Site Network:

SNORT 2.8.4 react

Home
  • Italiano

Change the file sp_react.c to redirect the client to another website:

at the row 306 edit the tmp_buf1[] variable

HTTP/1.1 302 FOUND\r\nLocation:http://google.com\r\nServer: Snort/2.8.3.2\r\nConnection:Close\r\nContent-Type: text/html\r\n\r\n

*google.com redirect to this address.

 

example rules:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"REACT RULES";flow: to_server,established;content:"example.com";classtype: policy-violation;sid:9999; react: block, msg ;)

*example.com it's the website to block.

 

Enjoy

Snortattack TEAM!