Cloud Hosted Honeypots: Harvesting Attack Packet Captures

spen440

 

Introduction

Packet and protocol analysis are skills which fall squarely into the “use it or lose it” category, and can easily atrophy through lack of practice. As Stephen Northcutt – President of the SANS Technology Institute – says in the foreword to Brian Caswell, Jay Beale and Andrew Baker’s book Snort Intrusion Detection and Prevention Toolkit: “…understanding the network traffic entering, leaving and within your network…” is one of the “…basic skills a professional must have to avoid being impotent as a security practitioner“.

There are plenty of publicly available sources of sample packet captures on the internet, but Read more “Cloud Hosted Honeypots: Harvesting Attack Packet Captures”

Snort IDS Custom Dynamic Preprocessor, Part 1

spen440

 

Introduction

This post describes process of building a custom dynamic preprocessor plugin for the Snort Network Intrusion Detection / Prevention System (IDS / IPS).

Snort is rules-based IDS. Although Snort rules have a simple structure, the number and variety of options within the Snort rule syntax allows reasonably complex analysis of packets under inspection to be performed. This is fine for situations where the symptoms of the threat being defended against can be  Read more “Snort IDS Custom Dynamic Preprocessor, Part 1”

Windows SEH Buffer Overflow Exploit

spen440

Introduction

This post describes the process of developing an exploit for a stack-based buffer oveflow vulnerability within a Windows application, with the aim of gaining remote access to the underlying host. The exploit will employ a technique which abuses the native Windows Structured Exception Handling (SEH) mechanism to gain control over process execution.

Read more “Windows SEH Buffer Overflow Exploit”