Hack Like a Pro: An Introduction to Regular Expressions, Part 2 « Null Byte :: WonderHowTo

Welcome back, my hacker novitiates!A short while ago, I introduced you toregular expressions. Regular expressions are a language that is particularly useful for finding complex text patterns in streams of data.Although first developed for Perl, regular expressions are used throughout the IT industry (but more so in UNIX/Linux environments), and you can find them implemented in databases, Perl, Java, Ruby, Python, C++, .NET, and other programming languages.For our purposes here, we want to focus on their implementation inSnort, the world's most widely used Intrusion Detection System (IDS). Snort is open source, but owned bySourcefire, which was recently purchased by Cisco. As a result, Snort will likely become even more widespread than it is today, so I strongly recommend learning its ins and outs.Regular Expressions in SnortAs hackers, the more we know about Snort and how it operates, the better we can evade it. As security professionals, the more we know about Snort, the better we can detect attempts at intruding into our system.One variety of regular expressions is the Perl Compatible Regular Expressions (PCRE). Due to the strength PCRE, Snort uses it in many of its rules to detect the signature of intrusions. PCRE can be implemented to find specific signatures of known exploits.In this tutorial, we will examine a Snort rule that will detect and alert us of a particular type of FTP DOS attack and, by doing so, hopefully, we will learn a bit of PCRE along the way.Step 1: Getting StartedIf you have not already done so, download and install Snort onyour Kali system. If you are still usingBackTrack, it is already installed.In Kali, simply type the following command to download the Snort package from the Kali repository.apt-get install snortOr, you candownload itand compile it as I've shown inthis tutorial.Step 2: Examine an ExploitSome versions of Google Chrome are prone to a remote denial-of-service vulnerability because it fails to handle user-supplied input properly. To find more information on this vulnerability/exploit, let's go to my favorite vulnerability database,SecurityFocus, and look atBugTraq ID 39183. It isdescribedthere as:Attackers can exploit this issue to crash the application, denying service to legitimate users. Google Chrome 4.1.249.1042 is vulnerable; other versions may also be affected.In itsdescription of the exploit, it says:To exploit this issue, an attacker must entice an unsuspecting user into visiting a malicious website or FTP server.This is one of the thousands of exploits Snort is designed to identify that uses PCRE. Because the signature of this attack is relatively simple, we will use it here to learn more about PCRE and how it is implemented in Snort for exploit signature identification.Step 3: PCRE ShorthandsBefore we examine this rule and its PCRE, we need to delve a bit deeper into some PCRE notation. Inmy previous article on PCRE, I introduced you to some basic PCRE notation. To understand this rule, we need to look at what PCRE refers to as "shorthands." These are single letters preceded by a "\" that tell the system to look for something very specific. Here is short list of a few.\b- This indicates a word boundary\d- This is any digit shorthand\s- This is whitespace shorthand\w- This is shorthand for any alpha, numeric, or underscore character\x- This shorthand references a hexadecimal character when followed by a hex number\n- This shorthand indicates a new lineStep 4: Examine a RuleNow, that we have expanded our knowledge a bit, let's look at that single rule in Snort and see whether we can decipher what the PCRE is looking for that denotes the signature of this Chrome FTP DOS attack.Now that you have downloaded and installed Snort, change directories to:kali > cd /etc/snort/rulesThen the DOS rules file and open it in your favorite text editor.kali > leafpad dos.rulesNow that you have that file open, find "39183." This is the BugTraq identifier for a DOS attack that uses Google Chrome to DOS an FTP server. It dates back to 2010 and has been patched in the newer versions of Google Chrome. Here we will be using it as an example of how PCRE can be used to identify the signature of this attack.The rule looks like this:alert tcp $EXTERNAL_NET 21 -> $HOME_NET any (msg:"DOS Google Chrome FTP handling out-of-bounds array index denial of service attempt"; flow:to_client,established; content:"|22 22|"; pcre:"/^2\d{2}^\n_*?