TryHackMe Snort Task 1 to Task 6

**Before following this walkthrough, make sure you:

• Have a TryHackMe account
• Know how to connect to a TryHackMe room (via OpenVPN or AttackBox)
• Have started the “Snort” room**

**Prerequisite:

1. Network Fundamentals.
2. Familiar with Linux CLI.
3. Knowledge on log analysis.**

Task 1: Introduction

Question 1: Read the task above. No answer needed.

Task 2: Interactive Material and VM

Question 1: Navigate to the Task-Exercises folder and run the command “./.easy.sh” and write the output

Answer: Too Easy!

Explanations: The script located inside ~/Desktop/Task-Exercises folder.

Therefore, we move to ~/Desktop/Task-Exercises directory by typing the following command.

cd ~/Desktop/Task-Exercises/

Now we can run the script.

./.easy.sh

Finally, we got the answer.

Task 3: Introduction to IDS/IPS

Question 1: Which IDS or IPS type can help you stop the threats on a local machine?

Answer: HIPS

Explanations: From the room’s tutorial, it mentioned the following. Host-based Intrusion Prevention System (HIPS): actively protects the traffic flow from a single endpoint device. The aim is to investigate the traffic on a particular device. If a signature is identified, the connection is terminated.

Question 2: Which IDS or IPS type can help you detect threats on a local network?

Answer: NIDS

Explanations: From the room’s tutorial, it mentioned the following. IDS is a passive monitoring solution for detecting possible malicious activities/patterns, abnormal incidents, and policy violations. It generates alerts for each suspicious event.

Network Intrusion Detection System (NIDS): monitors the traffic flow from various areas of the network. The aim is to investigate the traffic on the entire subnet. If a signature is identified, an alert is created.

Question 3: Which IDS or IPS type can help you detect the threats on a local machine?

Answer: HIDS

Explanations: From the room’s tutorial, it mentioned the following. Host-based Intrusion Detection System (HIDS): monitors the traffic flow from a single endpoint device. Its aim is to investigate the traffic on that device. If a signature is identified, an alert is created.

Question 4: Which IDS or IPS type can help you stop the threats on a local network?

Answer: NIPS

Explanations: From the room’s tutorial, it mentioned the following. IPS is an active protecting solution for preventing possible malicious activities/patterns, abnormal incidents, and policy violations. It is responsible for stopping/preventing/terminating the suspicious event as soon as it is detected.

Network Intrusion Prevention System (NIPS): monitors the traffic flow from various areas of the network. The aim is to protect the traffic on the entire subnet. If a signature is identified, the connection is terminated.

Question 5: Which described solution works by detecting anomalies in the network?

Answer: NBA

Explanations: From the room’s tutorial, it mentioned the following. Behaviour-based Intrusion Prevention System (Network Behaviour Analysis -):Behaviour-based systems monitor the traffic flow from various areas of the network. The aim is to protect the traffic on the entire subnet. If an anomaly is identified, the connection is terminated.

Question 6: According to the official description of the snort, what kind of NIPS is it?

Answer: full-blown

Explanations: We first got to the official site for Snort on the following URL. https://www.snort.org/

Then in “What is Snort?” section. It mentioned Snort is a full-blown network intrusion prevention system (NIPS).

Question 7: NBA training period is also known as …

Answer: baselining

From the room’s tutorial, it mentioned the following. The Network Behaviour Analysis System works similar to . The difference between and Behaviour-based systems is that behaviour-based systems require a training period (also known as “baselining”) to learn the normal traffic and differentiate the malicious traffic and threats. This model provides more efficient results against new and unknown threats.

Task 4: First Interaction with Snort

Question 1: Run the Snort instance and check the build number.

Answer: 149

Explanations: We can check the build version by running the following command.

snort -V

Question 2: Test the current instance with “/etc/snort/snort.conf” file and check how many rules are loaded with the current build.

