Netgate SG-1000 microFirewall

Author Topic: snort http rules not generating alerts  (Read 99 times)

0 Members and 1 Guest are viewing this topic.

Offline pffan

  • Jr. Member
  • **
  • Posts: 32
  • Karma: +2/-0
    • View Profile
snort http rules not generating alerts
« on: February 06, 2018, 09:25:27 am »
Http rules are not generating alerts but the preprocessor rules generate alerts just fine.  I think this might be due to the custom pass list I created automatically including local interfaces though I did not check that box in the config screen.  There are even ip6 addresses in that pass list yet I do not have ipv6 enabled for any interfaces.  It's not what I expected but maybe this is normal.

If anyone could shed light on what I'm doing wrong, I sure would appreciate it.

About my setup

pfSense 2.4.2-RELEASE-p1
haproxy 0.54_2 (1.7.10)
snort 3.2.9.6 (2.9.11.1)

Code: [Select]
--https--> [haproxy] --http--> [IIS]
                    ^
                 snort on LAN

Ruleset emerging threats open - web server category

Test case
Rule
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible DROP SQL Injection Attempt"; flow:to_server,established; content:"DROP"; nocase; http_uri; pcre:"/DROP\ +(database|procedure|table|column)/Ui"; reference:url,www.owasp.org/index.php/SQL_Injection; reference:url,www.w3schools.com/SQl/sql_drop.asp; reference:url,doc.emergingthreats.net/2010085; classtype:web-application-attack; sid:2010085; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, deployment Datacenter, tag SQL_Injection, signature_severity Major, created_at 2010_07_30, updated_at 2016_07_01;)

String entered into web form
Code: [Select]
'; DROP DATABASE FOO --'
Excerpt from packet capture verifying presence of offending string
Form item: "LastName" = "';drop database something --'"

snort.config

# snort configuration file
# generated automatically by the pfSense subsystems do not modify manually

# Define Local Network #
ipvar HOME_NET [10.0.0.4,10.0.0.5,10.0.0.9,10.0.0.11,127.0.0.1,::1,fe80::20d:3aff:fef3:30e4]
ipvar EXTERNAL_NET [[10.0.0.4,10.0.0.11,fe80::20d:3aff:fef3:30e4]]

# Define Rule Path #
var RULE_PATH /usr/local/etc/snort/snort_50718_hn1/rules

# Define Servers #
ipvar DNS_SERVERS [$HOME_NET]
ipvar SMTP_SERVERS [$HOME_NET]
ipvar HTTP_SERVERS [10.0.0.5]
ipvar WWW_SERVERS [$HOME_NET]
ipvar SQL_SERVERS [$HOME_NET]
ipvar TELNET_SERVERS [$HOME_NET]
ipvar SNMP_SERVERS [$HOME_NET]
ipvar FTP_SERVERS [$HOME_NET]
ipvar SSH_SERVERS [$HOME_NET]
ipvar POP_SERVERS [$HOME_NET]
ipvar IMAP_SERVERS [$HOME_NET]
ipvar SIP_PROXY_IP [$HOME_NET]
ipvar SIP_SERVERS [$HOME_NET]
ipvar RPC_SERVERS [$HOME_NET]
ipvar DNP3_SERVER [$HOME_NET]
ipvar DNP3_CLIENT [$HOME_NET]
ipvar MODBUS_SERVER [$HOME_NET]
ipvar MODBUS_CLIENT [$HOME_NET]
ipvar ENIP_SERVER [$HOME_NET]
ipvar ENIP_CLIENT [$HOME_NET]
ipvar AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]


