RE: More sid 1841

[Matt Kettler <mkettler () evi-inc com>]

At 03:20 PM 2/21/2003 -0600, Schmehl, Paul L wrote:
> Since you obviously understand the rules syntax quite well, then you can
> clarify something else for me.  I *thought* after reading the docs that
> this would work:
> content:"javascript\://"; content:"\n";
>
> Isn't this saying "if you see both of these strings anywhere in the
> payload, trigger this alert?

Actually the correct content rule pair is:

content:"javascript\://"; content:"\\n";

Other than the missing extra \, your rule is correct, and that is going to 
have a lower chance of false positive than the default rule, but there are 
still some possible cases of false positive, as it can go off if a \n 
appears anywhere in the packet after javascript://, and not necessarily in 
the same tag.

Still it's probably a worthwhile change as it will dramaticaly reduce the 
FP's, and is the solution I was eluding to in my last email (although I was 
also suggesting the use of "within" as a further restriction.

> I'm using snort 1.9 Build 290 from the FreeBSD ports collection, and I
> use oinkmaster, which updates the rules nightly.  The path used to fetch
> the rules (the "url" value in the conf file) is:
> http://www.snort.org/dl/signatures/snortrules-stable.tar.gz

Yeah, it looks like some things got shuffled around in the updated rules 
that, IMO, should not have been. But I'm not a snort devel of any sort, so 
that's just my opinion as an "average joe" snort user.





-------------------------------------------------------
This SF.net email is sponsored by: SlickEdit Inc. Develop an edge.
The most comprehensive and flexible code editor you can use.
Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial.
www.slickedit.com/sourceforge
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users