Lab 1: Perform Intrusion Detection using Various Tools

Module 12: Evading IDS, Firewalls, and Honeypots

Lab 1: Perform Intrusion Detection using Various Tools

Task 1: Detect Intrusions using Snort

if your here during test im sorry good luck follow lab instructions

get a real IDS and have their engineers set it up RIP

Z:\CEHv11 Module 12 Evading IDS, Firewalls, and Honeypots\Intrusion Detection Tools\Snort

click the Snort_2_9_15_Installer.exe

installer will go away after you click ok

go to:

Z:\CEHv11 Module 12 Evading IDS, Firewalls, and Honeypots\Intrusion Detection Tools\Snort\snortrules-snapshot-29150\etc

right click copy snort.conf

paste it in C:\Snort\etc

replace file with the one ur pasting in

go to:

Z:\CEHv11 Module 12 Evading IDS, Firewalls, and Honeypots\Intrusion Detection Tools\Snort\snortrules-snapshot-29150

copy snortrules-snapshot-29150

paste into C:\Snort.

from that file you now pasted in go into it and copy preproc_rules

paste it into C:\Snort;

click replace

doping same thing copy rules folder

paste it into c:\snort

windows key

run

cmd

cd C:\Snort\bin

type snort

After completion press Ctrl+C

snort -W

this command lists your machine’s physical address, IP address, and Ethernet Drivers, but all are disabled by default

Observe your Ethernet Driver index number and write it down (in this lab, it is 1).

enable the Ethernet Driver, in the command prompt, type:

snort -dev -i 1 and press Enter

You see a rapid scroll text in the command prompt, which means that the Ethernet Driver is enabled and working properly.

launch another command prompt

ping google.com

This ping command triggers a Snort alert in the Snort command prompt with rapid scrolling text.

Close both command prompt windows. The verification of Snort installation and the triggering

alert is complete, and Snort is working correctly in verbose mode.

go to

C:\Snort\etc.

open snort.conf with notepad ++

go to line 45

replace any with the IP of the targt machine snort is running

If you have a DNS Server, then make changes in the DNS_SERVERS line by replacing $HOME_NET with your DNS Server IP address;

its the part that says list of dns servers on your network right below that line 51

in this lab its 8.8.8.8

The same applies to SMTP_SERVERS, HTTP_SERVERS, SQL_SERVERS, TELNET_SERVERS, and SSH_SERVERS.

scroll to line Line 104

replace ../rules with C:\Snort\rules

Line 105,

replace ../so_rules with C:\Snort\so_rules

Line 106,

replace ../preproc_rules with C:\Snort\preproc_rules

109 and 110, replace

../rules with C:\Snort\rules.

minimise notepad

go to C:\Snort\rules,

create two text files; name them white_list and black_list and change their file extensions from .txt to .rules.

back in notepad

line 243

replace /usr/local/lib/snort_dynamicpreprocessor/ with C:\Snort\lib\snort_dynamicpreprocessor.

Line 246)

replace /usr/local/lib/snort_dynamicengine/libsf_engine.so with C:\Snort\lib\snort_dynamicengine\sf_engine.dll.

Add (space) in between # and dynamicdetection (Line 250).

add #‘#’ and (space) before each preprocessor rule (262-266).

line 326

delete lzma keyword and a (space).

you are now on step 45 and want to throw your computer

refer to blog for rest of lab.

lets say all this is already done by the nice lab people

go into cmd

cd C:\Snort\bin

snort -iX -A console -c C:\Snort\etc\snort.conf -l C:\Snort\log -K ascii

If you receive a fatal error, you should first verify that you have typed all modifications correctly and consider quitting your job

If you receive an error stating “Could not create the registry key,” then run the command prompt as Administrator.

if all done good it will show

Commencing packet processing (pid=xxxx) (the value of xxxx may be any number; in this lab, it is 5384)

After initializing interface and logged signatures, Snort starts and waits for an attack and triggers alerts when attacks occur on the machine.

Leave the Snort command prompt running.

Attack your own machine, and check whether Snort detects it or not.

waste of time

---------------------------------------------------------------------------------------------------------------------------------------

Module 12: Evading IDS, Firewalls, and Honeypots

Lab 1: Perform Intrusion Detection using Various Tools

Task 2: Detect Malicious Network Traffic using ZoneAlarm FREE FIREWALL 2019

ZoneAlarm FREE Firewall 2019 blocks attackers and intruders from accessing your system.

