Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

next/sv/69/20230705/v1 #1288

Merged
merged 4 commits into from Jul 6, 2023
Merged

next/sv/69/20230705/v1 #1288

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2bd211e
filemagic: test interaction with flowbits
regit Feb 19, 2019
4548ac8
tests: add filemagic/file.magic tests
victorjulien Jun 29, 2023
b736cde
tests: filename/fileext tests
victorjulien Jun 29, 2023
746b5c0
tests: add mixed case tls.fingerprint tests
victorjulien Jul 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 11 additions & 0 deletions tests/fileext-01/test.rules
View file
Open in desktop
@@ -0,0 +1,11 @@
alert tcp any any -> any any (fileext:"PDF"; sid:1;)
alert tcp any any -> any any (fileext:"pdf"; sid:2;)
alert tcp any any -> any any (fileext:"pDf"; sid:3;)

alert tcp any any -> any any (fileext:!"DOC"; sid:4;)
alert tcp any any -> any any (fileext:!"doc"; sid:5;)
alert tcp any any -> any any (fileext:!"dOc"; sid:6;)

alert tcp any any -> any any (fileext:!"PDF"; sid:7;)
alert tcp any any -> any any (fileext:!"pdf"; sid:8;)
alert tcp any any -> any any (fileext:!"pDf"; sid:9;)
46 changes: 46 additions & 0 deletions tests/fileext-01/test.yaml
View file
Open in desktop
@@ -0,0 +1,46 @@
requires:
features:
- HAVE_LIBJANSSON

pcap: ../filemagic-flowbits/pdf-dl.pcap

args:
- -k none

checks:
- filter:
count: 1
match:
alert.signature_id: 1
- filter:
count: 1
match:
alert.signature_id: 2
- filter:
count: 1
match:
alert.signature_id: 3
- filter:
count: 1
match:
alert.signature_id: 4
- filter:
count: 1
match:
alert.signature_id: 5
- filter:
count: 1
match:
alert.signature_id: 6
- filter:
count: 0
match:
alert.signature_id: 7
- filter:
count: 0
match:
alert.signature_id: 8
- filter:
count: 0
match:
alert.signature_id: 9
3 changes: 3 additions & 0 deletions tests/fileext-02/test.rules
View file
Open in desktop
@@ -0,0 +1,3 @@
alert tcp any any -> any any (filename:"r"; fileext:"PDF"; sid:1;)
alert tcp any any -> any any (filename:"r"; fileext:"DOC"; sid:2;)
alert tcp any any -> any any (filename:"x"; fileext:"pdf"; sid:3;)
22 changes: 22 additions & 0 deletions tests/fileext-02/test.yaml
View file
Open in desktop
@@ -0,0 +1,22 @@
requires:
features:
- HAVE_LIBJANSSON

pcap: ../filemagic-flowbits/pdf-dl.pcap

args:
- -k none

checks:
- filter:
count: 1
match:
alert.signature_id: 1
- filter:
count: 0
match:
alert.signature_id: 2
- filter:
count: 0
match:
alert.signature_id: 3
11 changes: 11 additions & 0 deletions tests/filemagic-01/test.rules
View file
Open in desktop
@@ -0,0 +1,11 @@
alert tcp any any -> any any (filemagic:"PDF"; sid:1;)
alert tcp any any -> any any (filemagic:"pdf"; sid:2;)
alert tcp any any -> any any (filemagic:"pDf"; sid:3;)

alert tcp any any -> any any (filemagic:!"VERSION 1.6"; sid:4;)
alert tcp any any -> any any (filemagic:!"version 1.6"; sid:5;)
alert tcp any any -> any any (filemagic:!"vErSiOn 1.6"; sid:6;)

alert tcp any any -> any any (filemagic:!"VERSION 1.5"; sid:7;)
alert tcp any any -> any any (filemagic:!"version 1.5"; sid:8;)
alert tcp any any -> any any (filemagic:!"vErSiOn 1.5"; sid:9;)
47 changes: 47 additions & 0 deletions tests/filemagic-01/test.yaml
View file
Open in desktop
@@ -0,0 +1,47 @@
requires:
features:
- HAVE_LIBJANSSON
- MAGIC

