Packet and protocol analysis are skills which fall squarely into the “use it or lose it” category, and can easily atrophy through lack of practice. As Stephen Northcutt – President of the SANS Technology Institute – says in the foreword to Brian Caswell, Jay Beale and Andrew Baker’s book Snort Intrusion Detection and Prevention Toolkit: “…understanding the network traffic entering, leaving and within your network…” is one of the “…basic skills a professional must have to avoid being impotent as a security practitioner“.
There are plenty of publicly available sources of sample packet captures on the internet, but Read more “Cloud Hosted Honeypots: Harvesting Attack Packet Captures”
This post describes process of building a custom dynamic preprocessor plugin for the Snort Network Intrusion Detection / Prevention System (IDS / IPS).
Snort is rules-based IDS. Although Snort rules have a simple structure, the number and variety of options within the Snort rule syntax allows reasonably complex analysis of packets under inspection to be performed. This is fine for situations where the symptoms of the threat being defended against can be Read more “Snort IDS Custom Dynamic Preprocessor, Part 1”
Just recently I decided to add a passive LAN tap to my toolkit, partly because I needed a quick, easy and non-intrusive way of being able to monitor network traffic, and partly to justify buying a new soldering iron.
Read more “Throwing Star LAN Tap”
This post describes the process of developing an exploit for a stack-based buffer oveflow vulnerability within a Windows application, with the aim of gaining remote access to the underlying host. The exploit will employ a technique which abuses the native Windows Structured Exception Handling (SEH) mechanism to gain control over process execution.
Read more “Windows SEH Buffer Overflow Exploit”