Cesiumjs 3D Globe, 2.5D and 2D map

Here is the piece of html code which I have used download.

This is the video which I recorded after writing that piece of code.

Snort alert count on Google Earth

Requirement

For a long time I wanted to know how could I plot the alerts which each snort sensor is generating on a Google Earth based on geographic location.  If this could be done I could see from which location on the globe am I getting lots of alerts from.

Solution

The solution to my problem was all in the power of KML file.


Pre-requisites

1. Have snort running on many places.
2. Have barnyard to log your alerts (Optional if you are using old version of snort).
3. The last three characters of your sensors should be named after the airport code. (For example: Chennai sensor name "SensorMAA").  If you are wondering how to get all airport codes stick around.
4. View the snort generated alerts using BASE (Since my mysql query will work only on the BASE generated mysql schema).
5. Be able to run my bash script on the server which runs your mysql server.
6. Of-course Google Earth.

Making

Follow along there are a few steps.

1. Download the script and the support files as a zip from here.  The flow chart for creating the script is here.
2. Edit the file "GoogleEarth/Project/conf/mysql.cnf" to contain your IDS mysql credentials.
3. Run the file "GoogleEarth/Project/bash.sh" like ./bash.sh
4. Now Open the file "GoogleEarth/Project/Alerts.kml"
5. You could add bash.sh to a cron job which runs every 5 minutes so that the bar height on Google Earth would get updated automatically.

If you think I am forgetting something you bet your correct, you can get all the airport codes from the file you downloaded. "GoogleEarth/Project/resource/airport_codes.csv"

Steps and Calories

Network Forensics - PCAP analysis

How did it start ?

It all started in December of 2013 when I received an email via a mailing list that there is a Holiday challenge which they have created.   This is the link to the challenge.  This is the link to the solutions.

Reason
The reason for putting together a bash script was to make our life as network analyst a bit easier if an unknown PCAP is given to be analysed.  The script which I have created will give us a quick overview of what we can expect in the pcap.

Running the script
There are some prerequisite for running the script.

1. Tcpdump should be installed and be in path.
2. Tshark be installed and be in path.
3. Snort be installed and be in path.

Running the script is as simple as[1] invoking the shellscript and passing the pcap file as the argument.  You can get the script by clicking here.

[1]
#./pcap2csv.sh sansholidayhack2013.pcap

Output file
There are two output files which will be created namely ip.csv and idsalert.txt

ip.csv - You can get the output file by clicking here.
1st column - List of all IP addresses in the PCAP.
2nd - List of all MAC gathered for the IP addresses in 1st column via ARP reply.
3rd - SYN connection attempted to various ports by 1st column.
4th - All listening TCP services of 1st column.
5th - All non-listening TCP services of 1st column.
6th - Open UDP ports (may give erroneous value).
7th - Domains resolved.
8th - HTTP useragent used by 1st column.

While opening the ip.csv, if you see that the rows are misaligned try these settings as shown in the screen shot. Remember to select Unicode (UTF-8), Comma and Text delimiter double quotes.

idsalert.txt - You can get the output file by clicking here.
This text file would show all the snort alerts generated for each IP considering it as its only HOME_NET. This is done as we don't know which is our HOME_NET to configure snort.

Honeyd on a nutshell

IDS alert analysis

Today I was going through my IDS logs and found something suspicious.

The following are the steps I took to know that the alerts were benign.

I went inside the payload, nothing was evident.  So I wanted to know how did I end up on the IP 130.239.18.142, so I went to my proxy logs and grep'ed the IP.  In an instance I came to realize that I was downloading some ISO files.

Now to prove that the timing match,

The first field on the proxy logs is unix epoch time, I converted that (1374814496.635) using [date -d @1374814496.635 +"%d-%m-%Y %T %z"]  to verify the same. "26-07-2013 10:24:56 +0530"
The second field is the milliseconds which took to download the file "1330675". Since unix epoch time increments one per second I had to get the seconds component by dividing the number by 1000 which gives me approx 1330 and add this with the previous epoch time to get the TotalTime of 1374815826 which happens to translate to "26-07-2013 10:47:06 +0530"

This shows that the alerts were well within the time of the download and IDS was sure to trip off any data contained within the ISO file which is obviously falsepositive.  Case closed.

Error while loading shared libraries

Hi

In Ubuntu when we get the following error "Error while loading shared libraries"  Check to see if you have the shared libraries which it complaints is present on your system.

Run the following command as shown in the image, then the error disappear.

export LD_LIBRARY_PATH=/usr/local/lib