Hack Security Pro.pdf - Index of

1.Intrusion detection systems
Intrusion detection systems are probes that are placed on the network to listen to all transiting network
frames. Their main functions are:
– Detecting port scans.
– Detecting applicative and web attacks, by comparing the contents of network fames to
databases of attack signatures.
The reference when it comes to intrusion detection today is SNORT, which offers a large array of
possibilities. What's more, it can be used on both Linux and Windows.
The first security rule to have when using an IDS is to not configure one's network card. It is put in
promiscuous mode in order to examine all transiting frames, and in no way needs to be configured to
communicate with other machines of the LAN. So, in case of intrusion, it is not possible for the hacker
to try to attack this probe. That way you can be sure of having real results in case of a successful
intrusion. Also, an IDS must be installed on a clean machine. As it is the only non-falsifiable source of
information, any other service could be a potential danger for the integrity of the system, and therefore
of the results obtained.
We are going to start by installing snort on a Linux system, with a mysql medium, and a log reading via
a php interface called ACID.
First download snort on www.snort.org, as well as the signature attack bases on
http://www.snort.org/dl/signatures. You will also need to have an apache installed, as well as a mysql
database.
cd /usr/local/snort ... tar -xvzf SNORT-1.9.*.tar.gz
./configure --with-mysql=/usr/lib/mysql
make
make install
Then we install the detection rules.
mkdir /etc/snort
usr/local/snort*/etc/snort.conf /etc/snort
cp snortrules.tar.gz /etc/snort
cd /etc/snort
tar -xvzf snortrules.tar.gz
You can then edit the snort configuration file (/etc/snort/snort.conf), so as to specify the network that
the IDS will listen to, for example:
var HOME_NET [10.1.1.0/24]
or
var HOME_NET (10.1.1.0/24,192.168.1.0/24]
The Hackademy DMP -182/209- SYSDREAM