Hack Like a Pro: Snort IDS for the Aspiring Hacker, Part 3 (Sending Intrusion Alerts to MySQL) « Null Byte :: WonderHowTo

Welcome back, my hacker novitiates!If you have been following thisnew Snort series, you know that Snort is the world's most widely used intrusion detection/protection system. Now a part of the world's largest network equipment company, Cisco, it is likely to be found everywhere in one form or another. This makes a compelling argument for learning how to use it, as it will likely be a necessity in any security-related position.In the previous tutorials in this series, weinstalledandconfigured Snorton our Kali system. In this tutorial, we will be taking the next step in building a production-level, professional IDS—getting intrusion notifications we can easily analyze.Snort has many capabilities and configurations, but we want an IDS that can be used in a secure, professional way to alert us of intrusions. To do so, we will need to send our alerts to a database where we can analyze them. We will be setting up a print spooler specifically designed for Snort calledBarnyard2and using it to send the data to a MySQL database.In the previous guides, I used Kali as my base OS. Unfortunately, some of the libraries necessary to run Barnyard2 do not work well on Kali. As a result, subsequent tutorials in this series will be with Ubuntu. Everything you have done up to this point in setting up Snort works well in Ubuntu without modification. In reality, this makes much more sense as you wouldnotlikely be using an attack system like Kali as your server for Snort in a production environment.Why Barnyard2?Converting binary data to a human-readable form (usually binary-to-ASCII) is very CPU-intensive for any application. This is particularly true for Snort, and since we want to dedicate as much of our resources to packet capture and analysis as possible, we would like to lay off as much of these CPU-intensive tasks as we can. That's what Barnyard2 is designed for.In a production environment, we want to send the event data from Snort to a database. Snort is capable of using any ODBC database such as Oracle, Microsoft's SQL Server, PostgreSQL, and MySQL. Here we will be using MySQL as this is the most common configuration for Snort. If we can send the alerts to a database, then we can query the database with another tool to be able to make sense of this information. For instance, we can query for what rules were alerted on, what IP addresses did the attacks come from, what severity level were the intrusions, etc.Here, we will configure Snort to process its alerts in binary form—it's simplest and least CPU-intensive form—and then use Barnyard2 to read these events, convert to human-readable form, and place them into a MySQL database.I want to note before we proceed that Snort will work without Barnyard2, but it will slow down its functioning—and potentially not process and analyze some packets in a busy environment—which may be dangerous.Step 1: Install Barnyard PrerequisitesBefore we begin, we need to install some libraries and applications that are Barnyard2 prerequisites.ubuntu > sudo apt-get install -y mysql-server libmysqlclient-dev mysql-client autoconf libtoolubuntu > sudo apt-get install libpcap-dev libmysql-dev libprelude-devStep 2: Install GitWe will be downloading and installing the latest version of Barnyard2 fromGitHub. If you don't already havegiton your system, you will need to install it now.ubuntu> sudo apt-get updateubuntu> sudo apt-get install gitStep 3: Edit Snort's Configuration FileTo direct our alerts to a database, we will need to edit thesnort.conffile. Open it with any text editor and go to the output section (section #6). There, we will be telling Snort to use our MySQL database (that we will be creating later in this tutorial with the username and password of your choice).In this example, I have used some simple selections for the database name, user, and password, allsnort. Of course, replace those with your own selections (see Step 6 below).Step 4: Download Barnyard2Barnyard2 is a print spooler than reduces the overhead of the Snort daemon to write the alerts to a human-readable form. Instead, it allows Snort to write these alerts in the far more efficient binary form, then Barnyard2 takes those binary files and converts them to a human-readable form. Lastly, it places them in a MySQL database for later analysis.Let's go ahead and get Barnyard2 from GitHub.ubuntu > git clone git://github.com/firnsy/barnyard2.gitNow, let's check to see whether it was downloaded and installed by doing along listingon this directory.ubuntu > ls -lAs you can see, it has created a directory namedbarnyard2. Let's navigate to it and list its contents.ubuntu > cd barnyard2ubuntu > ls -lNotice the very first file namedautogen.sh. Let's execute that script.ubuntu > ./autogen.shNext, type the following line.ubuntu > CFLAGS = '-lpthread'Then, run the appropriate configure command for your system.If you are using a 64-bit architecture—and I hope you are—this is the appropriate configure command:ubuntu> ./configure --with-mysql-libraries=/usr/lib/x86_64-linux-gnu --prefix=$HOME/barnyard2-installIf you are using a 32-bit