Re: What is the Correct usage of Content Modifiers in Snort rule

Hi,

Sounds like you read the Snort 2 manual and then looked at some Snort 3 rules. This is one of many differences between Snort 2 and Snort 3. For Snort 3, the buffer selector always precedes the content. For Snort 2, it depends: eg http_uri after content but file_data before content. When in doubt, look at Talos authored rules (registered rule set or LightSPD) for your Snort version.

Russ

________________________________
From: Snort-users <[email protected]> on behalf of Mahdi Ojaghi via Snort-users <[email protected]>
Sent: Tuesday, December 14, 2021 2:39 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] What is the Correct usage of Content Modifiers in Snort rule


Hi everyone

I'm new in using Snort and I'm trying to understand Snort rules.

As I was reading Content Modifiers section in snort's manual, it is mentioned that content modifiers should be used after a content in rule options

Consider Http Uri:

As this keyword is a modifier to the previous content keyword, there must be a content in the rule before http uri is specified.

But in the latest community rules "snort3-community.rules" , there are rules that have Content modifiers before a content is specified

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS ( msg:"SERVER-WEBAPP dcboard.cgi invalid user addition attempt"; flow:to_server,established; http_uri; content:"/dcboard.cgi"; pkt_data; content:"command=register"; content:"%7cadmin"; metadata:ruleset community; service:http; reference:bugtraq,2728; reference:cve,2001-0527; reference:nessus,10583; classtype:web-application-attack; sid:817; rev:19; )

I want to know how this rule is interpreted by snort engine and also what is the correct usage of content modifiers

Thanks for your help

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette