Tag Info

New answers tagged

0

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances? So, how can you do it? you need to use a log parser. So ...


4

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


1

I would look at Snort signatures, learn how they are written and use them as a template if you need to create your own. For some examples, this page has collected several signatures it has found most effective against malware found by its Honeypot. This is a good article about testing Snort with Metasploit. Since you asked about a book, it has been almost ...


0

So you should be able to recognize different exploits, or different attacks because those aren't the same. You can use wireshark to capture packets and analyses them. For attacks you should look for countermeasures. But for attack I mean D/DoS, arbitrary code execution etc. and for exploits I mean MS08-067 for example. If yo need anything else ask here.


1

If it's that much of a secure environment you should never disable your IDS. Besides, if your IDS picks up your vulnerability scanner - Thats good as you know your IDS is working and not been tampared with. I'd recommend something like: 1. Add your IP (which you'll be doing your scan from) to a whitelist so you're excluded from your rules then do your ...


1

On a) most IDS' allow the option of blocking addresses from generating alerts which answers your b). I believe the approach you are taking is a decent approach however, I need chime in that it is BEST to perform dual scanning. From the OUTSIDE of your perimeter, and from the inside. The reasoning is simple, external scanning usually finds nothing more than ...


1

You've got a number of options. The first and most common is to instruct the IDS to ignore attacks originating at the vulnerability scanner, and to configure the vulnerability scanner to correspond to the IDS. The second solution, which requires a lot more work, but has a lot more value is to take this as an opportunity to validate the behavior of both ...


1

If you're worried about security you could use the naxsi module with nginx and catch such attempts a bit more explicitely with rules. I'm pretty happy with it - it's fast and lightweight. https://github.com/nbs-system/naxsi


0

Yes. There have been known vulnerabilities in the snort code that allow specially crafted packets to cause remote code execution and DoS. The problem for the attacker is knowing that snort is running, and which vulnerable version is running, but you still need to design your IDS to defend against such a possibility.


-1

Not everything that is placed "outside of the router/DMZ/secured perimeter" is exploitable which is the key word you're confusing. There is a difference in vulnerability and exploit. Just because it is public facing, does not mean it is exploitable. It may be vulnerable to say scanning, information disclosure, unauthorized attempts at access, but exploit and ...



Top 50 recent answers are included