architecture, then the configure command changes slightly to:ubuntu > ./configure --with-mysql-libraries=/usr/lib/i386-linux-gnu --prefix=$HOME/barnyard2-installThere is one more library that Ubuntu needs for Barnyard2 calledlibdumbnet-dev. Let's get it from the repository.sudo apt-get install libdumbnet-devBecause themakescript for Barnyard2 is expecting the dependency file nameddnet.h, we need to create a symbolic link betweendumbnet.handdnet.h(the file names changed since the script was written).ubuntu > ln -s /usr/include/dumbnet.h /usr/include/dnet.hThen, update the libraries.ubuntu> sudo ldconfigNow, we can make Barnyard2.ubuntu > makeFinally, we need to make and install.ubuntu > sudo make installStep 5: Configure Barnyard2We need to do some basic configuration on Barnyard2 to make certain it runs properly. First, we need to copy Barnyard2's configuration file to the/etc/snortdirectory.ubuntu > sudo cp /snort_source /etc/barnyard2.conf /etc/snortNow we need to create a file that Barnyard2 needs in thevar/logdirectory. This is the bookmark file.ubuntu > touch /var/log/snort/barnyard2.waldoStep 6: Set Up MySQLNow that Barnyard2 is installed, compiled, and configured, we need to set up MySQL to receive the alerts. To do so, we need to:create a databasecreate a database schema for the alertscreate a usergrant the user the appropriate privilegesLet's start by logging into the MySQL database system.ubuntu > sudo mysql -u root -pWhen prompted for a password, entersnort.You are now in the MySQL system and should receive a MySQL prompt. Let's create a database for the Snort system to use.mysql > create database snort;(Note thatsnorthere is simply the name of the database we will be storing our alerts in. It could be named anything, but let's make it easy to remember.)Then let's tell the system we want to use that database.mysql > use snort;Barnyard2 comes with a script to create the schema for the Snort database. It is at/snort_source/barnyard2/schemas/create_mysql. We can run the script by typing:mysql > /snort_source/barnyard2/schemas/create_mysqlNext, we need to create a user for the snort database in MySQL.mysql > CREATE USER 'snort'@'localhost' IDENTIFIED BY 'snort'This command creates a usersnorton the localhost server that uses the passwordsnort. The name of the user and password can vary, but must be consistent with what you entered into thesnort.conffile in Step 3 above.Now to give that user the necessary permissions.mysql > grant create, insert, select, delete, update on snort.* to 'snort'@'localhost';This gives the usersnortthe rights to create objects, insert data, select data, delete data, and update data in the databasesnortat localhost.That's it! Now we have set up Snort to send its alerts to a file where Barnyard2 will pick them up, convert them to human-readable form, and place them in our Snort database in MySQL.In future tutorials in this series, we will begin sending the alerts to the database and analyzing those alerts, so keep coming back, my hacker novitiates!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:How to Evade a Network Intrusion Detection System (NIDS) Using SnortHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 2 (Setting Up the Basic Configuration)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 10 (Manipulating Text)Hack Like a Pro:How to Create a Nearly Undetectable Backdoor with CryptcatHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)Hack Like a Pro:Snort IDS for the Aspiring Hacker, Part 1 (Installing Snort)Hack Like a Pro:How to Create Your Own  PRISM-Like Spy ToolHack Like a Pro:An Introduction to Regular Expressions (Regex)Hack Like a Pro:How to Read & Write Snort Rules to Evade an NIDS (Network Intrusion Detection System)How To:Linux Basics for the Aspiring Hacker: Using Start-Up ScriptsHack Like a Pro:How to Spy on Anyone, Part 3 (Catching a Terrorist)Hack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHack Like a Pro:An Introduction to Regular Expressions, Part 2How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:How to Compile a New Hacking Tool in KaliHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 14 (MySQL)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)How to Hack Databases:Hacking MySQL Online Databases with SqlmapHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)How To:Detect network intrusions with Wireshark and SnortHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 16 (Stdin, Stdout, & Stderror)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How to Hack Databases:Extracting Data from Online Databases Using SqlmapHack Like a Pro:Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 1How To:The Five Phases of HackingHack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapNews:DIY Laser Tripwire System That Tweets Whenever Sharks Swim PastIPsec Tools of the Trade:Don't Bring a Knife to a GunfightGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingHack Logs and Linux Commands:What's Going On Here?News:FarmVille Orchard and Tree Gifting LinksNews:Personalized Orchard Request Links for FarmvilleNews:The 7 Best Secret Features of iOS 5Goodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking Simulations