# Snort Challenge - Live Attacks

## <mark style="color:red;">Scenario 1 | Brute Force</mark>

***Start Snort in sniffer mode and try to figure out the attack source, service and port.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FyY7GjSPiJnvumIqptTZr%2Fimage.png?alt=media&#x26;token=d0face27-1ef6-4357-84f6-822dc0aa90c4" alt=""><figcaption><p><code>sudo snort -v -i eth0:eth1</code></p></figcaption></figure>

***Write an IPS rule and run Snort in IPS mode to stop the brute-force attack.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FBsbzQKthPYEHTZVI1HJQ%2Fimage.png?alt=media&#x26;token=efa041f9-151b-4482-bb9e-6508076525ac" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FGZRgYYGaXk4reVg80qRO%2Fimage.png?alt=media&#x26;token=699afe1e-2d48-4eec-a03e-53dfb65e5a22" alt=""><figcaption><p><code>drop tcp any 22 -> any any</code>  would be more direct</p></figcaption></figure>

### <mark style="color:orange;">IPS mode and dropping packets</mark>

<mark style="color:yellow;">Full alert mode provides all possible information about the alert. There is no console output in this mode. Start the Snort instance in full alert mode (-A full ) with the following command</mark> <mark style="color:yellow;"></mark><mark style="color:yellow;">`sudo snort -c /etc/snort/snort.conf -A full`</mark>

### <mark style="color:orange;">IDS/IPS mode with parameter "-A full"</mark>

<mark style="color:yellow;">Snort IPS mode activated with</mark> <mark style="color:yellow;"></mark><mark style="color:yellow;">`-Q --daq afpacket`</mark> <mark style="color:yellow;"></mark><mark style="color:yellow;">parameters. This mode can also be activated by editing snort.conf file.</mark>

<mark style="color:yellow;">Activate the Data Acquisition (DAQ) modules and use the afpacket module to use snort as an IPS:</mark> <mark style="color:yellow;"></mark><mark style="color:yellow;">`-i eth0:eth1`</mark>

***Block the traffic at least for a minute and then the flag file will appear on your desktop.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FXRrqB0G7q7Doh1ZeMxlo%2Fimage.png?alt=media&#x26;token=e290cc10-4d77-461a-ae28-c4e5c14865af" alt=""><figcaption></figcaption></figure>

***What is the name of the service under attack?***

SSH

***What is the used protocol/port in the attack?***

TCP/22

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FZk09q9tx4KNejzCzzSaL%2Fimage.png?alt=media&#x26;token=e955dc6f-5cbb-4e9c-829d-238404f1e0b7" alt=""><figcaption><p>TCP/22</p></figcaption></figure>

### <mark style="color:red;">Scenario 2 | Reverse-Shell</mark>

***Start Snort in sniffer mode and try to figure out the attack source, service and port.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FJOvceD6sKv5NXBNkzbcc%2Fimage.png?alt=media&#x26;token=70768855-1621-4fd6-8771-90235382c299" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FYGZEb3M5YJ6vO4rvS2Rn%2Fimage.png?alt=media&#x26;token=0c176af7-4c40-4014-8056-b26d3319773f" alt=""><figcaption><p>Transfer Control Protocol (TCP)/4444</p></figcaption></figure>

***What is the used protocol/port in the attack?***

TCP/4444

***Which tool is highly associated with this specific port number?***

Metasploit

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FA1KhRvrjRPy9jIOinQmG%2Fimage.png?alt=media&#x26;token=04d8309e-ed40-400d-ad5a-f8c40e93d94d" alt=""><figcaption></figcaption></figure>

***Write an IPS rule and run Snort in IPS mode to stop the brute-force attack.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FKZdF04meClYBuiljVi9C%2Fimage.png?alt=media&#x26;token=eb3ef8c7-aee7-4b90-a7d4-396b28661606" alt=""><figcaption></figcaption></figure>

***Block the traffic at least for a minute and then the flag file will appear on your desktop.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FFEkU8DwmKcaphISGiLlt%2Fimage.png?alt=media&#x26;token=084d7c97-0b2c-4c12-baa7-8b6c9fdbde9f" alt=""><figcaption></figcaption></figure>