# Define Server Ports #
portvar DNS_PORTS [53]
portvar SMTP_PORTS [25]
portvar MAIL_PORTS [25,465,587,691]
portvar HTTP_PORTS [36,80,81,82,83,84,85,86,87,88,89,90,311,383,591,593,631,901,1220,1414,1533,1741,1830,2301,2381,2809,3037,3057,3128,3443,3702,4343,4848,5250,6080,6988,7000,7001,7144,7145,7510,7777,7779,8000,8008,8014,8028,8080,8081,8082,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8800,8888,8899,9000,9060,9080,9090,9091,9443,9999,10000,11371,15489,29991,33300,34412,34443,34444,41080,44440,50000,50002,51423,55555,56712]
portvar ORACLE_PORTS [1024:]
portvar MSSQL_PORTS [1433]
portvar TELNET_PORTS [23]
portvar SNMP_PORTS [161]
portvar FTP_PORTS [21,2100,3535]
portvar SSH_PORTS [22]
portvar POP2_PORTS [109]
portvar POP3_PORTS [110]
portvar IMAP_PORTS [143]
portvar SIP_PORTS [5060,5061,5600]
portvar AUTH_PORTS [113]
portvar FINGER_PORTS [79]
portvar IRC_PORTS [6665,6666,6667,6668,6669,7000]
portvar SMB_PORTS [139,445]
portvar NNTP_PORTS [119]
portvar RLOGIN_PORTS [513]
portvar RSH_PORTS [514]
portvar SSL_PORTS [443,465,563,636,989,992,993,994,995,7801,7802,7900,7901,7902,7903,7904,7905,7906,7907,7908,7909,7910,7911,7912,7913,7914,7915,7916,7917,7918,7919,7920]
portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143]
portvar SHELLCODE_PORTS [!80]
portvar SUN_RPC_PORTS [111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779]
portvar DCERPC_NCACN_IP_TCP [139,445]
portvar DCERPC_NCADG_IP_UDP [138,1024:]
portvar DCERPC_NCACN_IP_LONG [135,139,445,593,1024:]
portvar DCERPC_NCACN_UDP_LONG [135,1024:]
portvar DCERPC_NCACN_UDP_SHORT [135,593,1024:]
portvar DCERPC_NCACN_TCP [2103,2105,2107]
portvar DCERPC_BRIGHTSTORE [6503,6504]
portvar DNP3_PORTS [20000]
portvar MODBUS_PORTS [502]
portvar GTP_PORTS [2123,2152,3386]


# Configure the snort decoder #
config checksum_mode: none
config disable_decode_alerts
config disable_tcpopt_experimental_alerts
config disable_tcpopt_obsolete_alerts
config disable_ttcp_alerts
config disable_tcpopt_alerts
config disable_ipopt_alerts
config disable_decode_drops

# Enable the GTP decoder #
config enable_gtp

# Configure PCRE match limitations
config pcre_match_limit: 3500
config pcre_match_limit_recursion: 1500

# Configure the detection engine #
config detection: search-method ac-bnfa max-pattern-len 20 max_queue_events 5
config event_queue: max_queue 8 log 5 order_events content_length

# Configure to show year in timestamps
config show_year

# Configure IPv6 address logging in unified2 extra data
config log_ipv6_extra_data

# Configure protocol aware flushing #
# For more information see README.stream5 #
config paf_max: 16000

# Configure dynamically loaded libraries
dynamicpreprocessor directory /usr/local/etc/snort/snort_50718_hn1/snort_dynamicpreprocessor
dynamicengine directory /usr/local/lib/snort_dynamicengine
dynamicdetection directory /usr/local/lib/snort_dynamicrules

# Inline packet normalization. For more information, see README.normalize
# Disabled since we do not use "inline" mode with pfSense
# preprocessor normalize_ip4
# preprocessor normalize_tcp: ips ecn stream
# preprocessor normalize_icmp4
# preprocessor normalize_ip6
# preprocessor normalize_icmp6

# Flow and stream #
preprocessor frag3_global: memcap 4194304, max_frags 8192

preprocessor frag3_engine: policy bsd \
   timeout 60 \
   min_ttl 1 \
   detect_anomalies \
   overlap_limit 0 \
   min_fragment_length 0

preprocessor stream5_global: \
   track_tcp yes, \
   max_tcp 262144, \
   track_udp yes, \
   max_udp 131072, \
   track_icmp no, \
   memcap 8388608, \
   prune_log_max 1048576

preprocessor stream5_tcp: policy bsd, \
   timeout 30, \
   overlap_limit 0, \
   max_window 0, \
   max_queued_bytes 1048576, \
   max_queued_segs 2621, \
   ports client 21 22 23 25 42 53 70 79 109 110 111 113 119 135 136 137 \
                139 143 161 445 513 514 587 593 691 1433 1521 1741 \
                2100 3306 6070 6665 6666 6667 6668 6669 7000 8181 \
                32770 32771 32772 32773 32774 32775 32776 32777 \
                32778 32779, \
   ports both 80 81 82 83 84 85 86 87 88 89 90 110 311 383 443 465 563 \
              591 593 631 636 901 989 992 993 994 995 1220 1414 1533 \
              1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848 \
              5250 6080 6988 7907 7000 7001 7144 7145 7510 7802 7777 \
              7779 7801 7900 7901 7902 7903 7904 7905 7906 7908 7909 \
              7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 \
              8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 \
              8123 8180 8222 8243 8280 8300 8500 8800 8888 8899 9000 \
              9060 9080 9090 9091 9443 9999 10000 11371 15489 29991 \
              33300 34412 34443 34444 41080 44440 50000 50002 51423 \
              55555 56712

preprocessor stream5_udp: timeout 30



# HTTP Inspect #
preprocessor http_inspect: global \
   iis_unicode_map /usr/local/etc/snort/unicode.map 1252 \
   compress_depth 65535 \
   decompress_depth 65535 \
   memcap 150994944 \
   max_gzip_mem 838860

