Project

General

Profile

Actions
Copy link

Feature #2519

open
CL CT

XFF iprep support

Feature #2519: XFF iprep support

Added by chris lujan almost 8 years ago. Updated about 7 years ago.

Status:
New
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
medium
Difficulty:
high
Label:

Description

I have made many attempts and I am fairly confident that when xff is enabled (in overwrite mode), iprep is not applied to the overwritten field and does not alert.
My method of testing was:
1) GET / request to the webserver behind the load-balancer from a tor-browser (using an IP in iprep list), no alerts.
2) GET /uid=0(root) gid=0(root) groups=0(root) request to the webserver behind the load-balancer from a tor-browser (using an IP in iprep list), GPL ATTACK_RESPONSE id check returned root alert present, XFF ip present in src_ip field (src_ip found in iprep files).
3) Make GET request to IP found in iprep list (ET TOR Known Tor Exit Node Traffic group 7 && OTX internal host talking to host known in pulse alerted).
4) Change iprep rule from $HOME_NET any -> any any to any any -> any any, retry steps 1-3, same results.

AH Updated by Andreas Herz almost 8 years ago Actions
Copy link
 #1

  • Assignee set to Anonymous
  • Target version set to TBD

could you prepare a pcap?

VJ Updated by Victor Julien almost 8 years ago Actions
Copy link
 #2

  • Tracker changed from Bug to Feature
  • Effort set to medium
  • Difficulty set to high
  • Affected Versions deleted (4.0.4)

XFF is currently only used for output. Detection support would mean the detection engine would need to become aware of XFF.

AH Updated by Andreas Herz about 7 years ago Actions
Copy link
 #3

  • Assignee set to Community Ticket
Actions
Copy link

Also available in: PDF Atom