Some Tools for

Computer Security Incident Response Team

(CSIRT)

AfNOG 12
30th May 2011 – 10th June 2011
Tanzania

By
Marcus K. G. Adomey
Overview
Some Unix Commands
Some Selected Tools

Snort

AirSnort

hping

Nmap

Kismet

Tcpreplay

Aircrak

Tripwire

Argus

Tor

Nepenthes

Nessus

Wireshark

LanSpy
Rational for using tools in CSIRT Management

Network analysis

Log analysis

Incident, Vulnerability or Malware Handling

Investigation or research

Other side of the coin

At times difficult to use

Some of the tools may use by attacker for criminal
activities
Important language to know for making your own tool.

shell script, sed/awk

perl, python, ruby

Unix/Linux command line based tools

(some tools are also available for windows)
Basic Unix command line tools

ps, df, dd, dmesg, grep, ls, cd, cp, rm, mv, ifconfig whois, dig
(nslookup), traceroute, ping, strings, netstat, top (endless…)
Advance Unix command line tools

gnupg , ssh, snort, airsnort, hping2, nmap, kismet, netcat(nc),
tcpdump, wget,
tcpreplay, aircrack
Powerful tools.

Tripwire, Argus, Tor, Nepenthes
Snort
Snort is a free and open source network intrusion prevention
system (NIPS) and network intrusion detection system (NIDS).

Snort’s has the ability to perform real-time traffic analysis and

packet logging on Internet Protocol (IP) networks.
Snort performs protocol analysis, content searching, and content
matching.
The program can also be used to detect probes or attacks,
including, but not limited to, operating system fingerprinting
attempts, common gateway interface, buffer overflows, server
message block probes, and stealth port scans.
AirSnort
AirSnort is a wireless LAN (WLAN) tool which recovers
encryption keys. AirSnort operates by passively monitoring
transmissions, computing the encryption key when enough
packets have been gathered.
hping
hping is a free packet generator and analyzer for the TCP/IP
protocol. Hping is one of the de facto tools for security auditing and
testing of firewalls and networks, and was used to exploit the idle
scan scanning technique (also invented by the hping author).

The new version of hping, hping3, is scriptable using the Tcl

language and implements an engine for string based, human
readable description of TCP/IP packets, so that the programmer can
write scripts related to low level TCP/IP packet manipulation and
analysis in very short time.
Nmap
Nmap (Network Mapper) is a security scanner used to discover
hosts and services on a computer network, thus creating a "map" of
the network.

To accomplish its goal, Nmap sends specially crafted packets to the

target host and then analyzes the responses.

Nmap accounts for the network conditions (latency fluctuations,

network congestion, the target interference with the scan) during
the run.

Nmap has succeeded to extend its discovery capabilities beyond

basic host being up/down or port being open/closed to being able
to determine operating system of the target, names and versions of
the listening services, estimate uptime, the type of device, presence
of the firewall.
Kismet
Kismet is an 802.11 layer2 wireless network detector, sniffer,
and intrusion detection system. Kismet will work with any
wireless card which supports raw monitoring (rfmon) mode, and
(with appropriate hardware) can sniff 802.11b, 802.11a,
802.11g, and 802.11n traffic. Kismet also supports plugins which
allow sniffing other media such as DECT.

Kismet identifies networks by passively collecting packets and

detecting standard named networks, detecting (and given time,
decloaking) hidden networks, and infering the presence of
nonbeaconing networks via data traffic.
Tcpreplay
Tcpreplay is a suite of BSD GPLv3 licensed tools for UNIX (and
Win32 under Cygwin) operating systems which gives you the
ability to use previously captured traffic in libpcap format to test
a variety of network devices. It allows you to classify traffic as
client or server, rewrite Layer 2, 3 and 4 headers and finally
replay the traffic back onto the network and through other
devices such as switches, routers, firewalls, NIDS and IPS's.
Tcpreplay supports both single and dual NIC modes for testing
both sniffing and inline devices.
The Tcpreplay suite includes the following tools:

