shouldn't snort redefine uricontent to handle proxies?

[Jason Haar <Jason.Haar () trimble co nz>]

Hi there

We're trying to run snort on proxy servers so that we can pick up
infected internal hosts directly (instead of having snort further out
and only catching the proxy IP), and find that it doesn't work without
rewriting a lot of rules.

e.g.

alert tcp $HOME -> $EXTERNAL 80 (msg:"http rule";
uricontent:"/virus.exe";distance:0)

doesn't work when it's via a proxy as uricontent is now
"http://site.name/virus.exe";.

There are a lot of rules that contain "uricontent.*distance:0", so I was
wondering what would be the downside of the snort http preprocessor
normalizing out the front  bit of the URLs? As an aside, most/all web
servers map "GET http://my.name/uri"; to "GET /uri" anyway - so from what
I can see that is also been missed as it is?

This is under 2.8.4.

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users