Home / server / Questions / 1068876
In Process
Orphans
Asked: 2021-07-08 02:24:02 +0800 CST

Sending a malicious package as a test to test Suricata alerts

  • 772

I have a reverseproxy that proxies HTTP/HTTPS traffic between webbservers and I have set up Suricata in order to find and block malicious traffic to it.

Is there any way to trigger a alert via a CURL-request? Does the EICAR-test work?

I have done some googling but I could not find something straight-forward in order to trigger Suricata with curl.

linux security curl suricata

1 Answers

  1. http://testmynids.org/uid/index.html or http://www.testmyids.ca/ can be used to test, it will raise an "Attempted Information Leak".

    For the reverse proxy, you can create an HTML file with the content "uid=0(root) gid=0(root) groups=0(root)" on the web server 'http://webserver1/test_ids.html' then you can use curl to download it.

    • 1