tcpprep - multi-pass pcap file pre-processor which determines
packets as client or server and creates cache files used by
tcpreplay and tcprewrite

tcprewrite - pcap file editor which rewrites TCP/IP and Layer 2
packet headers

tcpreplay - replays pcap files at arbitrary speeds onto the
network

tcpreplay-edit - replays & edits pcap files at arbitrary speeds
onto the network

tcpbridge - bridge two network segments with the power of
tcprewrite

tcpcapinfo - raw pcap file decoder and debugger
Aircrack
Aircrack-ng is a set of tools for auditing wireless networks. It is an
802.11 WEP and WPA-PSK keys cracking program that can recover
keys once enough data packets have been captured. It implements
the standard FMS attack along with some optimizations like KoreK
attacks, as well as the all-new PTW attack, thus making the attack
much faster compared to other WEP cracking tools.
It comprises of:

airodump: 802.11 packet capture program

aireplay: 802.11 packet injection program

aircrack: static WEP and WPA-PSK key cracker

airdecap: decrypts WEP/WPA capture files
Tripwire
Tripwire is a free software security and data integrity tool useful
for monitoring and alerting on specific file change(s) on a range
of systems.

Tripwire functions as a host-based intrusion detection system. It

detects changes to file system objects.

When first initialized, Tripwire scans the file system as directed

by the administrator and stores information on each file scanned
in a database.
At a later date the same files are scanned and the results
compared against the stored values in the database. Changes are
reported to the user. Cryptographic hashes are employed to detect
changes in a file without storing the entire contents of the file in
the database.

While useful for detecting intrusions after the event, it can also
serve many other purposes, such as integrity assurance, change
management, and policy compliance.
Argus
Argus – (Audit Record Generation and Utilization System) is a fixed-
model real-time flow monitor designed to track and report on the
status and performance of all network transactions seen in a data
network traffic stream, doing that by that categorizing IP packets
which match the Boolean expression into a protocol-specific
network transaction model.

Argus provides a common data format for reporting flow metrics

such as connectivity, capacity, demand, loss, delay, and jitter on a
per transaction basis. The record format that Argus uses is flexible
and extensible, supporting generic flow identifiers and metrics, as
well as application/protocol specific information.
Tor
Tor is free software and an open network that helps you defend
against a form of network surveillance that threatens personal
freedom and privacy, confidential business activities and
relationships, and state security known as traffic analysis

Tor protects you by bouncing your communications around a

distributed network of relays run by volunteers all around the
world: it prevents somebody watching your Internet connection
from learning what sites you visit, and it prevents the sites you
visit from learning your physical location. Tor works with many
of your existing applications, including web browsers, instant
messaging clients, remote login, and other applications based
on the TCP protocol.
Nepenthes
Nepenthes is a low interaction honeypot to collect information
about potential attacks.

Nepenthes is designed to emulate vulnerabilities worms use to

spread, and to capture these worms.

There are module interface to:

resolve dns asynchronous

emulate vulnerabilities

download files

submit the downloaded files

trigger events (sounds abstract and it is abstract but is still
quite useful)

shellcode handler
Nessus
The Nessus vulnerability scanner, is the world-leader in active
scanners, featuring high speed discovery, configuration
auditing, asset profiling, sensitive data discovery and
vulnerability analysis of your security posture. Nessus
scanners can be distributed throughout an entire enterprise,
inside DMZs, and across physically separate networks.
Wireshark
Wireshark is the world's foremost network protocol analyzer. It
lets you capture and interactively browse the traffic running on
a computer network. It is the de facto (and often de jure)
standard across many industries and educational institutions.
LanSpy
LanSpy is a set of network utilities brought together in a single
program with simple and easy-to-use interface. LanSpy help
network administrators maintain and manage their networks.

LanSpy includes fast port scanner for gathering information

about open ports on remote computer, LanSpy displays services
using these ports.