Answer: 4151

Explanations: Run the following command. Then we will notice 4151 Snort rules were being loaded.

sudo snort -c /etc/snort/snort.conf -T

Question 3: Test the current instance with “/etc/snort/snortv2.conf” file and check how many rules are loaded with the current build.

Answer: 1

Explanations: Run the following command. Then we will notice 1 Snort rules were being loaded.

sudo snort -c /etc/snort/snortv2.conf -T

Task 5: Operation Mode 1: Sniffer Mode

Question 1:

You can practice the parameter combinations by using the traffic-generator script. No answer needed.

Task 6: Operation Mode 2: Packet Logger Mode

Question 1: Investigate the traffic with the default configuration file with ASCII mode.

sudo snort -dev -K ASCII -l .

Execute the traffic generator script and choose “TASK-6 Exercise”. Wait until the traffic ends, then stop the Snort instance. Now analyse the output summary and answer the question.

sudo ./traffic-generator.sh

Now, you should have the logs in the current directory. Navigate to folder “145.254.160.237”. What is the source port used to connect port 53?

Answer: 3009

Explanations: Step 1: Open a new terminal (terminal 1) and run Snort as ASCII packet logger mode in the current directory.

sudo snort -dev -K ASCII -l.

Step 2: Now open a second terminal (terminal 2) and run the traffic generator script located at ~/Desktop/Task-Exercises

sudo ./traffic-generator.sh

Step 3: Choose “TASK-6 Exercise” and click “OK”. Now wait until the script finished running.

Notice: When the script finished running, the pop up windows should disappear.

Step 4: Now go back to terminal 1.

Step 5: Inside terminal 1 press ctrl + c to terminate Snort process.

Step 6: Traffic Analysis.

Change your user type to root user first.

sudo su

Now we can move to folder “145.254.160.237” and list the folder’s content.

cd 145.254.160.237/
ls

Now we got the answer.

Question 2: Use snort.log.1640048004

Read the snort.log file with Snort; what is the IP ID of the 10th packet?

Answer: 49313

Explanations: This question will be tricky if you don’t know the location of snort.log.1640048004 log file. But no worry.

Step 1: Find out the log file location.

We can use find command to find out where is the location of this log file.

find / -name "snort.log.1640048004" 2>/dev/null

This command will search all file from the root directory and look for file name called snort.log.1640048004.

From the command output we known that the log file located inside ~Desktop/Task-Exercises/Exercise-Files/TASK-6/ which meant inside TASK-6’s directory.

Step 2: Move to the log file location.

cd /home/ubuntu/Desktop/Task-Exercises/Exercise-Files/TASK-6/

Step 3: Read the “snort.log.1640048004” file and look for the IP ID of the 10th packet. Here we go.

snort -r snort.log.1640048004 -n 10

Question 3: Read the “snort.log.1640048004” file with Snort; what is the referer of the 4th packet?

Answer: http://www.ethereal.com/development.html

Explanations: Run the following command and you will know the referer.

snort -r snort.log.1640048004 -X -n 4

-X # means display the full packet details.

Extra: Alternatively, if you don’t want to manually look for the referer.

You can pipeline the command output to grep command, this will directly shows you the referer. Thus, you don’t need to look at the command output line by line.

snort -r snort.log.1640048004 -X -n 4 | grep -i "referer" -C3

Question 4: Read the “snort.log.1640048004” file with Snort; what is the Ack number of the 8th packet?

Answer: 0x38AFFFF3

Explanations: Run the following command and you will know the ACK number of the 8th packet.

snort -r snort.log.1640048004 -X -n 8 | grep -i "ack"

Question 5: Read the “snort.log.1640048004” file with Snort; what is the number of the “TCP port 80” packets?

Answer: 41

Explanations: Run the following command and you will know the total number of the TCP port 80 packet.

snort -r snort.log.1640048004 'tcp and port 80'

‘tcp and port 80’ # is Berkeley Packet Filters (BPF) which is similar to Wireshark display filter syntax.

For Task 7 to Task 11. Please go to the following link.

https://medium.com/@birdv/tryhackme-snort-task-7-to-task-11-847555e21730