CODEWITHSUNDEEP
pcresnort
e.doroskevic
e.doroskevic

Reputation: 2169

snort | pcre| rule specification

My objective is to write a rule to detect a simple truth exploit (SQLi)

The string example is of a form: 

% ' or 1 = 1 #

In order to identify the string above and some of its variations, I have developed following pcre.

pcre: "/\W\s*\W\s*or\s*([\d\w])\s*\W\s*\1\s*\W/";

I ran a test @ regextester and my regex seems to work. However, in Snort, this rule fails to pick and does not trigger.

The rule is of a format

alert 192.168.x.x any -> 192.168.y.y 80 (msg: "SQL Query"; pcre: "/\W\s*\W\s*or\s*([\d\w])\s*\W\s*\1\s*\W/"; sid: 1001;);

I'd appreciate any help

GET request from Whireshark 

GET /dvwa/vulnerabilities/sqli/?id=%25+%27+or+1+%3D+1+%23&Submit=Submit

Upvotes: 1

Views: 2038

Answers (1)

Mr.kang
Mr.kang

Reputation: 617

The cause of the rule fail is URL encoding. %25 means %, %27means ', +(or %20) means space, %3D means =. https://www.w3schools.com/tags/ref_urlencode.asp

Snort have a HTTP normalization module. But i think it is not perfect.

Refer to following rule.

alert tcp any any -> any any (content:"+or+"; nocase; pcre:"/\+or\+\w\+%3D\+\w/";)

Using pcre alone can degrade performance. When used with content, it narrows the scope of the pcre inspection and improves performance.

Upvotes: 1

Related Questions