It manages and monitors all incoming and outgoing traffic and shields the network from hackers, malware,

and other online threats that put network privacy at risk, and monitors programs for suspicious behavior spotting

and stopping new attacks that bypass traditional anti-virus protection. This Firewall prevents identity theft by guarding

your data, and erases your tracks allowing you to surf the web in complete privacy. Furthermore, it locks out attackers,

blocks intrusions, and makes your PC invisible online. Additionally, it filters out annoying, as well as potentially

dangerous, email.

refer to blog

---------------------------------------------------------------------------------------------------------------------------------------

Module 12: Evading IDS, Firewalls, and Honeypots

Lab 1: Perform Intrusion Detection using Various Tools

Task 3: Detect Malicious Network Traffic using HoneyBOT

HoneyBOT is a medium interaction honeypot for windows. A honeypot creates a safe environment to capture and interact

with unsolicited traffic on a network. HoneyBOT is an easy-to-use solution that is ideal for network security research

or as part of an early-warning IDS.

refer to blog

-------------------------------------------------------------------------------------------------------------------------------------

Lab Scenario

The goal of the Intrusion Detection Analyst is to find possible attacks against a network. Recent years have witnessed a significant increase in Distributed Denial-of-Service (DDoS) attacks on the Internet, making network security a great concern. Analysts search for possible attacks by examining IDS logs and packet captures and corroborating them with firewall logs, known vulnerabilities, and general trending data from the Internet. IDS attacks are becoming more sophisticated; automatically reasoning the attack scenarios in real-time, and categorizing them has become a critical challenge. These processes result in huge amounts of data, which analysts must examine to detect a pattern. However, the overwhelming flow of events generated by IDS sensors make it difficult for security administrators to uncover hidden attack plans.

To become an expert penetration tester and security administrator, you must possess sound knowledge of network IPSs, IDSs, malicious network activity, and log information.

Lab Objectives

Detect intrusions using Snort
Detect malicious network traffic using ZoneAlarm FREE FIREWALL 2019
Detect malicious network traffic using HoneyBOT

Overview of Intrusion Detection Systems

Intrusion detection systems are highly useful as they monitor both the inbound and outbound traffic of the network and continuously inspects the data for suspicious activities that may indicate a network or system security breach. The IDS checks traffic for signatures that match known intrusion patterns and signals an alarm when a match is detected. It can be categorized into active and passive, depending on its functionality: an IDS is generally passive and is used to detect intrusions, while an intrusion prevention system (IPS) is considered as an active IDS, as it is not only used to detect the intrusion on the network, but also prevent them.

Main Functions of IDS:

Gathers and analyzes information from within a computer or a network, to identify the possible violations of security policy
Also referred to as a “packet-sniffer,” which intercepts packets traveling along various communication mediums and protocols
Evaluates traffic for suspected intrusions and signals an alarm after detection

Task 1: Detect Intrusions using Snort

Snort is an open-source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis and content searching/matching and is used to detect a variety of attacks and probes such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and OS fingerprinting attempts. It uses a flexible rules language to describe traffic to collect or pass, as well as a detection engine that utilizes a modular plug-in architecture.

Uses of Snort:

Straight packet sniffer such as tcpdump
Packet logger (useful for network traffic debugging, etc.)
Network intrusion prevention system

Here, we will use Snort to detect network intrusions.

Task 2: Detect Malicious Network Traffic using ZoneAlarm FREE FIREWALL 2019

ZoneAlarm FREE Firewall 2019 blocks attackers and intruders from accessing your system. It manages and monitors all incoming and outgoing traffic and shields the network from hackers, malware, and other online threats that put network privacy at risk, and monitors programs for suspicious behavior spotting and stopping new attacks that bypass traditional anti-virus protection. This Firewall prevents identity theft by guarding your data, and erases your tracks allowing you to surf the web in complete privacy. Furthermore, it locks out attackers, blocks intrusions, and makes your PC invisible online. Additionally, it filters out annoying, as well as potentially dangerous, email.

Task 3: Detect Malicious Network Traffic using HoneyBOT

HoneyBOT is a medium interaction honeypot for windows. A honeypot creates a safe environment to capture and interact with unsolicited traffic on a network. HoneyBOT is an easy-to-use solution that is ideal for network security research or as part of an early-warning IDS.

Here, we will use the HoneyBOT tool to detect malicious network traffic.