Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
1

I have been working on a conky configuration to help me manage penetration tests, but after much research, I cannot find anyone else speaking of their configs in any way other than the glitz.

Currently, I have:

  • CPU load
  • Memory load
  • top processes
  • networking summary
  • dashboard of pre-selected running services (ftp, tftp, www, p0f, wireshark, ettercap)

What I really want is to monitor all incoming connections, but localhost keeps getting in the way (metasploit connecting to postgres, msfrpcd, etc). Does anyone know how to filter out localhost from tcp_monitor?

Does anyone have a custom conky config for pentesting or know of a source for ideas?

Edit:

I have tried an if_match against the "remote ip" and "addr(lo)", but it throws errors with IPv6.

share|improve this question

3 Answers

up vote 1 down vote

You could look for all incoming tcp packets with the syn flag using tcpdump:

tcpdump "tcp[tcpflags] & tcp-syn != 0"

But is going to be very noisy. Great Penetration testers are also great programmers, and they often have to write or modify their own tools.

share|improve this answer
Why should it be noisy to run a sniff on your own box? – sfx Jul 19 '12 at 22:38
@sfx Run the command during a pen test and you tell me. – Rook Jul 19 '12 at 22:39
it's your own box, so they can only detect it by the network traffic. Your command puts the interface into promisc mode, but you can disable this behavior. But even if you don't, they have to send packets to detect it. And you should have a firewall to prevent this detection anyway. – sfx Jul 19 '12 at 22:59
@Rook Your idea has potential. Would filtering on outgoing ACKs reduce the noise? It would save me from being in promisc mode, and I am more interested on established connections than other traffic. – schroeder Jul 19 '12 at 23:21
up vote 1 down vote accepted

I ended up using 'execp' to run netstat grepping out localhost and added some awk goodness to format the output.

Doing it that way, I was also able to split out LISTENing ports and established.

As the basic example, which I split out in various forms:

${execp netstat -upant | grep "tcp\|udp" | grep -v "127.0.0.1\|::1" | awk '{split($4, a, ":"); print "%s %s\n", a[1], a[2] }' }
share|improve this answer
I am still stumped why there are not more conky scripts for pen testers. The quick and dirty one I have has been so helpful! – schroeder Jul 24 '12 at 20:02
I hadn't actually heard of Conky before. Generally bash scripts have always done it for me:) – Rory Alsop♦ Jul 24 '12 at 21:44
I am finding it useful as a constant monitor on the desktop. I can run several things at once, and the monitor can keep track of what's going on. Including, as my script now allows, checking to see if reverse shells have connected, and if I have remembered to set up listeners or servers, and which ones are active. I also have the normal dynamic monitors of CPU and RAM, as well as interface traffic and settings. It makes it easier to multitask in an engagement. – schroeder Jul 24 '12 at 22:12
up vote 1 down vote

iftop (which uses ncurses) would be cool to have in a Conky window.

Others I can think of: tcptrace

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.