0

I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on some programs, and then I must be able to recognise these same attacks. Currently I am in the research phase, more specifically how to generate signatures of the attacks. Does anybody have any idea where I could find some good books/documents/articles for signature generation (methods, approaches....)? I've already googled and looked in the first 40-50 pages of results and didn't find a lot of great resources. Are there any books dedicated to attack signatures? Any help would be greatly appreciated! Thanks!

Edit: I will give you an example of steps. Let's say my IDS looks at the log file in generated by an application( just as example). 1) In training(learning) phase, My IDS looks in the log file to generate signatures from the attacks 2) In detection phase, my IDS will look at the log files when the application is attacked, and try to match the content from the log file with the database that holds the signatures generated in the previous step. My question is : how to generate the signatures What should I look at? For example, for the detection, I use FSA (Finite State Automaton) to express the steps of an attack (eg. ssh->open a file->read the file->upload file contents in the case of a hacker that makes a remote connection that reads a secret file and then uploads its contents)

| improve this question | |
1

I would look at Snort signatures, learn how they are written and use them as a template if you need to create your own. For some examples, this page has collected several signatures it has found most effective against malware found by its Honeypot.

This is a good article about testing Snort with Metasploit.

Since you asked about a book, it has been almost 10 years since this book came out but that page has all the problems and answers from the signature section of the book.

Finally, the snort-sigs mailing list has in-depth discussion about exactly what you are looking for. I would craft a much more specific question than "where do I look" if you approach that mailing list.

It is common to feed Wireshark captures into Snort manually and I think this is what you would do for this exercise

| improve this answer | |
0

So you should be able to recognize different exploits, or different attacks because those aren't the same. You can use wireshark to capture packets and analyses them. For attacks you should look for countermeasures. But for attack I mean D/DoS, arbitrary code execution etc. and for exploits I mean MS08-067 for example. If yo need anything else ask here.

| improve this answer | |
  • Hello, thank you for taking interest in my question. I think I didn't quite ask the question correctly. Actually, I do not have to track the exploits, but rather the payloads (in terms of Metasploit). More precisely, I will use metasploit to attack some applications, and look at the log files from these applications to generate signatures (in learning phase), and then (in detection phase) detect the same attacks using the signatures generated. Everything is done through the log files. It i like an Application(or service) specific IDS. – user2435860 Apr 3 '14 at 10:17
  • 1
    Then check this security.stackexchange.com/questions/4016/… meterpreter is just example, also in the answers there are things that may help you with other exploits. – user3395407 Apr 3 '14 at 13:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.