Re: VMS 2.2 - TCP Reset to a word belonging to a URL

luiz.barreto · ‎10-07-2004

Does anyone know how to deny access to a site by doing a TCP Reset to a string on the site's domain name (using an IDS MC Custom Signature)?

jimwelsh · ‎10-07-2004

Create a STRING.HTTP custom signature. Make it "ToService". Set the RegexString to an appropriate Regular Expression for the URL. Enable it, and set the Action to "Reset".

If you need specifics, let me know. Please specify the domain name you wish to block.

Off-topic. I'd do this by having my local DNS server clain to be authoritative for that domain, and have no A records for it!

luiz.barreto · ‎10-08-2004

Hi Jim

I use IDS MC 1.2 and it doesn't has the engine STRING.HTTP.

I used STRING.TCP and the string letters (RegexString) between brackets but it didn't work.

About the DNS I don't think it is effective because the employees could use the IP address or use another DNS server.

I am waiting another idea from you.

Thanks.

jimwelsh · ‎10-08-2004

What was your RegexString that you tried?

Give me a specific example of a URL you want to block. Of course, if the user uses an IP Address, then you won't get the URL in the HTTP Headers, anyway.

jimwelsh · ‎10-08-2004

OOPS. My bad. I meant SERVICE.HTTP in my earlier post.

luiz.barreto · ‎10-08-2004

One URL I want to reset is www.parperfeito.com.br so the string to be reset would be parperfeito.

jimwelsh · ‎10-08-2004

Try:

[Pp][Aa][Rr][Pp][Ee][Ff][Ee][Ii][Tt][Oo]

You could get fancier (like specifying the "dot" chars with "\." before and after, and so forth), but this string seems unique enough to do the job.

Also, make sure you set the AlarmThrottle to "FireAll".

jimwelsh · ‎10-08-2004

I meant "[Pp][Aa][Rr][Pp][Ee][Rr][Ff][Ee][Ii][Tt][Oo]", obviously.

jimwelsh · ‎10-08-2004

OK, I tested tonight on an appliance, and the RequestRegex I used that is less likely to cause false positives is:

\x0d\x0a[Hh][Oo][Ss][Tt]: .*[Pp][Aa][Rr][Pp][Ee][Rr][Ff][Ee][Ii][Tt][Oo]\x2e[Cc][Oo][Mm]\x2e[Bb][Rr]\x0d\x0a

HTH

luiz.barreto · ‎10-14-2004

I tested this last suggestion and it didn't work with the engine SERVICE.HTTP.

jimwelsh · ‎10-14-2004

Please define "didn't work".

luiz.barreto · ‎10-27-2004

The connection was not reset.