Project

General

Profile

Actions
Copy link

Support #1996

closed
WW

Suricata worked in IDS mode ,Could detection the https attack?

Support #1996: Suricata worked in IDS mode ,Could detection the https attack?

Added by wo wo over 9 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

I have the private key in the webserver.

If i send the http request:

http://192.168.1.100/a.php?id=1 and 1=1 union select 1,2,3 from test

the attack will be deteced in the fast.log

BUT i used the https request like:

https://192.168.1.100/a.php?id=1 and 1=1 union select 1,2,3 from test

and the suricata didn`t deteced the attack.

thanks.

VJ Updated by Victor Julien over 9 years ago Actions
Copy link
 #1

Suricata does not decrypt https traffic. You will need a third party tool to decrypt it and have that tool send the decrypted traffic to Suricata.

VJ Updated by Victor Julien over 9 years ago Actions
Copy link
 #2

  • Description updated (diff)

WW Updated by wo wo over 9 years ago Actions
Copy link
 #3

Victor Julien wrote:

Suricata does not decrypt https traffic. You will need a third party tool to decrypt it and have that tool send the decrypted traffic to Suricata.

Thanks.

AH Updated by Andreas Herz about 9 years ago Actions
Copy link
 #4

Did you find a tool to that?

VJ Updated by Victor Julien about 9 years ago Actions
Copy link
 #5

  • Status changed from New to Closed
  • Assignee deleted (Victor Julien)

HH Updated by Hao Han over 7 years ago Actions
Copy link
 #6

Victor Julien wrote:

Suricata does not decrypt https traffic. You will need a third party tool to decrypt it and have that tool send the decrypted traffic to Suricata.

What tool could be used to decrypt ssl/tls traffic with the server's private key?

Actions
Copy link

Also available in: PDF Atom