pcap: ../filemagic-flowbits/pdf-dl.pcap

args:
- -k none

checks:
- filter:
count: 1
match:
alert.signature_id: 1
- filter:
count: 1
match:
alert.signature_id: 2
- filter:
count: 1
match:
alert.signature_id: 3
- filter:
count: 1
match:
alert.signature_id: 4
- filter:
count: 1
match:
alert.signature_id: 5
- filter:
count: 1
match:
alert.signature_id: 6
- filter:
count: 0
match:
alert.signature_id: 7
- filter:
count: 0
match:
alert.signature_id: 8
- filter:
count: 0
match:
alert.signature_id: 9
4 changes: 4 additions & 0 deletions tests/filemagic-flowbits-02/test.rules
View file
Open in desktop
@@ -0,0 +1,4 @@
alert http any any -> any any (msg:"Wget useragent";content:"wget"; nocase; startswith; http_user_agent; sid:1; rev:1; flowbits:set,wgetagent;)
alert http any any -> any any (msg:"PDF not wget"; flowbits:isnotset,wgetagent; filemagic:"PDF"; sid:3; rev:1;)
alert http any any -> any any (msg:"PDF not wget locked to client"; flow:to_client; flowbits:isnotset,wgetagent; filemagic:"PDF"; sid:4; rev:1;)

25 changes: 25 additions & 0 deletions tests/filemagic-flowbits-02/test.yaml
View file
Open in desktop
@@ -0,0 +1,25 @@
requires:
features:
- HAVE_LIBJANSSON
- MAGIC
min-version: 7

pcap: ../filemagic-flowbits/pdf-dl.pcap

args:
- -k none

checks:
- filter:
count: 1
match:
alert.signature_id: 1
pcap_cnt: 7
- filter:
count: 0
match:
alert.signature_id: 3
- filter:
count: 0
match:
alert.signature_id: 4
4 changes: 4 additions & 0 deletions tests/filemagic-flowbits-03/test.rules
View file
Open in desktop
@@ -0,0 +1,4 @@
alert http any any -> any any (msg:"Wget useragent"; http.user_agent; content:"wget"; nocase; startswith; flowbits:set,wgetagent; sid:1; rev:1;)
alert http any any -> any any (msg:"PDF not wget"; flowbits:isnotset,wgetagent; file.magic; content:"PDF"; sid:3; rev:1;)
alert http any any -> any any (msg:"PDF not wget locked to client"; flow:to_client; flowbits:isnotset,wgetagent; file.magic; content:"PDF"; sid:4; rev:1;)

25 changes: 25 additions & 0 deletions tests/filemagic-flowbits-03/test.yaml
View file
Open in desktop
@@ -0,0 +1,25 @@
requires:
features:
- HAVE_LIBJANSSON
- MAGIC
min-version: 7

pcap: ../filemagic-flowbits/pdf-dl.pcap

args:
- -k none

checks:
- filter:
count: 1
match:
alert.signature_id: 1
pcap_cnt: 7
- filter:
count: 0
match:
alert.signature_id: 3
- filter:
count: 0
match:
alert.signature_id: 4
Binary file added tests/filemagic-flowbits/pdf-dl.pcap
View file
Open in desktop
Binary file not shown.
9 changes: 9 additions & 0 deletions tests/filemagic-flowbits/test.rules
View file
Open in desktop
@@ -0,0 +1,9 @@
alert http any any -> any any (msg:"Wget useragent";content:"wget"; nocase; startswith; http_user_agent; sid:1; rev:1; flowbits:set,wgetagent; noalert;)
alert http any any -> any any (msg:"PDF wget"; flowbits:isset,wgetagent; filemagic:"PDF"; sid:2; rev:1;)
alert http any any -> any any (msg:"PDF not wget"; flowbits:isnotset,wgetagent; filemagic:"PDF"; sid:3; rev:1;)

alert http any any -> any any (msg:"pdf uri wget"; flowbits:isset,wgetagent; content:"pdf"; endswith; http_uri; sid:4; rev:1;)
alert http any any -> any any (msg:"pdf uri not wget"; flowbits:isnotset,wgetagent; content:"pdf"; endswith; http_uri; sid:5; rev:1;)

