<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>thx Anoop,<div>How Suricata handle http dir traversal encoded or not ?</div><div>Regards</div><div>Rmkml</div><div><br></div></body></html><br><br>
-------- Original message --------
Subject: Re: [Oisf-devel] Directory Traversal not fire when are encoded ?
From: Anoop Saldanha <anoopsaldanha@gmail.com>
To: rmkml@yahoo.fr
CC: Oisf-devel@openinfosecfoundation.org
<br><br><body><div style="word-break:break-all;">Afai see it, it shouldn't fire at all for any of the below cases,<br>since the ".." should be normalized. The bug would rather be suricata<br>firing when double encoded, than suricata not firing for the<br>non-encoded or single encoded case.<br><br>I think the path normalization seems to happen before the second level<br>of decoding happens on the uri, and maybe that's why it fires with<br>double encoded uris.<br><br>On Sun, Jul 8, 2012 at 2:56 AM, Rm Kml <rmkml@yahoo.fr> wrote:<br>> Hi,<br>><br>> First, Congrats All for Suricata v1.3 !<br>><br>> Im continue my testing, and maybe discovered then Suricata not fire when dir<br>> traversal are encoded like this:<br>><br>> GET<br>> /sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E//etc/vmware/hostd/vmInventory.xml<br>> HTTP/1.1<br>><br>> (Thx Nmap Scripting Engine [nse])<br>><br>> Someone confirm this please? (if yes Im open a new redmine ticket)<br>><br>> ok if I create this rule:<br>> ... content:"../"; http_uri; ...<br>><br>> 1) Suricata fire with "GET /sdk/../..."<br>><br>> 2) Suricata not fire with (simple encoded) "GET /sdk/%2E%2E/..."<br>><br>> 3) Suricata fire with (double encoded) "GET /sdk/%252E%252E%252F..."<br>><br>> Regards<br>> Rmkml<br>><br>> http://www.twitter.com/rmkml<br>><br>><br>> _______________________________________________<br>> Oisf-devel mailing list<br>> Oisf-devel@openinfosecfoundation.org<br>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel<br><br><br><br>-- <br>Anoop Saldanha<br></div> </body>