Snort alert signatures
1 like347 views
This document discusses network scanning and analysis tools. It describes using Nmap and Nikto to scan networks and web servers to find vulnerabilities. It also discusses using TCPdump and tshark to sniff network traffic. The main analysis tool discussed is Snort, which can analyze packets and recognize threats based on signatures in the Snort.conf file. Examples of signatures for threats like Code Red, Nimda, and directory traversal are provided.
![[Sharing Knowledge]
SNORT : Analyzing and Signatures
Deris Stiawan
Ph.D Candidate
Faculty of Computer Science & Information System
Universiti Teknolgi Malaysia
2012](https://image.slidesharecdn.com/snortalertsignatures-160529133720/85/Snort-alert-signatures-1-320.jpg)
Snort alert signatures
- 1. [Sharing Knowledge] SNORT : Analyzing and Signatures Deris Stiawan Ph.D Candidate Faculty of Computer Science & Information System Universiti Teknolgi Malaysia 2012
- 2. 1st run : Scanning • Scanning tools with NMAP – NMAP : powerful network scanning – To find information detailed – To find vulnerability from port / daemon / application active run – Mapping of network • Command : – nmap –v ip target – nmap –v –Sv – nmap -v -O -sF
- 4. • Scanning tools with NIKTO – NIKTO: powerful web scanner – Testing IIS / Apache running on web server in target – Checks your CGI vulnerabilities
- 6. 2nd : Sniffing • Sniffing data – TCPdump / tshark
- 8. 3rd : Analyzing • Analyzed and recognized threat with Snort – Analyzing from packet – Snort.conf
- 19. Nimda Footprint
- 21. Pervasive Computing Research Group Faculty of Computer Science & Information System Universiti Teknologi Malaysia Prof. Dr. Abdul Hanan Abdullah Deris Stiawan