Scribd Logo
Upload

Welcome to Scribd!

  • 21 views

    TP2 Partie2 Houssem - Mathlouthi

    Uploaded by

    Hadir Saadani
    This document summarizes the configuration and testing of Suricata IPS (Intrusion Prevention System) capabilities including: 1. Configuring Suricata to work with iptables to inspect all incoming and outgoing network traffic. 2. Testing Suricata's ability to block ICMP echo requests and clear HTTP traffic on specific ports. 3. Analyzing TLS traffic and having Suricata block access to sites with expired certificates or matching specific domains. 4. Configuring Suricata to extract downloaded files to disk and verifying extracted files.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    TP2 Partie2 Houssem - Mathlouthi

    Uploaded by

    Hadir Saadani
    21 views17 pages
    This document summarizes the configuration and testing of Suricata IPS (Intrusion Prevention System) capabilities including: 1. Configuring Suricata to work with iptables to inspect all incoming and outgoing network traffic. 2. Testing Suricata's ability to block ICMP echo requests and clear HTTP traffic on specific ports. 3. Analyzing TLS traffic and having Suricata block access to sites with expired certificates or matching specific domains. 4. Configuring Suricata to extract downloaded files to disk and verifying extracted files.

    Original Title

    TP2-Partie2-Houssem_Mathlouthi

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document summarizes the configuration and testing of Suricata IPS (Intrusion Prevention System) capabilities including: 1. Configuring Suricata to work with iptables to inspect all incoming and outgoing network traffic. 2. Testing Suricata's ability to block ICMP echo requests and clear HTTP traffic on specific ports. 3. Analyzing TLS traffic and having Suricata block access to sites with expired certificates or matching specific domains. 4. Configuring Suricata to extract downloaded files to disk and verifying extracted files.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    21 views17 pages

    TP2 Partie2 Houssem - Mathlouthi

    Uploaded by

    Hadir Saadani
    This document summarizes the configuration and testing of Suricata IPS (Intrusion Prevention System) capabilities including: 1. Configuring Suricata to work with iptables to inspect all incoming and outgoing network traffic. 2. Testing Suricata's ability to block ICMP echo requests and clear HTTP traffic on specific ports. 3. Analyzing TLS traffic and having Suricata block access to sites with expired certificates or matching specific domains. 4. Configuring Suricata to extract downloaded files to disk and verifying extracted files.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 17

    Houssem Mathlouthi

    CII3-SSIR-B

    Network Intrusion Prevention Systems


    Exploitation Use of Suricata IPS (Part
    2)

    I. Suricata IPS configuration

    1. The interaction between iptables and Suricata will be configured in the section “nfq” of the file.

    2. We Check if NFQ is enabled in Suricata.


    3. We Check the default rules and the default policy

    4. To send all the incoming and outgoing traffic from iptables to Suricata
    II. Preventing against ICMP echo requests

    nano /var/lib/suricata/rules/custom.rules

    We run suricata as an IPS with the NFQ mode.


    the following commands to test Suricata response.

    There should be no response to ping command, while DNS and HTTP connection should be
    possible. We check the log file fast.log and verify that suricata has successfully blocked the icmp
    traffic, logged the event and generated the alert.
    III. Filtering clear HTTP traffic

    we stop suricata and start it again as an IPS with the NFQ mode
    Access again to portquiz website through the two TCP ports 80 and 445 using the browser
    Firefox. Now, the website is completely unreachable.

    http://portquiz.net

    http://portquiz.net:445
    11. Check the log file fast.log, and verify that suricata has successfully blocked the two HTTP
    connections

    (port 80 and port 445)

    12. Using your browser Firefox try to access to the website

    https://www.google.com Is access possible? Explain why?

    IV.TLS analysis

    13. Connect to the website https://badssl.com/ and click on “expired” to access to the subdomain
    https://expired.badssl.com/ that uses an expired certificate. You should click on accept the risk and

    continue if your browser asks for confirmation. Check that the validity period of the certificate has
    ended.
    14. In the rule file custom.rules add the following entry to drop access to sites with expired certificates
    15. start it again as an IPS with the NFQ mode

    16. Test that access to https://expired.badssl.com/ is dropped and that the alert is generated.
    17. In the rule file custom.rules add a new entry to drop access to facebook website using TLS,
    matching the content of facebook 509 certificate.

    drop tls $HOME_NET any -> $EXTERNAL_NET any (msg:"Blocked Facebook TLS Traffic"; tls_sni;
    content:"facebook.com"; nocase; priority:1; sid:1000006; rev:1;)
    V.Downloaded files collection

    24. Open suricata.yaml configuration file, go to the output section,

    and update the file-store variable to enable file extraction capability.

    25. In /var/lib/suricata/rules/custom.rules add the following rule to store all files to disk.

    26. Stop and rexecute suricata using the command:


    27. Download a GIF image through a plaintext HTTP connection

    28. Go to the folder Review the folders /var/log/suricata/filestore/ and execute the following commands.
    You

    should notice that one of the stored image is a GIF file.

    # cd /var/log/suricata/filestore/

    # file */*

    29. Open the stored file using the command display (you should install ImageMagic using yum if it is

    not already available in your system) and check the obtained image.

    VI. Generating and analyzing alerts in JSON format

    30. Suricata can output alerts, http events, dns events, tls events and file info through EVE json
    format. The

    JSON format allows a nice handling of data in external tool like Elasticsearch or Splunk. Open the

    Suricata configuration file /etc/suricata/suricata.yaml in your editor and scroll down to the "output"

    section and check that logging in eve-log format is enabled:

    You might also like