Hack Like a Pro: How to Evade a Network Intrusion Detection System (NIDS) Using Snort « Null Byte :: WonderHowTo

Welcome back, my fledgling hackers!Nearly every commercial enterprise worth hacking has an intrusion detection system (IDS). These network intrusion detection systems are designed to detect any malicious activity on the network. That means you!As the name implies, a network intrusion detection system (NIDS) is intended to alert the system administrator of network-based intrusions. As a hacker, the better we understand how these NIDS work, the better we can evade them and stealthily enter and exit a network without detection. In an attempt to train you to evade these systems, I am beginning new series on how NIDS work.Introducing Snort: Our NIDS of ChoiceSnortis an open-source NIDS that is the most widely used NIDS in the world. Some estimate its market share at over 60%. It's used by such large organizations as Verizon, AT&T, the U.S. State Department, most U.S. military bases, and millions of medium to large businesses around the globe. Last month (July 2013), Cisco announced that they would be acquiring the parent company of Snort, Sourcefire Inc. of Columbia, MD. This insures that Snort will remain the dominant NIDS on the planet for some time to come, making it increasingly important that we understand Snort—so we can evade it.Image viawordpress.comFortunately, Snort is built into ourBackTrack, so we don't need to install it. If you do need to download it, you can find ithere.Step 1: Fire Up SnortSnort is basically a network traffic sniffer that can apply rules to the traffic it sees to determine whether it contains malicious traffic. We can start Snort in sniffer mode by opening any terminal in BackTrack and typing:snort -vdeAfter we hit enter, we begin to see packets going past the screen in rapid succession. Snort is simply sniffing packets from the wire and displaying them to us.To stop Snort, hit theControl C. When we stop Snort, it displays our statistics on the packet capture.Step 2: Intrusion Detection ModeTo get Snort to operate in Intrusion Detection (IDS) mode, we need to get Snort to use its configuration file. Nearly all applications inLinuxare controlled by a configuration file that is a simple text file. This same applies to Snort. Snort's configuration file is namedsnort.confand is usually found at/etc/snort/snort.conf. So, to get Snort to use its configuration file, we need to start it with:snort -vde -c /etc/snort/snort.confWhere-csays use the configuration file, and/etc/snort/snort.confis the location of the configuration file.When Snort starts in IDS mode, we begin to see a screen similar to that below. Eventually, the screen will stop scrolling and Snort will begin to watch your network traffic.Now Snort is sniffing our wire and will alert when something malicious appears!Step 3: Configuring SnortSnort comes with a default configuration file that, for the most part, will work with little editing. The configuration has plenty of comments to explain what each line and section does, so you can figure it out with little outside assistance.Their are at least 3 areas, though, that need some attention and configuring...The EXTERNAL_NET variableThe HOME_NET variableThe path to the Snort rulesWithout the Snort rules, Snort is just a sniffer/packet logger, far from the powerful IDS it can be. That being said, let's get inside that Snort configuration file and make the minimum changes to get Snort to run as an effective IDS.Let's open the snort configuration file withKWrite.kwrite /etc/snort/snort.confAs you can see in the screenshot above, the configuration file is comprised of six (6) sections.Set the variables on your networkConfigure dynamic loaded librariesConfigure preprocessorsConfigure output pluginsAdd any runtime config directivesCustomize your rule setWe need to first set the variables for our internal and external network. These are defined by the lines:var HOME_NETvar EXTERNAL_NETWe can define ourHOME_NETas the IP address or subnet we're trying to protect. You see in the screenshot that it's set as "any." This will work, but it's not optimal for detecting malicious activity. We should set theHOME_NETto our internal IP address, such as 192.168.1.1, or our internal subnet, such as 192.168.1.0/24.In most cases, security admins will define theirEXTERNAL_NETas everything that is NOT theirHOME_NET. To accomplish this, we can simply negate (!) theHOME_NETor! HOME_NET.Next, we need to set our path to our rules. As we can see in the screenshot below, about two-thirds of the way down, there is:var RULE_PATH /etc/snort/rulesIn most installations, this path will be correct (but does vary with different installations) and we can simply leave it as is, but make certain that your rules are in this path before assuming so. When you are done, simply save the snort.conf file.Step 4: Checking the Snort RulesWe can navigate to the rules directory by typing these two commands:cd /etc/snort/rulesls -lIn this way, we can see all of the files that comprise our Snort rules. It's these Snort rules that are designed to catch intrusions and alert the security admin.In my next tutorial in this series, we will examine these rules and how they work to catch intrusions. The better we understand these Snort rules, the better we able to evade them!If you have any questions or comments on Snort, please post them below. If you have questions on a different topic, visit theNull Byte forumfor help.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicensePigletsphoto via ShutterstockRelatedHack Like a Pro:How to Read & Write Snort Rules to Evade an NIDS (Network Intrusion Detection System)Hack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 2 (Setting Up the Basic Configuration)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)How To:Detect network intrusions with Wireshark and SnortNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Create a Nearly Undetectable Backdoor with CryptcatHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 3 (Sending Intrusion Alerts to MySQL)Hack Like a Pro:Snort IDS for the Aspiring Hacker, Part 1 (Installing Snort)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)Hack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHack Like a Pro:An Introduction to Regular Expressions, Part 2How To:Linux Basics for the Aspiring Hacker: Using Start-Up ScriptsHack Like a Pro:How to Compile a New Hacking Tool in KaliHack Like a Pro:How to Create Your Own  PRISM-Like Spy ToolHack Like a Pro:How to Spy on Anyone, Part 3 (Catching a Terrorist)Hack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 10 (Manipulating Text)Hack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)How To:The Five Phases of HackingHow To:The Essential Skills to Becoming a Master HackerHack Like a Pro:How to Evade AV Software with ShellterHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 2 (Dissecting ClamAV)Hack Like a Pro:An Introduction to Regular Expressions (Regex)Hack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 1News:What to Expect from Null Byte in 2015Hack Like a Pro:Networking Basics for the Aspiring Hacker, Part 2 (TCP/IP)Hack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHack Like a Pro:How to Evade AV Detection with Veil-EvasionHacking macOS:How to Create an Undetectable PayloadHow To:How Hackers Stole Your Credit Card Data in the Cyber Attack on Target StoresHack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)How to Hack Wi-Fi:Creating an Invisible Rogue Access Point to Siphon Off Data UndetectedHow To:Become a Computer Forensics Pro with This $29 TrainingIPsec Tools of the Trade:Don't Bring a Knife to a GunfightHow To:The Official Google+ Insider's Guide IndexLevitation Challenge:Evading ArrestHack Like a Pro:Hacking Samba on Ubuntu and Installing the Meterpreter