\x22{2}/"; metadata:service ftp; reference:bugtraq,39183; classtype:attempted-dos; sid:16795; rev:3;)For information on the what all this rule means, see myprevious articles on Snort and its rules. Here we will be focusing exclusively on the PCRE signature embedded within this rule:pcre:"/^2\d{2}^\n_*?\x22{2}/"Step 5: Dissect the PCRENow that we have extracted the PCRE signature identifying segment of this rule, let's dissect it piece by piece to see what it is looking for to identify this attack. The "pcre:" simply tells Snort that what follows should be interpreted as a Perl Compatible Regular Expression and the"character starts the PCRE.Now let's take apart each piece of the PCRE clause starting with:/- This opens the PCRE clause^2- This indicates that digit 2 must start the string\d {2}- This indicates that next any digit must appear twice^\n_- Then, look for the start of a new line* - Then, any number of the items?- Then, any single item of what is front of it\x22{2}- Matches hex character (22) appearing twice {2}/- This closes the PCRE clauseSo, if I can summarize in plain English what this PCRE clause is looking for, it would be:"Look for a string that begins with the digit 2, followed by two digits, then the start of a new line and then any number of items, followed by a single item, then the two hexidecimal characters 22 and 22."PCRE is one of the critical skills to be effective in many different areas of IT, but particularly IT security. Here we can see how PCRE was implemented to identify the signature of a DOS attack. In some cases, as a IT security engineer, you may be required to write your own rules, so the more you know, the more effective you will become. As a hacker, the more you know, the better you can evade these systems and hit your pot of gold.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:An Introduction to Regular Expressions (Regex)How To:Take Slo-Mo Selfies (AKA 'Slofies') on iPhone 11, 11 Pro & 11 Pro MaxHack Like a Pro:Perl Scripting for the Aspiring Hacker, Part 1News:The Best Cyber Monday Tech Deals on TVs, Phones, Laptops, & MoreHow To:Add Your Own Custom Screensaver Images to Your Kindle Lock ScreenHow To:Create This Easy Hologram Projector for Your Smartphone in Just Ten MinutesHow To:Force Restart Your iPhone SE (2nd Generation) When It's Frozen or Otherwise Acting UpNews:Jeep's New AR Experience Lets You Interact with a Car That Isn't Actually ThereHow To:Earn the "Sally Likes Blood" achievement in Call of Duty: Black OpsNews:You Can Get a OnePlus 7 Pro with INSANE Specs for the Price of theXRor S10eHow To:Draw a Vampire-SmirkHow To:Abe Lincoln Vampire HunterHow To:Save Custom Shooting Presets in Filmic Pro So You Don't Have to Adjust Settings Later for Similar ShotsHow To:9 Oreo Hacks That Make Life Worth LivingHow To:Get started using FileMaker Pro 11How To:Use Colorista plugin in Final Cut Pro (Introduction)How To:The Safest Way to Disable ALL Bloatware on Your Galaxy S10News:iOS 12.1.1 Public Beta 3 Now Available to Software TestersHack Like a Pro:How to Install BackTrack 5 (With Metasploit) as a Dual Boot Hacking SystemHow To:Draft/Make Patterns in Different Sizes (Pattern Making of a Basic Dress with Waistline)News:Amazon's Best Black Friday Tech Deals 2016—TVs, Phones & TabletsHow To:Expand Your Coding Skill Set with This 10-Course Training BundleNews:New Snapchat Group Features Swipe Back at Facebook's Story StealingHow To:Transform a Loaf of Bread into a Stuffed Sandwich Fit for a PicnicHow To:Get All the New iPad Pro Wallpapers on Your iPhoneHow To:This Quick & Easy Shortcut Minces Garlic in SecondsNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Get LED Color Effects for Music Playing on Your AndroidHow To:Use Adobe Premiere Pro to edit video and moviesHow To:Use Regular Expressions to find text patternsHow To:The Official Google+ Insider's Guide IndexNews:Game box art - what to regular people think?THE FILM LAB:Intro to Final Cut Pro - 02News:introductionContest:Potassium Nitrate CrystalsNews:Jim Winter - Palmistry - FINGERS - Pt2Camera Plus Pro:The iPhone Camera App That Does it AllNews:Welcome to Edit on a DimeHow To:Hack Your Old Printer to Automatically Print Hashtag-Based Instagram PhotosNews:Bricked iPad Pros, Error 56, & How to Fix