IDSwakeup – Simulador de ataques e falso positivos para testar IDS

Tudo bem, você já configurou seu IDS preferido, mas como saber se ele realmente está funcional? Para isso vamos usar o IDSWAKEUP, um gerador de ataques e falsos positivos.

Passo1:

# apt-get install idswakeup

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
– IDSwakeup : false positive generator –
– Stephane Aubert –
– Hervé Schauer Consultants (c) 2000 –
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Usage:
/usr/sbin/idswakeup [nb] [ttl]

Para usar você deve executar o comando:

Passo2:

# idswakeup

Passo3:

O processo será iniciado quando exibir algumas informações como estas:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
– IDSwakeup : false positive generator –
– Stephane Aubert –
– Hervé Schauer Consultants (c) 2000 –
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

src_addr:10.68.40.92 dst_addr:10.68.40.77 nb:1 ttl:1

sending : teardrop …
sending : land …
sending : get_phf …
sending : bind_version …
sending : get_phf_syn_ack_get …
sending : ping_of_death …
sending : syndrop …
sending : newtear …
sending : X11 …
sending : SMBnegprot …
sending : smtp_expn_root …
sending : finger_redirect …
sending : ftp_cwd_root …
sending : ftp_port …
sending : trin00_pong …
sending : back_orifice …
sending : msadcs …
10.68.40.92 -> 10.68.40.77 80/tcp GET /msadc/msadcs.dll HTTP/1.0
sending : www_frag …
10.68.40.92 -> 10.68.40.77 80/fragmented-tcp GET /…………….. ……………… HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/fragmented-tcp GET /AAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA\
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA\
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../cgi- bin/phf HTTP/1.0
sending : www_bestof …
10.68.40.92 -> 10.68.40.77 80/tcp GET / HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET //////// HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp HEAD / HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp HEAD/./
10.68.40.92 -> 10.68.40.77 80/tcp /cgi-bin\\handler
10.68.40.92 -> 10.68.40.77 80/tcp /cgi-bin\\webdist.cgi
10.68.40.92 -> 10.68.40.77 80/tcp /mlog.phtml
10.68.40.92 -> 10.68.40.77 80/tcp /mylog.phtml
10.68.40.92 -> 10.68.40.77 80/tcp /cfide\\administrator\\startstop.html
10.68.40.92 -> 10.68.40.77 80/tcp /cfappman\\index.cfm
10.68.40.92 -> 10.68.40.77 80/tcp /mall_log_files\\order.log
10.68.40.92 -> 10.68.40.77 80/tcp /admin_files\\order.log
10.68.40.92 -> 10.68.40.77 80/tcp /cgi-bin\\wrap
10.68.40.92 -> 10.68.40.77 80/tcp GET /cgi-bin/ph%66 HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /sahsc.lnk HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /sahsc.bat HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /sahsc.url HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /sahsc.ida HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /default.asp::$DATA HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET / HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp PUT /scripts/cmd.exe HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /scripts/cmd.exe HTTP/1.0
^A 10.68.40.92 -> 10.68.40.77 80/tcp BAD /scripts/cmd.exe HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /_vti_pvt/administrators.pwd HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /cgi-bin/handler HTTP/1.0
10.68.40.92 -> 10.68.40.77 80/tcp GET /../../../../../../etc/passwd HTTP/1.0

-=- Bye ! – sa/hsc -=-

Verifique o log do seus IDS e veja os ataques.

 

Deixe uma resposta

Preencha os seus dados abaixo ou clique em um ícone para log in:

Logotipo do WordPress.com

Você está comentando utilizando sua conta WordPress.com. Sair / Alterar )

Imagem do Twitter

Você está comentando utilizando sua conta Twitter. Sair / Alterar )

Foto do Facebook

Você está comentando utilizando sua conta Facebook. Sair / Alterar )

Foto do Google+

Você está comentando utilizando sua conta Google+. Sair / Alterar )

Conectando a %s