Hack Like a Pro: Snort IDS for the Aspiring Hacker, Part 1 (Installing Snort) « Null Byte :: WonderHowTo

Welcome back, my neophyte hackers!In the world of information security, the most common intrusion detection system (IDS) you will ever encounter isSnort. As you probably already know, an IDS works similarly to antivirus (AV) software on your desktop; It attempts to identify malicious software on your network and warns you of its presence.Snort, conceived by Martin Roesch in 1999, had become so popular that the networking giant Cisco purchased it in 2014, so you will likely see it built into nearly all Cisco devices in the near future. And since Cisco is the world's most widely used network device manufacturer, you are likely to encounter Snort everywhere.Even if your organization never uses Cisco products (unlikely) or Snort, you will likely benefit from understanding how this IDS works since most other intrusion detection systems work similarly.I have written afew articlesabout Snortin the past, but I thought it was time I put togethera comprehensive series on Snort. In this series, we will address how to use Snort from start to finish, including installation, configuration, managing output, rule writing, and alert monitoring.Let's start Snorting!Method 1: Installing Snort from the RepositoriesInstalling Snort is simple if you have Snort in your repository. Unfortunately, Snort is no longer in the Kali repository, so our first step is to add a repository thatdoeshave Snort. In this case, we will add some Ubuntu repositories.First, we need to open the/etc/sources.listfile. We can do this with any text editor (here, I will use Leafpad).kali > leafpad /etc/apt/sources.listAs you can see in the above screenshot, I added several Ubuntu repositories, which are also listed below. As Ubuntu is a fork from Debian (the base Linux distribution that Kali is built on), most Ubuntu packages will work on Kali.debhttp://ch.archive.ubuntu.com/ubuntu/saucy main restricteddeb-srchttp://ch.archive.ubuntu.com/ubuntu/saucy main restricteddebhttp://httpredir.debian.org/debianjessie maindeb-srchttp://httpredir.debian.org/debianjessie mainAfter saving the file to update our repositories list, we need to next update the packages list. We can do this by typing:kali > apt-get updateOnce our packages have been updated, we can now install the Snort package from the repository with:kali > apt-get install snortAnd that's all there is to it. Snort is installed and ready to go! To test it, simply type:kali > snort -VAs you can see, Snort responded with its version number (in this case, 2.9.2).Method 2: Installing Snort from SourceTo install Snort from source code is bit more complex and time-consuming, but the advantage is that Snort will be compiled specifically for your particular hardware and software configuration.This will provide you with significantly improved overall performance. As with any IDS, performance is critical. Slower performance by the IDS will either slow your overall network capability or drop packets. With the former, customers/users will be unhappy; with the latter, you will risk the security of your network.When using Snort in a secure production environment, installation from source is highly preferred. Furthermore, installing from source ensures that you are installing the latest version of Snort. Many of the repositories contain an older version. The current version of Snort is 2.9.8, while the repositories contain 2.9.2. Not a huge difference, but when we are trying to protect the "crown jewels," every little bit helps.Let's begin bycreating a directoryin Kali to download the source code to.kali > mkdir snort_sourceNext,navigateto that directory.kali > cd snort_sourceBefore we download Snort, we need to install the Data Acquisition library or DAQ. The DAQ has a few pre-requisites that we need to install.kali > apt-get install -y bison flexNow we can download and install DAQ for the Snort web site.kali > wget https://www.snort.org/downloads/snort/daq-2.0.6.tar.gzkali > tar -xvzf daq-2.0.6.tar.gzNext move to the daq directory.kali > cd daq-2.0.6Last, configure and make DAQ.kali > ./configurekali >makekali > installTo download the Snort source code directly from Cisco/Snort, we can use the wgetcommand as follows (new version links can be foundhere).kali > wgethttps://snort.org/snort/snort-2.9.8.0.tar.gzOnce it has been downloaded, we need to un-tar it and decompress it. (For more information on thetarcommand,check out my Linux Basics article.)kali > tar -xvzf snort-2.9.8.0.tar.gzNext, we need to change directories to where the new Snort files are located.kali > cd /snort-2.9.8.0Then, we need to configure it.kali > ./configure --enable-sourcefireAfterward, we need to use themakecommand, which determines which of the components of the source code needs to be recompiled and then issues the commands to do so.kali > makeFinally, wemake install. This takes our recompiled program components and places then in the proper directories.kali > make installBecause we installed new library files with this installation, we will need to update the shared libraries. We can do this with by typing:kali > ldconfigTo enable us to start and run Snort from any directory, we can make a symbolic link from the binaries in/usr/local/bin/snortand a new file in/usr/sbincalledsnort. Since/usr/sbinis in our PATH variable, we can then type Snort anywhere within our operating system to start our IDS.kali > ln -s /usr/local/bin/snort /usr/sbin/snortFinally, let's test our installation of Snort by typing:kali > snortAs you can see, Snort has started and is running successfully in packet dump mode, aka sniffer mode.Now that we have successfully installed Snort, we will progress to configuring it to detect malicious software. That will be in our next article inthis series, so keep coming back, my neophyte hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaMarius Jørgenrud/Digi.noRelatedHack Like a Pro:How to Evade a Network Intrusion Detection System (NIDS) Using SnortHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 3 (Sending Intrusion Alerts to MySQL)Hack Like a Pro:Snort IDS for the Aspiring Hacker, Part 2 (Setting Up the Basic Configuration)How To:Linux Basics for the Aspiring Hacker: Using Start-Up ScriptsNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Compile a New Hacking Tool in KaliHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 10 (Manipulating Text)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)Hack Like a Pro:How to Create a Nearly Undetectable Backdoor with CryptcatHack Like a Pro:How to Create Your Own  PRISM-Like Spy ToolHack Like a Pro:How to Spy on Anyone, Part 3 (Catching a Terrorist)Hack Like a Pro:An Introduction to Regular Expressions, Part 2Hack Like a Pro:How to Read & Write Snort Rules to Evade an NIDS (Network Intrusion Detection System)Hack Like a Pro:An Introduction to Regular Expressions (Regex)Hack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 16 (Stdin, Stdout, & Stderror)How To:The Essential Skills to Becoming a Master HackerHow To:Detect network intrusions with Wireshark and SnortHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)IPsec Tools of the Trade:Don't Bring a Knife to a GunfightWeekend Homework:How to Become a Null Byte Contributor (3/16/2012)News:My Prank IdeasGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 1 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker Training