Experimental sigs for looking for whitespace errors in HTTP headers; that sometimes appear as mistakes especially in fake http headers.
Kind Regards,
Kevin Ross
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Host Request header”; flow:established,to_server; content:“Host|3A 20 20|”; http_header; classtype:bad-unknown; sid:156001; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in User Agent Request header”; flow:established,to_server; content:“User-Agent|3A 20 20|”; http_header; classtype:bad-unknown; sid:156002; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Host Request header”; flow:established,to_server; content:“Host|3A 20 20|”; http_header; classtype:bad-unknown; sid:156003; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Referer Request header”; flow:established,to_server; content:“Referer|3A 20 20|”; http_header; classtype:bad-unknown; sid:156004; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Cookie Request header”; flow:established,to_server; content:“Cookie|3A 20 20|”; http_header; classtype:bad-unknown; sid:156005; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Connection Request header”; flow:established,to_server; content:“Connection|3A 20 20|”; http_header; classtype:bad-unknown; sid:156006; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Length Request header”; flow:established,to_server; content:“Length|3A 20 20|”; http_header; classtype:bad-unknown; sid:156007; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Content-Type Request header”; flow:established,to_server; content:“Content-Type|3A 20 20|”; http_header; classtype:bad-unknown; sid:156008; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Accept-Language Request header”; flow:established,to_server; content:“Accept-Language|3A 20 20|”; http_header; classtype:bad-unknown; sid:156009; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Accept-Encoding Request header”; flow:established,to_server; content:“Accept-Encoding|3A 20 20|”; http_header; classtype:bad-unknown; sid:156010; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Authorization Request header”; flow:established,to_server; content:“Authorization|3A 20 20|”; http_header; classtype:bad-unknown; sid:156011; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Authorization Request header”; flow:established,to_server; content:“Authorization|3A 20 20|”; http_header; classtype:bad-unknown; sid:156012; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Expect Request header”; flow:established,to_server; content:“Expect|3A 20 20|”; http_header; classtype:bad-unknown; sid:156013; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Range Request header”; flow:established,to_server; content:“Expect|3A 20 20|”; http_header; classtype:bad-unknown; sid:156015; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Via Request header”; flow:established,to_server; content:“Via|3A 20 20|”; http_header; classtype:bad-unknown; sid:156016; rev:1;)
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Content-Encoding Request header”; flow:established,to_server; content:“Content-Encoding|3A 20 20|”; http_header; classtype:bad-unknown; sid:156017; rev:1;)
This one may need looked at. I can’t remember if HTTP header argument allows for the return/newline in the header too.
alert tcp $HOME_NET any → EXTERNAL_NET $HTTP_PORTS (msg:“ET HUNTING Extra Whitespace in Termination of Request Header”; flow:established,to_server; content:“|20 0D 0A 0D 0A|”; http_header; classtype:bad-unknown; sid:156018; rev:1;)
