Re: What is the Correct usage of Content Modifiers in Snort rule

Mahdi,

Snort3 rules have different syntax from Snort2 rules. You may be reading the Snort2 manual to understand Snort3 rules. That won't work well.

The following refers to Snort3.

http_uri is a rule option that provides a buffer containing the normalized form of the HTTP URI. This buffer stays in effect until another rule option changes it. The subsequent content looks in that buffer.

pkt_data is another rule option that changes the buffer. It has two contents following it.

Tom


From: Snort-users <[email protected]> on behalf of Mahdi Ojaghi via Snort-users <[email protected]>
Reply-To: Mahdi Ojaghi <[email protected]>
Date: Tuesday, December 14, 2021 at 4:30 PM
To: "[email protected]" <[email protected]>
Subject: [Snort-users] What is the Correct usage of Content Modifiers in Snort rule


Hi everyone

I'm new in using Snort and I'm trying to understand Snort rules.

As I was reading Content Modifiers section in snort's manual, it is mentioned that content modifiers should be used after a content in rule options

Consider Http Uri:

As this keyword is a modifier to the previous content keyword, there must be a content in the rule before http uri is specified.

But in the latest community rules "snort3-community.rules" , there are rules that have Content modifiers before a content is specified

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS ( msg:"SERVER-WEBAPP dcboard.cgi invalid user addition attempt"; flow:to_server,established; http_uri; content:"/dcboard.cgi"; pkt_data; content:"command=register"; content:"%7cadmin"; metadata:ruleset community; service:http; reference:bugtraq,2728; reference:cve,2001-0527; reference:nessus,10583; classtype:web-application-attack; sid:817; rev:19; )

I want to know how this rule is interpreted by snort engine and also what is the correct usage of content modifiers

Thanks for your help

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette