Snort lab - Information Assurance major only

INFA630 Lab #2 Step-by-Step Instructions with Screen Shots

Open up a terminal.

Execute the following:

cd /etc/snort/rules/rules

Execute the following to use the nano editor:

sudo nano local.rules

Enter the StudentFirst credential (username: StudentFirst, password: Cyb3rl@b)

You will see the following screen.

Scroll down by using down arrow key in your keyboard. Then you will see the following:

The last 3 rules were created for testing purposes. Comment them out by placing # character in the front of each line as follows:

Now, you may enter your own rule to detect the traffic to/from invalid web site you chose.

I simply created a rule for detecting any traffic whose destination port is equal to 443 (SSL/TLS). This port is used for most of the SSL/TLS enabled web servers. Many web servers are automatically redirect/utilize 443 port for secure connection, even though you specify http://... in your web browser.

For example, www.mdlottery.com seems to be utilizing this mechanism.

Depending upon the actual pattern matching features you want to use in your rule, this port number information may be used or may not be used – e.g., if you are trying to detect the occurrence of mdlottery.com in packet payloads.

So, please replace this last rule with yours.

Press ^O (Ctrl-O) to write back to the file “local.rules”

Press Enter.

Press ^X (Ctrl-X in your keyboard) to exit from nano.

Now, you are ready to run Snort.

Execute the following to go to the home directory:

cd ~

Execute:

sudo snort –c /etc/snort/snort.conf –A console > alert.txt

Enter the StudentfFirst credential and wait until you will see the following (it may take a while):

Now open up a web browser while snort is running. I chose to open Firefox.

Then, type in your chosen URL. I chose www.mdlottery.com

It may take a really long time (several minutes) until you see the page loaded. You don’t really need to wait until the page is loaded. Snort will capture the upstream traffic (e.g., HTTP request messages) and generate alerts.

You may wait about 20 or 30 seconds, and place the cursor on top of the terminal (on which the snort is runnig) and click it to make it appear in the foreground as follows.

As is shown, snort is still running. Press ^C (Ctrl-C in your keyboard together) to terminate the running snort. Then snort execution will be terminated.

You may check the contents of “alert.txt” by executing:

sudo nano alert.txt

Enter the StudentFirst credential again.

You may search for your own sid (e.g., 1000004) by typing in ^W (Ctrl-W together on your keyboard) and entering the sid number as follows:

The following shows that there were alerts generated with sid=1000004.

You may submit this type of screen shot to the Assignment folder in LEO.

Now you are done!