preprocessor http_inspect_server: \
   server default \
   profile iis \
   ports { 36 80 81 82 83 84 85 86 87 88 89 90 311 383 591 593 631 901 1220 1414 1533 1741 1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848 5250 6080 6988 7000 7001 7144 7145 7510 7777 7779 8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8500 8800 8888 8899 9000 9060 9080 9090 9091 9443 9999 10000 11371 15489 29991 33300 34412 34443 34444 41080 44440 50000 50002 51423 55555 56712 } \
   server_flow_depth 0 \
   client_flow_depth 0 \
   http_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA } \
   post_depth 65495 \
   max_headers 0 \
   max_header_length 0 \
   max_spaces 0 \
   enable_xff \
   enable_cookie \
   normalize_cookies \
   normalize_headers \
   normalize_utf \
   extended_response_inspection \
   inspect_gzip \
   unlimited_decompress \
   normalize_javascript \
   max_javascript_whitespaces 200





# Snort Output Logs #
output alert_csv: alert timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority
output alert_syslog: LOG_AUTH LOG_ALERT

output alert_pf: /usr/local/etc/snort/snort_50718_hn1/CSTM_HOME_NET,snort2c,both,kill

# Misc Includes #
include /usr/local/etc/snort/snort_50718_hn1/reference.config
include /usr/local/etc/snort/snort_50718_hn1/classification.config



# Snort user pass through configuration


# Rules Selection #
include $RULE_PATH/snort.rules
include $RULE_PATH/flowbit-required.rules
include $RULE_PATH/custom.rules

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3288
  • Karma: +861/-0
    • View Profile
Re: snort http rules not generating alerts
« Reply #1 on: February 06, 2018, 12:38:30 pm »
Are you sure you copied the content of the snort.conf file accurately?  I'm asking because this line should have the NOT operator ("!") in front of the variable declaration (unless you have a customized EXTERNAL_NET list created):

Code: [Select]
ipvar EXTERNAL_NET [[10.0.0.4,10.0.0.11,fe80::20d:3aff:fef3:30e4]]
Generally EXTERNAL_NET should contain only IP addresses that are not in HOME_NET.  Also realize that if you are testing from your LAN and the web server is also on your LAN, then Snort will never see the traffic as your switch will route it port-to-port and leave the firewall (and Snort) out of the loop.  Not sure from your diagram how things are configured in your network in terms of IP segments.

Bill
« Last Edit: February 06, 2018, 02:19:43 pm by bmeeks »

Offline pffan

  • Jr. Member
  • **
  • Posts: 32
  • Karma: +2/-0
    • View Profile
Re: snort http rules not generating alerts
« Reply #2 on: February 06, 2018, 02:45:35 pm »
Thanks for the response.

I am testing from inside the LAN but I figured that because IIS bound traffic is exiting the LAN interface, it is subject to fw rules and thus snort inspection.  Also the preprocessor rules are generating alerts okay.

The external net variable has been customized.  Not sure where the ipv6 address came from but the others are ips of my pfsense interfaces.

I think the problem might be due to my custom pass list which I tried to make empty.  The local interface addresses are added automatically.  Can you confirm if traffic originating from an ip in the pass list is still checked?  Or is it just discarded immediately?  I think that might be the problem.

One other thing I didn't mention is that haproxy is adding x-forward-for headers to http traffic and I was hoping to detect and block those addresses when offensive.  Is that possible or am I going about this the wrong way?

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3288
  • Karma: +861/-0
    • View Profile
Re: snort http rules not generating alerts
« Reply #3 on: February 08, 2018, 08:54:31 am »
Thanks for the response.

I am testing from inside the LAN but I figured that because IIS bound traffic is exiting the LAN interface, it is subject to fw rules and thus snort inspection.  Also the preprocessor rules are generating alerts okay.

The external net variable has been customized.  Not sure where the ipv6 address came from but the others are ips of my pfsense interfaces.

I think the problem might be due to my custom pass list which I tried to make empty.  The local interface addresses are added automatically.  Can you confirm if traffic originating from an ip in the pass list is still checked?  Or is it just discarded immediately?  I think that might be the problem.

One other thing I didn't mention is that haproxy is adding x-forward-for headers to http traffic and I was hoping to detect and block those addresses when offensive.  Is that possible or am I going about this the wrong way?

A pass list entry prevents that IP address from being blocked, but it has no impact on the alert showing up on the ALERTS tab.  So the pass list has no bearing on what alerts you see.  It only determines whether or not the IP itself gets added to the "blocked IPs" snort2c table in the pf firewall.

In your case, a failure to see alerts would be due to one or both of the following:  (1) the traffic in question is not actually traversing the firewall, or (2) the IP addressess in HOME_NET and EXTERNAL_NET are not correct in terms of the rule's logic, and thus the rule is not triggered.

Bill