- Setup VM
- COPY files from stick to USB
- Install VirtualBox & VirtualBox Extensions
- Uncompress files- 7-zip on Windows, "The Unarchiver" on Mac
- Open the VM (replace BroTraining.vbox)
- logon bro/bro
- Class files, either:
- Mount the folder
- git clone https://github.com/LiamRandall/BsidesDC-Training.git
- Download zip from https://github.com/LiamRandall/BsidesDC-Training/archive/master.zip
- What is Bro?
- Bro is a language first
- Event-driven
- Built-in variables like IP address and time interval are designed for network analysis
- Built-in functions can be implemented in C++ for speed and integration with other tools
- A Tour of the Bro logs
- Run Bro against a PCAP (e.g. /opt/TrafficSamples/faf-traffic.pcap)
- Go through some of the logs (e.g. cat files.log | colorize)
- SSL/TLS
- Exercise:
bro -C -r rsasnakeoil2.cap(pcap) - Exercise:
bro -r basic-gmail.pcap(pcap) - HTTP Auth
- Exercise:
bro -C -r http-auth.pcap(pcap) - Exercise:
bro -C -r http-auth.pcap http-auth.bro(script) - bro-cut
- Exercise:
bro -C -r http-basic-auth-multiple-failures.pcap - What is the count of the distinct status_code:
cat http.log | bro-cut status_code | sort | uniq -c | sort -n - What were the status codes by username?
- What happened here:
1 - testWhy is this line missing the status_code? (hint: conn.log) - Notice Framework
- Exercise:
bro -r 01_emailing_simple.bro synscan.pcap(script, pcap) - Exercise:
bro -r 02_emailing_complex.bro synscan.pcap(script, pcap) - Exercise:
bro -r 03_avoid_some_scanners.bro synscan.pcap(script, pcap) - Exercise:
bro -r 04_create_a_new_notice.bro mbam_download.trace(script, pcap) - Walk-through 05_create_an_action.bro
- Intel Framework
- Exercise
- Exercise
- Exercise
- Files Framework
- File extraction demo
1. Extract files:
bro -r /opt/TrafficSamples/exercise-traffic.pcap extract-all-files.bro(script) 2. Show files:nautilus extract_files/3. Play a video: ```totem "extract_files/"`ls -S1 extract_files | head -n 1```` - Writing a script: (shell, solution)
- Running the script:
bro -r 01_notice_on_mimetype.bro /opt/TrafficSamples/faf-traffic.pcap - Walk-through 02_run_exiftool.bro
- Signature Framework
- Exercise:
bro -r /opt/PCAPS_TRAFFIC_PATTERNS/APT/mswab_yayih/Mswab_Yayih_FD1BE09E499E8E380424B3835FC973A8_2012-03.pcap site/local.bro - With file extraction:
bro -r /opt/PCAPS_TRAFFIC_PATTERNS/APT/mswab_yayih/Mswab_Yayih_FD1BE09E499E8E380424B3835FC973A8_2012-03.pcap site/local.bro extract-all-files.bro(script) - Analyze requests/responses:
for i in `bro-grep info.asp http.log | bro-cut orig_fuids resp_fuids | sed -e 's/\t/\n/' | grep -v '-'`; do cat "extract_files/extract-HTTP-$i"; echo; echo "-------"; done
-
Notifications
You must be signed in to change notification settings - Fork 6
LiamRandall/BsidesDC-Training
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Latest commit | ||||
Repository files navigation
About
2013-10 BsidesDC Training Resources
Resources
License
Stars
Watchers
Forks
Releases
No releases published