alert http any any -> any any (msg:"pdf data wget"; flowbits:isset,wgetagent; file_data; content:"pdf"; sid:6; rev:1;)
alert http any any -> any any (msg:"pdf data not wget"; flowbits:isnotset,wgetagent; file_data; content:"pdf"; sid:7; rev:1;)
34 changes: 34 additions & 0 deletions tests/filemagic-flowbits/test.yaml
View file
Open in desktop
@@ -0,0 +1,34 @@
requires:
features:
- HAVE_LIBJANSSON
- MAGIC
min-version: 7

args:
- -k none

checks:
- filter:
count: 1
match:
alert.signature_id: 2
- filter:
count: 0
match:
alert.signature_id: 3
- filter:
count: 1
match:
alert.signature_id: 4
- filter:
count: 0
match:
alert.signature_id: 5
- filter:
count: 1
match:
alert.signature_id: 6
- filter:
count: 0
match:
alert.signature_id: 7
11 changes: 11 additions & 0 deletions tests/filename-01/test.rules
View file
Open in desktop
@@ -0,0 +1,11 @@
alert tcp any any -> any any (filename:"R.PDF"; sid:1;)
alert tcp any any -> any any (filename:"r.pdf"; sid:2;)
alert tcp any any -> any any (filename:"R.pDf"; sid:3;)

alert tcp any any -> any any (filename:!"S.PDF"; sid:4;)
alert tcp any any -> any any (filename:!"s.pdf"; sid:5;)
alert tcp any any -> any any (filename:!"S.pDf"; sid:6;)

alert tcp any any -> any any (filename:!"R.PDF"; sid:7;)
alert tcp any any -> any any (filename:!"r.pdf"; sid:8;)
alert tcp any any -> any any (filename:!"R.pDf"; sid:9;)
46 changes: 46 additions & 0 deletions tests/filename-01/test.yaml
View file
Open in desktop
@@ -0,0 +1,46 @@
requires:
features:
- HAVE_LIBJANSSON

pcap: ../filemagic-flowbits/pdf-dl.pcap

args:
- -k none

checks:
- filter:
count: 1
match:
alert.signature_id: 1
- filter:
count: 1
match:
alert.signature_id: 2
- filter:
count: 1
match:
alert.signature_id: 3
- filter:
count: 1
match:
alert.signature_id: 4
- filter:
count: 1
match:
alert.signature_id: 5
- filter:
count: 1
match:
alert.signature_id: 6
- filter:
count: 0
match:
alert.signature_id: 7
- filter:
count: 0
match:
alert.signature_id: 8
- filter:
count: 0
match:
alert.signature_id: 9
14 changes: 14 additions & 0 deletions tests/rules/filemagic/test.rules
View file
Open in desktop
@@ -0,0 +1,14 @@
alert tcp any any -> any any (file.magic; content:"one"; sid:1;)
alert tcp any any -> any any (file.magic; content:"one"; content:"two"; within:8; sid:2;)
alert tcp any any -> any any (file.magic; content:"one"; within:8; sid:3;)
alert tcp any any -> any any (file.magic; content:"one"; distance:8; sid:4;)
alert smb any any -> any any (flow:to_server; file.magic; content:"in file magic"; pkt_data; content:"in pkt data"; sid:5;)
alert smb any any -> any any (flow:to_server; file.magic; pcre:/one/R; sid:6;)
alert smb any any -> any any (flow:to_server; file.magic; pcre:/one/; sid:7;)
alert smb any any -> any any (flow:to_server; file.magic; pcre:/one/RB; sid:8;)
alert smb any any -> any any (flow:to_server; file.magic; content:"one"; pcre:/two/R; sid:9;)

alert tcp any any -> any any (filemagic:"pdf"; sid:10;)
alert tcp any any -> any any (filemagic:!"pdf"; sid:11;)
alert tcp any any -> any any (filemagic:"PDF"; sid:12;)
alert tcp any any -> any any (filemagic:!"PDF"; sid:13;)