Hack Like a Pro: How to Read & Write Snort Rules to Evade an NIDS (Network Intrusion Detection System) « Null Byte :: WonderHowTo

Welcome back, my novice hackers!Myrecent tutorialshave been focused upon ways to NOT get caught. Some people call this anti-forensics—the ability to not leave evidence that can be tracked to you or your hack by the system administrator or law enforcement.One the most common ways that system admins are alerted to an intrusion on their network is with aNetwork Intrusion Detection System(NIDS). The most widely used of these is Snort.I already did anintroduction to Snort, and now I want to delve deeper to show you how the rules in Snort are designed to detect your intrusion. The more we know about Snort and other NIDS, the better we can evade them.Step 1: Finding the Snort RulesSnort is basically a packet sniffer that applies rules that attempt to identify malicious network traffic. These rules are analogous to anti-virus software signatures. The difference with Snort is that it's open source, so we can see these "signatures."We can see the Snort rules by navigating to/etc/snort/ruleson ourBackTrackinstall. Let's go that directory and take a look.cd /etc/snort/rulesNow, let's do alistingof that directory to see all of our rule files.ls -lAs we can see in the screenshot above, there are numerous Snort rules files. Each of these files contains a category of rules, some with hundreds of rules.Step 2: Viewing Snort RulesThe Snort rules files are simple text files, so we can open and edit them with any text editor. I'll be usingKWrite. Let's open the fileporn.rules. This set of rules is designed to detect pornography on the wire. This is a rather old set of rules and most system admins no longer use it.kwrite /etc/snort/porn.rulesWe can see that these rules are designed to detect a variety of pornography. If you ever wondered how your sysadmin knew you downloaded porn, now you know!Step 3: Examining a RuleLet's take a simple rule and dissect it. Let's open the filescan.rules.kwrite /etc/snort/scan.rulesLet's copy that highlighted rule to a separate text file and dissect it now.Step 4: Dissecting the SF Scan RuleThis rule is designed to detect scans by scanning tools such asnmapand hping. One of those scans is called aSYN-FINscan. This scan sends TCP packets with both the SYN and the FIN flags set to attempt to determine what ports are open on the target system.This type a packet should never be seen in the wild as a packet with both the SYN and the FIN flags set would be asking the system to open a connection (SYN) and close a connection (FIN) simultaneously.It's rather easy to see that any packet with these flags set must be an attempt to do recon on the system and the sysadmin should be alerted.Step 5: Rule HeaderLet's start by examining the first part of that rule from the beginning to the first starting parenthesis. This initial part of the rule is referred to as the header, and ours looks like this:Breaking Down the Rule Headeralert- This the action. It can be alert, log, or pass (drop).tcp- This the protocol of the traffic the rule is looking for. It can be tcp, udp, and icmp.$EXTERNAL_NET- This the source IP or network of the malicious packets. It can beset as a variable in the snort.conf.any- This the source port of the malicious traffic. This can set as a single port, multiple ports, or a range of ports.->- This is the direction of the traffic. In this case, we are looking for traffic moving from the EXTERNAL_NET to the internal or HOME_NET.$HOME_NET- This the destination IP address that the traffic is moving to. As with the EXTERNAL_NET, it can be set as a variable in the snort.conf.any- This the destination port. It can also contain specific ports, like 80, or a variable containing a list of ports.Step 6: Snort Rule OptionsNow let's take a look at the part of the rule that falls between the parentheses. This is referred to as the rule options. This part of the Snort rule is comprised of a couplet with a keyword, a colon, and the argument.keyword:argumentsOur example rule options look like this:Breaking Down the Rule Optionsmsg- This is the message that's sent to the sysadmin if the rule is triggered. In this case, Snort reports to the sysadmin "SCAN SYN FIN".flow- This option allows the rule to check the flow of the traffic. It can have a number of values including established (TCP established), not established (no TCP connection established), stateless (either established or not established), etc. In our example, the rule is triggered on traffic with or without an established TCP connection.flags- This couplet checks for TCP flags. As you know, TCP flags can be SYN, FIN, PSH, URG, RST, or ACK. This rule is looking for traffic that has both the SYN and FIN flags set (SF) and in addition, has the two reserved bits in the flags byte set (12).reference- This section is for referencing a security database for more information on the attack. In our example, we can find more info on this attack in the arachnids database, attack 198.classtype- All the rules are classified into numerous categories to help the admin understand what type of attack has been attempted. In our example, we can see that it is classified as an "attempted-recon".Step 7: Evade & DisableNow that we understand how the Snort rules work, we can design our attack to evade these rules. If we can get to the NIDS server, we can disable or edit the rules that might alert the sysadmin to our attack.In my next Snort tutorial, we'll delve deeper into the complexities of some of more sophisticated Snort rules, so stay tuned. If you have any questions or comments on Snort, please post them below. If you have questions on a different topic, visit theNull Byte forumfor help.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicensePig readingimage via ShutterstockRelatedHack Like a Pro:How to Evade a Network Intrusion Detection System (NIDS) Using SnortHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 2 (Setting Up the Basic Configuration)Hack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Create Your Own  PRISM-Like Spy ToolHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 3 (Sending Intrusion Alerts to MySQL)Hack Like a Pro:An Introduction to Regular Expressions, Part 2Hack Like a Pro:How to Spy on Anyone, Part 3 (Catching a Terrorist)How To:Detect network intrusions with Wireshark and SnortHack Like a Pro:How to Create a Nearly Undetectable Backdoor with CryptcatHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 1 (Installing Snort)Hack Like a Pro:An Introduction to Regular Expressions (Regex)Hack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 10 (Manipulating Text)How To:Linux Basics for the Aspiring Hacker: Using Start-Up ScriptsHack Like a Pro:How to Compile a New Hacking Tool in KaliHow To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)Hack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBHack Like a Pro:Networking Basics for the Aspiring Hacker, Part 2 (TCP/IP)Hack Like a Pro:How to Evade AV Software with ShellterHow To:The Five Phases of HackingHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 1Hacking macOS:How to Create an Undetectable PayloadHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 2 (Dissecting ClamAV)News:What to Expect from Null Byte in 2015Hack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHack Like a Pro:How to Evade AV Detection with Veil-EvasionIPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:The Epson International Pano Awards Photography Contest - Deadline April 15, 2011News:51 Ways to Improve Your WritingNews:Jackass 3D Prank ContestNews:Janet Fitch's rules for writingWeekend Homework:How to Become a Null Byte Contributor (3/16/2012)How To:The Official Google+ Insider's Guide IndexNews:Golf Driving Range (erotic tale of the granny golfer)