whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
killchain-compendium/Miscellaneous/Snort.md

4.1 KiB
Raw Blame History

Snort

Snort is comprised of multiple modules to process network packets.

  • packet decoder
  • pre processor
  • detection engine
  • logging and alerting
  • output and plugins

Data Aquisition Modules

  • Pcap, default
  • Afpacket, inline mode, IPS
  • Ipq, uses netfilter on linux
  • Nfq, inline mode on linux
  • Ipfw, inline mode on BSD
  • Dump, test mode

Usage

  • Check config, and run tests via
snort -c <config> -T

Sniffing

Parameter Description
-v Verbose. Display the TCP/IP output in the console.
-d Display the packet data (payload).
-e Display the link-layer (TCP/IP/UDP/ICMP) headers.
-X Display the full packet details in HEX.
-i Liste on interface

Packet Logger

  • Logged by IP as directory, ports as files inside these dirs
  • BPF filter can be used like tcp port 80
  • Log files can be opened by wireshark or tcpdump -r <logfile>
Parameter Description
-l Logger mode, target log and alert output directory. Default output folder is tcpdump to /var/log/snort.
-K ASCII Log packets in ASCII format
-r Filter dumped logs in Snort
-n Specify the number of packets that will be read

IDS and IPS

  • Output is an alert file along an optional log file
Parameter Description
-c Defining the configuration file
-T Testing the configuration file
-N Disable logging
-D Background mode
-A Alert modes; full: all possible info about alerts, default mode; fast : alert message, timestamp, source and destination IP, port numbers. console: Provides fast style alerts on the console screen. cmg: CMG style, basic header details with payload in hex and text format. none: Disabling alerting
  • Rules found in /etc/snort/rules/local.rules
alert icmp any any <> any any  (msg: "ICMP Packet Found"; sid: 100001; rev:1;)

PCAPs

  • snort -c <configfile> -r file.pcap -A console -n <number of packets>
  • snort -c <configfile> --pcap-list="file1.pcap file2.pcap" -A console -l .

Rules

snort -c /etc/snort/rules/local.rules -A console
snort -c /etc/snort/rules/local.rules -A full

  • Every rule has an IP source and destination, as well as a port for every endpoint

  • General, payload and non payload rules

  • Direction of the packet

    • -> to destination
    • <> bidirectional

  • IDS -> alert

  • IPS -> reject

<action> <protocol> <ip.src> <src.port>  <> <ip.dst> <dst.port>(msg: "<msg>; <reference>; <ruleID>;<revision info>

  • Actions

    • alert
    • log
    • drop
    • reject

  • SID rule IDs

    • < 100 reserved rules
    • 100 - 999,999 rules of the build

    • = 1,000,000 user rules

  • Reference may be a CVE

  • Revisions are versionings of the rule

  • Filter address range via CIDR

alert icmp 192.168.1.0/24 any <> any any  (msg: "ICMP Packet Found"; sid: 100001; rev:1;)
  • Filter multiple address ranges
alert icmp [192.168.1.0/24, 10.1.1.0/24] any <> any any  (msg: "ICMP Packet Found"; sid: 100001; rev:1;)
  • Exlude via !10.10.0.1
  • Filter via any and ports between 4712 and 8080
alert icmp any 4711,8080: <> any any (msg: "TCP Packet Found"; sid: 100001; rev:1;)

Detection Rules

  • /etc/snort/rules/local.rules
  • ASCII or gex mode
ASCII mode - alert tcp any any -> any 8080  (msg: "GET Request Found"; content:"GET";content: "/foo"; sid: 100001; rev:1;)
alert tcp any any -> any 8080  (msg: "GET Request Found"; content:"|47 45 54|"; sid: 100001; rev:1;)
  • Case insensitiv
alert tcp any any -> any 8080  (msg: "GET Request Found"; content:"GET"; nocase; sid: 100001; rev:1;)
  • Fast pattern
alert tcp any any <> any 80  (msg: "GET Request Found"; content:"GET"; fast_pattern; content:"www";  sid:100001; rev:1;)
  • Non payload detection rules
    • TCP flags, flags: F,S,A,R,P,U
    • Payload size, dsize:min<>max
    • SameIP, alert ip any any <> any any (msg: "SAME-IP TEST"; sameip; sid: 100001; rev:1;)
    • Packet IDs, id: 4711