Hack Like a Pro: Snort IDS for the Aspiring Hacker, Part 2 (Setting Up the Basic Configuration) « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!As you shouldknow from before, Snort is the most widely deployed intrusion detection system (IDS) in the world, and every hacker and IT security professional should be familiar with it. Hackers need to understand it for evasion, and IT security professionals to prevent intrusions. So a basic understanding of this ubiquitous IDS is crucial.In myprevious tutorialinthis series, I showed you how to install Snort either by using the packages stored in the Ubuntu repository or from the source code directly fromSnort's website.Now, I will show you the basic configuration so you can get started Snorting right away. In later tutorials, we will tweak the configuration to optimize its performance, send its output to a database, and analyze the output through a GUI interface.Step 1: Get Snort HelpBefore we configure Snort, let's take a look at its help file. Like withmost commands and applications in Linux, we can bring up the help file by typing the command or application's name followed by either-?or--help.kali > snort --helpAs you can see in the screenshot above, I have circled several key switches.The first is-c, along with the location of theSnort rulesfile, tells Snort to use its rules. Rules in Snort are like virus signatures; they are designed to detect malicious packets and software.The second is-d, which tells Snort to show the application layer of data.The third is-e, which tells Snort to display the second layer information, or theData-Link Layer, which contains the MAC address.If we scroll down a bit, we can see even more switches.The-iswitch allows us to designate the interface that we want to use. Snort defaults to using the eth0 interface, so we only need to use this if we want to use a different one, such as wlan0.The-lswitch will tell Snort where to log the data. As we will see, depending upon the configuration, Snort logs to/var/log/snortby default, but we can designate a different location here by placing the path after the-lswitch.The-vswitch tells Snort to be verbose, i.e., wordy, to provide us with all its information.Step 2: Start SnortNow that we know the basics of some of its switches, let's try running Snort; It can be run as a sniffer, packet logger, or NIDS (network intrusion detection system). Here, we'll just take a look at the sniffer (packet dump) and NIDS modes.To run Snort in packet dump mode, type:kali > snort -vdeTo run Snort as an NIDS, we need to tell Snort to include the configuration file and rules. In most installations, the configuration file will be at/etc/snort/snort.conf, and that file will point to the Snort rules. We need to the-cswitch and then the location of the configuration file.kali > snort -vde -c /etc/snort/snort.confStep 3: Open the Config FileLike nearly every Linux application, Snort is configured using a configuration file that is a simple text file. Change the text in this file, save it, restart the application, and you have a new configuration.Let's open the Snort configuration file with any text editor; I will be using Leafpad. Again, the configuration file is located at/etc/snort/snort.conf.kali > leafpad /etc/snort/snort.confWhen thesnort.confopens in your text editor, it should look like the screenshot above. Note that many of the lines are simply comments beginning with the#character. If we scroll down to lines 25-37, we can see in the comments that the configuration file has nine sections.Set the network variablesConfigure the decoderConfigure the base detection engineConfigure dynamic loaded librariesConfigure preprocessorsConfigure output pluginsCustomize your rule setCustomize preprocessor and decoder rule setCustomize shared object rule setIn this basic configuration, we will only address steps 1, 6, and 7 in that list (bolded above). With just these three, we can get Snort running effectively in most circumstances. As we get to more advanced configurations, we will address the others.Step 4: Set the VariablesOn line 45 above, we can see "ipvar HOME_NET any." This sets the IP addresses of your network to be protected. The HOME_NET is the variable that you assign IP addresses to, and it can be a single IP, a list of IPs separated by commas, a subnet in CIDR notation, or simply left asany.The best practive here is to set the HOME_NET to the subnet you are protecting in CIDR notation, such as:ipvar HOME_NET 192.168.181.0/24Step 5: Check the OutputIf we scroll down to lines 464-485, we can see the output plugins section. Here is where we tell Snort where and how to send us logs and alerts. By default, line 471 is commented out and 481 is active.In this default configuration, Snort sends logs in tcpdump format to the/var/log/snortdirectory. Line 471 enables what Snort calls unified logging. This type of logging logs both the complete packet and the alerts. For now, let's uncomment this type of output (unified2) and comment out line 481. Eventually, we will configure the output to go to a database of our choice (MS SQL, MySQL, Oracle, etc.).Step 6: Disable RulesMany times, to get Snort to run properly, we need to adjust the rules that it relies upon. Sometimes a rule or rule set will throw errors, so we need to comment out a rule or rule set temporarily. If we scroll down to line 504, this begins the "Customize your rule set" step of the configuration file.Notice line 511 for local rules. These are rules that we can add to Snort's rule set in our customized configuration.To keep Snort from using a rule set, simply comment out the "include" part. Notice that there are many legacy rule sets that are commented out, but can become active simply by removing the#before them.When we are done making our changes to the configuration file, we simply save the text file.Step 7: Test the ConfigurtaionBefore we put Snort into production, let's test our new configuration. We can use the-Tswitch followed by the configuration file to test our Snort configuration.kali > snort -T -c /etc/snort/snort.confNote that Snort has started in Test mode.As we can see, Snort tested our configuration and validated it. We can now go into production!Now you have a Snort application that is ready for intrusion detection. We still need to configure Snort to automatically update its rule set each day, send its output to a database of our choice, write our own rules, and then analyze the output through a GUI. So keep coming back, my tenderfoot hackers.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Evade a Network Intrusion Detection System (NIDS) Using SnortHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 3 (Sending Intrusion Alerts to MySQL)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 10 (Manipulating Text)Hack Like a Pro:Snort IDS for the Aspiring Hacker, Part 1 (Installing Snort)Hack Like a Pro:How to Create Your Own  PRISM-Like Spy ToolHow To:Linux Basics for the Aspiring Hacker: Using Start-Up ScriptsHack Like a Pro:An Introduction to Regular Expressions (Regex)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)Hack Like a Pro:How to Compile a New Hacking Tool in KaliHack Like a Pro:How to Create a Nearly Undetectable Backdoor with CryptcatHack Like a Pro:How to Spy on Anyone, Part 3 (Catching a Terrorist)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 16 (Stdin, Stdout, & Stderror)Hack Like a Pro:An Introduction to Regular Expressions, Part 2Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:How to Read & Write Snort Rules to Evade an NIDS (Network Intrusion Detection System)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 17 (Client DNS)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 25 (Inetd, the Super Daemon)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 12 (Loadable Kernel Modules)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 21 (GRUB Bootloader)Goodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingIPsec Tools of the Trade:Don't Bring a Knife to a GunfightCommunity Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingWeekend Homework:How to Become a Null Byte Contributor (3/16/2012)Community Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 5 - Legal Hacker TrainingHow To:Hack Wireless Router Passwords & Networks Using HydraGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking Simulations