Tudo bem, você já configurou seu IDS preferido, mas como saber se ele realmente está funcional? Para isso vamos usar o
IDSWAKEUP, um gerador de ataques e falsos positivos.
Por: Mauro Risonho de Paula Assumpção
Analista de Segurança de Redes
Machine IT
BeMoreSecurity
mobile +55-19-91406602
Passo1:
# apt-get install idswakeup
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
- IDSwakeup : false positive generator -
- Stephane Aubert -
- Hervé Schauer Consultants (c) 2000 -
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Usage:
/usr/sbin/idswakeup <src addr> <dst addr> [nb] [ttl]
Para usar você deve executar o comando:
Passo2:
# idswakeup <ip_de_origem> <ip_de_destino>
Passo3:
O processo será iniciado quando exibir algumas informações como estas:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
- IDSwakeup : false positive generator -
- Stephane Aubert -
- Hervé Schauer Consultants (c) 2000 -
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
src_addr:10.68.40.92 dst_addr:10.68.40.77 nb:1 ttl:1
sending : teardrop ...
sending : land ...
sending : get_phf ...
sending : bind_version ...
sending : get_phf_syn_ack_get ...
sending : ping_of_death ...
sending : syndrop ...
sending : newtear ...
sending : X11 ...
sending : SMBnegprot ...
sending : smtp_expn_root ...
sending : finger_redirect ...
sending : ftp_cwd_root ...
sending : ftp_port ...
sending : trin00_pong ...
sending : back_orifice ...
sending : msadcs ...
10.68.40.92 -> 10.68.40.77 80/tcp GET /msadc/msadcs.dll HTTP/1.0
sending : www_frag ...
10.68.40.92 -> 10.68.40.77 80/fragmented-tcp GET /................. .................. HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/fragmented-tcp GET /AAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA\
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA\
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../cgi- bin/phf HTTP/1.0
sending : www_bestof ...
10.68.40.92 -> 10.68.40.77 80/tcp GET / HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET //////// HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp HEAD / HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp HEAD/./
10.68.40.92 -> 10.68.40.77 80/tcp /cgi-bin\\handler
10.68.40.92 -> 10.68.40.77 80/tcp /cgi-bin\\webdist.cgi
10.68.40.92 -> 10.68.40.77 80/tcp /mlog.phtml
10.68.40.92 -> 10.68.40.77 80/tcp /mylog.phtml
10.68.40.92 -> 10.68.40.77 80/tcp /cfide\\administrator\\startstop.html
10.68.40.92 -> 10.68.40.77 80/tcp /cfappman\\index.cfm
10.68.40.92 -> 10.68.40.77 80/tcp /mall_log_files\\order.log
10.68.40.92 -> 10.68.40.77 80/tcp /admin_files\\order.log
10.68.40.92 -> 10.68.40.77 80/tcp /cgi-bin\\wrap
10.68.40.92 -> 10.68.40.77 80/tcp GET /cgi-bin/ph%66 HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /sahsc.lnk HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /sahsc.bat HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /sahsc.url HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /sahsc.ida HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /default.asp::$DATA HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET / HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp PUT /scripts/cmd.exe HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /scripts/cmd.exe HTTP/1.0
^A 10.68.40.92 -> 10.68.40.77 80/tcp BAD /scripts/cmd.exe HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /_vti_pvt/administrators.pwd HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /cgi-bin/handler HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /../../../../../../etc/passwd HTTP/1.0
-=- Bye ! - sa/hsc -=-
Verifique o log do seus IDS e veja os ataques.
Até a próxima pessoal!
Mauro Risonho de Paula Assumpção
Analista de Segurança de Redes
Machine IT
BeMoreSecurity
mobile +55-19-91406602
Backtrack 4 - Cisco OCS Mass Scanner
Versão para impressora
Indicar para um amigo
Enviar dica