# Securing Infrastructure-as-a-Service Public Clouds Using Security Onion
## 5 Results and Discussion
### Discovery Phase  
#### 5.1.1 Intelligence Gathering and Analysis  
**Foot Printing:** Our first assumption is that the malicious user does not know the IP address of the victim system. We employ fping tool to find out the host that are alive on the network.  
**Scanning:** The foot printing stage discussed earlier aids a malicious user to discover the IP address of the victim. Furthermore, the malicious user can use tools, such as traceroute and ping to collect more information about the victim system. The output is given by the ping and traceroute command shows that the victim system is alive and accessible with a maximum of 30 hops. This, therefore, confirms that the victim system is active and can be reached within a range of possible distance.  
After confirming that the victim system is alive, the different applications/services running on the victim system can be identified by the attacker using Nmap command. The result from Nmap scan reveals ports that are open, their service version, and the protocols types which are currently running.  
During the information gathering stage, our IDS has real-time access to events, session data and packet data captured on the network, and uses the Sguil interface to analyze these events. Figure 4 shows the output of the Sguil console during the information gathering phase.  
Data from the Figure 4 above indicates that a variety of scans and probes are being initiated on the target IP 192.168.182.130 from the source IP 192.168.182.129. The event message column gives a security analyst a brief description of the action that triggered the alert. The first line on the console (first logged event) indicates that a ping request is being sent across the network. These tallies with the first process of information gathering we carried out. Further going down the list of logged events, we noticed that each line on the console corresponds with all of the probes and scans made during the information gathering stage. The Sguil console also shows the network interface being monitored, the source and destination ports and ID of the alert for further analysis.  
**Enumerating:** In the enumeration stage, we make use of open port services and active connections to detect services that are not adequately implemented. This stage helps an attacker to create a blueprint of the target network, hence determining potential weaknesses. The domain name, MAC  
Figure 4: Sguil Console Output: Information Gathering.  
address and host name of the destination NetBIOS of the victim system are then revealed by means of _nbtscan_ command.  
Additional enumeration is performed using the Metasploit framework. We found the version of Samba of the victim machine. We also enumerated HTTP port 80 using the Nmap.  
During the enumeration phase, our IDS continues monitoring the network and alerts for strange events to the Sguil console for further analysis by a security administrator. Figure 5 below shows the output of the Sguil console during the enumeration phase.  
The output of the enumeration phase showed in Figure 5 indicates in the first line of the probe on the system with the destination IP 192.168.182.130 and destination port 445 from source IP 192.168.182.129 and source port 37,469 to detect the version of Samba that is being run by the target system. Also, the output of the console indicates several probes being carried out on the HTTP port 80 of the target system; this alert corresponds to the HTTP enumeration we carried out.