Security Onion Blog

Monday, October 17, 2011

In Search Of Evil User Agents

I've got a guest blog post over at PaulDotCom describing how to find evil User Agents on your network using the new httpry functionality in Security Onion:
In Search Of Evil User Agents
at
Labels: ,

2 comments:

Alec Waters said...

Hi Doug,

httpry is a great tool, but there is a minor gotcha in that it doesn't do any defragmentation or TCP segment reassembly etc. It only considers client->server segments that begin with one of the specified HTTP methods, and server->client segments that begin with "HTTP".

This means that you may not always get complete information in the httpry output, most notably in the field that denotes the Host: header. This can happen when the Host: header isn't in the first TCP segment that the client sends to the server, either because that's just the way the browser sent it, or because of malicious intent (evasion).

tshark can do a similar job, complete with reassembly code. Fiddle with the -e fields as required:

sudo tshark -i eth1 -R http.request -T fields -e http.host -e http.request.uri

It's a somewhat heavier option, though :)

alec

October 17, 2011 at 12:04 PM
Doug Burks said...

Hi Alec,

Thanks for your comment. Ultimately, we may end up replacing httpry with Suricata's HTTP logging which should have no problems with defragmentation or reassembly.

Thanks,
Doug

October 17, 2011 at 12:18 PM

Post a Comment

Subscribe to: Post Comments (Atom)

Search This Blog

Featured Post

Did You Know Security Onion Scales to the Enterprise?

Did you know Security Onion scales to the enterprise? Security Onion is designed to scale from simple standalone deployments all the way up ...

Popular Posts

Blog Archive