[Oisf-users] Wordpress Brute Force Rules

[Mesra.net CEO]

Thanks Jason,

Btw may i know how can i enable [!$SG_NET,$EXTERNAL_NET] ? That not supported on my suricata

TQ so much

From: Jason Williams 
Sent: Thursday, August 3, 2017 5:09 AM
To: Mesra.net CEO 
Cc: oisf-users at lists.openinfosecfoundation.org 
Subject: Re: [Oisf-users] Wordpress Brute Force Rules

Hello,

The issue is the inclusion of geoip, which is an IP keyword. http://suricata.readthedocs.io/en/latest/rules/header-keywords.html?highlight=geoip

If you define a range of IPs in the suricata.yaml as the variable SG_NET you want to allow logins from, you could probably do something similar with the below. 

drop http [!$SG_NET,$EXTERNAL_NET] any -> any any (msg:"WORDPRESS Brute Force Login"; flow:to_server,established; content:"POST"; http_method; content:"/wp-login.php"; nocase; http_uri; sid:56; rev:1;)

Thanks,

Jason


On Wed, Aug 2, 2017 at 11:35 AM, Mesra.net CEO <admin at mesra.my> wrote:

  Dear All,

  I try to make a rule to drop any of access out of Singapore on wplogin.php, and this is the rule:

  drop tcp $EXTERNAL_NET any -> any $HTTP_PORTS (msg:"WORDPRESS Brute Force Login"; flow:to_server,established;content:"POST"; nocase; http_method; uricontent:"/wp-login.php"; nocase; geoip:src,!SG; sid:56; rev:1;)

  But i have an error:

  [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Signature combines packet specific matches (like dsize, flags, ttl) with stream / state matching by matching on app layer proto (like using http_* keywords).

  What i’m doing wrong, please help and thank you so much





  _______________________________________________
  Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
  Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
  List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users

  Conference: https://suricon.net
  Trainings: https://suricata-ids.org/training/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170803/06132aa4/attachment-0002.html>