Sponsored Content
Full Discussion: Snort HTTPS
Special Forums Cybersecurity Snort HTTPS Post 302733851 by drd0spt on Wednesday 21st of November 2012 07:47:58 AM
Old 11-21-2012
ok the situation is i have a IDS ( SourceFire ) is snort based and i have a completly normal snort rule, that looks for a escape character on normal HTTP request and he assumes that the type of request on some of the strings i have on my network are a exploit but in fact is not is just a HTTPS that escape the ASCII (a-f 0-9) in this case the rule looks for %1u content and in fact that character "u" exists in some of the requests in https for security reasons. I would like to say Snort if u see any HTTPS request dont use this rule or edit that rule and put only HTTP not on HTTPS transactions.
 

5 More Discussions You Might Find Interesting

1. BSD

Snort on openbsd

Im trying to gather some info to set up snort on openbsd 3.2, has anyone out there managed to get it up and running ? My initial attempts seem to be quite below par (4 Replies)
Discussion started by: malcontent
4 Replies

2. Linux

snort port no

Hi, can anybody know snort port no in linux, (1 Reply)
Discussion started by: manoj.solaris
1 Replies

3. Cybersecurity

Snort/NTOP Placement

I have been asked to place 2 (1 NTOP & 1 SNORT) boxes within our network as part of our tool kit for network monitoring and Intrusion detection. Out network is very simplistic and it layed out like this: internet | | Cisco 1811 Router (8x Layer 2 switch ports) ... (0 Replies)
Discussion started by: metallica1973
0 Replies

4. Solaris

Need suggestion:- Failed HTTPS transfer to https://supportfiles.sun.com/curl

Hi Guys, I have recently started reciving below Error message Failed HTTPS transfer to https://supportfiles.sun.com/curl whenever I run /usr/local/bin/sudo /opt/SUNWexplo/bin/explorer -P -q -v from all Servers. Looks like the SSL certificate as Expired. Whenever I type... (4 Replies)
Discussion started by: manalisharmabe
4 Replies

5. Homework & Coursework Questions

Error in installation of Snort 2.97.0

Use and complete the template provided. The entire template must be completed. If you don't, your post may be deleted! 1. The problem statement, all variables and given/known data: My system is Redhat 5.6. I want to install snort in my system which requires following dependencies. 1. Libpcap... (8 Replies)
Discussion started by: Ankur Goyal
8 Replies
certmonger(8)						      System Manager's Manual						     certmonger(8)

NAME
certmaster-submit SYNOPSIS
certmaster-submit [-h serverHost] [-c cafile] [-C capath] [csrfile] DESCRIPTION
certmaster-submit is the helper which certmonger uses to make requests to certmaster-based CAs. It is not normally run interactively, but it can be for troubleshooting purposes. The signing request which is to be submitted should either be in a file whose name is given as an argument, or fed into certmaster-submit via stdin. OPTIONS
-h serverHost Submit the request to the certmaster instance running on the named host. The default is localhost:51235 if a file named /var/run/certmaster.pid is found on the local system, and is read from /etc/certmaster/minion.conf if that file is not found. -c cafile Submit the request over HTTPS instead of HTTP, and only trust the server if its certificate was issued by the CA whose certificate is in the named file. -C capath Submit the request over HTTPS instead of HTTP, and only trust the server if its certificate was issued by a CA whose certificate is in a file in the named directory. EXIT STATUS
0 if the certificate was issued. The certificate will be printed. 1 if the CA is still thinking. A cookie value will be printed. 2 if the CA rejected the request. An error message may be printed. 3 if the CA was unreachable. An error message may be printed. 4 if critical configuration information is missing. An error message may be printed. FILES
/var/run/certmaster.pid the certmaster service's PID file. Its presence is taken to indicate that this system is a CA, and that requests should be submit- ted to a certmaster server running on the local system. /etc/certmaster/minion.conf the certmaster minion configuration file. If there is no indication that the local system is a certmaster server, then this file is consulted to determine the location of the certmaster server. KNOWN BUGS
Checking for the existence of certmaster's PID file is a terrible way to figure out whether we're a minion or not. BUGS
Please file tickets for any that you find at https://fedorahosted.org/certmonger/ SEE ALSO
certmonger(8) getcert(1) getcert-list(1) getcert-list-cas(1) getcert-resubmit(1) getcert-start-tracking(1) getcert-stop-tracking(1) cert- monger-ipa-submit(8) certmonger Manual 7 June 2010 certmonger(8)
All times are GMT -4. The time now is 10:15 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy