Bug #2510
closed
Suricata doesnt decompress HTTP Post body
Added by ajaxtpm ajaxtpm almost 6 years ago.
Updated over 2 years ago.
Description
The subject is self-explained. If I send a HTTP Post request with gzipped Post body it doesnt get decompressed and cleartext inside could not be inspected by signatures.
Of course it is the IDS bypass technique.
Example signatures:
alert http any any -> any any (msg: "GZIPPED REQUEST"; flow: established, to_server; content: "name"; http_client_body; nocase; sid: 1; rev: 1; )
alert http any any -> any any (msg: "TO_SERVER |1F 8B|"; flow: established, to_server; content: "|1F 8B|"; http_client_body; sid: 2; rev: 1; )
Pcap Attached
Expectation: alert sid 1
Reality: alert sid 2
Files
- Assignee set to OISF Dev
- Target version set to TBD
- Private changed from No to Yes
- Effort set to medium
- Difficulty set to medium
thanks for reporting, we will look into that
Libhtp, which does the decompression on the response body side, simply doesn't implement decompression for request bodies. So addressing this issue would involve adding this support to libhtp or implementing it in Suricata itself somehow.
Victor Julien wrote:
Libhtp, which does the decompression on the response body side, simply doesn't implement decompression for request bodies. So addressing this issue would involve adding this support to libhtp or implementing it in Suricata itself somehow.
Hi Victor, should I submit this issue to libhtp github and close this one?
I think a libhtp issue would be good, but lets keep this ticket open as well. Thanks!
- Status changed from New to Assigned
- Assignee changed from OISF Dev to Philippe Antoine
Hi Philippe, can you have a look at what it would take for us to also support request body decompression?
- Target version changed from TBD to 6.0.0beta1
- Related to Task #3479: libhtp 0.5.33 (4.1.x) added
- Status changed from Assigned to In Review
- Target version changed from 6.0.0beta1 to 7.0.0-beta1
- Status changed from In Review to Closed
- Private changed from Yes to No
Also available in: Atom
PDF