Web Application Defender's Cookbook

Recipe 1-4: Integrating Intrusion Detection System Signatures

This recipe shows you how to integrate public Snort IDS web attack signatures within ModSecurity.

Ingredients

• OWASP ModSecurity CRS5
• Emerging Threats (ET) Snort Rules (for Snort v2.8.4)6
  • emerging-web_server.rules
  • emerging-web_specific_apps.rules

Emerging Threats’ Snort Web Attack Rules

You may be familiar with the Emerging Threats project. It has a few Snort rules files related to known web application vulnerabilities and attacks:

• emerging-web_server.rules
• emerging-web_specific_apps.rules

Here is a sample ET rule taken from the emerging-web_specific_apps.rules file that describes a known SQL Injection vulnerability in the 20/20 Auto Gallery application:

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS  (msg:"ET
 WEB_SPECIFIC_APPS 20/20 Auto Gallery SQL Injection Attempt – 
vehiclelistings.asp vehicleID SELECT";  flow:established,to_server
; uricontent:"/vehiclelistings.asp?"; nocase;  uricontent:
"vehicleID="; nocase; uricontent:"SELECT"; nocase;  pcre:"/.
+SELECT.+FROM/Ui"; classtype:web-application-attack; reference:cve
,CVE-2006-6092; reference:url,www.securityfocus.com/bid/21154;
  reference:url,doc.emergingthreats.net/2007504;
  reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/
WEB_SPECIFIC_APPS/WEB_2020_Auto_gallery; sid:2007504; rev:5;)

When reviewing this web attack rule, we can conclude that there is a SQL Injection vulnerability in the /vehiclelistings.asp page, presumably in the