.

    I am testing from inside the LAN but I figured that because IIS bound traffic is exiting the LAN interface, it is subject to fw rules and thus snort inspection.  Also the preprocessor rules are generating alerts okay.

    The external net variable has been customized.  Not sure where the ipv6 address came from but the others are ips of my pfsense interfaces.

    I think the problem might be due to my custom pass list which I tried to make empty.  The local interface addresses are added automatically.  Can you confirm if traffic originating from an ip in the pass list is still checked?  Or is it just discarded immediately?  I think that might be the problem.

    One other thing I didn't mention is that haproxy is adding x-forward-for headers to http traffic and I was hoping to detect and block those addresses when offensive.  Is that possible or am I going about this the wrong way?

    A pass list entry prevents that IP address from being blocked, but it has no impact on the alert showing up on the ALERTS tab.  So the pass list has no bearing on what alerts you see.  It only determines whether or not the IP itself gets added to the "blocked IPs" snort2c table in the pf firewall.

    In your case, a failure to see alerts would be due to one or both of the following:  (1) the traffic in question is not actually traversing the firewall, or (2) the IP addressess in HOME_NET and EXTERNAL_NET are not correct in terms of the rule's logic, and thus the rule is not triggered.

    Bill


Log in to reply